NXP Semiconductors K32 L2A Series, Reference Manual, Page: 599 / 1379

Debug The debugger is a non-processor bus master and cannot step, trace or break in execute-only
regions. In supervisor-only mode, the debugger is restricted from changing modes. Debug
accesses to any segment of flash space marked as execute-only also terminate with a bus
error.
PC-relative addressing Hardware cannot track speculative instruction fetches (ifetches) across boundaries, and
hardware cannot determine if PC-relative data references are crossing segment boundaries;
therefore restrictions for PC-relative addressing are placed on software.
• If ifetch is executing in a protected segment, then data references will be allowed; if
ifetch is executing in a nonprotected segment, then data references to a protected
segment are not allowed.
• PC-relative re-entry to execute-only segments is allowed.
Interrupts If function calls are used to move into an execute-only segment, then this can be tracked by
hardware when typical software controls are used (i.e., saving registers and states before
executing new code).
Reset Vector
In the Arm core, the reset vector fetch is supervisor data, which poses issues if the reset
vector is located in a segment marked execute-only. Additional logic has been implemented
to allow supervisor data fetches to execute-only spaces, after reset until the first valid
instruction fetch. After the first valid instruction fetch, the FAC logic follows normal checks.
23.5.2.4 Software considerations
There are software considerations that need to be communicated to tool and library
vendors. The hardware cannot see all states of the Arm core and cannot track the software
flow, therefore software restrictions are required, to work with the hardware for a robust
solution.
• Any segment marked as execute-only can see all code in the system. This means
one execute-only segment can read the execute-only code in another segment.
Therefore, if a company is sending pre-loaded code to another vendor, then that
vendor will have access to that pre-loaded code. To deal with this issue, NDAs and
legal agreements can be used.
• If using single software pre-loads (for example, if a company is pre-loading for a
general purpose market or if a vendor with a blank part is pre-loading proprietary
code), then both levels of access control must be programmed, to protect the pre-
loaded code.
• If any portion of a protected segment is not used by pre-loaded code, then the
portion of a protected segment that is not used by pre-loaded code should be
programmed with NOPs, to prevent additional code from being programmed in that
segment by hackers.
23.5.2.5 Access Check Evaluation
The flash controller FAC provides a cycle-by-cycle evaluation of the access rights for
each data transaction routed to the on-chip flash memory.
Chapter 23 Flash Memory Controller (FMC)
K32 L2A Reference Manual, Rev. 2, 01/2020
NXP Semiconductors 599