Implementing Flash Read Out Protection on s7g2 using Renesas Flash Programmer

I wanted to implement the Flash read out protection(Purpose: Flash Erase on possible attempt of read) in our projects. We are using s7g2 and flashing the code from Renesas Flash Programmer. I researched a bit and found out that the latest Renesas Flash Programmer V3.08.01 has the option of various Flash protection settings, including the said Flash read protection. PFA attached screenshot of the user manual. However when I installed this latest version, I do not find the tab of "Flash Options" itself. Why is this?. Moreover I found threads of implementing ID Setting, but we have to do this without using e2 studio.
Kindly request anyone to help me out here.
Himanshu M.
  • Hi

    Some options are not available because it is not applicable to that MCU.

    Flash protection options applies to newer Trustzone devices on Cortex-M33.

    Remark: Only those items the target MCU supports are shown. For the meanings and details of the settings
    of the individual items, refer to the user’s manual of the target MCU in use.

    For S7G2, typical read-out protection is carried out by writing an ID-code.  You can refer to script/s7g2.ld  for its location.

    ID_CODES (rx) : ORIGIN = 0x40120050, LENGTH = 0x10 /* 16 bytes */

    If you program your device with RFP, the next time you connect, you will be prompted to enter that 16-byte ID.

  • Ok.  Can i do this feature on renesas flash programer? 

  • The ID code is part of the binary that you download with RFP. The SSP already inserts the ID code into the binary that is created, but will be all 0xFF if not changed from the default, e.g. from the Srecord created from a Blinky project :-


    So you would either set the ID code in the SSP project in e2studio, or you could manipulate the srecord binary to change the ID code.

    Be careful when manually manipulating the ID code in the binary files, as it is possible to lock the debug interface totally if bit 127 of the ID is 0.

    It is not possible to set the ID code in RFP for a Synergy device.

  • How do i  insert the id code from e2studio and use it with RFP. I did not understand the process. Please help out with the process.

  • In an SSP project you can set the ID code in the properties of BSP tab of the configurator, by default it is set to 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

  • And how do i use it with RFG?

  • Program the srecord created by e2studio with RFP, then the ID code is programmed into the device.

  • Ok jeremy. And if i have to use the MCU (programmed with id code) Again with e2 studio. How wil i be able to do that.

  • You have to enter the ID code into the debug configuration in e2studio, or when connecting to the device with RFP, as long as the ID code programmed into the device allows a connection (i.e. BIT 127 of the ID code is NOT 0). The SSP configurator will modify the ID code entered in the BSP tab to ensure the ID Code matches the mode set in the configurator.

    Look in the file synergy_cfg/ssp_cfg/bsp/bsp_cfg.h to see the actual ID code that will be in the binary created by the compiler.

  • E.g. in synergy_cfg/ssp_cfg/bsp/bsp_cfg.h :-

    /* ID CODE: 00112233445566778899AABBCCDDEEff */
    #define BSP_CFG_ID_CODE_LONG_1 (0x33221100)
    #define BSP_CFG_ID_CODE_LONG_2 (0x77665544)
    #define BSP_CFG_ID_CODE_LONG_3 (0xBBAA9988)
    #define BSP_CFG_ID_CODE_LONG_4 (0xffEEDDCC)

    you would use 00112233445566778899AABBCCDDEEff as the ID code in the debug configuration in e2studio.

    Rather confusingly, the byte order of the ID code is reversed in RFP, so the ID code you would use in RFP to connect to a device that had this ID code programmed into it would be :-


  • Dear jeremy,

    I followed the procedure suggested by you. I changed the default id code from FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF  to FFFFFFFFFFFFFFFFFFFFFFFFFFFFF561 and the ID code mode to "locked with erased support". The generated id code in bsp_cfg.h was FFFFFFFFFFFFFFFFFFFFFFFFFFFFF5e1 which I pasted into the debugger   uger->connection settings->ID code. Please find the Screenshots attached along with. However how do i check now if the the read out protection is successful. Can I read the MCU in e2studio/RFP, if yes how do I do it?.

    Also I could successfully debug the code through e2studio, I assume it should prompt me for the id code. Am I missing anything?.

  • If you have the wrong ID set in the debug configuration (i.e. the default of 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF) then you will be prompted for an ID code when debugging.

    Once the ID code authentication has occured (.e. you have entered the correct ID Code), the debugger can debug the device as normal, so will be able to read back the code flash.

    When using RFP, the ID code will need to be entered, or RFP will not be able to connect to the device.

  • I did the change. Changed the debugger id code to default (FFFFFFFFFFFFFFFF) However still no authentication prompt occcured. I am using SK S7G2 board as debugger(Changed the header on J1 & J31).

  • Have you confirmed that memory locations 0x40120050 - 0x4012005F are programmed with the ID you set in the e2studio project, in the memory window in e2studio?

    Also, confirming the ID code programmed into the S7G2 devicet is not all 0xFF try power cycling the device to make sure it uses the new ID code, then retry the debug connection in e2studio.

  • Dear jeremy,

    I do know memory usage window. But where is memory window, where i can read the contents of the flash.