The RAMOPEN mode provides a means for
bootloader applications to exclusively access RAM for the purpose of storing code or
data downloaded from an external source. RAMOPEN can only be initiated by two
sources:
- Direct JTAG writes to the
RAMOPENFRC register. This gives the debugger the ability to open RAM access for
writing before downloading code to the RAM. Debugger writes to LINK1 RAM are
only allowed in SSUMODE1, in SSUMODE2, or when ZONE1 is enabled for full
debug.
- Boot loader code running in
LINK1.
RAMOPEN cannot be initiated by code
running from any of the user LINKs (2 and above).
When RAMOPEN is opened, the following
sequence occurs:
- The hardware erases the RAMs
using RAMINIT.
- Any write to RAM that was
initiated prior to or during RAMINIT is aborted. Write accesses can only update
RAM after RAMINIT completes and RAMOPEN status becomes active.
- LINK1 gains read, write and
execute permissions for RAMOPENed memories. All other LINKs have no access to
any of the RAMs.
- The SSU sets
RAMOPENSTAT.LINK1_RAMOPENS to 1 to indicate RAMOPEN is now active.
After the intended use for RAMOPEN
completes, return the RAM back to the user application by writing 1 to the
RAMOPENCLR.CLEAR_LINK1 register. Once the bit has been written, if the
RAMOPENFRC.WIPE_ON_LINK1_CLR bit was set, the device erases the RAM content for all
RAMOPENed memories using the RAMINIT feature, and then clears the
RAMOPENSTAT.LINK1_RAMOPENS bit. If the RAMOPENFRC.WIPE_ON_LINK1_CLR bit was not set,
then the RAM contents are preserved when RAM is returned to the user application.
This feature gives user bootloaders (for example, firmware updaters) the ability to
automatically wipe sensitive data or code from the RAM after the bootloader
operation completes.
The following sequence occurs when
RAMOPENCLR.CLEAR_LINK1 is written:
- If RAMOPENFRC.WIPE_ON_LINK1_CLR
is set, then the RAMs are erased using RAMINIT.
- Any write to RAM that was
initiated prior to or during RAMINIT is aborted. Only writes initiated after
RAMINIT completes and RAMOPEN status is set to inactive update the RAM.
- RAM access permissions are
allocated according to the configured user protection policy (UPP).
- The SSU sets
RAMOPENSTAT.LINK1_RAMOPENS to 0 to indicate RAMOPEN is now inactive.
Note: In RAMOPEN mode, unauthorized code
can be loaded into memory as LINK1 code. Any ZONEs that permit firmware updates from
the LINK1 can be updated without user code control. The most secure way to perform a
firmware update is to lock boot loaders down and use a secure firmware update
algorithm.