Functional Description
540
SLAU723A – October 2017 – Revised October 2018
Copyright © 2017–2018, Texas Instruments Incorporated
Internal Memory
•
Flash Memory Protection Read Enable (FMPREn) : If a bit is set in this register, the corresponding
block can be executed or read by software or debuggers. If a bits in this register are cleared and the
same block in the FMPREn register is cleared, the corresponding block can only be executed, and
contents of the memory block are prohibited from being read as data. FMPREn protection can be
programmed in 2KB increments, unlike the FMPPEn, which must be programmed in 16KB increments.
However, if an application does read-protect a 16KB block, eight bits must be written from 1 to 0.
The policies can be combined as listed in
Table 7-2. Flash Memory Protection Policy Combinations
FMPPEn
FMPREn
Protection
0
0
Execute-only protection. The block can only be executed and cannot be
written or erased. This mode is used to protect code.
1
0
The block can be written, erased, or executed, but cannnot be read. This
combination is unlikely to be used.
0
1
Read-only protection. The block can be read or executed but cannot be
written or erased. This mode is used to lock the block from further
modification while allowing any read or execute access.
1
1
No protection. The block can be written, erased, executed, or read.
A flash memory access that attempts to read a read-protected block (FMPREn bit is clear) is prohibited
and generates a bus fault. A flash memory access that attempts to program or erase a program-protected
block (FMPPEn bit is clear) is prohibited and can optionally generate an interrupt (by setting the AMASK
bit in the Flash Controller Interrupt Mask (FCIM) register) to alert software developers of poorly behaving
software during the development and debug phases.
The factory settings for the FMPREn and FMPPEn registers are a value of 1 for all implemented banks.
These settings create a policy of open access and programmability. The register bits can be changed by
clearing the specific register bit. The changes are not permanent until the register is committed (saved), at
which point the bit change is permanent. If a bit is changed from 1 to 0 and not committed, it can be
restored by executing a simulated power-on-reset (SIM_POR) event. The changes are committed using
the Flash Memory Control (FMC) register. For details on programming these bits, see
7.2.3.5
Execute-Only Protection
An application designer can use the execute-only protection to help protect the integrity and confidentiality
of software stored in these protected regions, helping prevent, for example, unauthorized software
updates or software reverse-engineering. If, however, the attacker has debug access or has malicious
code running, the confidentiality of the code in the execute-only region during runtime could be
compromised, for example by observing the effect of each instruction on CPU registers. Therefore, an
application designer should consider implementing additional security measures such as debug lock,
carefully written software update mechanisms, use of the memory protection unit (MPU), and other
appropriate security measures to protect valuable software.
Literal data introduces a complication to the protection mechanism. When C code is compiled and linked,
literal data (constants, and so on) is typically placed in the text section, between functions, by the
compiler. The literal data is accessed at run time through the use of the LDR instruction, which loads the
data from memory using a PC-relative memory address. The execution of the LDR instruction generates a
read transaction across the DCode bus of the Cortex-M4, which is subject to the execute-only protection
mechanism. If the accessed block is marked as execute only, the transaction is blocked, and the
processor is prevented from loading the constant data and, therefore, inhibiting correct execution.
Therefore, using execute-only protection requires that literal data be handled differently. There are three
ways to address this:
1. Use a compiler that allows literal data to be collected into a separate section that is put into one or
more read-enabled flash blocks. Note that the LDR instruction can use a PC-relative address, in which
case the literal pool cannot be located outside the span of the offset, or the software can reserve a
register to point to the base address of the literal pool and the LDR offset is relative to the beginning of
the pool.
2. Use a compiler that generates literal data from arithmetic instruction immediate data and subsequent
computation.