Code Read Protection (CRP)

24 Sep 2010

How do you set code read protection? Can you do it by a statement in the code?

24 Sep 2010

Hmm, when using the mbed itself you can't really do it AFAIK.

But when using an produced board with ISP or JTAG, you can

user guide; http://www.nxp.com/documents/user_manual/UM10360.pdf

Page 621, there you'll find it.

/ Lerche

24 Sep 2010

Hi Christian,

That is where I started from (User Manual page 621). It tells yo what to do, but not how to do it.

For the AVR microcontrollers you do it using the ISP software, but there does not seem to be provision in Flash Magic.

As you deduced I have moved pass the mbed module stage, but am still using the mbed compiler etc to tweak the code on my target prototype, after a 'Bin2Hex' conversion to get the file for Flash Magic.

John

24 Sep 2010

Hmm, why don't you use JTAG? I think OpenOCD supports CRP?

Lerche

24 Sep 2010 . Edited: 24 Sep 2010
user avatar John Harris wrote:

How do you set code read protection? Can you do it by a statement in the code?

We haven't tried it ourselves but there's some info here that may help:

http://forum.flashmagictool.com/index.php?topic=3620.0

24 Sep 2010

You can't set CRP with the online compiler. The startup code provided by the mbed library has a predefined value in the CRP location (0x2FC). I assume it was done to prevent accidental bricking of mbed in case someone managed to put a valid CRP key there.

25 Sep 2010

I assume 'bricking' means locking the code in place so that it cannot be erased or over-written. My understanding of CPR from UM10360 is that this form of code locking is not possible by the CPR register.

Also any wrong coding to the CPR register can be corrected by the Flash Magic default full erase that includes the CPR register.

I really want to prevent people being able to read the flash, and use the results to make duplicates of my design, before I send samples to clients. That is what CPR is for.

Any chance of a review of this decision to prevent CPR setting by code?

John

25 Sep 2010

The CRP can block JTAG. As I understand it, the mbed interface chip uses JTAG to program the new binary, so if you disable JTAG you won't be able to replace the code anymore.

BTW you can just post-process the compiled .bin file and patch the CRP value (at offset 0x2FC) to the one you need.

26 Sep 2010

I am off the mbed module and programming a LPC1768 on my prototype target, so the mbed interface chip is not in the loop. I program using the serial ISP interface with Flash Magic so for me the JTAG interface is not used. However perhaps post- processing the ,bin file could be my salvation.

Igor can you give some instruction on how to post-processing the .bin file? I assume I need to locate the default value for the CRP register  in the start up code and edit it.

John

26 Sep 2010

user avatar John Harris wrote:

I am off the mbed module and programming a LPC1768 on my prototype target, so the mbed interface chip is not in the loop. I program using the serial ISP interface with Flash Magic so for me the JTAG interface is not used.

I understand that. However, you need to keep in mind that the main target of mbed compiler is mbed modules.

As for post-processing the bin file, a simple Python script should do it:

import sys, struct
if len(sys.argv) < 2:
    print "Usage: crp.py file.bin [CRP1|CRP2|CRP3]"
else:
    infile = open(sys.argv[1], "rb")
    infile.seek(0x2FC)
    crp = struct.unpack("<I", infile.read(4))
    infile.close()
    print "Current CRP value: 0x%08X" % crp
    if len(sys.argv)>2:
        opt = sys.argv[2]
        crp = None
        if opt == 'CRP1':
            crp = 0x12345678
        elif opt == 'CRP2':
            crp = 0x87654321
        elif opt == 'CRP2':
            crp = 0x43218765
        else:
            print "Bad CRP value name"
        if crp:
            infile = open(sys.argv[1], "r+b")
            infile.seek(0x2FC)
            infile.write(struct.pack("<I", crp))
            infile.close()
            print "New CRP value 0x%08X written" % crp
 

26 Sep 2010
user avatar Igor Skochinsky wrote:

 

        elif opt == 'CRP2':
            crp = 0x87654321
        elif opt == 'CRP2':
            crp = 0x43218765
 

 

I assume one of these should be 'CRP3'?

26 Sep 2010

Yep, copy/paste error.

28 Sep 2010

Is the value at 0x2FC now  0xFFFF2DE9 ?

27 Jul 2011

Sorry to open this up again.

Could the CRP be set in an offline compiler, to overwrite the value in the mbed.h file, instead of using Python? It's not that I don't like Python, on the contrary, it's quite nice, but i would be easier to use a simple asm or C string to set the CRP BTW: Offline compiler: Keil

Any ideas?

Lerche

27 Jul 2011

Have you tried something like this for CRP2:

const unsigned long crp __attribute__ ((at(0x2FC))) = 0x87654321;

I saw this in the http://forum.flashmagictool.com/index.php?topic=3620.0 link given by Chris Burrows in his post above.

In theory this should work in the Keil compiler if you aren't linking with the mbed libraries but I haven't tried it. In GCC it could probably be done through the linker's .ld file.