LPC Microcontrollers中的主题 Re: LPC5460x ECRP Lockout

LPC5460x ECRP Lockout

corytodd — Wed, 06 Oct 2021 20:31:26 GMT

We are using an LPC5460x part with ECRP and a legacy boot image. We are finding that some of our parts, after setting the ECRP bits for release, can no longer be unlocked or mass erased. The parts are stuck with whatever firmware they had loaded on them and we can never update them. One or two parts are completely disabled, most like due to the section 2 of chapter 3.3.1 of the UM10912 manual.

What we don't understand is that most of the time things work just fine, we can flash a release image over a debug image, then revert to a debug image as needed.

The ECRP we are using:

bits set (0x00015800)
11 - IAP Sector Erase/Write protection is disabled.
12 - Do not allow ISP entry via pins
14 - Do not allow ISP entry via IAP call
16 - Disable external access to chip

No OTP registers are written by our code. Any suggestions on what we could be doing wrong here?

Re: LPC5460x ECRP Lockout

Alice_Yang — Fri, 08 Oct 2021 09:18:44 GMT

Hello corytodd,

So how do you want to update your firmware after your ECRP configuration?

Alice

Re: LPC5460x ECRP Lockout

corytodd — Mon, 11 Oct 2021 15:24:12 GMT

edit: posted as reply below

Re: LPC5460x ECRP Lockout

corytodd — Mon, 11 Oct 2021 15:23:53 GMT

Hello Alice,

We would like to be able to mass erase and reprogram via SWD but prevent others from reading out the contents of ROM.

Re: LPC5460x ECRP Lockout

Alice_Yang — Tue, 12 Oct 2021 02:31:49 GMT

While you have disable SWD

16 - Disable external access to chip

Re: LPC5460x ECRP Lockout

corytodd — Tue, 12 Oct 2021 13:50:26 GMT

Hi Alice,

Yes, I realize that sounds silly. However, that's the only way we found to prevent reading out the ROM contents per table 1022.ECRP of UM10912 regarding SWD ENABLE.

"Internal memory contents can be read or compared."

Also, SEGGER's JCommand can unlock the part with SWD access "disabled" so there is more to the ECRP than we are understanding. Can you suggest an alternative?

We want to disallow SWD from reading ROM/RAM but allow mass erase. This has been simple on every other part we use but this LPC part does not seem to offer such an option that we can find. More problematically, the behavior is inconsistent.

Re: LPC5460x ECRP Lockout

Alice_Yang — Wed, 13 Oct 2021 02:48:38 GMT

Hello corytodd,

OK, I know your meaning.

How about mass erase command?

And pay attention, the OTP MASS ERASE need enabled.

https://community.nxp.com/t5/LPC-Microcontrollers/Flash-Programming-access-block-in-LPC54608J512BD208/m-p/1305119

Alice

Re: LPC5460x ECRP Lockout

corytodd — Wed, 13 Oct 2021 14:25:36 GMT

Hi Alice,

It sounds like you're saying it is impossible for us to make the ECRP meet our requirements. We aren't using the ISP module so that post doesn't quite pertain to us but I appreciate the information. We do have the CRP MASS ERASE DISABLE OTP bit clear which is the default state.

Are there any other solutions for this besides ISP?

Re: LPC5460x ECRP Lockout

BrunoSenzio — Wed, 13 Oct 2021 15:12:00 GMT

Hello,

I am not sure if I am on the same channel here, but, does the idea of a boot loader sound weird?

I was just going through this one but seems its for the LPC1100 and LPC1300 only...

https://www.nxp.com/docs/en/application-note/AN10968.pdf

Cheers

Re: LPC5460x ECRP Lockout

corytodd — Wed, 13 Oct 2021 15:12:07 GMT

Hi Bruno,

Not weird at all! We are using a bootloader, we just need a way to be able to update the bootloader once the chip is secured.

Re: LPC5460x ECRP Lockout

BrunoSenzio — Wed, 13 Oct 2021 15:25:25 GMT

Hi corytodd,

If such is the case, the only idea that came into my mind is encryption...

https://www.nxp.com/docs/en/application-note/AN4605.pdf

https://www.nxp.com/docs/en/nxp/application-notes/AN12352.pdf

The idea would be that the bootloader relies on private key cryptography wherein the key is stored in the bootloader and is known only in the development environment and the MCU. The aim is to keep the encryption key secret from all third parties to protect the firmware.

I am not sure for the LPC5460x though...

Would this help?

Thanks and regards,

Re: LPC5460x ECRP Lockout

corytodd — Wed, 13 Oct 2021 15:56:31 GMT

Hi Bruno,

Thanks for the input but we do have the encryption portion of our bootloader working as intended. Our question is about ECRP and how to get around SWD prohibition.

Re: LPC5460x ECRP Lockout

BrunoSenzio — Wed, 13 Oct 2021 16:57:41 GMT

Hi Cory,

Seems then that IAP might end up being the alternative here. The use of the "unlocker firmware" with encryption would be a great idea as mentioned.

Once again, thank you for your time and attention.

Best Regards,

Re: LPC5460x ECRP Lockout

guitardenver — Wed, 13 Oct 2021 23:23:00 GMT

The issue is not updating the firmware. The issue is that SWD access is being completely disabled and stuck disabled when it should not be.
But only on SOME units. The same firmware image was loaded on about 40 different MCUs and only about 8 were NOT recoverable.

Using the SEGGER JLink and their tools we can unlock and recover SWD access just fine. We confirmed the flash contents were secure because you could not read the contents out. But on a few units, recovery was not possible. We tried via JLINK and P&E debugger hardware.

So this means, the ECRP bits we set, is not completely disabling SWD to a point it can't be recovered/mass erased via SWD because all units would be unrecoverable.

Is there some other way for recovery? Any idea why some units are acting differently? Note that non of our code is writing any OTP bits.

We tried using the IAP command EraseSector to do a "Mass Erase" as describe below:

But this did not recover SWD access either. Which means our bootloader is now erased and the MCU is completely bricked.

Re: LPC5460x ECRP Lockout

BrunoSenzio — Wed, 13 Oct 2021 23:39:08 GMT

Hello,

My two cents on this one is to implement some sort of "secure code retriever firmware" to perform secure handshake and allow to retrieve the code besides the options that have already been implemented.

Does that sound like a crazy idea?

Thanks and regards,

Re: LPC5460x ECRP Lockout

guitardenver — Thu, 14 Oct 2021 00:16:04 GMT

Bruno, we are not trying to recover the code inside the MCU. We are trying to recover SWD access. SWD is the thing that is disabled.

Re: LPC5460x ECRP Lockout

Alice_Yang — Thu, 14 Oct 2021 03:32:38 GMT

Hello corytodd,

No, I mean it possible. while sorry I haven't test on my side. There is customer successful unlock it.

Using J-link, "unlock LPC5460x" command to unlock it.

You can have a look at this thread:

https://community.nxp.com/t5/LPC-Microcontrollers/LPC546xx-MASS-ERASE-ulink2/m-p/1048588

Alice

Re: LPC5460x ECRP Lockout

corytodd — Thu, 14 Oct 2021 13:57:57 GMT

Hi Alice,

Yes, that's the method we use and it works about 80% of the time. That leaves us with 20% that we cannot unlock meaning the SWD appears to be permanently disabled.

Since some of these units have out bootloader on them we're able to load new application code. As a test we wrote a firmware that erases the ECRP vector to see if that would unlock the chip. Doing so does not restore SWD access. Additionally, we wrote a test firmware to issue a mass erase command which succeeded in wiping all the code but did not restore SWD access.

Re: LPC5460x ECRP Lockout

BrunoSenzio — Thu, 14 Oct 2021 14:08:30 GMT

Hi Cory,

In that same sense, if there is a problem on bringing the SWD access with all the other methods, what I was thinking is not to disable it at all but only provide access for SWD either by firmware with some sort of secure handshake or to put some condition by hardware not to enable SWD unless it is met. Would this be an option?

Regards,

Re: LPC5460x ECRP Lockout

BrunoSenzio — Tue, 16 Nov 2021 14:18:26 GMT

Hello guitardenver and Cory,

I am not sure if this has been resolved so far. If this has not been solved, could it be possible to ask you with the following?

1. Replace a bad(locked) part with a good (working part) board (a board that has already gone through the SWD disable, then chip erase, and reprogram)

2. Could you check the lot dates of these parts? (just to see if this could be part of the issue)

3. What Field Analysis ruled have you followed so far? Would be important to continue following a couple more until the root cause is found?

Thank you for your time in advance.

Best Regards,

Bruno