This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

MSPM0G3107: Manually enable MSPM0G3107 readout protection from MCU application code

Part Number: MSPM0G3107
Other Parts Discussed in Thread: SYSCONFIG

Tool/software:

Hello, 

I am trying to enable readout protection on production devices and need a bit of guidance.

I have not found officially any API's to do that, so I tried to generate OTP area configuration

using sysconfig and write it into flash manually. 

The issue seems to be that we already have some default config written into BCR and BSL areas.

I just want to modify BCR config, and write a new one. What seems possible is to erase the entire

sector and write a new one, I see that it does not return any errors. But when I try to read that data

with a pointer, it gives NMI. So I am not sure if it's feasible at all. Could someone give some suggestions 

as to what might be wrong or its not possible to do it like this from MCU?

If this is not possible to do manually, then this config needs to be flashed with the original image, and some of our devices

that have been produced will not have this protection enabled.

Thank you.

  • Hi Mykolat,

    But when I try to read that data

    with a pointer, it gives NMI.

    Please check what triggers NMI? You can find the trigger source:

    And where the address you read?

    B.R.

    Sal

  • By the way, what readout function you want to use? Can you show how you configure you NVM here?

    B.R.

    Sal

  • Hi Thanks for your reply. I can check more precisely what triggers it tomorrow and reply here.

  • Here is a snippet of what I am trying to do: 

    // structs generated by sysconfig with some debug port restrictions
    extern const BCR_Config BCRConfig;
    extern const BSL_Config BSLConfig;

    #define BCR_CONFIG_ADDR 0x41C00000

    BCR_Config bcr_read = {0};
    memcpy(&bcr_read, (uint8_t*)BCR_CONFIG_ADDR, sizeof(BCR_Config));

    if(memcmp(&BCRConfig, &bcr_read, sizeof(BCR_Config)) == 0) {
    LOG_DBG("BCRConfig matches");
    return;
    }

    // At this point I am sure that BCR config is not what it should be, so I try to modify it

    DL_FlashCTL_unprotectSector(FLASHCTL, BCR_CONFIG_ADDR, FLASHCTL_CMDCTL_REGIONSEL_NONMAIN);

    if (!DL_FlashCTL_waitForCmdDone(FLASHCTL)) {
    LOG_DBG("Unprotect sector error");
    return;
    }


    DL_FlashCTL_eraseMemory(FLASHCTL, BCR_CONFIG_ADDR, FLASHCTL_CMDTYPE_SIZE_SECTOR);

    if (!DL_FlashCTL_waitForCmdDone(FLASHCTL)) {
    LOG_DBG("Sector erase error");
    return;
    }

    ret = DL_FlashCTL_programMemoryBlocking(FLASHCTL,BSL_CONFIG_ADDR, (uint32_t *)&BCRConfig, sizeof(BSL_Config), FLASHCTL_CMDCTL_REGIONSEL_NONMAIN);

    LOG_DBG("Flash program ret: %d", ret);

    At this point I expect that BCR data is updated. So I proceed to check with the same command as before: 

    if(memcmp(&BCRConfig, (uint8_t*)BCR_CONFIG_ADDR, sizeof(BCR_Config)) == 0) {
    LOG_DBG("BCRConfig matches");
    return;
    }

    However, this time trying to access data in BCR_CONFIG_ADDR region triggers NMI (I suspect it is bus error or flash error).

    I would repeat the same for BSL as well and protect the sector, except I do not get here cause I am in error handler.

    I am not sure if this approach is valid at all. It's not clear from documentation if something like this is allowed or not.

  • Here are configs themselfs:


    const BCR_Config BCRConfig =
    {
    .bcrConfigID = 0x1,
    .debugAccess = BCR_CFG_DEBUG_ACCESS_DIS,
    .swdpMode = BCR_CFG_SWDP_EN,
    .tifaMode = BCR_CFG_TIFA_DIS,
    .bslPinInvokeEnable = BCR_CFG_BSL_PIN_INVOKE_DIS,
    .passwordDebugLock = {CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE,
    CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE},
    .fastBootMode = BCR_CFG_FAST_BOOT_DIS,
    .bootloaderMode = BCR_CFG_BOOTLOADER_MODE_DIS,
    .massEraseMode = BCR_CFG_MASS_ERASE_EN,
    .factoryResetMode = BCR_CFG_FACTORY_RESET_EN,
    .passwordMassErase = {CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE,
    CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE},
    .passwordFactoryReset = {CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE,
    CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE},
    .staticWriteProtectionMainLow = CFG_DEFAULT_VALUE,
    .staticWriteProtectionMainHigh = CFG_DEFAULT_VALUE,
    .staticWriteProtectionNonMain = BCR_CFG_NON_MAIN_STATIC_PROT_DIS,
    .secureBootMode = BCR_CFG_SECURE_BOOT_DIS,
    .userSecureAppStartAddr = CFG_DEFAULT_VALUE,
    .userSecureAppLength = CFG_DEFAULT_VALUE,
    .userSecureAppCrc = CFG_DEFAULT_VALUE,
    .userCfgCRC = 0xc629ebd0,
    };

    const BSL_Config BSLConfig =
    {
    .configID = 0x1,
    .interfacePins.UART_RXD_pad_num = DEF_UART_RXD_PAD,
    .interfacePins.UART_RXD_PF_mux_sel = DEF_UART_RXD_MUX,
    .interfacePins.UART_TXD_pad_num = DEF_UART_TXD_PAD,
    .interfacePins.UART_TXD_PF_mux_sel = DEF_UART_TXD_MUX,
    .interfacePins.I2C_SDA_pad_num = DEF_I2C_SDA_PAD,
    .interfacePins.I2C_SDA_PF_mux_sel = DEF_I2C_SDA_MUX,
    .interfacePins.I2C_SCL_pad_num = DEF_I2C_SCL_PAD,
    .interfacePins.I2C_SCL_PF_mux_sel = DEF_I2C_SCL_MUX,
    .pin.pinData0 = DEFAULT_BSL_PIN_INVOCATION_DATA0,
    .pin.pinData1 = DEFAULT_BSL_PIN_INVOCATION_DATA1,
    .memoryRead = BSL_CFG_MEMORY_READOUT_DISABLE,
    .password = {CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE,
    CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE,
    CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE, CFG_DEFAULT_VALUE},
    .pluginType = BSL_CFG_PLUGIN_TYPE_ANY,
    .flashPluginEnable = BSL_CFG_PLUGIN_FLASH_NOT_EXIST,
    .pluginSramSize = 0xff,
    .pluginHook[0] = CFG_DEFAULT_VALUE,
    .pluginHook[1] = CFG_DEFAULT_VALUE,
    .pluginHook[2] = CFG_DEFAULT_VALUE,
    .pluginHook[3] = CFG_DEFAULT_VALUE,
    .BSLAlternateConfig = BSL_CFG_FLASH_BSL_NOT_EXIST,
    .reserved = 0xFFFF,
    .BSLAlternateAddr = CFG_DEFAULT_VALUE,
    .appRev = (uint32_t *) CFG_DEFAULT_VALUE,
    .securityAlert = BSL_CFG_SECURITY_IGNORE,
    .i2cSlaveAddress = 0x48,
    .userCfgCRC = 0xf7df416,
    };

  • Hi Mykolat,

    I'll check your configuration later this week.

    What the NMI you triggered?

    B.R.

    Sal

  • Sorry for late reply. It's been a busy period. I found there was a TI example of how to write to non main flash, it was almost the same that I was doing, but few things were different. I just copied that and it worked, so we can mark this issue as resolved.