SWCU195A December 2024 – May 2025 CC2744R7-Q1 , CC2745P10-Q1 , CC2745R10-Q1 , CC2745R7-Q1 , CC2755R10
The debug subsystem supports several methods for restricting access to the device through the SWD interface. The debug access policy is determined by the user configuration specified in the CCFG flash region. See Section 10.3 for a detailed description of debug access control through the CCFG flash region.
There are 3 levels of access control, given in Table 5-3. By default, products shipped from TI arrive in a "debug enabled" state, where the device is fully open. This state is not recommended for production. For production, TI recommends changing the debug configuration to 'require authentication' or 'disabled'.
| DEBUGSS Function | Debug Configuration | ||
|---|---|---|---|
| Debug Enabled (default) | Debug Enabled with Authentication | Debug Disabled | |
| SW-DP (Debug Port) | EN | EN | DIS |
| CFG-AP | EN | EN | DIS |
| SEC-AP | EN | EN | DIS |
| AHB-AP (CPU Debug) | EN | EN w/ Authentication | DIS |
When debug is enabled with public key-based authentication, the debug access commands implementing a secure challenge-response sequence must be provided to the DEBUGSS mailbox by the debug probe.
When debug is disabled, the SW-DP is disabled during the boot process. Any commands previously sent to the mailbox are ignored during boot. Following boot, any attempt to connect to the SW-DP is ignored.
Debug access can be permanently locked by configuring the CCFG flash region to disable debug access while also configuring the CCFG flash region as statically write-protected (locked). Locking the CCFG configuration has the added security of preventing the ROM serial bootloader and application code from changing the debug security policy.