version 1.0.9, hacker Solo v2 stays in bootloader mode

[aaribaud]

Hello,

I have tried building a firmware for the hacker Solo v2, following the instructions in https://solo2.dev/.
What I did :

• install rust/cargo then cargo install mboot (got version 0.3) and cargo install solo2 (0.1.1)
• clone the present solo2 repo
• Run virtualenv -p 3 venv ; . venv/bin/activate
• Change value of BOARD variable in runners/lpc55/Makefile from lpcxpresso55 to solo2
• Run make build-dev
• Ensure the hacker key is in bootloader mode (lsusb indicates 1209:b000 Generic USB COMPOSITE DEVICE)
• run mboot --target 0x1209:0xb000 erase --mass
• run mboot --target 0x1209:0xb000 write runners/lpc55/app.bin

Everything runs fine, no error message, but the key does not boot past the bootloader mode.

The only difference with https://solo2.dev/ commands is that the cargo objcopy mentions a different bin file name (firmware.bin rather than app.bin but apart from that the command is the same (and if I run the "firmware.bin" command in running lpc55 I end up with a firmware.bin file identical to the app.bin file).

What am I doing wrong here?

[gcochard]

I've run into the same issue and I believe you need to disable the secure boot via the pfr configuration: https://hackmd.io/@solokeys/solo2-getting-started#Disabling-Secure-Boot

I also have not been able to resurrect my key even with solo2 update, which I expected to write a bootable image.

[gcochard]

I got this working with quite a bit of tinkering:

the lpc55-host binary has a bug as of commit 4a30bef that causes the pfr, configure, and write-flash subcommands to fail. Specifically, src/bootloader/protocol.rs#295 needs the assertion inverted. It should be assert!(packet.has_data); instead of assert!(!packet.has_data);.

In addition to this, the yaml formatted pfr data is not a valid input to the configure command, and the yaml parser chokes on seemingly valid input as well. I had to change the format of the file to toml, change the factory dict to factory-settings, then also change the factory-settings.customer-data from a string to a hex byte array.

Here's a relevant excerpt of my toml file:

[factory-settings]
usb-id = { vid = 4617, pid = 45056 }
rot-fingerprint = "a4xxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxx76"
customer-data = [
0x53, 0x6f, 0x6c, 0x6f, 0x20, 0x32, 0x20, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x20,
...
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
]
[factory-settings.boot-configuration]
speed = "48MHz"
mode = "Usb"
[factory-settings.secure-boot-configuration]
secure-boot-enabled = false
dice-computation-disabled = true

Once I ran lpc55 -vvv configure factory-settings pfr-settings-no-secure-boot.toml I was then able to write an unsigned firmware image successfully.

Another tweak I had to make was to modify runners/lpc55/Cargo.toml to add admin-app, fido-authenticator, ndef-app, and oauth-authenticator into the develop features, so I would get a fully-featured dev build.

Finally, I had to remove enough epoxy on my key to get to the R pad of the LED which is connected to the ISP pin on the MCU. I shorted this to ground while plugging in the key to force it to start up in bootloader mode.

[gcochard]

One more point I forgot to make: I couldn’t output the pfr in toml format from the lpc55 utility, it throws an error when trying to deserialize in that format (and only that format has issues). Toml and yaml are the only two formats that the configure subcommand recognizes, hence the need to convert yaml to toml.

[willrnch]

Thanks for the details @gcochard, it was really helpful!

I also had to tweak the lpc55 binary by setting assert!(packet.has_data); in src/bootloader/protocol.rs#L326 and src/bootloader/protocol.rs#L290. Then I was able to use lpc55 pfr. To flash the firmware, I had to use mboot as lpc55 kept crashing.

Now I have two keys flashed in dev mode but I can boot them in bootloader mode. The LED and the button seem completely disabled. I tried to scrape off the epoxy to get access to the ISP but the LED is so small it really seems impossible.

It is really unfortunate that the hacker edition can not physically be booted in bootloader mode like the V1. It is essentially completely useless if you do not have an overpriced debug probe or the NXP LPC55 dev kit. That entirely kills the purpose of the hacker edition from my point of view.

I tried the compile a firmware without the develop feature to have a custom firmware with the LED and button enabled. Apparently, it completely bricked the key.

I guess the only viable option for me now is to get a NXP LPC55 dev kit. Does anyone know if they offer the same NFC capacity or do I need to get some kind of extension board for it?