topic Re: unable to load secure boot in MCUXpresso Secure Provisioning Tool

unable to load secure boot

NXPMike — Fri, 07 Feb 2025 01:03:10 GMT

I have configured my LPC55S69-EVK board as follows:

In addition I have configured:

TrustZone disabled image
Authentication key: ROT1: IMG1_1
SBKEK: <random>
Boot: Signed
from: Onchip flash
LC: Development
TP: No TrustProvisioning
ROT1/2/3/4, IMG1_1/2_1/3_1/4_1, debug auth key and debug auth cert

With these settings I have SEC (version 10.0) generate the following files (build image):

image.sb
cfpa.bin
cmpa.bin

I then enter ISP mode and use blhost (version 2.6.7) to flash the files:

ps> .\blhost.exe -u 0x1FC9,0x0021 write-memory 0x9de00 cfpa.bin

Inject command 'write-memory'

Preparing to send 512 (0x200) bytes to the target.

Successful generic response to command 'write-memory'

(1/1)100% Completed!

Successful generic response to command 'write-memory'

Response status = 0 (0x0) Success.

Wrote 512 of 512 bytes.

ps> .\blhost.exe -u 0x1FC9,0x0021 write-memory 0x9e400 cmpa_sealed.bin

Inject command 'write-memory'

Preparing to send 512 (0x200) bytes to the target.

Successful generic response to command 'write-memory'

(1/1)100% Completed!

Successful generic response to command 'write-memory'

Response status = 0 (0x0) Success.

Wrote 512 of 512 bytes.

ps> .\blhost.exe -u 0x1FC9,0x0021 -- receive-sb-file .\image.sb

Inject command 'receive-sb-file'

Preparing to send 12992 (0x32c0) bytes to the target.

Successful generic response to command 'receive-sb-file'

(1/1)16%usb hid detected receiver data abort

Data phase write aborted by status 0x2712 kStatus_AbortDataPhase

Possible JUMP or RESET command received.

Response status = 10101 (0x2775) kStatusRomLdrSignature

Wrote 2128 of 12992 bytes.

I'm concerned about the errors that occur when I flash the .sb file and now my board is going straight to SPI mode and not running the image (which was working in "plain image" mode).

Any ideas what I'm configuring wrong?

Re: unable to load secure boot

NXPMike — Fri, 07 Feb 2025 01:09:03 GMT

I am also unable to successfully complete debug authentication:

##########################################################################################################
Open a debug port - operation started at 2025-02-06 16:56:21
##########################################################################################################
Executing script C:\SecureProvisioningBuild2\debug_auth\open_debug_port.bat
ERROR: Script failed with return code: [2]ERROR
### SCRIPT: Open debug port: C:\SecureProvisioningBuild2\debug_auth\open_debug_port.bat
call "C:\nxp\MCUX_Provi_v10\bin\_internal\tools\spsdk\nxpdebugmbox.exe" -p 1.0 -i pyocd -s OSAYAQGQ auth -b 0 -c "C:\SecureProvisioningBuild2\debug_auth\debug_auth_cert.dc" -k "C:\SecureProvisioningBuild2\keys\debug_authentication_key_RSA_2048.pem"
WARNING:__main__:The -p/--protocol option is deprecated and will be removed in version 2.4. (1701ms since start, nxpdebugmbox.py:259)
WARNING:__main__:The Family is not specified. This is a new option that will be mandatory since SPSDK 2.4. Please update your scripts. (1701ms since start, nxpdebugmbox.py:279)
DeprecationWarning: The command 'auth' is deprecated.
# Interface Id Description
----------------------------------------------------------------------------
0 PyOCD OSAYAQGQ NXP Semiconductors LPC-LINK2 CMSIS-DAP V5.224
WARNING:spsdk.dat.debug_mailbox:The debug mailbox access port index is not specified, trying autodetection. (2396ms since start, debug_mailbox.py:194)
Debug Authentication ends without AHB access.
SPSDKAppError: Debug Mailbox authentication failed:
SPSDK: Problem with debug mailbox occurred: Access to AHB is not granted.
nxpdebugmbox failed
### RESULT of the script `Open debug port`: Failure (return code = [2]ERROR)
Status of the operation: Failure: Open debug port

Re: unable to load secure boot

liborukropec — Sun, 16 Feb 2025 21:22:38 GMT

Hello Mike,

I can see you are invoking the blhost commands manually. Did you try the SEC workflow? Y/N?

If not, did you enrolled the key plus the sbkek.bin ? Without the SBKEK you cannot receive encrypted SB file.

see the generated write_win.bat what it does.

Also I'm curious why you went using manual steps.

Regards,

Libor

Re: unable to load secure boot

JabezLaw — Tue, 05 Aug 2025 03:54:25 GMT

Hi, Mike

I also encountered a same problem.

Debug Authentication ends without AHB access.

SPSDKAppError: Debug Mailbox authentication failed:
SPSDK: Problem with debug mailbox occurred: Access to AHB is not granted.

I wonder if you have resolved this successfully.

May I pick your brain if so.

Jabez

Re: unable to load secure boot

marek-trmac — Thu, 14 Aug 2025 15:18:16 GMT

Hi guys,

for debug authentication problems, I'd recommend to read the following paragraph in the user guide: Troubleshooting — MCUXpresso Secure Provisioning Tool 25.06