KEA FTMRH_FSEC[SEC]

[sam_lgu]

Hi， everyone!  I want to limits access to flash resources by sec bits(SEC = 00). however, the swd debug can still work. could anyone tell me why. thanks!

[sam_lgu]

it worked, thank u! 

[diego_charles]

Hi @sam_lgu 

I hope you are doing well!

Could you help me to confirm the following ?: 

1 Are you trying to write the to Flash security byte of the Flash Configuration Field  (generally located in the startup files ) from your image itself? Or are you trying to implement another method?

2. Even after a power on reset, the security setting (SEC = 00) is  not  set , right?

3.Additionally, could you let me know your IDE and KEA MCU part number?

Regarding your question , probably, the Flash config field is not being written as we may expect . As we know  from the KEA reference manuals , the  FTMRH_FSEC[SEC] is loaded  with  the Security byte of the Flash config field during reset sequence. So,   if the Flash config field does not have the our security settings , the FTMRH_FSEC[SEC] will not , either.

diego_charles_0-1629386915117.png

diego_charles_1-1629386942779.png

Following that idea, my  suggestion is that you could try to dump the flash memory contents to  check the values of the Flash config field. So we can can have more data , to determine if that is part of the problem , or the problem.

All the best

Diego.

[sam_lgu]

Hi, @diego_charles ! Thanks for ur reply!

My IDE is cw11.0, and mcu is KEA128.

It is true that the content of SEC is not being written as expected by checking flash memory. It is always 10b, which is unsecure.

The code which set SEC bits is generated by Processor Expert. SEC bits is written as 00b by code.

Here is code  by Processor Expert.

/* Flash configuration field constants */
#define CPU_FLASH_CONFIG_FIELD \
/* NV_BACKKEY0: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY1: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY2: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY3: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY4: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY5: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY6: KEY=0xFF */ \
0xFFU, \
/* NV_BACKKEY7: KEY=0xFF */ \
0xFFU, \
/* Reserved */ \
0xFFU, \
/* Reserved */ \
0xFFU, \
/* Reserved */ \
0xFFU, \
/* Reserved */ \
0xFFU, \
/* Reserved */ \
0xFFU, \
/* NV_FPROT: FPOPEN=1,??=1,FPHDIS=1,FPHS=0,FPLDIS=1,FPLS=0 */ \
0xE4U, \
/* NV_FSEC: KEYEN=3,??=1,??=1,??=1,??=1,SEC=0 */ \
0xFCU, \
/* NV_FOPT: ??=1,??=1,??=1,??=1,??=1,??=1,??=1,??=1 */ \
0xFFU

__attribute__ ((section (".cfmconfig"))) const uint8_t _cfm[0x10] = {CPU_FLASH_CONFIG_FIELD};

However, the content of _cfm[14] is not 0xFC, it is 0xFE!

[diego_charles · Accepted solution]

Hi @sam_lgu 

Thank you for your reply! 

I suspect that the IDE or the Debug tools  are not letting you  update the FSEC with your security settings.

I  tried on my side and ran in the same problem , I was not able to update FSEC  .  I  used :   the  KE04Z ;  the MCUXpresso IDE ,  my and  LPC-Link 2 with Segger J-Link firmware. 

It was a bit tricky but I managed to update the FSEC as I wanted, see my procedure below.

1 I set the FSEC to 11 (secure mode ) at the Flash config structure , in the MCUXpresso this structure it is located in the startup file . 

diego_charles_0-1630529091506.png

2  After , that I generated an hex file   to verify if the IDE was generating  my image with my desired FSEC setting of 0b11. I used Hexedit to validate that I was generating my settings. 

diego_charles_11-1630530779069.png

(The flash security bite containing  the FSEC is located at the 0x40C)

3 Then,  I programed the application , and using the debugger I checked the value of  FSEC ;  I wanted it to be 0b11 but it was 0b10 (the default mode with no security ) The same problem  you experimented.

diego_charles_1-1630529416058.png

4. Then I changed the MCU in the J-Link  debug configuration to the allow security version.

diego_charles_4-1630529587784.png

5. I recompiled the project and debugged one more time. I was able to see that the FSEC now changed to my desired value of 0b11.

diego_charles_6-1630530543215.png

That is  why  I say that the debugger may not letting you to update the FSEC,  also verify if Code warrior is generating the image with the FSEC.  Then check the configurations  of your probe firmware. 

Note :  I checked the FSEC during a debug session after programming  the MCU with J-Link , but I do not recommend doing that, the best is to read the value of FSEC using code and then display it using a serial terminal , for example.

Let me know your results, or if you have complications.

Diego