SWCU193A April 2023 – August 2024 CC2340R2 , CC2340R5 , CC2340R5-Q1
The debug subsystem supports several methods for restricting access to the device through the SWD interface. The debug access policy is determined by the user configuration specified in the CCFG flash region. See Section 9.2 for a detailed description of debug access control through the CCFG flash region.
There are three levels of access control, given in Table 5-3. By default, products shipped from TI arrive in a "debug enabled" state where the device is fully open. This state is not recommended for production. For production, TI recommends changing the debug configuration to password-protected or disabled.
| DEBUGSS Function | Debug Configuration | ||
|---|---|---|---|
| Debug Enabled (default) | Debug Enabled with Password | Debug Disabled | |
| SW-DP(debug port) | EN | EN | DIS |
| CFG-AP | EN | EN | DIS |
| SEC-AP | EN | EN | DIS |
| AHB-AP (CPU Debug) | EN | EN w/ PW | DIS |
When debug is enabled with a password, the debug access command together with the user-specified debug access password must be provided to the DEBUGSS mailbox by the debug probe.
When debug is disabled, the SW-DP is disabled during the boot process. Any commands previously sent to the mailbox are ignored during boot. Following boot, any attempt to connect to the SW-DP is ignored.
Debug access can be permanently locked by configuring the CCFG flash region to disable debug access while also configuring the CCFG flash region as statically write-protected (locked). Locking the CCFG configuration has the added security of preventing the bootstrap loader (BSL) and application code from changing the debug security policy.