topic Re: Urgent help - CRP on LPC4357 in LPC Microcontrollers

Urgent help - CRP on LPC4357

lpcware — Wed, 15 Jun 2016 19:05:02 GMT

Content originally posted in LPCWare by DT1 on Mon Mar 16 08:43:55 MST 2015
Hi,

I'm currently having a problem making the CRP work and I'm production...
I though it was working correctly, but it seems not.

I'm not sure how I must activate CRP. I'm using :

- IAR
- J-Link
- LPC4357 Flash Bank A : Secondary bootloader + User application
- LPC4357 Flash Bank B : Utility User application

What I tried so far :
- Generate my bootloader.bin that will be written at address 0x1A000000. After generation, using JFlash, I manually modify address 0x1A0002FC to enable CRP1 (0x12345678)
- Power cycle
- Try to read back the chip memory using JFlash : working (and should not)

What am I doing wrong ? What's the best way to enable CRP using my setup ?
Thanks !!!

Re: Urgent help - CRP on LPC4357

lpcware — Wed, 15 Jun 2016 19:05:03 GMT

Content originally posted in LPCWare by riccardoventrella on Mon Mar 16 09:17:11 MST 2015
This is a very interesting question, which could help me as well.
I'd like to use CRP on a almost new 43S37 MCU.

Where did you find information on how to set CRP on 4357? I mean: is to set a secondary boot loader the only
way to enable CRP?

I know 43S37 has some useful AES features for boot crypting. I wonder is anyone is able to tell me where informations
to properly set use it on a 43S37 MCU.

Thanks

Re: Urgent help - CRP on LPC4357

lpcware — Wed, 15 Jun 2016 19:05:04 GMT

Content originally posted in LPCWare by TheFallGuy on Mon Mar 16 11:09:38 MST 2015

Quote:
- Generate my bootloader.bin that will be written at address 0x1A000000. After generation, using JFlash, I manually modify address 0x1A0002FC to enable CRP1 (0x12345678)
- Power cycle
- Try to read back the chip memory using JFlash : working (and should not)

What am I doing wrong ? What's the best way to enable CRP using my setup ?

What does 0x1a0002fc read as?
Are you sure you are booting from that Flash?

Re: Urgent help - CRP on LPC4357

lpcware — Wed, 15 Jun 2016 19:05:04 GMT

Content originally posted in LPCWare by TheFallGuy on Mon Mar 16 11:12:38 MST 2015

Quote:
is to set a secondary boot loader the onlyway to enable CRP?

No. See 6.6 of the LPC43xx User Manual (UM10503.pdf)

Quote:

I know 43S37 has some useful AES features for boot crypting. I wonder is anyone is able to tell me where informations
to properly set use it on a 43S37 MCU.

This is described in Chapter 7: LPC43xx Boot ROM for secure parts of UM10503.pdf

Re: Urgent help - CRP on LPC4357

lpcware — Wed, 15 Jun 2016 19:05:05 GMT

Content originally posted in LPCWare by DT1 on Mon Mar 16 12:17:46 MST 2015
When I read back using JFlash, I can see that I have 0x12345678 at 0x1A0002FC

Your second question is interesting... I've always had in mind that I was booting my M4 first, but now I'm wondering. The thing is that if I only program my secondary bootloader (which is located on the M4, 0x1A000000), I can see my LED blink on my board, meaning that it's running.

Could the M0 be the one starting ?
If the M0 is starting, then starts the M4 and then goes to reset, must I have 0x1B0002FC at 0x12345678 AND 0x1A0002FC to be secure ?

Re: Urgent help - CRP on LPC4357

lpcware — Wed, 15 Jun 2016 19:05:05 GMT

Content originally posted in LPCWare by starblue on Mon Mar 16 14:23:22 MST 2015
No, the M0 will be kept in reset until the M4 releases it.
But maybe the M4 ist starting from the other memory bank, for whatever reason.

Re: Urgent help - CRP on LPC4357

lpcware — Wed, 15 Jun 2016 19:05:06 GMT

Content originally posted in LPCWare by DT1 on Mon Mar 16 15:18:42 MST 2015
ok, I found what my problem was. Somewhere in the code, I found a "no_init" call to the CRP memory region, so that's why I wasn't able to correctly generate my .bin. After commenting this, my generated .bin contained the correct values (different endianess ??) :

Value forced : 0x12345678
Value in JFlash when opening the .bin : 0x78 56 34 12

After programming my .bin, I lost access to the board via JTAG. And I was able to flash my applications using the bootloader, which is what I need. I'm now at the point to test with Flash Magic if it's locked correctly.

Re: Urgent help - CRP on LPC4357

lpcware — Wed, 15 Jun 2016 19:05:06 GMT

Content originally posted in LPCWare by riccardoventrella on Tue Mar 17 08:37:10 MST 2015

Thanks for the pdf,
I finally found it before your answer, nevertheless you answer was really helpful in addressing me
to the proper chapters.
Since I've found so many CRP experts thank to this post, I'd like to post you some related question, if possible.

1) my aim is to avoid other people cloning flash code. As far as I can have understood, to achieve this it should
     be enough to use CRP, i.e. using "simply" 4337 instead of 43S37.
     Since I don't need to use AES, I think CRP should by far enough, isn't it?

2) reading from page 68 of the UM10503.pdf, I had some problem in understanding fully the CRP3 level description:

     "This mode effectively disables ISP override using the P2_7 pin. It is up to the user’s
      application to provide for flash updates by using IAP calls or by invoking ISP. Caution:
      If CRP3 is selected, no future fact ory testing can be performed on the device"

    So, does this mean the flash is no more readable at all, neither the JTAG would be, but we can STILL
    flash firmware updates through ISP or IAP?

Thanks

Re: Urgent help - CRP on LPC4357

lpcware — Wed, 15 Jun 2016 19:05:07 GMT

Content originally posted in LPCWare by DT1 on Tue Mar 17 11:06:30 MST 2015
Ok, so I managed to take control via Flash Magic. After some testing, I found out a flaw (I think)...

My boot flash is Bank A. So I put 0x12345678 (CRP1) at 0x1A0002FC. All is fine, I can't read back Bank A and Bank B from Flash Magic or JTAG. In Flash Magic, I erase Bank A and power cycle.

I can now read Bank B from JTAG and Flash Magic.

I tried to put CRP1 at 0x1B0002FC also, no change. So it is possible to steal code from the other Flash Bank... Or I'm missing something ?

Re: Urgent help - CRP on LPC4357

lpcware — Wed, 15 Jun 2016 19:05:08 GMT

Content originally posted in LPCWare by riccardoventrella on Tue Mar 17 13:27:24 MST 2015

Hi DT1,
your problem addresses as well another doubt of mine.
Let's take to have 2 banks of 512Kb each, like happening on the 4337 MCU I'd like to use.
It seems to what I've read, it would be possible to hide only one flash bank each time, from
what you are reporting.
But, if my code is lasting, for instance, 700Kb or so, encompassing in 2 banks as whole, how
I could hide the 2 banks altogether?

Is the point you are addressing as well?

Thanks