linux-kernel - Re: [RFC PATCH 0/1] Timeout error with Microchip OTPC driver on SAM9X60

Open Source and information security mailing list archives

Message-ID: <20240701-nuttiness-backlit-60ccfea75b56@thorsis.com>
Date: Mon, 1 Jul 2024 09:40:56 +0200
From: Alexander Dahl <ada@...rsis.com>
To: claudiu beznea <claudiu.beznea@...on.dev>
Cc: Alexander Dahl <ada@...rsis.com>, linux-kernel@...r.kernel.org,
	linux-arm-kernel@...ts.infradead.org,
	Cyrille Pitchen <cyrille.pitchen@...rochip.com>
Subject: Re: [RFC PATCH 0/1] Timeout error with Microchip OTPC driver on
 SAM9X60

Hei hei,

Am Wed, Apr 24, 2024 at 10:32:02AM +0300 schrieb claudiu beznea:
> Hi, Alexander,
> 
> On 12.04.2024 17:08, Alexander Dahl wrote:
> > Hei hei,
> > 
> > on a custom sam9x60 based board we want to access a unique ID of the
> > SoC.  Microchip sam-ba has a command 'readuniqueid' which returns the
> > content of the OTPC Product UID x Register in that case.
> > 
> > (On a different board with a SAMA5D2 we use the Serial Number x Register
> > exposed through the atmel soc driver, which is not present in the
> > SAM9X60 series.)
> > 
> > There is a driver for the OTPC of the SAMA7G5 and after comparing
> > register layouts it seems that one is almost identical to the one used
> > by SAM9X60.  So I thought just adapting the driver for SAM9X60 should be
> > easy.  (At least as a start, the driver has no support for that UID
> > register, but I suppose it would be the right place to implement it.)
> > 
> > However it does not work.  I used the patch attached with
> > additional debug messages on a SAM9X60-Curiosity board.  (That patch is
> > not meant for inclusion, just for showing what I've tried.)
> > 
> > On probe the function mchp_otpc_init_packets_list() returns with
> > ETIMEDOUT, which it can only do if mchp_otpc_prepare_read() returns with
> > timeout and that can only happen if read_poll_timeout() times out on
> > reading the Status Register.  Poking that register with `devmem
> > 0xeff0000c 32` gives 0x00000040 which means "A packet read is on-going".
> 
> 
> Would it be possible that the OTP memory is not properly initialized and
> the algorithm to initialized the packet list to confuse the hardware?
> 
> I see in the datasheet the following: "The initial value of the OTP memory
> is ‘0’ but the memory may contain some “defective” bits already set to the
> value ‘1’."

Meanwhile we looked deeper into this driver.  I just drop here what we
found so far, because it's vacation time, and this will probably not
be picked up again this month because vacation etc.  I wanna get it
out of my head for now. ;-)

Note: most of this should also apply to sama7g5, from comparing data
sheets the OTPC is the same.

1. the call to read_poll_timeout() most probably has its sleep and
timeout paramaters swapped.

2. the read access to OTPC_CR register is not necessary, the datasheet
says the register is "write only".  It may even trigger an interrupt
for reading a write only register.  Furthermore the WPCTEN bit in the
OTPC Write Protection Mode register (OTPC_WPMR) is not checked before
accessing OTPC_CR as suggested by the datasheet.

3. the errata sheet for the SAM9X60 SoC (DS80000846) has a section on
the OTPC which recommends a fixup before the first write operation,
with code example:
https://ww1.microchip.com/downloads/aemDocuments/documents/MPU32/ProductDocuments/Errata/SAM9X60-Device-Silicon-Errata-and-Data-Sheet-Clarif-DS80000846.pdf
The same thing is implemented in 'atmel-software-package' which has
(at least had in the past) the code for the binary applets used in the
'sam-ba' tool:
https://github.com/atmelcorp/atmel-software-package/blame/master/drivers/nvm/otp/otpc.c#L86
I bet this fixup should be implemented in this driver here as well?

So far for now.

Greets
Alex

> 
> Otherwise, from the top of my mind I don't have any idea on what might happen.
> 
> Thank you,
> Claudiu Beznea
> 
> > 
> > Kinda stuck here.  Any ideas?
> > 
> > Greets and have a nice weekend everyone
> > Alex
> > 
> > Alexander Dahl (1):
> >   nvmem: microchip-otpc: Add support for SAM9X60
> > 
> >  .../dts/microchip/at91-sam9x60_curiosity.dts     |  4 ++++
> >  arch/arm/boot/dts/microchip/sam9x60.dtsi         |  7 +++++++
> >  drivers/nvmem/microchip-otpc.c                   | 16 +++++++++++++---
> >  3 files changed, 24 insertions(+), 3 deletions(-)
> > 
> > 
> > base-commit: fec50db7033ea478773b159e0e2efb135270e3b7
> 
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel@...ts.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives