Read the security fuse (KIll) state

Tip / Sign in to post questions, reply, level up, and achieve exciting badges. Know more

cross mob
chva_349096
Level 3
Level 3
5 sign-ins 10 replies posted 5 replies posted

Hello,

Is there a way to verify, from a Bootloadable set of code, if the security fuse (KILL) has been blown or not?  What I am trying to do is prevent firmware from running unless that fuse is set.

Thank you.

- Chris

0 Likes
1 Solution
chva_349096
Level 3
Level 3
5 sign-ins 10 replies posted 5 replies posted

So with an evening of working through this, I have a solution.  The following will return the value of the Chip Protection that is configured.

For PSoC 4 parts with 128 byte flash rows:
unsigned char* p = (unsigned char*)(0x0FFFF07F);

For PSoC 4 parts with 256 byte flash rows:
unsigned char* p = (unsigned char*)(0x0FFFF0FF);

if (*p == 0x00) // Open
if (*p == 0x01) // Virgin
if (*p == 0x02) // Protected
if (*p == 0x04) // Kill

- Chris

View solution in original post

0 Likes
5 Replies
Len_CONSULTRON
Level 9
Level 9
Beta tester 500 solutions authored 1000 replies posted

Chris,

You have posted in the PsoC4 forum.  Can you specific which PSoC4 you are planning on using?

According to the "002-27800_PSoC_4100S_Plus_256KB_PSoC_4_Registers_Technical_Reference_Manual_TRM.pdf"

page 149 Section 7.1.3 

The CPUSS_PROTECTION register:

Bits 3:0:  KILL = 0x01xx.

I hope this helps.

Len
"Engineering is an Art. The Art of Compromise."
0 Likes
chva_349096
Level 3
Level 3
5 sign-ins 10 replies posted 5 replies posted

Thank you for the quick reply.

I am using CYBLE-224166.

When I print the output of (CYREG_CPUSS_PROTECTION & 0x000000F), I am receiving a value of 12 / 0x0C / 0b1100.  To me this indicates that the unit is still in boot mode.  Could that be?  At what point does the MCU leave boot mode?

In my test, was expecting to find the unit in protected mode, or 0b001x.

0b1xxx: BOOT
0b01xx: KILL
0b001x: PROTECTED
0b0001: OPEN
0b0000: VIRGIN (also used for DEAD mode, but then FLASH_LOCK is also set)

Thank you for your help.

- Chris

0 Likes

Chris,

Interesting.

From the bit defs listed it also seems that the bits are individually defined.

For example:

b3 = BOOT

b2 = KILL

b1 = PROTECTED

b0 = OPEN

Therefore 0b1100 = BOOT | KILL.  ???

The sad part is that in order to program the KILL mode, you can't add any more code changes into that part.

You may have to get Infineon to weight in on this to clarify.

Len
"Engineering is an Art. The Art of Compromise."
0 Likes

So, with a bunch of testing, this register is not quite what I am looking for.  What I would like to do is read the eFuses on the PSoC 4 like it appears you can on the PSoC 6:

https://infineon.github.io/psoc6pdl/pdl_api_reference_manual/html/group__group__efuse__functions.htm...

So far I have had no luck finding a PSoC 4 equivalent call.

- Chris

 

0 Likes
chva_349096
Level 3
Level 3
5 sign-ins 10 replies posted 5 replies posted

So with an evening of working through this, I have a solution.  The following will return the value of the Chip Protection that is configured.

For PSoC 4 parts with 128 byte flash rows:
unsigned char* p = (unsigned char*)(0x0FFFF07F);

For PSoC 4 parts with 256 byte flash rows:
unsigned char* p = (unsigned char*)(0x0FFFF0FF);

if (*p == 0x00) // Open
if (*p == 0x01) // Virgin
if (*p == 0x02) // Protected
if (*p == 0x04) // Kill

- Chris

0 Likes