7.4.3 Write Process

The command used to write on a unique address is CMD=0x0000.

The command used to write on several consecutive addresses is CMD=0x0001. In this case, it will be sent the 32 bits of the initial address, 16 bits of the command (0x0001) and as many consecutive words (32 bits) as are wanted to write.

Regarding the decryption packets, the commands to write the number of decryption packets (CMD=0x0004), the initial vector of decryption (CMD=0x0005) or the decryption signature to test if decryption is correct (CMD=0x0006), the address of the frame is not taken into account and it can be composed of any address value. To write the decryption packet, only the last 15 bits are taken into account. In the case of decryption initial vector and decryption signature where it is necessary to send the 128-bit value as data, it is made in the same way as the write process at consecutive addresses, sending 4 consecutive words (32 bits).

To write a fuse box, the Buffer register must be written in advance (CMD=0x0007) and then the Tamper registers of KEY_ENC_BOX, KEY_TAG_BOX or CONTROL_BOX must be written with the content of the buffer (CMD=0x0008, CMD=0x0009 and CMD=0x000B respectively). Finally, to blow the desired fuses with the values in the corresponding Tamper register, the command (CMD=0x000C) must be sent with any address and any data value.

The end of this writing process is indicated in the answer of the bootloader status command (CMD=0x0012). If the writing process is active, bit 0 of the answer is ‘1’. In other cases, all data of the answer is ‘0’.

In the case of CONTROL_BOX, to activate the new values, it is also necessary to write the CONTROL_FUSES values to the corresponding Tamper register (CMD=0x0010).