Implementing Flash Read Out Protection on s7g2 using Renesas Flash Programmer

I wanted to implement the Flash read out protection(Purpose: Flash Erase on possible attempt of read) in our projects. We are using s7g2 and flashing the code from Renesas Flash Programmer. I researched a bit and found out that the latest Renesas Flash Programmer V3.08.01 has the option of various Flash protection settings, including the said Flash read protection. PFA attached screenshot of the user manual. However when I installed this latest version, I do not find the tab of "Flash Options" itself. Why is this?. Moreover I found threads of implementing ID Setting, but we have to do this without using e2 studio.
Kindly request anyone to help me out here.
Regards,
Himanshu M.
Parents
  • Hi

    Some options are not available because it is not applicable to that MCU.

    Flash protection options applies to newer Trustzone devices on Cortex-M33.

    Remark: Only those items the target MCU supports are shown. For the meanings and details of the settings
    of the individual items, refer to the user’s manual of the target MCU in use.

    For S7G2, typical read-out protection is carried out by writing an ID-code.  You can refer to script/s7g2.ld  for its location.


    ID_CODES (rx) : ORIGIN = 0x40120050, LENGTH = 0x10 /* 16 bytes */

    If you program your device with RFP, the next time you connect, you will be prompted to enter that 16-byte ID.

  • Ok.  Can i do this feature on renesas flash programer? 

  • The ID code is part of the binary that you download with RFP. The SSP already inserts the ID code into the binary that is created, but will be all 0xFF if not changed from the default, e.g. from the Srecord created from a Blinky project :-

    S31540120050FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF58

    So you would either set the ID code in the SSP project in e2studio, or you could manipulate the srecord binary to change the ID code.

    Be careful when manually manipulating the ID code in the binary files, as it is possible to lock the debug interface totally if bit 127 of the ID is 0.

    It is not possible to set the ID code in RFP for a Synergy device.

  • How do i  insert the id code from e2studio and use it with RFP. I did not understand the process. Please help out with the process.

  • In an SSP project you can set the ID code in the properties of BSP tab of the configurator, by default it is set to 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

  • And how do i use it with RFG?

  • Program the srecord created by e2studio with RFP, then the ID code is programmed into the device.

  • Ok jeremy. And if i have to use the MCU (programmed with id code) Again with e2 studio. How wil i be able to do that.

  • You have to enter the ID code into the debug configuration in e2studio, or when connecting to the device with RFP, as long as the ID code programmed into the device allows a connection (i.e. BIT 127 of the ID code is NOT 0). The SSP configurator will modify the ID code entered in the BSP tab to ensure the ID Code matches the mode set in the configurator.

    Look in the file synergy_cfg/ssp_cfg/bsp/bsp_cfg.h to see the actual ID code that will be in the binary created by the compiler.

  • E.g. in synergy_cfg/ssp_cfg/bsp/bsp_cfg.h :-

    /* ID CODE: 00112233445566778899AABBCCDDEEff */
    #define BSP_CFG_ID_CODE_LONG_1 (0x33221100)
    #define BSP_CFG_ID_CODE_LONG_2 (0x77665544)
    #define BSP_CFG_ID_CODE_LONG_3 (0xBBAA9988)
    #define BSP_CFG_ID_CODE_LONG_4 (0xffEEDDCC)
    #endif

    you would use 00112233445566778899AABBCCDDEEff as the ID code in the debug configuration in e2studio.

    Rather confusingly, the byte order of the ID code is reversed in RFP, so the ID code you would use in RFP to connect to a device that had this ID code programmed into it would be :-

    FFEEDDCCBBAA99887766554433221100

Reply
  • E.g. in synergy_cfg/ssp_cfg/bsp/bsp_cfg.h :-

    /* ID CODE: 00112233445566778899AABBCCDDEEff */
    #define BSP_CFG_ID_CODE_LONG_1 (0x33221100)
    #define BSP_CFG_ID_CODE_LONG_2 (0x77665544)
    #define BSP_CFG_ID_CODE_LONG_3 (0xBBAA9988)
    #define BSP_CFG_ID_CODE_LONG_4 (0xffEEDDCC)
    #endif

    you would use 00112233445566778899AABBCCDDEEff as the ID code in the debug configuration in e2studio.

    Rather confusingly, the byte order of the ID code is reversed in RFP, so the ID code you would use in RFP to connect to a device that had this ID code programmed into it would be :-

    FFEEDDCCBBAA99887766554433221100

Children
  • Dear jeremy,

    I followed the procedure suggested by you. I changed the default id code from FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF  to FFFFFFFFFFFFFFFFFFFFFFFFFFFFF561 and the ID code mode to "locked with erased support". The generated id code in bsp_cfg.h was FFFFFFFFFFFFFFFFFFFFFFFFFFFFF5e1 which I pasted into the debugger   uger->connection settings->ID code. Please find the Screenshots attached along with. However how do i check now if the the read out protection is successful. Can I read the MCU in e2studio/RFP, if yes how do I do it?.

    Also I could successfully debug the code through e2studio, I assume it should prompt me for the id code. Am I missing anything?.

  • If you have the wrong ID set in the debug configuration (i.e. the default of 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF) then you will be prompted for an ID code when debugging.

    Once the ID code authentication has occured (.e. you have entered the correct ID Code), the debugger can debug the device as normal, so will be able to read back the code flash.

    When using RFP, the ID code will need to be entered, or RFP will not be able to connect to the device.

  • I did the change. Changed the debugger id code to default (FFFFFFFFFFFFFFFF) However still no authentication prompt occcured. I am using SK S7G2 board as debugger(Changed the header on J1 & J31).

  • Have you confirmed that memory locations 0x40120050 - 0x4012005F are programmed with the ID you set in the e2studio project, in the memory window in e2studio?

    Also, confirming the ID code programmed into the S7G2 devicet is not all 0xFF try power cycling the device to make sure it uses the new ID code, then retry the debug connection in e2studio.

  • Dear jeremy,

    I do know memory usage window. But where is memory window, where i can read the contents of the flash.

  • Dear jeremy, 

    I checked the memory locations 0x40120050-0x4012005F , they are not programmed with the id code. Am i missing any step?. Ther are all F's

  • It sounds like you have not actually programmed the binary containing the ID code that is not all 0xFF, into the device.

  • ok.But what am i missing? Any step?

  • Dear jeremy my project 's board selection is DKs7G2. Is that a problem?

  • The ID is programmed into the S7G2 device, the board selection makes no difference.

    The proceedure to set an ID code is :-

    1) Create an SSP project, set an ID code in the BSP tab of the project, make sure the ID code is not disabled.

    2) Confirm the generated source code contains the ID code you configured in the file synergy_cfg/ssp_cfg/bsp/bsp_cfg.h, also confirm the output of the compiler contains the ID code by looking at the srecord file generated by the compilation process :-

    S31540120050FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF58 (this is a blank ID code, but it is located at address 0x40120050, so it is at the correct location)

    The ID code location in memory can also be confirmed by looking in the .map file, e.g. for a project based on SSP 1.7.8 :-

    .id_code_1      0x40120050       0x10
                    0x40120050                __ID_Codes_Start = .
     *(.id_code_1*)
     .id_code_1     0x40120050       0x10 ./synergy/ssp/src/bsp/mcu/s7g2/bsp_rom_registers.o
                    0x40120060                __ID_Codes_End = .

    3) Debug the project, and confirm the ID code has been programmed into the OSIS regsters 0x40120050-0x4012005F.

    Some early versions of the SSP did not support the generation of an ID code (I think it was SSP 1.4.0 that was the first version of the SSP to properly support the ID code). If a project has been upgraded from a version of the SSP that did not fully support ID codes, the linker script file might need updating to place the ID code at the correct location in the memory map. The linker script should have a entry for the .id_code section, e.g. the GCC linker script, at the top defines the memory regions, there is a region for the ID_CDOES :-

    MEMORY
    {
      FLASH (rx)         : ORIGIN = 0x00000000, LENGTH = 0x0400000  /*   4M */
      RAM (rwx)          : ORIGIN = 0x1FFE0000, LENGTH = 0x00A0000  /* 640K */
      DATA_FLASH (rx)    : ORIGIN = 0x40100000, LENGTH = 0x0010000  /*  64K */
      QSPI_FLASH (rx)    : ORIGIN = 0x60000000, LENGTH = 0x4000000  /*  64M, Change in QSPI section below also */
      SDRAM (rwx)        : ORIGIN = 0x90000000, LENGTH = 0x2000000  /*  32M */
      ID_CODES (rx)      : ORIGIN = 0x40120050, LENGTH = 0x10       /* 16 bytes */    
    }

    and at the end of the GCC linker script is the .id_code section :-

        .id_code_1 :
        {
            __ID_Codes_Start = .;
            KEEP(*(.id_code_1*))
            __ID_Codes_End = .;
        } > ID_CODES

  • Dear jeremy,

    It seems i did not have the .id_code section in my project. I added the above two code parts manually in the linker script and it worked.

    However now I am facing a strange thing. I would explain it with example 

    When I kept 

    BSP ID CODE as 3322110077665544BBAA9988FFEEDDCC, I could successfully debug by E2studio by giving the generated id code  3322110077665544BBAA9988FFEEDDcc and by RFP through ccDDEEFF8899AABB445566770112233.

    However when i kept the BSP ID CODE as 17170707191996961717070719199696, I could only debug by E2studio by giving the generated id code 171707071919969617170707191996d6 and not by RFP. I gave 6d699191707071716969919107071717. why is this happening? I get 

    [W0000005] : Mismatch of ID Code.  &
    Error(E1000007): An authentication code error occurred in the device. (Command: 30, Response: DB)
    Operation failed

    errors respectively. Please help.

  • Try the ID d6961919070717179696191907071717 with RFP

  • It did not work. Same error Mismatch of id code.

  • I just tried setting the ID code in the configurator as :- 17170707191996961717070719199696 with ID Code mode as "Locked with all erase support".

    In bsp_cfg.h the ID code is :-

    /* ID CODE: 171707071919969617170707191996d6 */
    #define BSP_CFG_ID_CODE_LONG_1 (0x07071717)
    #define BSP_CFG_ID_CODE_LONG_2 (0x96961919)
    #define BSP_CFG_ID_CODE_LONG_3 (0x07071717)
    #define BSP_CFG_ID_CODE_LONG_4 (0xd6961919)

    In the srecord file that is generated the ID code is :-

    S31540120050171707071919969617170707191996D6D4

    I use the ID code 171707071919969617170707191996d6 in e2studio debug configuration to connect.

    In RFP I use the ID code d6961919070717179696191907071717 to connect.

    It all works as expected.

  • Dear jeremy,

    I found out the problem was that the .srec contained the old id code(I had programmed before), i had not programmed the new id code into the MCU and was trying to connect with the new one on RFP. Thankyou for helping me out with minute details for this task. The support I get here on forum is immense.

    Warm regards & Thankyou,

    Himanshu M