EM357-RTR datasheet(32/240 Pages) ETC2

32 / 240 page

EM351 / EM357

Table 5-1. Option Byte Storage

Address

bits [15:8]

bits [7:0]

Notes

0x08040800

Inverse Option Byte 0

Option Byte 0

Configures flash read protection

0x08040802

Inverse Option Byte 1

Option Byte 1

Reserved

0x08040804

Inverse Option Byte 2

Option Byte 2

Available for customer use1

0x08040806

Inverse Option Byte 3

Option Byte 3

Available for customer use1

0x08040808

Inverse Option Byte 4

Option Byte 4

Configures flash write protection

0x0804080A

Inverse Option Byte 5

Option byte 5

Configures flash write protection

0x0804080C

Inverse Option Byte 6

Option Byte 6

Configures flash write protection2

0x0804080E

Inverse Option Byte 7

Option Byte 7

Reserved

1 Option bytes 2 and 3 do not link to any specific hardware functionality other than the option byte loader. Therefore, they

are best used for storing data that requires a hardware verification of the data integrity.

2 Option byte 6 is reserved/unused in the EM351 due to the smaller flash size.

Table 5-2 shows the mapping of the option bytes that are used for read and write protection of the flash. Each

bit of the flash write protection option bytes protects a 4 page region of the main flash block. The EM351 has

16 regions and therefore option bytes 4 and 5 control flash write protection (option byte 6 is

reserved/unused). The EM357 has 24 regions and therefore option bytes 4, 5, and 6 control flash write

protection. These write protection bits are active low, and therefore the erased state of 0xFF disables write

protection. Like read protection, write protection only takes effect after a reset. Write protection not only

prevents a write to the region, but also prevents page erasure.

Option byte 0 controls flash read protection. When option byte 0 is set to 0xA5, read protection is disabled.

All other values, including the erased state 0xFF, enable read protection when coming out of reset. The

internal state of read protection (active versus disabled) can only be changed by applying a full chip reset. If a

debugger is connected to the EM35x, the intrusion state is latched. Read protection is combined with this

latched intrusion signal. When both read protection and intrusion are set, all flash is disconnected from the

internal bus. As a side effect, the CPU cannot execute code since all flash is disconnected from the bus. This

functionality prevents a debug tool from being able to read the contents of any flash. The only means of

clearing the intrusion signal is to disconnect the debugger and reset the entire chip using the nRESET pin. By

requiring a chip reset, a debugger cannot install or execute malicious code that could allow the contents of

the flash to be read.

The only way to disable read protection is to program option byte 0 with the value 0xA5. Option byte 0 must

be erased before it can be programmed. Erasing option byte 0 while read protection is active automatically

mass-erases the main flash block. By automatically erasing main flash, a debugger cannot disable read

protection and readout the contents of main flash without destroying its contents.

Note:

When read protection is active, the bottom four flash pages, addresses 0x08000000 to 0x08001FFF, are

automatically write-protected. Write protecting the bottom four flash pages of main flash prevents an

attacker from reprogramming the reset vector and executing arbitrary code.

In general, if read protection is active then write protection should also be active. This prevents an attacker

from reprogramming flash with malicious code that could readout the flash after the debugger is

disconnected. Even though read protection automatically protects the reset vector, the same technique of

reprogramming flash could be performed at an address outside the bottom four flash pages. To obtain fully

protected flash, both read protection and write protection should be active.

5-5

120-035X-000D

Preliminary

EM357-RTR 数据表(PDF) 32 Page - List of Unclassifed Manufacturers

EM357-RTR 数据表(HTML) 32 Page - List of Unclassifed Manufacturers

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

数据表下载