AM62P-Q1: AM62Px: Custom SW for e-fuse writing

Hello,

If you mean writing the keys to efuses and converting the device to HSSE then it can only be done through the standalone keywriter package.

Hello,

yes, I'm referring to as writing the keys to efuses and converting the device to HS-SE.

Can you confirm the above operation can only be done through the standalone OTP keywriter package and the execution of such keywriter cannot be controlled from "outside" (e.g., triggered via CAN frame)?

Hello,

Carlo Pettinato said:

Can you confirm the above operation can only be done through the standalone OTP keywriter package

Yes, it can only be done through the standalone keywriter package. The only way for a custom software to run the keywriter binary is to reset the SoC to the boot media over which the keywriter binary boots. Please note a cold power on reset is required after the keywriting.

Carlo Pettinato said:

I would like to run a custom software on the R5F core that can receive a CAN frame that triggers e-fuse writing for the enforcement of Secure Boot.

May I know the reason for this design?

The keywriting is supposed to be done in a factory environment where the SoC is converted to HSSE and the signed images are flashed independently.

Thanks!

I would need a further clarification on the following sentence:

"Yes, it can only be done through the standalone keywriter package. The only way for a custom software to run the keywriter binary is to reset the SoC to the boot media over which the keywriter binary boots. Please note a cold power on reset is required after the keywriting."

After the keywriter binary boots and completes its operation, how to switch again the boot media in order to boot the "final SW"?

Carlo Pettinato said:

After the keywriter binary boots and completes its operation, how to switch again the boot media in order to boot the "final SW"?

That is dependent on your flow. If you are booting the keywriter and "final SW" from different boot media then you would have to cold reset the device and switch the bootmode to the media where "final SW" resides.

a) As far I know, the boot media can be switched only by HW configuration (no SW switch is possible). Is it right?

b) Assume that I have both keywriter and "final SW" preinstalled in the same boot media, which can be the exact flow to:

  1. Run keywriter for writing e-fuses 

  2. Reset the SoC

  3. Run "final SW" (signed)

NOTE: From step 3 onwards, the SoC shall start always from "final SW".