LPC55S28 ISP_CMD_EN not disabling ISP commands Hello, I have an LPC55S28 MCU with the attached CMPA and CFPA settings. I got these value directly from reading via blhost via python with the commands below. So these came directly from the actual MCU. This was after a full power cycle of the MCU. CMPA read via USB. uv run python -m spsdk.apps.blhost -u 0x3972,0x3333 read-memory 0x0009E400 512 -f cmpa_dump.bin CMPA parse into yaml with uv run python -m spsdk.apps.pfr parse -f lpc55s28 -t cmpa -b cmpa_dump.bin -o parsed_cmpa.yaml Then the same thing for CFPA with different address. I read the CFPA from address 0x9DE00, which I think is the scratch version. But the ping and pong match other than the fact that the CMPA_PROG_IN_PROGRESS reads something non-zero for the scratch. But 0x00 for ping and pong. Below is a summary of the full files attached. Full files attached for more details CMPA: PIN, DFLT NIDEN = USE_DAP, DISABLED DEGEN = USE_DAP, DISABLED TAPEN = USE_DAP, DISABLED ISP_CMD_EN = USE_DAP, DISABLED FA_ME_CMD_EN = FIXED_STATE, ENABLED SEC_BOOT_EN = ENABLE_0 CFPA: PIN, DFLT NIDEN = USE_DAP, DISABLED DEGEN = USE_DAP, DISABLED TAPEN = USE_DAP, DISABLED ISP_CMD_EN = USE_DAP, DISABLED FA_ME_CMD_EN = FIXED_STATE, ENABLED From my understanding, with these settings, I should not be able to use blhost to read memory. I can read CMPA, CFPA, application flash, application RAM, I can dump my entire executable via blhost with no DAP authentication. Questions: 1. If ISP_CMD_EN is disabled, does that mean you can not read and write to internal memory? Either PFR or application memory. I still need the ability to send secure .sb files to the bootloader though. 2. Does ISP_CMD_EN disable the ability to load .SB files via USB over the bootloader? 3. What settings do I need to keep USB bootloader functionality with .SB files, but disable the ability to read and write to memory over ISP commands? 4. Why is my MCU still allow blhost ISP commands even though the CMPA and CFPA have it disabled? I have read the forum post at this link: https://community.nxp.com/t5/LPC-Microcontrollers-Knowledge/LPC55-Disable-ISP-and-SWD-to-utilize-code-protection/ta-p/1654157 But the settings have it completely disable ISP, which disables the bootloader completely. I I don't think that forum post shows why my settings are still allowing ISP commands over the blhost, when the ISP_CMD_EN is disabled. Re: LPC55S28 ISP_CMD_EN not disabling ISP commands Hi @guitardenver
The key point is that ISP_CMD_EN is not a global enable/disable bit for all blhost commands. It controls whether ISP mode can be entered through the Debug Mailbox Enter ISP Mode command. Once the device has entered ROM ISP through another permitted boot path, USB blhost commands are handled separately by the ROM bootloader.
1. Memory read/write: Disabling ISP_CMD_EN does not by itself disable ReadMemory or WriteMemory. These commands can still access memory that is not otherwise protected.
2. SB file download: ISP_CMD_EN does not directly disable the ROM ReceiveSBFile command. Therefore, it should not be treated as the control for USB SB-file updates.
3. SB update while blocking raw memory access: According to the LPC55S28 reference manual, there is currently no configuration that can keep USB ISP available for SB updates while disabling ReadMemory and WriteMemory commands.
4. Why blhost still works: This behavior does not necessarily mean your CMPA/CFPA settings are being ignored. The device has already entered ROM ISP, while ISP_CMD_EN controls a different path into ISP.
BR
Harry
View full article