Kinetis MicrocontrollersのトピックRe: KEA FTMRH_FSEC[SEC]

KEA FTMRH_FSEC[SEC]

sam_lgu — Wed, 18 Aug 2021 12:03:49 GMT

Hi， everyone! I want to limits access to flash resources by sec bits(SEC = 00). however, the swd debug can still work. could anyone tell me why. thanks!

Re: KEA FTMRH_FSEC[SEC]

diego_charles — Thu, 19 Aug 2021 15:39:14 GMT

Hi @sam_lgu

I hope you are doing well!

Could you help me to confirm the following ?:

1 Are you trying to write the to Flash security byte of the Flash Configuration Field (generally located in the startup files ) from your image itself? Or are you trying to implement another method?

2. Even after a power on reset, the security setting (SEC = 00) is not set , right?

3.Additionally, could you let me know your IDE and KEA MCU part number?

Regarding your question , probably, the Flash config field is not being written as we may expect . As we know from the KEA reference manuals , the FTMRH_FSEC[SEC] is loaded with the Security byte of the Flash config field during reset sequence. So, if the Flash config field does not have the our security settings , the FTMRH_FSEC[SEC] will not , either.

Following that idea, my suggestion is that you could try to dump the flash memory contents to check the values of the Flash config field. So we can can have more data , to determine if that is part of the problem , or the problem.

All the best

Diego.

Re: KEA FTMRH_FSEC[SEC]

sam_lgu — Mon, 23 Aug 2021 00:35:57 GMT

Hi, @diego_charles ! Thanks for ur reply!

My IDE is cw11.0, and mcu is KEA128.

It is true that the content of SEC is not being written as expected by checking flash memory. It is always 10b, which is unsecure.

The code which set SEC bits is generated by Processor Expert. SEC bits is written as 00b by code.

Here is code by Processor Expert.

/* Flash configuration field constants */
#define CPU_FLASH_CONFIG_FIELD \
/* NV_BACKKEY0: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY1: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY2: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY3: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY4: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY5: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY6: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY7: KEY=0xFF */ \
0xFFU, \
/* Reserved */ \
0xFFU, \
/* Reserved */ \
0xFFU, \
/* Reserved */ \
0xFFU, \
/* Reserved */ \
0xFFU, \
/* Reserved */ \
0xFFU, \
/* NV_FPROT: FPOPEN=1,??=1,FPHDIS=1,FPHS=0,FPLDIS=1,FPLS=0 */ \
0xE4U, \
/* NV_FSEC: KEYEN=3,??=1,??=1,??=1,??=1,SEC=0 */ \
0xFCU, \
/* NV_FOPT: ??=1,??=1,??=1,??=1,??=1,??=1,??=1,??=1 */ \
0xFFU

__attribute__ ((section (".cfmconfig"))) const uint8_t _cfm[0x10] = {CPU_FLASH_CONFIG_FIELD};

However, the content of _cfm[14] is not 0xFC, it is 0xFE!

Re: KEA FTMRH_FSEC[SEC]

diego_charles — Wed, 01 Sep 2021 21:34:58 GMT

Hi @sam_lgu

Thank you for your reply!

I suspect that the IDE or the Debug tools are not letting you update the FSEC with your security settings.

I tried on my side and ran in the same problem , I was not able to update FSEC . I used : the KE04Z ; the MCUXpresso IDE , my and LPC-Link 2 with Segger J-Link firmware.

It was a bit tricky but I managed to update the FSEC as I wanted, see my procedure below.

1 I set the FSEC to 11 (secure mode ) at the Flash config structure , in the MCUXpresso this structure it is located in the startup file .

2 After , that I generated an hex file to verify if the IDE was generating my image with my desired FSEC setting of 0b11. I used Hexedit to validate that I was generating my settings.

(The flash security bite containing the FSEC is located at the 0x40C)

3 Then, I programed the application , and using the debugger I checked the value of FSEC ; I wanted it to be 0b11 but it was 0b10 (the default mode with no security ) The same problem you experimented.

4. Then I changed the MCU in the J-Link debug configuration to the allow security version.

5. I recompiled the project and debugged one more time. I was able to see that the FSEC now changed to my desired value of 0b11.

That is why I say that the debugger may not letting you to update the FSEC, also verify if Code warrior is generating the image with the FSEC. Then check the configurations of your probe firmware.

Note : I checked the FSEC during a debug session after programming the MCU with J-Link , but I do not recommend doing that, the best is to read the value of FSEC using code and then display it using a serial terminal , for example.

Let me know your results, or if you have complications.

Diego

Re: KEA FTMRH_FSEC[SEC]

sam_lgu — Thu, 02 Sep 2021 01:52:21 GMT

it worked, thank u!