Secure Boot with Strict Sequential Boot Mode

[香龙朱]

Hi,

I was working on secure boot function recently. I run my device in "Sequential Boot Mode", but I find this mode is not what I need. Because, whether the boot check is fail or not, it will run Flash code. I think if the boot check is fail, it should stop or reset.

So, I try "Strict Sequential Boot Mode". But I didn't read AN5401.pdf carefully. I burned my code to flash, Then I configured CSEc, and I configured "Strict Sequential Boot Mode" with "automatic BOOT_MAC calculation".

Now, my device can not be startup, it is always stay in RESET state. The RESET pin is always low.

How Can I reuse my device?

Thanks a lot!

[leo_cheng]

Hi Shannon,

I am wondering if you solved it or not. I have a same problem, the MCU always stays in RESET state because of strict security boot failure.

[jiri_kral]

Hi, 

as I mentioned in different thread - your device is probably locked and mass erase is disabled. Under this condition there is no way how to recover it.

Jiri 

[香龙朱]

Hi, Jiri

   Thanks for your support.

   This is another hardware, Rather than "Device is secure, Erase to unsecure".

   I try the "Strict Sequential Boot Mode" function. But I didn't write the BOOT_MAC. So, my hardware is always stay in RESET. the RESET pin is always low.

   I want to know How can I run my hardware form RAM. or How can I change the secure boot type of my hardware. 

Thanks a lot.

Shannon. 

[jiri_kral]

Hi, 

I see. So - in my opinion the easiest way how to "reset" your hardware is use csec_keyconfig_s32k144 example: 

Enable erase all keys in main.c source file: 

This example erase flash area and restore flash config to default value. Be sure that you are running this example as RAM target: 

If it doesn't help - can you please share your project? I'll test it on my EVB and try to find recovery process. 

Jiri 

[香龙朱]

Hi，

Thanks for support！

For this issue, I refer the chapter 4.4.3.2 Automatically using CSEc of AN5401.pdf.

   1,I debug the "UartDemo" porject for burn the code into Flash.

   2,I debug the "1_Configure_part_and_Load_keys" project for load the ECU_KEY. and I use the Debug_RAM.

   3,I debug the "4_secure_boot_add_BOOT_MAC_manual" project for config the secure boot. and I use the Debug_RAM.

I modify "4_secure_boot_add_BOOT_MAC_manual" project like this:

I change the BOOT_SIZE and boot flavor. and run it use Debug_RAM. I want to calculate the BOOT_MAC automatic. I power off my hardware and wait a few minutes, then I power on my hardware, I think it will run Flash code, but it doesn't. Then I power off and power on my hardware several times, But it doesn't work.

[香龙朱]

Sorry for last reply, it is not complete.

continue!

I refer the AN5401.pdf, I find the mode flavor = 0(Strict Sequential Boot Mode) can not use automatic BOOT_MAC caculation.The reset pin is always low.I can not debug the "csec_keyconfig_s32k144" example.

I can't submit my project in this reply.

the "UartDemoNoBoot" project is a simple project that can print some information when run from flash.

I do not modify the "1_Configure_part_and_Load_keys" project in AN5401SW.zip

I modify the  "4_secure_boot_add_BOOT_MAC_manual" project like last reply.

Thanks a lot.

Shannon

[mikedoidge]

Hi Shannon,

To attach the project, you can use the link 'Use advanced editor' at the upper right of your response box. Then you will be able to attach a file.

Best Regards,

Mike

[香龙朱]

Hi, Mike

Thanks！