Hi Derek,
I tested attached certificates in SDK and all works. Hopefully I found your issues.
1) Issue with secure boot
I expect your issue for secure bootloader is due to incorect CFPA page modification.
"6. Read CFPA page (0x9DE00) and set byte @ 0x9DE18 to 0x01, write modified page back to 0x9DE00"
I tested your modification and ROM will not accept this CFPA page. (see screen below)
CFPA page has at offset 0x4 Version register. Each time when you load new CFPA page Version has to be incremented for loading new CFPA page.
2) SB file issue
I expect that you are using 1B silicon. The 0A version of the LPC55S6xx silicon supports version 2.0 and the 1B version of the LPC55S6xx supports version 2.1 of the SB image format. SB 2.0 is encrypted and SB2.1 is encrypted + signed.
As you posted you are generating SB2.0 which is not valid for 1B silicon.
@echo off
set SB_KEK="D:\ENCRYPTION\BIO\SECURE_BOOT\SBK.txt"
set SB_CFG=hello_world_test_cfg_sb2.bd
set SB_OUT=hello_world_test_sb2.sb2
@echo on
..\..\..\Tools\Programming\elftosb_gui\elftosb\win\elftosb.exe -V -f lpc55xx -k %SB_KEK% -c %SB_CFG% -o %SB_OUT%Example of use (Encrypted + Signed SB):
1 root key
elftosb.exe -f lpc55xx -k "sbkek.txt" -c "commandFile.bd" -o "output.sb2" -s selfsign_privatekey_rsa2048.pem" -S "selfsign_v3.der.crt" -R "selfsign_v3.der.crt" -h "RKTH.bin" "input.bin"4 root keys
elftosb.exe -f lpc55xx -k "sbkek.txt" -c "commandFile.bd" -o "output.sb2" -s private_key_1_2048.pem -S certificate_1_2048.der.crt -R certificate_1_2048.der.crt -R certificate_2_2048.der.crt -R certificate_3_2048.der.crt -R certificate_4_2048.der.crt -h "RHKT.bin" "input.bin".bd file content
options {
flags = 0x8; // 0x8 encrypted + signed, 0x4 encrypted
buildNumber = 0x1;
productVersion = "1.00.00";
componentVersion = "1.00.00";
}
sources {
inputFile = extern(0);
}
section (0) {
erase 0x0..0x40000;
load inputFile > 0x0;
}where
-f = family lpc55xx
-k = path to KEK file (SBKEK)
-c = path to command file to be processed
-o = path to output file
-s = path to private key of certificate used for signing
-S = path(s) to certificates in certificate chain, each certificate in chain must be specified with new -S switch in order of how was chain created (root certificate first)
-R = path(s) to root certificate(s), 1-4 root certificates can be specified, each root certificate must be specified with new -R switch, one of the root certificates must be first certificate specified by -S switch
-h = path and name of output binary file generated by elftosb, which contain hash of hashes of all root certificates (RKTH), which must be uploaded to the device register
I hope this can help your issue.
Regards,
Tomas
Hi,
SB2 file issymetrically encrypted. For decryption of the file, the key has to be loaded into device. The key size for
SB2 file is 256 bits. During boot, the SB key is used with AES to decrypt the SB2 file. The SB key input for
ELFTOSB GUI is .txt file with plain text key. This key is loaded into PUF key store of LPC55Sxx.
SB2 file creation
Run elftosb command line tool with arguments below:
elftosb.exe -V -f lpc55xx -k "keys\sbkek.txt" -c "commandFile.bd" -o "output.sb2"
•-k <path to SB key for encryption(.txt)>
•-c <path to SB file config(.bd)>
•-o <path to output file(.sb2)>
SB file config file contains configuration commands that will be processed after SB2 file is loaded in the device.
In part sources is our new signed image.
The SB2 file created with the updated binary image can be loaded into the device through ISP command handler
with command receive sb file:
blhost -p COMxx receive-sb-file <path to the secured binary(.sb2)>
After successfully loading the SB2 file it is executed as configured in SB configuration file (.bd file).
When the file is executed, the internal flash address from 0x0 to 0x40000 is erased.
After flash erase operation, the image mentioned in the mainImage parameter is loaded to address 0x0.
Reset the device after these operations:
Press reset pin or run BLHOST tool blhost -p COMxx reset
The updated image loaded into internal flash starts to execute.
I hope this helps,
have a nice day
Regards
Soledad
