LPC55: Device enters ISP mode instead of booting Signed Master Boot Image (MBI) at 0x0

samehgrira — Sun, 08 Mar 2026 15:09:42 GMT

Hello NXP Community,

I am having trouble with the Secure Boot flow on an LPC55S28. I have a Primary Image located at address 0x00000000 which has been processed into a Signed Master Boot Image (MBI) using the NXP Secure Provisioning Tool.

Despite the image being signed and the CMPA/CFPA being provisioned, the device ignores the image upon reset and enters ISP mode (appearing as a HID/VCOM device).

PFR Configuration (CMPA/CFPA):

I have provisioned the PFR with the following values to ensure debug access remains open and the certificate chain is valid:

• SEC_BOOT_EN: 0x01 (Signed Mode enabled in SECURE_BOOT_CFG).

• ROTKH: Programmed and verified. The SHA-256 hash read back from the CMPA matches the value provided by the signing tool exactly.

• ROT_KEY_EN: All bits set to 1 (all keys enabled).

• CFPA Version: Correctly incremented with every write to ensure the anti-rollback counter is satisfied.

• Debug Boundaries: CC_SOCU_PIN and CC_SOCU_DFLT (CMPA/CFPA) are all set to 0xFE2001DF to maintain SWD/JTAG access.

The Issue:

The signed .bin file at address 0x0 contains a valid MBI header, yet the ROM refuses to boot and falls back to ISP.

1. Since the device enters ISP mode, does this strictly imply a trust failure (ROTKH mismatch), or could an integrity failure (Signature/Hash check) also trigger the ISP fallback?

2. Is there a specific register (like a ROM status flag) I can inspect while the device is in this ISP state to determine the exact reason the ROM rejected the image?

3. If the ROM reaches ISP mode, does it mean the MBI header was at least parsed correctly, or is ISP the default behavior for any failure at address 0x0 when Secure Boot is enabled?

4. Are there any hidden dependencies in the CMPA/CFPA (other than ROTKH, ROT_KEY_EN, and SEC_BOOT_yEN) that must be configured for a standard signed XIP image to be accepted by the ROM?

Thank you for your help

Re: LPC55: Device enters ISP mode instead of booting Signed Master Boot Image (MBI) at 0x0

Alice_Yang — Mon, 09 Mar 2026 10:50:28 GMT

Hello @samehgrira

For first‑time use of the secure boot function on the LPC55S28, I strongly recommend using the Secure Provisioning Tool and referring to the "6.5 LPC55(S)0x/1x/2x/6x device workflow" of the user guide. It describe the steps more detail.

Thank you.

Alice

LPC MicrocontrollersのトピックLPC55: Device enters ISP mode instead of booting Signed Master Boot Image (MBI) at 0x0

LPC55: Device enters ISP mode instead of booting Signed Master Boot Image (MBI) at 0x0

Re: LPC55: Device enters ISP mode instead of booting Signed Master Boot Image (MBI) at 0x0