Fails PN5190B1 Secure Firmware Update via the PNEV5190BP.

[k_uchida]

I am creating a prototype board equipped with PN5190B1

The PN5190B1 it obtained has an old FW version of 2.1, and I would like to update it to the latest version 2.7,
but Firmware Update fails.

I ran the Secure Firmware Update downloader from the NXP Website from the IDE via the PNEV5190BP.

Secure Firmware Update downloader: https://www.nxp.com/webapp/sps/download/license.jsp?colCode=SW6592

Please give me advice.
Also, are there other ways to perform firmware updates?

--- [ Things I tried ] ------------------------------------

I executed the source code Secure Firmware Update downloaded from the NXP Website from the IDE.

Enter 1: FW Version 02.01 was obtained.

Enter 3: perform SOFT RESET. I was able to confirm with the oscilloscope that a reset pulse was output from /VEN.

Enter 5 : Secure Firmware Update fails.

(statue 0x0B: PH_DLHAL_HWDOWNLOAD_ERR_UNKNOWN_CMD)

--- [ Operating environment etc. ] -----------------------

Connection with PNEV5190BP

  -- Mode: MCU INT, NFC EXT (R5 ON, R6 OFF, R7 ON)

  -- Connect to PC via J-Link to J1

  -- Connect the prototype board with PN5190B1 to J21 via SPI

  -- J6 VEN to /VEN of evaluation board

Software used

  --Windows 10

  --MCUXpresso IDE

  -- Secure Firmware Update (Unzip SW6592.zip downloaded from NXP Website and build source)

  -- pn5190_v02.07.esfwu (Unzip SW8725.zip downloaded from NXP Website)

--- [Console log when trying] ---------------------------

Executed SetRestartOnClose=1

[MCUXpresso Semihosting Telnet console for 'DownloadLibEx1 JLink DebugFRDMK82F' started on port 61218 @ 127.0.0.1]

SEGGER J-Link GDB Server V7.94b - Terminal output channel

******** Secure Firmware Update ********

 =====Menu==== 

- Enter 1 for FW Version.

- Enter 2 to Get DieID.

- Enter 3 to perform SOFT RESET.

- Enter 4 to CheckSessionState.

- Enter 5 for Secure Firmware Update 

  Select Option: 

(For MCUXpresso, you may have to press many enter keys after your input) : 1

Option 1 selected

GetFirmwareVersion func

Secure FW ver     : 02.01

Non Secure FW ver : 00.00

 =====Menu==== 

- Enter 1 for FW Version.

- Enter 2 to Get DieID.

- Enter 3 to perform SOFT RESET.

- Enter 4 to CheckSessionState.

- Enter 5 for Secure Firmware Update 

  Select Option: 

(For MCUXpresso, you may have to press many enter keys after your input) : 5

Option 5 selected

Secure Firmware upload func

Please Wait..

Warning : Trying to either Downgrade or load same Fw

Current 

MajorVersion = 02 bMinorVersion = 01 

updating to 

MajorVersion = 02 bMinorVersion = 07 

 firmware upload failure

 Status Returned = 0x0B

[k_uchida]

I tracked down the parts where I was failing.
ucHost_Utils\Common\SecureDownloadLib\comps\phDownloadLib\src\phDownload_lib.c
In the phDlhalHwDownload_Transceive function, The phDlhalHwBalExchange() function fails on the third call.
Below is the debug output.
I also attach phDownload_lib.c with debug output.

---------------------------------------------------------------

[MCUXpresso Semihosting Telnet console for 'DownloadLibEx1 JLink DebugFRDMK82F' started on port 53046 @ 127.0.0.1]

SEGGER J-Link GDB Server V7.94b - Terminal output channel

******** Secure Firmware Update ********

=====Menu====

- Enter 1 for FW Version.

- Enter 2 to Get DieID.

- Enter 3 to perform SOFT RESET.

- Enter 4 to CheckSessionState.

- Enter 5 for Secure Firmware Update

Select Option:

(For MCUXpresso, you may have to press many enter keys after your input) : 5

Option 5 selected

Secure Firmware upload func

Please Wait..

Warning : Trying to either Downgrade or load same Fw

Current

MajorVersion = 02 bMinorVersion = 01

updating to

MajorVersion = 02 bMinorVersion = 06

aChunkBuffer[] =

7fH,04H,80H,c0H,00H,06H,02H,d8H,f2H,08H,b8H,89H,f6H,fcH,4fH,3dH,

b2H,a7H,efH,4aH,a0H,19H,1cH,70H,2dH,f6H,f7H,00H,0bH,76H,2eH,8aH,

7fH,82H,1bH,5aH,d5H,d9H,ffH,19H,25H,6fH,bcH,dfH,6fH,f2H,7eH,acH,

4fH,45H,78H,a3H,57H,06H,91H,c0H,30H,02H,90H,21H,65H,5dH,d4H,34H,

13H,afH,5dH,9cH,14H,40H,5eH,73H,8aH,d4H,18H,31H,9dH,33H,16H,9bH,

bdH,19H,0eH,acH,2cH,45H,d8H,78H,d8H,73H,77H,c0H,98H,d7H,7fH,60H,

29H,c8H,a5H,f3H,7dH,62H,38H,a7H,49H,a5H,52H,67H,6cH,a0H,e3H,aaH,

87H,f5H,e7H,08H,c6H,e0H,8fH,9eH,77H,e3H,32H,acH,38H,3aH,2bH,71H,

39H,adH,e0H,26H,76H,

phDlhalHwBalExchange() status=0H

aChunkBuffer[] =

7fH,04H,80H,a7H,f3H,6fH,0aH,0dH,c7H,5dH,b7H,3cH,26H,88H,51H,3bH,

9aH,f6H,01H,65H,86H,58H,64H,30H,05H,6aH,61H,05H,deH,67H,97H,28H,

caH,e9H,42H,24H,8dH,dcH,17H,ccH,03H,0cH,d0H,74H,9fH,83H,85H,5cH,

89H,b8H,daH,e0H,95H,b3H,51H,74H,30H,94H,f2H,d6H,17H,cfH,f4H,57H,

90H,1dH,b9H,13H,16H,f3H,d3H,f7H,47H,dcH,63H,d4H,acH,f9H,88H,25H,

0fH,59H,87H,97H,b5H,0fH,13H,55H,96H,bdH,23H,02H,8eH,dcH,6eH,50H,

3fH,87H,dcH,c4H,5aH,3bH,2aH,39H,52H,b4H,71H,20H,4cH,d9H,acH,47H,

51H,28H,51H,43H,6cH,daH,3aH,2aH,cdH,e0H,21H,39H,f4H,d5H,b2H,e0H,

9eH,c4H,20H,54H,08H,

phDlhalHwBalExchange() status=0H

aChunkBuffer[] =

7fH,00H,34H,0eH,4eH,c1H,65H,16H,a2H,9aH,4bH,d1H,6cH,bfH,c4H,5aH,

a9H,a4H,5dH,dbH,e3H,afH,9bH,e5H,90H,bdH,68H,00H,b2H,24H,a9H,7eH,

fbH,9bH,ebH,38H,86H,74H,e9H,feH,f3H,7dH,52H,f8H,0eH,d3H,8dH,0aH,

6dH,1eH,82H,b4H,54H,74H,a1H,e8H,39H,94H,f2H,d6H,17H,cfH,f4H,57H,

90H,1dH,b9H,13H,16H,f3H,d3H,f7H,47H,dcH,63H,d4H,acH,f9H,88H,25H,

0fH,59H,87H,97H,b5H,0fH,13H,55H,96H,bdH,23H,02H,8eH,dcH,6eH,50H,

3fH,87H,dcH,c4H,5aH,3bH,2aH,39H,52H,b4H,71H,20H,4cH,d9H,acH,47H,

51H,28H,51H,43H,6cH,daH,3aH,2aH,cdH,e0H,21H,39H,f4H,d5H,b2H,e0H,

9eH,c4H,20H,54H,08H,

phDlhalHwBalExchange() status=0H

phhalHw_ReturnCodesMapping() status=bH

_PerformSecureFirmwareUpdateInt() status=0xb

firmware upload failure

Status Returned = 0x0B

[danielchen]

Hi @k_uchida 

To update the PN5190 we provide a example “DownloadLibEx1” for MCUXpresso. This example is per default configured to support the PN5190 *B2* . Which is the encrypted firmware download. B0/B1 are using the unencrypted “legacy” download mode.

Unfortunately the commands changed [UM11942 PN5190 instruction layer – 3.4.1 HDLL Command OP codes]:

Regards

Daniel

[danielchen]

If you use the example and run into a “0x0B” failure, this is a very good indication that you maybe have not changed the project configuration to use B0/B1, but it is still on B2.

[danielchen · Accepted solution]

To fix this, you have to change the Preprocessor  defines of “SecureDownloadLib” and “DownloadLibEx1” project. So that “PN5190_B2_IC” is *NOT* in the “Defined symbols (-D)”. To easily revert it back I just put it into the “Undefined symbols (-U)”. Just deleting it also is good enough.

[k_uchida]

Dear Danielchen,
Thank you for your voice from heaven.
I was able to successfully update the FW by disabling PN5190_B2_IC.

[danielchen]

Nice to hear your good news, have a nice weekend