AM263P4-Q1: UART boot E-FUSE locked/disabled in production

Hi Jidhin,

Jidhin Angadithazha said:

s there an eFuse or boot-configuration option that can permanently disable one or more boot modes (for example, UART boot mode)?

The boot modes are mainly set using the SOP pin circuitry. You can fix the SOP pins to OSPI boot mode in your schematics.

But in ROM, even in OSPI Boot, the final failsafe mode is UART, i.e. if ROM doesn't find image on 4 redundant locations of Flash, then it would prepare itself to accept image from UART. 

Jidhin Angadithazha said:

On HS-SE devices, is it possible to lock or disable boot-mode selection through the boot pins, such that the Boot ROM always boots from OSPI regardless of the boot-pin configuration?

Boot rom decides the boot mode based on the SOP mode value in the pin. As mentioned above, this can be frozen in the circuit.But in ROM, even in OSPI Boot, the final failsafe mode is UART, i.e. if ROM doesn't find image on 4 redundant locations of Flash, then it would prepare itself to accept image from UART. 

Jidhin Angadithazha said:

Can the device be configured so that alternative boot modes cannot be invoked after provisioning?

In ROM, even in OSPI Boot, the final failsafe mode is UART, i.e. if ROM doesn't find image on 4 redundant locations of Flash, then it would prepare itself to accept image from UART. 

Jidhin Angadithazha said:

If disabling boot modes is not supported, what is the recommended approach to prevent unauthorized use of other boot mode in a production HS-SE device  ?

To freeze the SOP in schematics to OSPI boot mode, But in ROM, even in OSPI Boot, the final failsafe mode is UART, i.e. if ROM doesn't find image on 4 redundant locations of Flash, then it would prepare itself to accept image from UART. 

Jidhin Angadithazha said:

I would like to understand and reduce the security implications if the SMPK or BMPK private key is compromised.

I would like to understand your thought process on how the UART boot mode would possess a security threat to the SMPK /BMPK in the EFUSE. The ROM firewalls this region to HSM only access and ROM does not have the capability to open HSM JTAG. 
Hence, UART boot mode access to ROM cannot retrieve the ROT keys AFAIK.

May I know if we have any other thoughts here?

Thanks and Regards,

Nikhil Dasan

Hello Nikhil,

I’m considering the scenario where the SMPK/BMPK private key is compromised at the PKI level. In that situation, an attacker could sign any image and use UART boot mode to load a malicious SBL. They would still need physical access and a pin‑bed setup, but once they can push a compromised SBL together with a modified HSMRt, the secure‑boot chain is effectively broken.

The impact becomes much larger if the same SMPK/BMPK is shared across all ECUs, because there is no mechanism to rotate or update that key once devices are deployed. Using unique keys per ECU would limit the breach to a single unit, but it also complicates software updates—especially HSM updates—because each new HSM image must be signed with the SMPK/BMPK corresponding to that specific ECU. That means the update container would differ for every device, making large‑scale rollout extremely difficult.

Please let me know if any part of this understanding is incorrect.

Thanks & Best Regards,
Jidhin Angadithazha