The RAMOPEN mode provides a means for bootloader applications to exclusively access RAM for the purpose of storing code or data downloaded from an external source. RAMOPEN can only be initiated by two sources:
- Direct JTAG writes to the RAMOPENFRC register. This gives the debugger the ability to open RAM access for writing before downloading code to the RAM. Debugger writes to LINK1 RAM are only allowed in SSUMODE1, in SSUMODE2, or when ZONE1 is enabled for full debug.
- Boot loader code running in LINK1.
RAMOPEN cannot be initiated by code running from any of the user LINKs (2 and above).
When RAMOPEN is opened, the following sequence occurs:
- The hardware erases the RAMs using RAMINIT.
- Any write to RAM that was initiated prior to or during RAMINIT is aborted. Write accesses can only update RAM after RAMINIT completes and RAMOPEN status becomes active.
- LINK1 gains read, write and execute permissions for RAMOPENed memories. All other LINKs have no access to any of the RAMs.
- The SSU sets RAMOPENSTAT.LINK1_RAMOPENS to 1 to indicate RAMOPEN is now active.
After the intended use for RAMOPEN completes, return the RAM back to the user application by writing 1 to the RAMOPENCLR.CLEAR_LINK1 register. Once the bit has been written, if the RAMOPENFRC.WIPE_ON_LINK1_CLR bit was set, the device erases the RAM content for all RAMOPENed memories using the RAMINIT feature, and then clears the RAMOPENSTAT.LINK1_RAMOPENS bit. If the RAMOPENFRC.WIPE_ON_LINK1_CLR bit was not set, then the RAM contents are preserved when RAM is returned to the user application. This feature gives user bootloaders (for example, firmware updaters) the ability to automatically wipe sensitive data or code from the RAM after the bootloader operation completes.
The following sequence occurs when RAMOPENCLR.CLEAR_LINK1 is written:
- If RAMOPENFRC.WIPE_ON_LINK1_CLR is set, then the RAMs are erased using RAMINIT.
- Any write to RAM that was initiated prior to or during RAMINIT is aborted. Only writes initiated after RAMINIT completes and RAMOPEN status is set to inactive update the RAM.
- RAM access permissions are allocated according to the configured user protection policy (UPP).
- The SSU sets RAMOPENSTAT.LINK1_RAMOPENS to 0 to indicate RAMOPEN is now inactive.
Note: In RAMOPEN mode, unauthorized code can be loaded into memory as LINK1 code. Any ZONEs that permit firmware updates from the LINK1 can be updated without user code control. The most secure way to perform a firmware update is to lock boot loaders down and use a secure firmware update algorithm.
|
Enabled |
Start Address |
End Address |
Comment |
| CPU1.LINK1 |
Yes |
0x200E 0000 |
0x2010 FFFF |
RAM used by bootloaders. Includes all LDAx and LPAx RAMs. |
| All other LINKs |
No |
N/A |
N/A |
N/A |