LPC55S69:Write CMPA bricks the chip

[Halry]

I wrote some codes to try to read back CMPA, then change its bootcfg, then write it back. However, it bricks chip. Now chip does not responds to DAP and USB ISP is not working.

Program codes:

#include "flash.h"

#include "fsl_iap.h"
#include "fsl_iap_ffr.h"

#define FLASH_BL3_START_ADDR 0x10008000
#define FLASH_BL3_SIZE 0x18000

static flash_config_t flashInstance;
static flash_config_t ffr_instance;
static cfpa_cfg_info_t cfpa_data;
static cmpa_cfg_info_t cmpa_data;

void flash_init(void)
{
	status_t status;
	if ((status=FLASH_Init(&flashInstance) )!= kStatus_Success)
	{
		printf("Flash init failed,Error Code:%lu\r\n", status);
	}
	if ((status=FFR_Init(&ffr_instance)) != kStatus_Success)
	{
		printf("FFR init failed,Error Code:%lu\r\n",status);
	}
	//read cfpa to sram
	if ((status=flash_read_cfpa()) != kStatus_Success)
	{
		printf("CFPA cannot read,Error Code:%lu\r\n", status);
	}
	if ((status=flash_read_cmpa()) != kStatus_Success)
	{
		printf("CMPA cannot read,Error Code:%lu\r\n", status);
	}
	if (cmpa_data.bootCfg != 0x88000300)
	{
		printf("CMPA Bootcfg not match,program it\r\n");
		cmpa_data.bootCfg = 0x88000300;
		if ((status = flash_program_CMPA()) != kStatus_Success)
		{
			printf("CMPA cannot write,Error Code:%lu\r\n", status);
		}
	}
	printf("Secure FW Min Version:%lu, Non-Secure FW Min Version:%lu\r\n",
		cfpa_data.secureFwVersion, 
		cfpa_data.nsFwVersion);
	
}

status_t flash_erase_BL3(void)
{
	return FLASH_Erase(&flashInstance, FLASH_BL3_START_ADDR, FLASH_BL3_SIZE, kFLASH_ApiEraseKey);
}

status_t flash_verify_erase(void)
{
	return FLASH_VerifyErase(&flashInstance, FLASH_BL3_START_ADDR, FLASH_BL3_SIZE);
}

status_t flash_program(uint32_t flash_addr, void *pData, uint32_t len)
{
	return FLASH_Program(&flashInstance, flash_addr, pData, len);
}

status_t flash_read_cfpa(void)
{
	return FFR_GetCustomerInfieldData(&ffr_instance, (uint8_t*)&cfpa_data, 0, sizeof(cfpa_data));
}
status_t flash_read_cmpa(void)
{
	return FFR_GetCustomerData(&ffr_instance, (uint8_t*)&cmpa_data, 0, sizeof(cmpa_data));
}
status_t flash_program_CMPA(void)
{
	return FFR_CustFactoryPageWrite(&ffr_instance, (uint8_t *)&cmpa_data, false);
}

 I could read back both CMPA and CFPA, all zeros inside these structures, then I added codes to program CMPA, the chip bricks. I want the chip be able to boot to ISP with USBFS.

I checked the settings with MCUXpresso secure provisioning, I don't think I setup the wrong boot cfg

[Halry]

Hello, is there any result that i can get? Have been nearly a week. I don’t have too much chip to let me brick but i still can’t utilize the PFR flash api correctly.

[ZhangJennie]

Hi Halry 

We can read/write internal flash via either ISP or SWD.

You wrote bootcfg, it may disable ISP.  It's normal you can't work with ISP USB any more.

Please make sure SWD interface is enabled, becuase the only way to re-enable ISP is to mass erase Flash via SWD interface.

Please make sure you didn't write SOCU_PIN and SOCU_DFLT in cmpa. It they are not 11, SWD disabled. Thus you can't access SWD.

If both ISP and SWD are disabled, and you didn't use debug authentication feature, the part can't be recover any more.

Have a nice day,

Jun Zhang

[Halry]

Thanks. My fault, I should notice this inside the datasheet. However, when I read the CMPA back when the chip is in the initial state from whether secure provision program and bootloader inside the chip, it shows 0, which I think should be described more clearly inside the reference manual that if touching the CMPA, user should take care of these registers as well.

Update:

After change SOCU_PIN to 0xfd0002ff and SOCU_DFLT to 0xfd0002ff in CMPA, writing to the CMPA still brick the chip

I only add some codes that change data about CMPA

if (cmpa_data.bootCfg != 0x00000280)
	{
		printf("CMPA Bootcfg not match,program it\r\n");
		cmpa_data.bootCfg = 0x00000280;
		cmpa_data.dcfgDflt = 0xfd0002ff;
		cmpa_data.dcfgPin = 0xfd0002ff;
		cmpa_data.usbId.pid=0x21;
		cmpa_data.usbId.vid = 0x1fc9;
		
		if ((status = flash_program_CMPA()) != kStatus_Success)
		{
			printf("CMPA cannot write,Error Code:%lu\r\n", status);
		}
	}

 Secure provision program provides the values of CC_SOCU

Maybe I need to change CFPA as well?

[ZhangJennie]

HI

I write bootcfg related cmpa page (512bytes) all 0. I can access SWD and ISP without issue. Please have a try.

Thanks,

Jun Zhang

[Halry]

I can't access the chip anymore via SWD or ISP if I write all zero to CMPA with PFR Flash API.

I can use elftosb-gui to provision CMPA and PUF without problem. And then I can use secure provision program to write the bootcfg area, and it works. But I can't change bootcfg using PFR flash api.

And weirdly, I have read what secure provision program had written to CMPA about DCFG_SOC, it is all zero. But it still works.

Inside the firmware:

It seems PFR flash api has some problems with it, or maybe I don't configure it correctly? I can't find an example in the SDK archive. The SDK version I am using is 2.13.0. Like the code that I have provided, all I have touched is the bootcfg, so why secure provision program or elftosb-gui can write only the bootcfg but I can't do it in firmware.

[Halry]

I just used secure provision program to program cfpa only, it still locks me out from debugging and ISP.

Here is the logs from secure provision program:

Write script created: (workspace)/gen_scripts\write_cfpa_win.bat
Executing script C:\Users\liang\secure_provisioning00\gen_scripts\write_cfpa_win.bat
### SCRIPT: Write user configuration to processor: C:\Users\liang\secure_provisioning00\gen_scripts\write_cfpa_win.bat
### Create CFPA page - binary ###
C:\nxp\MCUX_Provi_v5\bin\tools\spsdk\pfr.exe generate-binary -c "C:\Users\liang\secure_provisioning00\gen_sb\cfpa.json" -o "C:\Users\liang\secure_provisioning00\gen_sb\cfpa.bin"
WARNING:spsdk.pfr.pfr:The silicon revision is not specified, the latest: '1b' has been used.
### Check connection ###
blhost -t 2000 -u 0x1FC9,0x0021 -j -- get-property 1 0
{
"command": "get-property",
"response": [
1258487808
],
"status": {
"description": "0 (0x0) Success.",
"value": 0
}
}
blhost succeeded
### Write Customer Field Programmable Area [CFPA] ###
blhost -t 5000 -u 0x1FC9,0x0021 -j -- write-memory 0x0009DE00 "C:\Users\liang\secure_provisioning00\gen_sb\cfpa.bin"
{
"command": "write-memory",
"response": [
512
],
"status": {
"description": "0 (0x0) Success.",
"value": 0
}
}
blhost succeeded

### RESULT of the script `Write user configuration to processor`: SUCCESS (return code = [0]SUCCESS)
Status of the operation: SUCCESS : Write user configuration to processor

[ZhangJennie]

I asked you to write bootcfg related cmpa page (512bytes) all 0. This is just to test if your chip can be recovered to normal. If this works, you can test other features on your requirement.

[Halry]

But I want to change the bootcfg to use USB FS for ISP and 96Mhz FRO.

According your description, I setup the CC_SOCU_PIN(9E410) and CC_SOCU_DFLT(9E414) as well in CMPA to try to avoid to brick the chip. However the chip still bricks after writing to CMPA. Cannot boot to ISP anymore. Can you try to write a program to program the chip's CMPA and still leave the debugging enable?

I saw secure provision program will program CFPA when build a sb package. Do I also need to change DCFG_CC_SOCU_NS_PIN(9de20) and DCFG_CC_SOCU_NS_DFLT(9de24) and write them to CFPA?

[ZhangJennie]

Hi

In ISP mode, please erase cmpa, cfpa,keystore insequence.

the commands are

blhost.exe -p com24 -- write-memory 0x9e400 cmpa_zero.bin

blhost.exe -p com24 -j -- write-memory 0x9de00 cfpa_new.bin

blhost.exe -p com24 -j -- write-memory 0x9e600 zero_keystore.bin

The related files are attached.

We tested it, the board can be recovered to normal.

Have a nice day,

Jun Zhang

[Halry]

Thanks for replying.

But writing to PFR using flash API still not working. Can you provide me an example? I can't find example in SDK example folder.

And I can't put the chip into ISP mode anymore if I use PFR flash API to write CMPA or CFPA (via USB, USB not enumerate at all. And I try to use UART but chip not respond). But I can use secure provision program to write CMPA and CFPA successfully after chip provisioned by elftosb.

[ZhangJennie]

Please recover CMPA,CFPA in ISP mode with setting PIO0_5 pin low.

the blhost commands were listed above.

Then using blhost to erase CMPA,CFPA and keystore.