i.mx93 Fusebox description

[im93user]

Dear NXP,

I have a few issues with the fusebox descriptions across all available documents for imx93

=================

General questions:

=================

IMX93RM_rev4:

"Fuses can generally only be set from 0 to 1 and the most common failure is a 1 appearing as a 0. The simplest mechanism to verify 

these failures is redundancy. Redundancy is when two bits are OR'd together so that if either is set, then the output value is a 1.

In case of fuses protected by redundancy, only 16 of the 32 bits are available (bits 15:0 are automatically copied to 31:16) and 

checked on read. This allows for multiple programming operations on a word, so bits can be configured at different times."

I haven't found a single fuse in the fusemap xls attached to the RM or in the security RM where this redundancy could have been written into

the shadowregisters.

Is that redundancy something that is handled by the ELE fwr?

Which fuses are protected by redundancy?

Does every fuse have to be written through the ELE API or are there any other fuses present that can be

accessed (read\write) without it?

=======================================

Questions regarding exact fuse settings:

=======================================

!BootCFG0!

SD Speed Selection/ eMMC bus width:

If my boot mode fuses is "internal fuses" and bt_fuse_sel is true, my boot mode will be:

USDHC1 8-bit eMMC 5.1

What SD Speed section "0b11 - 8 bit ddr (eMMC 4.4)" or "0b01 - 8bit" eMMC Bus width decides then exactly?

uSDHC IO Voltage Selection / eMMC Speed Selection / eMMC Bus width:

Can these actually set separately? Afaik HS400 eMMC requires all of these to be set:

8 bit DDR, 1.8 V I\O , not sure what high speed means but I'm guessing it sets the clock?

!BootCFG1!

uSDHC Power Cycle Interval

uSDHC Power Cycle Delay

Power Cycle Enable

Are these attached to the secondary boot offset somehow?

I thought that the only way to set up let's say a fallback bootloader to an eMMC on the uSDHC is to

specify a fixed offset for it, what the power cycling is\can be used for exactly?

uSDHC DLL Enable

uSDHC DLL Select

Couldn't find much information in eMMC 5.1 reference manuals for this, how does that work exactly?

WDOG_Enable

WDOG_Timeout_Select

Is the WDOG needed if I'm using a fallback bootloader on an eMMC so that during NORMAL boot mode it can iterate

through primary bootloader -> secondary bootloader -> serial fallback?

What feeds the WDOG HW during boot?

!OEM MAC ADDRESS!

315 - WORD

32  - num of fusebits

MAC1_ADDR_31_0[31:0]

316 - WORD

16 - num of fusebits

MAC1_ADDR_47_32[47:32]

16 - num of fusebits

MAC2_ADDR_15_0[15:0]

317 - WORD

32  - num of fusebits

MAC2_ADDR_47_16[47:16]

According to the i.MX9 fusemap description the OEM MAC addresses shall be stored in a straight-forward manner, 

and the mainlined nvmem linux drivers are swapping the endianness the MAC Addresses like that.

However, the security reference manual describes the exact same fuses the following way:

39 word 3  MAC1_ADDR_31_0[15:0]

           MAC1_ADDR_31_0[31:16]

39 word 4  MAC1_ADDR_47_32[47:32]

           MAC2_ADDR_47_32[47:32]

39 word 5  MAC2_ADDR_31_0[15:0]

           MAC2_ADDR_31_0[31:16]

Which one is the correct description?

!SRK HASHES!

Based on the RMs are my assumptions correct regarding NXP and OEM SRK hashes:

NXP fuses NXP SRK hashes during manufacturing, and during boot it is verified that only signed binaries

by NXP can be loaded as an ELE fwr to the ELE CPU and these fuse words then set to non-readable?

Later, OEM SRK hashes can be added in order to verify bootloader\OS images for OEM usage.

[im93user]

[bump]

Hello, can I get a clarification for my questions above?


Thank you