Engineering mode and CA7 secure state

[Martin Devera]

In RM it is stated that in Engineering mode (BOOT pins at 3'b100) the MPU re-opens CA7 secure debug.

I boot in that mode, then halt in openocd:

stm32mp15x.cpu0: hardware has 6 breakpoints, 4 watchpoints
> halt
stm32mp15x.cpu0 rev 5, partnum c07, arch f, variant 0, implementor 41
target halted in Thumb state due to debug-request, current mode: Supervisor
cpsr: 0x200001f3 pc: 0x00010fc0
MMU: enabled, D-Cache: disabled, I-Cache: enabled
> mdw 0x5c005014
0x5c005014: 0000000f

In BSEC register 0x14 (DEBUG) there is 0xf - which means unsecure debug is enabled,

but secure is disabled. Also MMU is enabled and 0x2ffc0000 is RO and 0x10000000 unmapped.

Thus I can't upload and run A7 code via JTAG.

Is it correct ? Is the only way to upload some code to new MP1 board only via USB/serial

bootloader ?

I ask because typical way for STM32 MCUs was to use Openocd to send some stub code

for Flash programming of new part but it doesn't seem to work here.

Only way I found is to upload fake code via USB, break into it and then debugger has full access to MPU in secure state.

Martin

[PatrickF · Accepted solution]

Are you sure you are really in EngiBoot mode ?

I double check on my platform, and I read BSEC_DENABLE (@0x5c005014) to 0x000047F, which mean all debug are allowed. Furthermore, cache is disabled in EngiBoot.

Could you check SYSCFG_BOOTR @0x50020000 ? Should be 0x00000004 for EngiBoot.

I suspect you are still in one of the Flash boot mode which fallback to USB/Serial as no good Flash content is detected.

[Martin Devera]

Ouch, shame on us :-)

Thanks you for the good catch, there is 1 in BOOTR (I overlooked its existence) and I just realized that our PCB guy mislabeled

(reversed) BOOT0..2 labels next to DIP switch. Now DENABLE is 47F as expected.

Martin