Appendix#

Reading Manufacturing Parameters#

The following command is used to read the manufacturing parameters from a file.

Command:

commander manufacturing read <tambr|efuse|efusecopy> --out <filename.bin|filename.json> -d <full opn> serialinterface -skipinit

Programming eFuse Command#

In the case of eFuse/OTP data, Commander will first check that the requested update is possible (since bits can only be set to 1 and never cleared). Then it will ask for confirmation from the user. It is possible to skip the confirmation via the --noprompt option although note that this is a one-time operation.

It is possible to check the results of the operation before physically going ahead with the one-time programming by using the --dryrun option.

This command is used to write efuse data into flash.

Syntax:

commander manufacturing write efuse --data file.json -d <full opn> [--skipload] [--noprompt] [–dryrun] --serialinterface --skipinit

Sample Boot Configurations#

Make the boot configurations as required. For example:

Boot configurations in MBR:

{
   "efuse_data": {
        "safe_upgrade_frm_host": 1,
        "ta_secure_boot_enable": 1

   }
}

Boot configurations in eFuse:

"bootloader_config": {
  "ta_secure_boot_enable": 1,
   "safe_upgrade_frm_host": 1,
},

Save the above as JSON file.

Sample eFuse Only Configurations#

{
    "bootloader_config": {
        "safe_upgrade_frm_host": 0,
        "ta_anti_roll_back": 0,
        "ta_digital_signature_validation": 0,
        "ta_secure_boot_enable": 0
    },
    "otp_lock_1": {
        "debug_port_opened": 0,
        "section_lock_128_255": 0
    },
    "otp_lock_2": {
        "section_lock_256_767": 0
    },
    "otp_lock_3": {
        "section_lock_768_1023": 0
    },
    "ta_config": {
        "enable_autobaud_detection": 0,
        "ta_encrypt_firmware": 0
    },
    "wireless_chip_modes": {
        "disable_ta_jtag": 0,
        "ta_otp_lock_r1": 0,
        "ta_otp_lock_r2": 0,
        "ta_otp_lock_r3": 0,
        "ta_otp_lock_r4": 0
    }
}

MIC Protected Content Length Map#

OTP Write Lock Process#

SiWx917 has OTP (eFuse) memory of 1024 bytes. This memory is divided into 4 sections with control to enable write locks for each of these sections. This section explains the details of how the write locks for OTP are implemented.

Security Key Management and Protection#

Inject custom public and private keys, along with other secret keys, onto the chips during manufacturing to safeguard your products from the very beginning of their lifecycle. The Bootloader uses public and private key-based digital signatures to recognize authentic software. The Security Bootloader also provides the capability for inline execution (XIP) of encrypted firmware directly from Flash.

If this feature is enabled, the Physically Unclonable Function (PUF) engine will be activated. PUF Keys are generated internally by the PUF and stored in flash. These keys are used to encrypt and decrypt images, ensuring that only authorized firmware can run on the device. The PUF Intrinsic Keys are unique to each device and are generated randomly, making them highly secure.

Keys generated using the commander are as follows.

For information on how to generate the keys at commander, refer to Generate Keys from Commander. For PUF activation, refer to Activation Code Generation, and to generate intrinsic keys and load the keys (both the intrinsic keys and keys generated at commander), refer to Intrinsic Key Generation and Loading Keys.

The table below shows the Key type, Key length, and Storage type.

Note: The NWP Public key actual key size is 91 bytes, remaining 5 padding bytes added to make key size multiple of 16 for AES encryption.