I've successfully enabled and tested secure boot for my 1B revision chip. Now I'm working on updating the CFPA page live so I can update the secureFirmwareVersion field after secure firmware updates.
I'm using the ROM flash API to do the update. Specifically, I use ffr_get_customer_infield_data to read the CFPA page. I confirmed that the data read in by `ffr_get_customer_infield_data` is correct, and there is no error code.
I then edit both secureFirmwareVersion and Version fields. As I understand, if the Version field is incremented in the scratch page, then CFPA will get updated on the next power cycle. So I increment Version and write back CFPA using ffr_infield_page_write. I then power cycle and then read back the CFPA page with ffr_get_customer_infield_data.
I've found that when I increment Version by 1, CFPA doesn't update at all (and gives no error code on the write). If I increment by 2, then it works only once. It doesn't work again unless I increment by 3, and then only works once. This continues and seems to indicate that I need to increment Version by a larger amount every time. For each trial I did a power cycle. This doesn't seem correct and I cannot find any more documentation on how to use this flash API properly.
What are the exact steps one should take to use the ROM flash API to update the CFPA page in a repeatable way? Is there any documentation on the Version field of CFPA?
After some more experimenting, I found I could avoid these issues by just not using ffr_get_customer_infield_data to read the CFPA page. Instead, to read the CFPA i just read the 512 byte scratch page by reading from address 0x0009_DE00 directly. It seems that the ffr_get_customer_infield_data returns old versions of the CFPA that are not in the scratch, ping, or pong pages.