How to Enable Secure Boot on K32L3A

[jraczak]

I'm trying to implement secure boot on my project. I'm using the K32L3A and using BLhost to write the IFR's. I seem to have all other functions working except secure boot. For simplicity of testing, I'm putting an unsigned image and not programming the RKTH onto the part. I would like to see it not boot when I enable secure boot. My process is as follows.

1. Enable secure boot
   1. The command I use is: ./blhost --spi <mysettings> --noping -- flash-program-once 0x98 8 FFFFFF00FFFFFF00
   2. According to this article each bit in the IFR is mapped to a CCOB register and the register should be written with a 0xFF for b'1 and 0x00 for b'0. I should be writing 11101110 to the register, which according to the documentation is:
      • secure boot enabled.
      • secure boot development mode disabled
      • if secure boot fails, go to bootloader mode.
2. Enable Flash security.
   1. The command I use is: ./blhost --spi  <mysettings> --noping -- flash-program-once 0x80 4 FFFFFFFF
   2. I'm very confident this command works because any subsequent BLHost commands get a response of "security must be disabled".

Upon reset, the unsigned image boots, meaning secure boot is not active. I can't find any examples of how to enable secure boot and based on the user guide, these seemed to be the only two necessary steps. Any help is appreciated!

[jraczak · Accepted solution]

I was able to solve the issue. 0xFF and 0x00 only maps to logic 1's and 0's for some of the IFR's. It turns out, I just had to use ./blhost --spi <mysettings> --noping -- flash-program-once 0x98 8 FFFFFFFFFFFFFFE1 to get my desired setting.

[bobpaddock]

Is there any Endian byte swapping going on? That would not be apparent in writing all 0xFFs, it would in real data.

M0+ are Little Endian.