• State TI Thinks Resolved
  • Locked Locked
  • Replies 5 replies
  • Answers 3 answers
  • Subscribers 20 subscribers
  • Views 1217 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC1352R: Memory protection and unprotection

Juan Fernandez Blasco
Prodigy 60 points

Part Number: CC1352R
Other Parts Discussed in Thread: CC2538

Dear all,

I am Juan and I am working with the CC1352R1 MCU. My aim is to protect the flash memory, but also to know how to unprotect the flash memory of the device once protected.

I am attaching some screenshots of the main parts of the TI docs I have already read about this topic.

The table is taken from the doc called Secure Boot in SimpleLink™ CC13x2/CC26x2 Wireless MCUs and the text below the table is taken from the doc called CC13x2, CC26x2 SimpleLink™ Wireless MCU Technical Reference Manual.

I have also searched in the SDK version 4.20.01.04 but did not find any function for protecting/unprotecting the flash memory. I deepened into the files NVSCC26XX.c and NVS.c and found some functions like NVS_LockFxn and NVS_UnlockFxn, but I read that they are used for other purposes, not for the one I want.

So, in conclusion, I guess the protection method which I should carry out is the one described in the text below the table. Is there anything more I should take into account? How is the unprotection method?

Thanks for your attention.

Best regards,

Juan

  • 0
    TI__Guru* 87321 points

    In addition to reading about the Customer Configuration (CCFG) section in the TRM, you can also look at the flash documentation in driverlib:

    BR

    Siri

     

  • 0 in reply to Siri
    Prodigy 60 points

    Hello Siri,

    thanks so much for your answer. Those days I keep researching about the flash memory protection in TI. Also, I took some time to read about the flash library from the SDK you suggested to me.

    Regarding the flash library, understood that I can protect the flash memory using the function FlashProtectionSet, but then, if I want to unprotect I have to do a reset of the device. Does it mean that if I turn off and turn on again the device, the flash sector which was protected is now unprotected? Or does it means that I have to do a forced mass erase to unprotect it?

    In the end, I protected the flash memory by following the 7 steps from my previous message. Then, if I want to unprotect the flash memory, what I do is a forced mass erase by using the program Flash Programmer 2 so that the MCU takes the status as if it has just been delivered from the factory. By now, this is the solution I chose but I read and tried more stuff I saw it was possible.

    I enter the bootloader mode of the MCU and send commands via UART. After establishing the communication sending two bytes with value 0x55 and receiving an ACK, I send more commands, but I do not get any response from the MCU. Any hints? Just to let you know what I do: for example, to send the command COMMAND_GET_CHIP_ID, I send the following sequence of bytes as indicated in the protocol: 0x03 (length), 0x28 (checksum) and 0x28 (command value), is that correct? Then, I wait for an ACK (0xCC), but nothing comes.

    Also, is it possible to do a forced mass erase to unprotect the flash memory from the bootloader mode? From what I read it is possible to do a bank erase of the memory sectors which are not write-protected, so I guess it is not possible to unprotect the flash by using the bootloader mode, right?

    The last point: I have read that a chip erase can be performer via JTAG even deactivating its ports in the CCFG file because some features of JTAG WUC remain enabled. So I guess it is possible to do a forced mass erase to unprotect the flash memory using the JTAG. The thing is that I did not find the procedure to do it. Could you provide some information about it? Or maybe an example would be also great.

    Thanks in advance for everything.

    Best regards,

    Juan

  • 0 in reply to Juan Fernandez Blasco
    TI__Genius 14845 points

    Hi Juan, 

    If you have protected the flash that means that you cannot read or write to flash. The only way of unlocking the flash is the forced mass erase which wipes the whole flash of the device and resets the CCFG to the default values. It is unfortunately not possible to unprotect the flash using the serial bootloader. 

    There is an application note about the serial bootloader on the CC2538/CC26x0/CC26x2  devices that where you can find a lot of useful information if you are interested in learning more about it. 

    If you want to perform a mass erase using JTAG in Flash Programmer 2, you should mark the device under "XDS-110, XDS-xxxxxxxx", press Tools-> "CC13xx/CC26xx Forced Mass Erase" and wait for the erase is successful. 

    Thanks, 
    Elin

  • 0 in reply to Elin W
    Prodigy 60 points

    Hello Elin,

    thanks a lot for your message.

    so, just to confirm, I can use the flash library function "FlashProtectionSet" to protect whatever sector but then I have to do a forced mass erase if I want to unprotect the protected sectors, right?

    Another question: is there any possible way to check which sectors are protected? I mean any function which returns the protected sectors or something like that.

    About the bootloader mode, I already read the manual you sent me and some more, but after establishing the communication sending two bytes with value 0x55 and receiving an ACK, I send more commands, but I do not get any response from the MCU. Just to let you know what I do: for example, to send the command COMMAND_GET_CHIP_ID, I send the following sequence of bytes as indicated in the protocol: 0x03 (length), 0x28 (checksum) and 0x28 (command value), is that correct? Then, I wait for an ACK (0xCC), but nothing comes. If you have any hint let me know.

    Best regards,

    Juan

  • 0 in reply to Juan Fernandez Blasco
    TI__Guru 58425 points

    Hi Juan,

    To clear a few confusions out here. The FlashProtectionSet() will disable the flash FSM for that given page, meaning it can't be erased or written. It does not prevent reading the flash. Calling this API will only apply the protection until the next device reset as this will also reset the flash FSM. 

    How do I then get a lasting protection? Well in that case you will need to write the corresponding "protection" bit inside the CCFG region. This region is read during device bootup (ROM level) and in cases a flash page is set to be protected, the flash FSM will be disabled (and this would occur each reset until the CCFG protection bit was cleared). 

    This means that you can select from having a "device level" protect where the specific region is set to be "protected" during boot, or you can handle it yourself (potentially leaving it unprotected during bootup).

    As for how to check what is protected, you can use the FlashProtectionGet() API.