KW45 Production Binary

[Arjv]

I am trying to do the generate a single binary for mass production following the AN14003 and I am facing some issues. I was not successful with the jupyter part for generating the keys and creating the secure binaries. For that part I am using the SPSDK CLI tool that was mentioned in an nxp forum thread (https://community.nxp.com/t5/Wireless-MCU/KW45-Sb3-file/m-p/2181239#M20082), by downloading spsdk from https://github.com/nxp-appcodehub/dm-kw45-secure-boot-scripts (I mean for generating the keys and the sb3 files). But I am getting issues when I merge the Binary files as mentioned in the AN14003.

As per the document, i gave used the otap_client_freertos sdk example and did modifications as mentioned. and generated the bin file. Then I opened the otap_client_freertos.bin & kw45b41_nbu_ble_xp_hosted.sb3 files in a hex editor and copied the contents of the sb3 file to the address 0x7A000 of the otap_client_freertos.bin as mentioned. I then loaded the merged binary to the SEGGER J-Flash utility for flashing the binary into the KW45. But the operation failed and after this, I am not even able to program a blinky example also. To recover from this condition I had to enter the ISP mode and erase the entire chip (I was not able to access the chip via SWD even for erasing it). The following is the error message I got when the flashing failed with the merged binary.

****************************************************************************************

Programming and verifying target (1040384 bytes, 1 range) ...

- Connecting ...

- Connecting via USB to probe/ programmer device 0

- Probe/ Programmer firmware: J-Link V9 compiled Dec 13 2022 11:14:50

- Probe/ Programmer S/N: 69730348

- Device "KW45B41Z83" selected.

- Target interface speed: 4000 kHz (Fixed)

- VTarget = 3.290V

- ConfigTargetSettings() start

- ConfigTargetSettings() end - Took 499us

- InitTarget() start

- SWD selected. Executing JTAG -> SWD switching sequence.

- ROM entered ISP command handling loop. Re-enable the debug access.

- InitTarget() end - Took 117ms

- Found SW-DP with ID 0x6BA02477

- DPv0 detected

- CoreSight SoC-400 or earlier

- AP map detection skipped. Manually configured AP map found.

- AP[0]: AHB-AP (IDR: Not set, ADDR: 0x00000000)

- Iterating through AP map to find AHB-AP to use

- AP[0]: Skipped ROMBASE read. CoreBaseAddr manually set by user

- AP[0]: Core found

- CPUID register: 0x410FD214. Implementer code: 0x41 (ARM)

- Feature set: Mainline

- Cache: No cache

- Found Cortex-M33 r0p4, Little endian.

- Cortex-M (ARMv8-M and later): The connected J-Link (S/N 69730348) uses an old firmware module that does not handle I/D-cache correctly. Proper debugging functionality cannot be guaranteed if cache is enabled

- FPUnit: 8 code (BP) slots and 0 literal slots

- Security extension: implemented

- Secure debug: enabled

- ROM table scan skipped. CoreBaseAddr manually set by user: 0x80030000

- SetupTarget() start

- SetupTarget() end - Took 7.11ms

- Executing init sequence ...

- Executing Reset (0, 0 ms)

- ResetTarget() start

- No valid application programmed. Skipping reset.

- ResetTarget() end - Took 1.18ms

- Device specific reset executed.

- Initialized successfully

- Target interface speed: 4000 kHz (Fixed)

- Found 1 JTAG device. Core ID: 0x6BA02477 (None)

- Connected successfully

- Checking if selected data fits into selected flash sectors.

- Start of preparing flash programming

- End of preparing flash programming

- Start of determining dirty areas in flash cache

- End of determining dirty areas

- CPU speed could not be measured.

- Start of flash programming

- Programming range 0x00000000 - 0x00007FFF ( 4 Sectors, 32 KB)

- End of flash programming

- ERROR: Program failed

- Start of restoring

- ERROR: Failed to restore target. RAMCode never stops

- End of restoring

- ERROR: Failed to program and verify target

WARNING: Supply voltage too low or too high, disconnecting target! VTarget = 0.000V

Disconnecting ...

- Disconnected

**********************************************************************************************

It appears like the area we are attempting to program is 0x00000000 - 0x00007FFF & as per the document the NBU firmware is copied to 0x7A000 which is beyond this range.

Please correct me if I'm wrong here.

[luis_maravilla]

Hello,

Could you help us confirm the following?

Are you using a NXP development board [KW45B41Z-EVK / KW45-LOC] or a custom board? as this will influence in the necessary keys; also, could you help us confirm if you have burned the fuses already?

Could you help us bring more details about the error in generating the keys? Or share the error message, It would be highly appreciated.

I notice that the NBU that you are using is [kw45b41_nbu_ble_xp_hosted.sb3].

The differences between the NBU versions are described as this:

"nbu_ble_hosted" is the standard BLE 5.3 controller firmware that supports general BLE features.

"nbu_ble_xp_hosted" stack enables experimental features such as DBAF and ACS.

Could you help us try using the nbu_ble_hosted.sb3 file instead?

Best Regards

Luis

[Arjv]

Dear Luis

Thank you for the reply...

"Are you using a NXP development board [KW45B41Z-EVK / KW45-LOC] or a custom board? as this will influence in the necessary keys; also, could you help us confirm if you have burned the fuses already?"

we have designed a custom BLE Module out of KW45 and are working on that module. We have burned the default NXP keys already into the module. we have tested the module with a basic wireless sdk example(ancs_client).

"Could you help us bring more details about the error in generating the keys? Or share the error message, It would be highly appreciated."

I am able to generate the keys using the SPSDK scripts provided github link that I had mentioned in my original query. the error here I'm getting is while flashing the combined binary.  AS i mentioned, the J-Flash tool is trying to flash the memory in the range 0x00000000 - 0x00007FFF (4 Sectors, 32 KB). But the SB3 file is being copied to 0x7A000 (as per AN14003) which is beyond this range. 

"Could you help us try using the nbu_ble_hosted.sb3 file instead?"

As you suggested, we tried with nbu_ble_hosted.sb3 and the results were same.

[luis_maravilla]

Hello

Could you help us confirm if you add a padding of 0x00 between the valid signedcm33.bin to 0x7A000 as the AN14003 Chapter 5.4 Figure 11?

This implies that the binary must include padding 0x00 between 0x00007FFF up to address 0x0007A000.

Best Regards

Luis