Boot Configurations Update – eFuse#
This section provides the commands to read and write eFuse data along with the list of the available configurations in eFuse that can be programmed by the user.
Once all the development and testing work is complete, the next step would be to program the eFuses. It is important to note that this is a permanent and one-time operation.
SiWG917 has eFuse memory of 1024 bytes. This memory is divided into four sections with control to enable write locks for each of these sections.
eFuse section | Byte Range |
|---|---|
R1 | 0-127 |
R2 | 128-255 |
R3 | 256-767 |
R4 | 768-1024 |
Note: You cannot write to eFuse through the M4 application image or through NWP via APIs. You must have an active JTAG connection to write the eFuse bits.
Read eFuse Data#
You can read the eFuse data/contents to an .json (for example, efuse_value.json) file. The command to read eFuse data is as follows.
Syntax:
commander manufacturing read efuse --out efuse_value.json -d <full opn>
Example:
commander manufacturing read efuse –out efuse_value.json -d SiWG917M111MGTBA
Write eFuse Data#
In the case of eFuse (one time programmable) data, simplicity commander CLI first checks whether the requested update is possible (since bits can only be set to 1 and never cleared). Then it will ask for your confirmation.
The possible eFuse configurations are mentioned in the section Possible Boot Configurations.
You can modify the eFuse bits in the efuse_value.json file which is read in the section Read eFuse Data and use the following command which are used to write efuse data into flash.
Syntax:
commander manufacturing write efuse --data efuse_value.json -d <OPN Number> [--skipload] [--pinset n] [-s jlinkserialno] [--noprompt] [--dryrun]
--noprompt: It is possible to skip the confirmation, although users need to note that this is a one-time operation.--dryrun: It is possible to check the results of the operation before physically going ahead with the one-time programming.
Example:
commander manufacturing write efuse --data efuse_value.json -d SiWG917M111MGTBA -skipload --dryrun
Possible Boot Configurations#
The following table shows the available user configurable eFuse bits.
Note: The following fields can also be configured in MBR, you can modify them during development in the MBR and program in the eFuse once all the development and testing is completed.
| # | Field | Description | Number of bits | Default Setting | Default value in NWP eFuse |
|---|---|---|---|---|---|
| 1 | safe_upgrade_frm_host |
When set to 1 – upgrade the:
|
1 | Enabled | 1 |
| 2 | ta_secure_boot_enable |
Enable NWP Secure Boot 1: Secure boot is enabled for NWP 0: Secure boot is disabled in NWP |
1 | Disabled | 0 |
| 3 | ta_anti_roll_back |
1: Anti roll back check is enabled for NWP firmware (will not allow to update old versions) 0: Anti roll back check is not enabled for NWP firmware |
1 | Anti roll back check is not enabled for NWP firmware | 0 |
| 4 | ta_digital_signature_validation |
1: Digital signature validation is enabled for NWP firmware 0: Digital signature validation is disabled for NWP firmware |
1 | Digital signature validation is disabled for NWP firmware | 0 |
| 5 | m4_anti_roll_back |
1: Anti roll back check is enabled for M4 firmware (will not allow to update old versions) 0: Anti roll back check is not enabled for M4 firmware |
1 | Disabled | 0 |
| 6 | m4_digital_signature_validation |
1: Digital signature validation is enabled for M4 firmware 0: Digital signature validation is disabled for M4 firmware |
1 | Disabled | 0 |
| 7 | enable_autobaud_detection |
1: Auto baud rate detection for UART is enabled 0: Auto baud disabled – Default config – 115200 bps |
1 | Disabled | 0 |
| 8 | ta_encrypt_firmware |
00: NWP firmware stored in unencrypted form in flash 01: NWP firmware stored in encrypted form in flash with CTR mode encryption 10: NWP firmware stored in encrypted form in flash with XTS mode encryption 11: Reserved |
2 | Disabled: NWP firmware stored in unencrypted form in flash | 0 |
| 9 | m4_flash_present |
This field indicates that the M4 has a separate flash (the device is dual flash). 1: M4 has flash 0: M4 doesn't have flash |
1 | Disabled: M4 doesn't have flash – it's a common flash device | 0 |
| 10 | m4_flash_pinset |
M4 flash pin set 1: GPIO_46_TO_51 2: GPIO_52_TO_57 |
4 |
Not applicable as the m4_flash_present bit is not set by default; device will not use the values
from this field
|
0 |
| 11 | m4_secure_boot_enable |
1: Secure boot is enabled for M4 0: Secure boot is not enabled for M4 |
1 | Secure boot is not enabled for M4 | 0 |
| 12 | m4_encrypt_firmware |
0: M4 firmware stored in unencrypted form in flash 1: M4 firmware stored in encrypted form in flash |
1 | M4 firmware is stored in unencrypted form in the flash | 0 |
| 13 | common_flash_enabled |
Enable common flash configuration. Note: If enabled from eFuse, cannot be overridden from MBR. 1: Common flash mode is enabled 0: Common flash mode not selected The value written for this bit during manufacturing changes between device types:
|
1 | If writing in eFuse, the value is set to 0. If writing to MBR, the value is set to 1. | 0 |
| 14 | ta_otp_lock |
NWP eFuse programming lock for R1 address region (0–127) 1: NWP eFuse programming is locked 0: NWP eFuse programming is not locked When eFuse is locked, you won’t be able to modify secure boot related parameters present in R1 address region. |
1 | NWP eFuse programming is not locked for 0–127 range | 0 |
| 15 | disable_ta_jtag |
Disable NWP JTAG interface. Write 0 for enabling NWP JTAG. 0: Enable NWP JTAG interface 1: Disable NWP JTAG interface |
1 | NWP JTAG interface enabled | 0 |
| 16 | otp_lock_1 |
NWP eFuse programming lock for address region (128–255) of eFuse. This is enabled by programming the eFuse
offset 255 with value 1. 1: NWP eFuse programming is locked 0: NWP eFuse programming is not locked When eFuse is locked, you won’t be able to modify secure boot related parameters present in R2 address region. |
1 | NWP eFuse programming is not locked in range 128–255 | 0 |
| 17 | otp_lock_2 |
NWP eFuse programming lock for address region (256–767). This is enabled by programming the eFuse offset 766
with value 1. 1: NWP eFuse programming is locked 0: NWP eFuse programming is not locked When eFuse is locked, you won’t be able to modify secure boot related parameters present in R3 address region. |
1 | NWP eFuse programming is not locked in range 256–767 | 0 |
| 18 | otp_lock_3 |
NWP eFuse programming lock for R4 address region (768–1024). This is enabled by programming the eFuse offset
1023 with value 1. 1: NWP eFuse programming is locked 0: NWP eFuse programming is not locked When eFuse is locked, you won’t be able to modify secure boot related parameters present in R4 address region. |
1 | NWP eFuse programming is not locked in range 768–1024 | 0 |
| 19 | m4_otp_programming_lock |
1: M4 eFuse programming is locked 0: M4 eFuse programming is not locked When eFuse is locked, you won’t be able to modify secure boot related parameters. |
1 | M4 eFuse programming is not locked | 0 |
| 20 | disable_m4_jtag |
Disable M4 JTAG interface. 0: Enable M4 JTAG interface (default) 1: Disable M4 JTAG interface |
1 | JTAG enabled | 0 |
| 21 | disable_m4_access_frm_tass_sec |
When set, M4 can't access TASS memory or registers except for host communication registers. Note: Setting this eFuse must be the last step in manufacturing. Once set, any further operations with manufacturing tools will not be possible. |
1 | This is secure zone which is disabled by default | 0 |
| 22 | mbr_mic_sign_enable |
MIC/signature for combined region of MBR, boot descriptor, and key descriptor table. 00: CRC 01: MIC – Applicable only when OTP Symmetric key is written 10: Reserved 11: Sign – Applicable only when OTP public key is written |
2 | CRC check enabled | 00 |
| 23 | MIC protected content length |
This field depicts how much space is MIC protected using the OTP key stored in eFuse at offset 659. The MIC value is stored in eFuse at offset 643. | 4 | Not applicable | 0000 |
| 24 | m4_firmware_encryption_mode |
Indicates M4 firmware encryption mode. Valid only if m4_encrypt_firmware is set to 1; otherwise ignored.00: NA 01: Firmware stored in encrypted form in M4 flash – CTR mode 10: Firmware stored in encrypted form in M4 flash – XTS mode 11: Reserved |
2 |
Not applicable as m4_encrypt_firmware is disabled by default. This field will be neglected.
|
00 |
| 25 | disable_psram_encryption |
Contents in PSRAM will be encrypted if this bit is enabled. This field explicitly disables PSRAM encryption
irrespective of whether M4 firmware encryption is enabled while firmware is in flash. 0: PSRAM encryption using same key config as M4 flash. PSRAM encryption mode will be CTR independent of M4 flash encryption mode. 1: PSRAM encryption disabled. |
1 | PSRAM encryption enabled | 0 |