OTP whitelabel options for RP2350 boards

Development
28
Unexpected writes to some OTP rows

It appears picotool silently (automagically?) writes to multiple rows, when asking it to write to a row that is RBIT-3 (voting algorithm amongst multiple rows) … or maybe it’s the bootrom itself?

As an example, when using picotool to write to Row 0x59, it appears to also automatically write to rows 0x5A and 0x5B.

Other failures

I’ve messed up two RP2350 board’s OTP thus far:

  • In one, I accidentally writing to reserved areas of the OTP (Rows 0x064 onwards) … so while the settings worked in bootrom, no telling what settings I destroyed, so it’s only usable for OTP testing in bootrom.
  • In the other, I forgot to update whitelabel address offsets after re-arranging the string order. Oops. Works, but with some unexpected / odd / null-enclosing strings in places.
Progress at last!

I should have an update in the next couple days, with a focus on verifying the steps to be taken during manufacturing.

I have verified a simple way to program all but one string (the manufacturing details) per-product line (e.g., BP5XL, BP6, BP7), and to add the string containing the manufacturing details later.

Thus, a first script can run identically on all devices (of a given type), causing the USB white label of the bootrom to be tested as part of QA.

A second script can be run after QA, to store the variable portions of the data, and lock the USB whitelabel page.
This reduces the complexity of the script for the variable data portion, which I consider a “Good Thing ™”.

Todo...

  • Modify command to be otp dump (two words), so can add other OTP sub-commands later
  • Add directory entry for the portions of the OTP used for the whitelabel customization. (yes, even though it’s duplicative of Rows 0x59…0x5C, … it’s a start).
  • document edge cases when reading OTP having various errors using bootrom vs. memory-mapped regions … do all methods report errors?
    • Reading non-ECC pages as ECC protected
    • Reading ECC-protected pages with 1-bit error
    • Reading ECC-protected pages with 2-bit errors
    • Reading ECC-protected pages with Bit Recovery By Polarity (BRBP)
    • Manual recovery of original data from raw BRBP ECC row
1 Like