Viability of using ROM Bootloader as part of user firmware updates

[chrismc]

We've been looking at the possibility of user the Kinetis ROM bootloader (on MKL27Z4) as part of the user (post-shipping) firmware update process via USB, however from what we can tell it doesn't seem it would be a viable option for us if we're interested in securing the flash.

The main issue we would hit is that once flash has been configured as secure, it seems that to make any update via the  ROM bootloader it would require a full erase (of absolutely all flash). This would mean that any 'factory' data stored in flash would be lost (the PC side updater app could potentially request and cache that data before switching the target to ROM bootloader mode, but the process could be interrupted and the data lost).

Is that understanding correct? If so, it would seem to mean that the ROM bootloader fundamentally can't be part of a secure firmware update process (where no other secure data storage is available).

[cutworth]

Hi Chris,

Please note the flash security feature apply only to external access from debug. CPU access to flash is not affected by flash security status.

Also Kinetis ROM bootloader has a command called FlashSecurityDisable which can be used for disabling flash security by comparing 8-byte backdoor key during flash firmware update. And you can enable flash security again as long as your updated firmware has 0x40C(flash configuration byte) configured as flash secured.

Hao

[chrismc]

Hi Hao

Thanks for the reply.

Regarding the CPU still having flash access... doesn't the ROM bootloader also respect the flash security status and not allow access through itself (even though it's running on the CPU)? Related to that, I have wondered if the bootloader's 'write-memory' and 'execute' command would mean that it would be relatively simple to bypass that.

On the backdoor key, we had previously discounted that as an option due to the need of transferring it unencrypted over USB, but we've reevaluated that and it does look like we can use that in a useful way.

Cheers, Chris

[cutworth]

Hi Chris,

Yes, you are correct.

For write memory command with the ROM bootloader, if you need to write flash area, then you need to first unsecure flash. See following note from RM.

First, any flash sector written to must have been previously erased with a FlashEraseAll, FlashEraseRegion, or FlashEraseAllUnsecure command.

But for execute command, there is no relationship with flash security, you can still execute code in flash under secure state. Secure mode just prevents external access to flash content.

Hao

[chrismc]

So if the bootloader allows you to upload and execute any code to be run on the CPU (which can then access the Flash and make its content available no matter what the security setting is), then it's possible to work around the security features right?