At various phases during boot, protection mechanisms are enabled, and certain registers in the design are locked to improve FW security. The majority of ROM (including the implementation of security features) is also read-protected.
- Changes to hardware trims for oscillators, voltage/current references, flash trimming, and power management output voltages
- Wrong hardware trim values can result in the device operating out of spec and thus having unpredictable behavior.
- Flash sector write/erase protection
- To avoid program errors, malicious attacks or a debug connection from changing the contents of certain flash sectors
- SWD port and debug access
- The SWD port gives access to the CFG-AP and SEC-AP access points from boot to allow device IDs and information to be read out through CFG-AP and communication with SACI through SEC-AP
- The AHB-AP access point that is used by the debug probe can be enabled before the bootloader is invoked or the application is invoked using CCFG configurations
- Debug access is enabled by default, and if specified by CCFG.debugCfg or with CCFG authentication (password) configurations
- Debug access is only enabled if the XCFG (CCFG and SCFG) regions are valid. "Validity" in this context means that the CRCs within the XCFG regions are valid. See CCFG and SCFG sections for more details.
The protections/locking are applied in two phases:
- Prior to invoking the bootloader (FCFG restrictions)
- Immutably lockable hardware trims are locked
- Flash sector write/erase protection applied according to FCFG.flashProt (FCFG is write/erase protected)
- AHB-AP and debugging can be opened up if CCFG is valid and CCFG.debugCfg allows bootloader debugging
- Prior to invoking the application (CCFG restrictions)
- Individual device features or modules can be disabled as specified by CCFG.hwOpts so that program errors or malicious attacks cannot make use of them
- Flash sector write/erase protection applied according to CCFG.flashProt (user defined, protecting CCFG recommended at minimum)
- SWD port can be closed altogether at this point if either FCFG.permissions.allowDebugPort (n/a) or CCFG.permissions.allowDebugPort is FORBIDDEN
- AHB-AP and debugging can be opened up if CCFG.debugCfg allows debugging and (if required) debug authentication has succeeded
If no bootloader is invoked both passes are done in quick succession before invoking application. For more information on the device configuration see Chapter 10.