How to remove the securrity state after executing mass_erase process.

[PeterTsai]

I use bdm interface with DIY to mass_erase a SH8 mcu. But its content all become 0xff. include the NVOPT location of flash. So the mcu into secure state. Then I can not hold on to program or burst code into it. I have attempted to reset or write 0x7e to NVOPT(0xffbf) after executing mass_erase process. But I found it out that the erase, program and burst process are all failure at the moment.How to unlock the secure state when executed mass_erase process. Please someone could give me any opinion. ps. But it can mass_erase and program code if use the ERASE_MODULE command of hivave.exe to erase the mcu.

[kef · Accepted solution]

Peter,

I wonder what is DIY, do it yourself? Not sure 100% about S08, but to unsecure S12 over BDM you first mass erase, then simply reset and reenter BDM mode. On entry to active BDM mode, BDM firmware performs blank check of EEPROM and FLASH, and if both are erased, then you get read/write access to everything until next reset. Read/write access to mass erased part is granted, though security bits are both set and part should be secured. Since read/write accesses over BDM are granted, there's no problem to reflash whole part or just security bits

I don't see in SH8 RM how to unsecure it over BDM, I would try resetting and reentering active BDM mode, then flashing new firmware or just NVOPT.

[PeterTsai]

Hi kef,

1. yes, I need to bulit a stand-alone programmer for our company.

2. I ignore the blank_check action after mass_erase command. So that the NVOPT can not be updated secure state. Now my pcb can work normally. Thanks a lot.

3. Another problem is how to reserve the content of feq. trim value if want to reprogram a old mcu with secure state?only re-trim?

[kef]

2. You don't have to do blank check after masserase. I meant each chip (at least it is so on S12, and I guess on S08 too), has small BDM firmware, which is not accessible from user code, normally not mapped into CPU address space. When BDM and BDM firmware gets activated, CPU executes code from this hidden BDM firmware; BDM firmware blankchecks flash and EEPROM and decides to allow or to inhibit accesses to secure memories.

3. BDM accesses to trim values in flash are not possible when secured. Yes, retrimming is required.

[peg]

Hello,

At the raw, chip and BDM command level (ignoring what programming software may do automagically) this is what you need to do. (for S08)

Mass erase the device (cmd 41)

Blank check the device (cmd 05)

whenever a blank check is successful this sets the bits in FOPT to 1:0.

Now you have full access until you reset.

If you want full access to continue after a reset programme NVOPT to 1:0.

The only other possibility is backdoor access if that had previously been setup.

[PeterTsai]

Hi kef,peg, 

 I think the blank_check command could be omitted previously. I recover a blank_check command after mass_erase command today. The security is disengaged and my master pcb can work unexpectedly.

Now I can mass_erase target mcu. But I am also lost the trim vaule of the factory. If the target mcu has set secure mode. I want to re-program it. At first, I must mass_erase it. So I should how to re-trim over BDM.

regards,

Peter

[peg]

Hello Peter,

The only way to retain the factory trim value is to read it before you erase and then programme it back.

However it is best to determine the exact value required under YOUR operating conditions. The value varies quite a bit with voltage and temperature and so you are best to determine this "in circuit".

If using the P&E BDM it has the facility to measure the actual operating frequency and then recommend a value to correct any error. There are also many AN's with various methods of doing this.

e.g. AN2312, AN2496 & AN2498

[PeterTsai]

Hi peg,

these AN's document all need to use external pulse generator. I am curious about the P&E BDM how to measeur the actual frequency without any additional equipment.

I have attempted to due to SYNC command to count the singal of the 128 clock of slave. But the result seems inaccurate.

What is your opinion about re-trim frequency without anything?

Regards,

Peter

[peg]

Hello Peter,

I don't know exactly but presume that they are using the speed/power of the UF MCU to accurately measure the sync pulse length.

I know that OSBDM developers have commented that they were unable to do this with sufficient accuracy although that was before they moved on to the faster MCU's that they are using currently.

Even the P&E's ability to do this seems to be only just sufficient. On devices without a fine trim bit it generally gives a value that is always the same (sometimes + or - 1) and varies by one from cold to run temp. However on devices with a fine trim this value is different almost every time you check it.