Exception/Panic during board flashing/booting

[Paradox]

Hello,

I have been trying to work with the BSEC and write some data to the upper OTPs, where I managed to successfully write only to the words containing the MAC address. Then I realised, that the device tree needs to be modified to allow other OTP words to be written, however now the MCU does not boot up and it does not allow me to reflash it as well to fix the overwritten data. I have the MAC address, I just do not know how to write to OTP if I am not able to boot up. Any help would be greatly appreciated.

The platform used is STM32MP157A-DK1 and the log during programming is here:

NOTICE:  CPU: STM32MP157AAC Rev.B
NOTICE:  Model: STMicroelectronics STM32MP157A-DK1 Discovery Board
NOTICE:  Board: MB1272 Var7.5 Rev.O-13
INFO:    Reset reason (0x14):
INFO:      Pad Reset from NRST
INFO:    PMIC version = 0x10
INFO:    Using USB
INFO:      Instance 2
INFO:    Boot used partition fsbl1
NOTICE:  BL2: v2.2-r1.0(debug):v2.2-dirty
NOTICE:  BL2: Built : 13:36:23, Oct 22 2019
INFO:    Using crypto library 'stm32_crypto_lib'
INFO:    BL2: Doing platform setup
INFO:    RAM: DDR3-DDR3L 16bits 533000Khz
INFO:    Memory size = 0x20000000 (512 MB)
INFO:    BL2 runs SP_MIN setup
INFO:    BL2: Loading image id 4
INFO:    Loading image id=4 at address 0x2ffed000
INFO:    Image id=4 loaded: 0x2ffed000 - 0x2ffff000
INFO:    BL2: Loading image id 5
INFO:    GETSTATUS :
INFO:                   DFU_STATE_IDLE
INFO:    UPLOAD :
INFO:                   Phase ID : 0
INFO:                   address 0x2ffe7988
INFO:    GETSTATUS :
INFO:                   DFU_STATE_IDLE
INFO:    GETSTATUS :
INFO:                   DFU_STATE_IDLE
INFO:    UPLOAD :
INFO:                   Phase ID : 0
INFO:                   address 0x2ffe7988
INFO:    GETSTATUS :
INFO:                   DFU_STATE_IDLE
INFO:    Start Download partition 0 to address 0xc0000000 length 0
INFO:    USB : DFU : end of download partition : 0
INFO:    Loading image id=5 at address 0xc0100000
INFO:    GETSTATUS :
INFO:                   DFU_STATE_IDLE
INFO:    UPLOAD :
INFO:                   Phase ID : 3
INFO:                   address 0x2ffe7988
INFO:    GETSTATUS :
INFO:                   DFU_STATE_IDLE
INFO:    GETSTATUS :
INFO:                   DFU_STATE_IDLE
INFO:    UPLOAD :
INFO:                   Phase ID : 3
INFO:                   address 0x2ffe7988
INFO:    GETSTATUS :
INFO:                   DFU_STATE_IDLE
INFO:    usb_partition_size: partition size : 0xd4022
INFO:    Start Download partition 3 to address 0xc0100000 length 868386
INFO:    USB : DFU : end of download partition : 3
INFO:    GETSTATUS :
INFO:                   DFU_STATE_IDLE
INFO:    UPLOAD :
INFO:                   Phase ID : 0
INFO:                   address 0xffffffff
INFO:    Send detach request
INFO:    GETSTATUS :
INFO:                   DFU_STATE_IDLE
INFO:    Receive Detach
INFO:    Image id=5 loaded: 0xc0100000 - 0xc01d4022
WARNING: Skip signature check (header option)
NOTICE:  ROTPK is not deployed on platform. Skipping ROTPK verification.
NOTICE:  BL2: Booting BL32
INFO:    Entry point address = 0x2ffed000
INFO:    SPSR = 0x1d3
PANIC at PC : 0x2fff499f
 
Exception mode=0x00000016 at: 0xfffffffc

EDIT: I have managed to flash the basic boot chain from old ecosystem version 1.2.0 with a script included in the starter package and I successfully booted up the system. However, the MAC address part of the OTP is not available in the basic boot chain, so I tried to modify the linux kernel device tree that the basic boot chain uses instead of the TF-A device tree, by adding the MAC address part from the trusted boot chain.

I modified this part in the file stm32mp157.dtsi:

bsec: nvmem@5c005000 {
	compatible = "st,stm32mp15-bsec";
	reg = <0x5c005000 0x400>;
	#address-cells = <1>;
	#size-cells = <1>;
 
	part_number_otp: part_number_otp@4 {
		reg = <0x4 0x1>;
	};
	ts_cal1: calib@5c {
		reg = <0x5c 0x2>;
	};
	ts_cal2: calib@5e {
		reg = <0x5e 0x2>;
	};
};

and I added this part from the TF-A device tree:

mac_addr: mac_addr@e4 {
	reg = <0xe4 0x8>;
	st,non-secure-otp;
};

I hoped this would enable the user in basic boot chain to access the MAC address part and fix the value, so that I could boot the trusted boot chain again, however, now it is stuck in an endless boot loop after it attempts to load the modified device tree.

[Olivier GALLIEN]

Hi @Matej Záhorský​ ,

As per warn in wiki

MAC address / board Id OTP write should not be performed on ST boards ! They are written and protected by ECC during factory production. Any further write will break the board with no way to recover if these OTP are not locked.

You can anyway workaround this situation with this procedure :

Remove &bsec mac_address node in TF-A Device Tree.

This should remove the Panic and allow to boot.

Archive the old mac address of you board from U-boot :

STM32MP> env print ethaddr

ethaddr=00:80:e1:42:45:20

In case you reflash your board, you will need to reinitialse the mac address:

STM32MP> env set ethaddr 00:80:e1:42:45:20

Hope it help,

Olivier

[Paradox]

Hi @Community member​ ,

Thanks for your reply. I have removed the node from TF-A device tree, which successfully enabled the board to boot as you have said. However, I am not sure I understood correctly, because now I am unable to write the correct address as the OTP node is now removed from the device tree. In U-Boot, there is no such variable "ethaddr". The TF-A checks the ethernet address in BSEC before the boot process of other components begin, which means that it will either panic or the ethernet address node has to be removed from device tree. Does this mean I am at a dead end?

[Olivier GALLIEN]

Hi @Matej Záhorský​ 

For sure you can no more use mac OTP on this board and removal of &bsec mac_address node in TF-A Device Tree need to be permanent in order to prevent panic.

Setting "ethaddr" in U-Boot is a pure workaround .. surprise by your statement that you don't find it.

Are you using Ecosystem V1.2 or V2.0 ?

Olivier

[Paradox]

Hi @Community member​,

I used version 1.2 before to have access to basic boot chain, which is no longer present in version 2.0, but otherwise I use the newest version (2.0).

When I enter U-Boot and then the command to print ethernet address, this is the output:

Hit any key to stop autoboot:  0
STM32MP> env print ethaddr
## Error: "ethaddr" not defined
STM32MP>