1
2Steps to blow fuses on NXP LS SoC:
3==================================
4
5
6- Enable POVDD
7  -- Refer board GSG(Getting Started Guide) for the steps to enable POVDD.
8  -- Once the POVDD is enabled, make sure to set variable POVDD_ENABLE := yes, in the platform.mk.
9
10+---+-----------------+-----------+------------+-----------------+-----------------------------+
11|   |   Platform      |  Jumper   |  Switch    | LED to Verify   |  Through GPIO Pin (=number) |
12+===+=================+===========+============+=================+=============================+
13| 1.| lx2160ardb      |  J9       |            |                 |             no              |
14+---+-----------------+-----------+------------+-----------------+-----------------------------+
15| 2.| lx2160aqds      |  J35      |            |                 |             no              |
16+---+-----------------+-----------+------------+-----------------+-----------------------------+
17| 3.| lx2162aqds      |  J35      | SW9[4] = 1 |    D15          |             no              |
18+---+-----------------+-----------+------------+-----------------+-----------------------------+
19
20- SFP registers to be written to:
21
22+---+----------------------------------+----------------------+----------------------+
23|   |   Platform                       |   OTPMKR0..OTPMKR7   |   SRKHR0..SRKHR7     |
24+===+==================================+======================+======================+
25| 1.| lx2160ardb/lx2160aqds/lx2162aqds | 0x1e80234..0x1e80250 | 0x1e80254..0x1e80270 |
26+---+----------------------------------+----------------------+----------------------+
27
28- At U-Boot prompt, verify that SNVS register - HPSR, whether OTPMK was written, already:
29
30+---+----------------------------------+-------------------------------------------+---------------+
31|   |   Platform                       |           OTPMK_ZERO_BIT(=value)          | SNVS_HPSR_REG |
32+===+==================================+===========================================+===============+
33| 1.| lx2160ardb/lx2160aqds/lx2162aqds | 27 (= 1 means not blown, =0 means blown)  | 0x01E90014    |
34+---+----------------------------------+-------------------------------------------+---------------+
35
36From u-boot prompt:
37
38  --  Check for the OTPMK.
39   .. code:: shell
40
41        md $SNVS_HPSR_REG
42
43      Command Output:
44          01e90014: 88000900
45
46          In case it is read as 00000000, then read this register using jtag (in development mode only through CW tap).
47                       +0       +4       +8       +C
48          [0x01E90014] 88000900
49
50          Note: OTPMK_ZERO_BIT is 1, indicating that the OTPMK is not blown.
51
52  --  Check for the SRK Hash.
53   .. code:: shell
54
55        md $SRKHR0 0x10
56
57      Command Output:
58          01e80254: 00000000 00000000 00000000 00000000    ................
59          01e80264: 00000000 00000000 00000000 00000000    ................
60
61          Note: Zero means that SRK hash is not blown.
62
63- If not blown, then from the U-Boot prompt, using following commands:
64  --  Provision the OTPMK.
65
66   .. code:: shell
67
68        mw.l $OTPMKR0  <OTMPKR_0_32Bit_val>
69        mw.l $OTPMKR1  <OTMPKR_1_32Bit_val>
70        mw.l $OTPMKR2  <OTMPKR_2_32Bit_val>
71        mw.l $OTPMKR3  <OTMPKR_3_32Bit_val>
72        mw.l $OTPMKR4  <OTMPKR_4_32Bit_val>
73        mw.l $OTPMKR5  <OTMPKR_5_32Bit_val>
74        mw.l $OTPMKR6  <OTMPKR_6_32Bit_val>
75        mw.l $OTPMKR7  <OTMPKR_7_32Bit_val>
76
77  --  Provision the SRK Hash.
78
79   .. code:: shell
80
81        mw.l $SRKHR0  <SRKHR_0_32Bit_val>
82        mw.l $SRKHR1  <SRKHR_1_32Bit_val>
83        mw.l $SRKHR2  <SRKHR_2_32Bit_val>
84        mw.l $SRKHR3  <SRKHR_3_32Bit_val>
85        mw.l $SRKHR4  <SRKHR_4_32Bit_val>
86        mw.l $SRKHR5  <SRKHR_5_32Bit_val>
87        mw.l $SRKHR6  <SRKHR_6_32Bit_val>
88        mw.l $SRKHR7  <SRKHR_7_32Bit_val>
89
90      Note: SRK Hash should be carefully written keeping in mind the SFP Block Endianness.
91
92- At U-Boot prompt, verify that SNVS registers for OTPMK are correctly written:
93
94  --  Check for the OTPMK.
95   .. code:: shell
96
97        md $SNVS_HPSR_REG
98
99      Command Output:
100          01e90014: 80000900
101
102          OTPMK_ZERO_BIT is zero, indicating that the OTPMK is blown.
103
104          Note: In case it is read as 00000000, then read this register using jtag (in development mode only through CW tap).
105
106   .. code:: shell
107
108        md $OTPMKR0 0x10
109
110      Command Output:
111          01e80234: ffffffff ffffffff ffffffff ffffffff    ................
112          01e80244: ffffffff ffffffff ffffffff ffffffff    ................
113
114          Note: OTPMK will never be visible in plain.
115
116  --  Check for the SRK Hash. For example, if following SRK hash is written:
117
118       SFP SRKHR0 = fdc2fed4
119       SFP SRKHR1 = 317f569e
120       SFP SRKHR2 = 1828425c
121       SFP SRKHR3 = e87b5cfd
122       SFP SRKHR4 = 34beab8f
123       SFP SRKHR5 = df792a70
124       SFP SRKHR6 = 2dff85e1
125       SFP SRKHR7 = 32a29687,
126
127       then following would be the value on dumping SRK hash.
128
129   .. code:: shell
130
131        md $SRKHR0 0x10
132
133      Command Output:
134          01e80254: d4fec2fd 9e567f31 5c422818 fd5c7be8    ....1.V..(B\.{\.
135          01e80264: 8fabbe34 702a79df e185ff2d 8796a232    4....y*p-...2...
136
137          Note: SRK Hash is visible in plain based on the SFP Block Endianness.
138
139- Caution: Donot proceed to the next step, until you are sure that OTPMK and SRKH are correctly blown from above steps.
140  -- After the next step, there is no turning back.
141  -- Fuses will be burnt, which cannot be undo.
142
143- Write SFP_INGR[INST] with the PROGFB(0x2) instruction to blow the fuses.
144  -- User need to save the SRK key pair and OTPMK Key forever, to continue using this board.
145
146+---+----------------------------------+-------------------------------------------+-----------+
147|   |   Platform                       | SFP_INGR_REG | SFP_WRITE_DATE_FRM_MIRROR_REG_TO_FUSE  |
148+===+==================================+=======================================================+
149| 1.| lx2160ardb/lx2160aqds/lx2162aqds | 0x01E80020   |    0x2                                 |
150+---+----------------------------------+--------------+----------------------------------------+
151
152   .. code:: shell
153
154        md $SFP_INGR_REG  $SFP_WRITE_DATE_FRM_MIRROR_REG_TO_FUSE
155
156- On reset, if the SFP register were read from u-boot, it will show the following:
157  --  Check for the OTPMK.
158
159   .. code:: shell
160
161        md $SNVS_HPSR_REG
162
163      Command Output:
164          01e90014: 80000900
165
166          In case it is read as 00000000, then read this register using jtag (in development mode only through CW tap).
167                       +0       +4       +8       +C
168          [0x01E90014] 80000900
169
170          Note: OTPMK_ZERO_BIT is zero, indicating that the OTPMK is blown.
171
172   .. code:: shell
173
174        md $OTPMKR0 0x10
175
176      Command Output:
177          01e80234: ffffffff ffffffff ffffffff ffffffff    ................
178          01e80244: ffffffff ffffffff ffffffff ffffffff    ................
179
180          Note: OTPMK will never be visible in plain.
181
182  -- SRK Hash
183
184   .. code:: shell
185
186        md $SRKHR0 0x10
187
188      Command Output:
189          01e80254: d4fec2fd 9e567f31 5c422818 fd5c7be8    ....1.V..(B\.{\.
190          01e80264: 8fabbe34 702a79df e185ff2d 8796a232    4....y*p-...2...
191
192          Note: SRK Hash is visible in plain based on the SFP Block Endianness.
193
194Second method to do the fuse provsioning:
195=========================================
196
197This method is used for quick way to provision fuses.
198Typically used by those who needs to provision number of boards.
199
200- Enable POVDD:
201  -- Refer the table above to enable POVDD.
202
203     Note: If GPIO Pin supports enabling POVDD, it can be done through the below input_fuse_file.
204
205  -- Once the POVDD is enabled, make sure to set variable POVDD_ENABLE := yes, in the platform.mk.
206
207- User need to populate the "input_fuse_file", corresponding to the platform for:
208
209  -- OTPMK
210  -- SRKH
211
212  Table of fuse provisioning input file for every supported platform:
213
214+---+----------------------------------+-----------------------------------------------------------------+
215|   |   Platform                       |                        FUSE_PROV_FILE                           |
216+===+==================================+=================================================================+
217| 1.| lx2160ardb/lx2160aqds/lx2162aqds | ${CST_DIR}/input_files/gen_fusescr/ls2088_1088/input_fuse_file  |
218+---+----------------------------------+--------------+--------------------------------------------------+
219
220- Create the TF-A binary with FUSE_PROG=1.
221
222   .. code:: shell
223
224        make PLAT=$PLAT FUSE_PROG=1\
225          BOOT_MODE=<platform_supported_boot_mode> \
226          RCW=$RCW_BIN \
227          BL32=$TEE_BIN SPD=opteed\
228          BL33=$UBOOT_SECURE_BIN \
229          pbl \
230          fip \
231          fip_fuse \
232          FUSE_PROV_FILE=../../apps/security/cst/input_files/gen_fusescr/ls2088_1088/input_fuse_file
233
234- Deployment:
235  -- Refer the nxp-layerscape.rst for deploying TF-A images.
236  -- Deploying fip_fuse.bin:
237
238       For Flexspi-Nor:
239
240   .. code:: shell
241
242        tftp 82000000  $path/fuse_fip.bin;
243        i2c mw 66 50 20;sf probe 0:0; sf erase 0x880000 +$filesize; sf write 0x82000000 0x880000 $filesize;
244
245      For SD or eMMC [file_size_in_block_sizeof_512 = (Size_of_bytes_tftp / 512)]:
246
247   .. code:: shell
248
249        tftp 82000000  $path/fuse_fip.bin;
250        mmc write 82000000 0x4408 <file_size_in_block_sizeof_512>;
251
252- Valiation:
253
254+---+----------------------------------+---------------------------------------------------+
255|   |   Platform                       |    Error_Register        | Error_Register_Address |
256+===+==================================+===================================================+
257| 1.| lx2160ardb/lx2160aqds/lx2162aqds | DCFG scratch 4 register  |     0x01EE020C         |
258+---+----------------------------------+---------------------------------------------------+
259
260   At the U-Boot prompt, check DCFG scratch 4 register for any error.
261
262   .. code:: shell
263
264        md $Error_Register_Address 1
265
266      Command Ouput:
267          01ee020c: 00000000
268
269      Note:
270       - 0x00000000 shows no error, then fuse provisioning is successful.
271       - For non-zero value, refer the code header file ".../drivers/nxp/sfp/sfp_error_codes.h"
272