Unable to program the eMMC using STM32CubeProgramer with a signed & encrypted arm trusted firmware and FIP

[ThinhNguyen]

Hardware setup:
- STM32MP257F-DK

- The OTP in the chip is burned with the correct OTP value and it is closed.

- Connect CN15 USB Port to a Ubuntu Laptop.

- BOOT0 = BOOT1 = BOOT2 = BOOT3 = 0

- Power on the DEV KIT.

Software:

Enable Secure Boot + Encrypted

ROOT_SIGN_KEY = "/mnt/HDD_2TB/KeyGenSecBoot/stm32mp25-signaturekey"
ROOT_ENCRYPT_KEY = "/mnt/HDD_2TB/KeyGenSecBoot/stm32mp25-encryptionkey"
# Generate Distribution Package with signed binaries for STM32MP25
SIGN_KEY = "${ROOT_SIGN_KEY}/privateKey00.pem"
SIGN_KEY_stm32mp21 = "${ROOT_SIGN_KEY}/privateKey00.pem"
SIGN_KEY_stm32mp23 = "${ROOT_SIGN_KEY}/privateKey00.pem"
SIGN_KEY_stm32mp25 = "${ROOT_SIGN_KEY}/privateKey00.pem"
EXTERNAL_KEY_CONF = "1"
SIGN_KEY_PASS = "xxx xxx xxxx xxxx xxxxxx xxx xxx xxx"
SIGN_ENABLE = "1"
SIGN_TOOL = "/home/thinhnguyen/STMicroelectronics/STM32Cube/STM32CubeProgrammer/bin/STM32_SigningTool_CLI"

# Generate a Distribution Package with encrypted partition binaries for STM32MP25
ENCRYPT_ENABLE = "1"
ENCRYPT_FSBL_KEY = "${ROOT_ENCRYPT_KEY}/stm32mp_encryption_key.bin"
ENCRYPT_FSBL_KEY_stm32mp21 = "${ROOT_ENCRYPT_KEY}/stm32mp_encryption_key.bin"
ENCRYPT_FSBL_KEY_stm32mp23 = "${ROOT_ENCRYPT_KEY}/stm32mp_encryption_key.bin"
ENCRYPT_FSBL_KEY_stm32mp25 = "${ROOT_ENCRYPT_KEY}/stm32mp_encryption_key.bin"
ENCRYPT_FIP_KEY = "${ROOT_ENCRYPT_KEY}/stm32mp_encryption_key_256bits.bin"
ENCRYPT_FIP_KEY_stm32mp21 = "${ROOT_ENCRYPT_KEY}/stm32mp_encryption_key_256bits.bin"
ENCRYPT_FIP_KEY_stm32mp23 = "${ROOT_ENCRYPT_KEY}/stm32mp_encryption_key_256bits.bin"
ENCRYPT_FIP_KEY_stm32mp25 = "${ROOT_ENCRYPT_KEY}/stm32mp_encryption_key_256bits.bin"

Build st-image-weston

Flash Layout

#Opt	Id	Name	Type	IP	Offset	Binary
-	0x01	fsbl-boot	Binary	none	0x0	arm-trusted-firmware/tf-a-stm32mp257f-dk-optee-programmer-usb_Encrypted_Signed.stm32
-	0x02	fip-ddr	FIP	none	0x0	fip/fip-stm32mp257f-dk-ddr-optee-programmer-usb_Encrypted_Signed.bin
-	0x03	fip-boot	FIP	none	0x0	fip/fip-stm32mp257f-dk-optee-programmer-usb_Encrypted_Signed.bin
PED	0x10	emmcboot0	RawImage	mmc1	boot1	none
PED	0x11	emmcboot1	RawImage	mmc1	boot2	none
PED	0x12	emmcall	RawImage	mmc1	0x0	none
PED	0x15	sdcardall	RawImage	mmc0	0x0	none

Program the DEV KIT via USB Using STM32CubeIDE
At first, STM32CubeProgrammer can connect to the DK via USB. After that, The DEV KIT keeps disconnected after loading arm-trusted-firmware and fip. Below is the log from STM32CubeProgramer.

09:26:54 : Start Embedded Flashing service
09:26:54 : Opening and parsing file: tf-a-stm32mp257f-dk-optee-programmer-usb_Encrypted_Signed.stm32
09:26:54 : Memory Programming ...
09:26:54 :   File          : tf-a-stm32mp257f-dk-optee-programmer-usb_Encrypted_Signed.stm32
09:26:54 :   Size          : 191.53 KB 
09:26:54 :   Partition ID  : 0x01 
09:26:54 : Download in Progress:
09:26:55 : File download complete
09:26:55 : Time elapsed during download operation: 00:00:01.515
09:26:55 : RUNNING Program ... 
09:26:55 :   PartID:      :0x01 
09:26:56 : Reconnecting the device ...
09:26:56 : USB speed   : High Speed (480MBit/s)
09:26:56 : Manuf. ID   : STMicroelectronics
09:26:56 : Product ID  : DFU @Device ID /0x505, @Revision ID /0x0011, @Name /STM32MP257FAK Rev.Y,
09:26:56 : SN          : 004600314236501600363847
09:26:56 : DFU protocol: 1.1
09:26:56 : Board       : --
09:26:56 : Device ID   : 0x0505
09:26:56 : Device name : STM32MP257FAK Rev.Y
09:26:56 : Device type : 
09:26:56 : Device CPU  : 
09:26:56 : Start operation done successfully at partition 0x01
09:26:56 : Opening and parsing file: fip-stm32mp257f-dk-ddr-optee-programmer-usb_Encrypted_Signed.bin
09:26:56 : Memory Programming ...
09:26:56 :   File          : fip-stm32mp257f-dk-ddr-optee-programmer-usb_Encrypted_Signed.bin
09:26:56 :   Size          : 34.34 KB 
09:26:56 :   Partition ID  : 0x02 
09:26:56 : Download in Progress:
09:26:56 : File download complete
09:26:56 : Time elapsed during download operation: 00:00:00.070
09:26:56 : RUNNING Program ... 
09:26:56 :   PartID:      :0x02 
09:26:57 : Reconnecting the device ...
09:26:57 : USB speed   : High Speed (480MBit/s)
09:26:57 : Manuf. ID   : STMicroelectronics
09:26:57 : Product ID  : DFU @Device ID /0x505, @Revision ID /0x0011, @Name /STM32MP257FAK Rev.Y,
09:26:57 : SN          : 004600314236501600363847
09:26:57 : DFU protocol: 1.1
09:26:57 : Board       : --
09:26:57 : Device ID   : 0x0505
09:26:57 : Device name : STM32MP257FAK Rev.Y
09:26:57 : Device type : 
09:26:57 : Device CPU  : 
09:26:57 : Start operation done successfully at partition 0x02
09:26:57 : Opening and parsing file: fip-stm32mp257f-dk-optee-programmer-usb_Encrypted_Signed.bin
09:26:57 : Memory Programming ...
09:26:57 :   File          : fip-stm32mp257f-dk-optee-programmer-usb_Encrypted_Signed.bin
09:26:57 :   Size          : 2.99 MB 
09:26:57 :   Partition ID  : 0x03 
09:26:57 : Download in Progress:
09:27:03 : File download complete
09:27:03 : Time elapsed during download operation: 00:00:06.132
09:27:03 : RUNNING Program ... 
09:27:03 :   PartID:      :0x03 
09:27:04 : Reconnecting the device ...
09:27:07 : USB speed   : High Speed (480MBit/s)
09:27:07 : Manuf. ID   : STMicroelectronics
09:27:07 : Product ID  : USB download gadget@Device ID /0x505, @Revision ID /0x0011, @Name /STM32MP257FAK Rev.Y,
09:27:07 : SN          : 004600314236501600363847
09:27:07 : DFU protocol: 1.1
09:27:07 : Board       : --
09:27:07 : Device ID   : 0x0505
09:27:07 : Device name : STM32MP257FAK Rev.Y
09:27:07 : Device type : 
09:27:07 : Device CPU  : 
09:27:07 : Start operation done successfully at partition 0x03
09:27:07 : Flashlayout Programming ...
09:27:07 : Running Flashlayout Partition ...
09:27:08 : Reconnecting the device ...
09:27:38 : Error: Unable to reconnect the target device: time out expired
09:27:38 : Error: Start Operation failed at Flashlayout partition
09:27:38 : Error: TSV flashing service failed
09:27:38 : Disconnected from device.

From the log, I found that the arm-trusted-firmware and fip are downloaded. Afterthat, The board die. I am sure that my OTP and device closing are correct because the board can boot from SD card with Signed and Encryted boot loader. Please help with this issue.

[ThinhNguyen · Accepted solution]

I seems the process is done successfully. It may not delete all eMMC, just nesesary sectors.

09:27:07 : Start operation done successfully at partition 0x03
09:27:07 : Flashlayout Programming ...
09:27:07 : Running Flashlayout Partition ...