KW45 Custom Board NBU Flashing and Fuse keys generation

[tomaru]

Dear Team,

We have prepared our custom board with KW45 MCU.
We do not have pins required for ISP 

In my Dev board "KW45 EVK" the MCU comes pre fused with the Default keys.

I am using custom board designed  by us, I want to know following - 

1. I don't want to use security features, can I RF Core run without it ? Without using Fuse ? My application is simple and do not require security.

2. I read somewhere that MCU KW45 comes with default "NULL" keys from plant. Can I use 0x00 "NULL" keys and flash my NBU ? Will it work ?

3. If above 2 question - No. Can you tell me how can I use default keys of KW45 EVK board and program the fuse so that I can use the same keys ?

What I want - 
1. Keys and certificate generation - I want to use the same as EVK board or Skip.
2. Burning KW45 ROM bootloader fuses with custom generated keys - I want to use the same as EVK board or Skip. Also if required flashing it using SWD without ISP.
3. Generation of a secure binary file - To be generated using Null or default keys.
4. Programming encrypted images into the radio flash through KW45 bootloader - How to do using SWD ?

I would be grateful if you can answer all these queries.

Please let us know if we can have a detail telephonic conversation for the above as the issue persist even multiple queries from our side.

Best Regards
Tomaru

KW45 DEVICEHSM-TRUST-PROVISIONING EDGELOCK-A5000 KW45B41Z-EVK BLE-NFC 

[tomaru]

Dear Luis,

Thank you for your response.

Please find my response in BOLD.

The ISP pin is recommended for updating authenticated and optionally encrypted firmware via SB3 files, as the KW45 requires signed firmware to be loaded into the NBU through the bootloader. I would recommend adding this support if the board doesn’t have it. I understand giving ISP is necessary and considering future we can plan to give it, but in current proto we do not have it. We can try to do some custom rework just to get the pin out from MCU.

You can consult how is this pin connected in the KW45EVK Board with the KW45B41Z Evaluation Kit Board Schematics and you can refer for more information about this on this Community post The best way to build a PCB first time right with KW45 (Automotive) or K32W1/MCXW71 (IoT/Industrial)..., and in KW45 Hardware Design Recommendations Presentation in Bootloader pins slide.
We have considered the First time right document and designed the PCB and Schematics

On the other hand,Application Note AN14003describes the process for programming the KW45 fuse, burning CM33 and NBU firmware operations. Also how to implement a merging of the NBU image and CM33 flash via SWD for mass production is addressed in this document.
We have followed the process as per AN14003 document strictly but the end result was - We were getting Warning at the end of flashing "No Data written in Flash" while the flashing process succeeded. Note that we do not have ISP and we are flashing using SWD and FX Multilink Debugger. Flashing of firmware in CM33 is not a problem, but we are not sure if the fuse was programmed and NBU is flashed as RF did not work at all. Additionally I also see that on my custom board the .bin files are unable to flash once I convert axf to bin. I don't know if it relates to anything form above.

 If the user burns the fuse using EVK default keys, the .sb3 file located in sdk path described in Chapter 5.1 [AN14003]  can be used.
We noticed that in the SPSDK path there are 4 different .sb3 files being unaware we flashed with one amongst 4.

The sb3 file generation is described in chapter 5.1.1,
As we will be using EVK keys, do we still need this ? my understanding is no we do not need this.

For flashing via SWD you will need to merge the CM33 image and NBU image after following the steps in the application note, and how to merge the image process is described in chapter 5.4
Thank you for your support, but as we are continuously encountering issues with the generation of merged file.

Can you share with us one merged file (CM33 (random firmware)+NBU + sb3(with eval board keys)) ?
Further I will flash my axf in CM33 (Build on Dev Board) after the NBU and SB3 is flashed successfully using SWD. 

Will my application code  (.axf) build using Eval Board KW45 EVK flash successfully in such case on my custom board ?

BR,
Tomaru

[luis_maravilla · Accepted solution]

Hello Tomaru,

You're mentioned that the CM33 image can be flashed but have a warning for flashing process, could you share with us the log that contains the warning? Also, if you could bring more details about issue warning message is highly appreciated.

As the intention is using KW45B41Z-EVK board keys, the .sb3 file located in SDK path described in Chapter 5.1 [AN14003] can be used. [kw45b41_nbu_ble_hosted.sb3 is the standard BLE 5.3 controller firmware that supports general BLE features.]

NBU firmware can only be uploaded via sb3(binary files), if you are using axf files may be an incompatibility using FX Multilink Debugger.

Is it possible that you have an MCU-Link / J-link probe to test instead of the Multilink Debugger?

When signing the image as Chapter 5.3 description, are you facing any error message from the OTAP tool? Or could you help us bring information about your CM33 image?

Best Regards

Luis

[tomaru]

Hello Lius,

Thank you for your reply.

Regarding the NBU Flash file, we got support from NXP.

Regarding Bin files unable to flash problem - This is not possible using "PEmicro's Multilink Universal FX"so we used MCU-Link, it worked.

Thank you for your support.

BR,
Tomaru

[luis_maravilla]

Hello Tomaru,

The ISP pin is recommended for updating authenticated and optionally encrypted firmware via SB3 files, as the KW45 requires signed firmware to be loaded into the NBU through the bootloader. I would recommend adding this support if the board doesn’t have it.

You can consult how is this pin connected in the KW45EVK Board with the KW45B41Z Evaluation Kit Board Schematics and you can refer for more information about this on this Community post The best way to build a PCB first time right with KW45 (Automotive) or K32W1/MCXW71 (IoT/Industrial)..., and in KW45 Hardware Design Recommendations Presentation in Bootloader pins slide.

On the other hand, Application Note AN14003 describes the process for programming the KW45 fuse, burning CM33 and NBU firmware operations. Also how to implement a merging of the NBU image and CM33 flash via SWD for mass production is addressed in this document.

The KW45B41Z Evaluation Kit Board comes with pre fused default keys provided by NXP, However, for the KW45 chip received from the factory for using in a custom board, by default, the SBKDK and RoTKTH keys in the fuse are null. Therefore, writing these two keys to fuse is essential. Otherwise, the sb3 update would fail.

It's important to mention that the method of burning the fuse cannot be reversed on the board. Therefore, it is recommended to modify the fuse with caution.

The Default KW45 EVK board keys are described in chapter 5.2.1 figure 9.[AN14003]

 If the user burns the fuse using EVK default keys, the .sb3 file located in sdk path described in Chapter 5.1 [AN14003]  can be used.

The tool you will need for fuse default keys its "Jupyterlab" described in chapter 4. If your unfamiliar with the tool you could try this link for the installation and a tutorial. spsdk/examples/jupyter.rst at master · nxp-mcuxpresso/spsdk

The sb3 file generation is described in chapter 5.1.1,

For flashing via SWD you will need to merge the CM33 image and NBU image after following the steps in the application note, and how to merge the image process is described in chapter 5.4

Best Regards

Luis