
EM358x
Rev. 0.4
15
Table 2-1. Option Byte Storage
Address
bits [15:8]
bits [7:0]
Notes
0x08080800
Inverse Option Byte 0
Option Byte 0
Configures flash read protection
0x08080802
Inverse Option Byte 1
Option Byte 1
Reserved
0x08080804
Inverse Option Byte 2
Option Byte 2
Available for customer use
1
0x08080806
Inverse Option Byte 3
Option Byte 3
Available for customer use
1
0x08080808
Inverse Option Byte 4
Option Byte 4
Configures flash write protection
0x0808080A
Inverse Option Byte 5
Option byte 5
Configures flash write protection
0x0808080C Inverse Option Byte 6
Option Byte 6
Configures flash write protection
0x0808080E
Inverse Option Byte 7
Option Byte 7
Configures flash write protection
1
Option bytes 2 and 3 do not link to any specific hardware functionality other than the option byte loader. Therefore, they are best used
for storing data that requires a hardware verification of the data integrity.
Table 2-2 shows the mapping of the option bytes that are used for read and write protection of the flash. Each bit
of the flash write protection option bytes protects a 4 page region of the main flash block. The EM358x has up to
32 regions and therefore option bytes 4, 5, 6, and 7 control flash write protection. These write protection bits are
active low, and therefore the erased state of 0xFF disables write protection. Like read protection, write protection
only takes effect after a reset. Write protection not only prevents a write to the region, but also prevents page
erasure.
Option byte 0 controls flash read protection. When option byte 0 is set to 0xA5, read protection is disabled. All
other values, including the erased state 0xFF, enable read protection when coming out of reset. The internal state
of read protection (active versus disabled) can only be changed by applying a full chip reset. If a debugger is
connected to the EM358x, the intrusion state is latched. Read protection is combined with this latched intrusion
signal. When both read protection and intrusion are set, all flash is disconnected from the internal bus. As a side
effect, the CPU cannot execute code since all flash is disconnected from the bus. This functionality prevents a
debug tool from being able to read the contents of any flash. The only means of clearing the intrusion signal is to
disconnect the debugger and reset the entire chip using the nRESET pin. By requiring a chip reset, a debugger
cannot install or execute malicious code that could allow the contents of the flash to be read.
The only way to disable read protection is to program option byte 0 with the value 0xA5. Option byte 0 must be
erased before it can be programmed. Erasing option byte 0 while read protection is active automatically mass-
erases the main flash block. By automatically erasing main flash, a debugger cannot disable read protection and
readout the contents of main flash without destroying its contents.
In general, if read protection is active then write protection should also be active. This prevents an attacker from
reprogramming flash with malicious code that could readout the flash after the debugger is disconnected. To
obtain fully protected flash, both read protection and write protection should be active.
Table 2-2. Option Byte Write Protection Bit Map
Option Byte
Bit
Notes
Option Byte 0
bit [7:0]
Read protection of all flash (MFB, FIB, CIB)
Option Byte 1
bit [7:0]
Reserved for Silicon Labs use
Option Byte 2
bit [7:0]
Available for customer use
Option Byte 3
bit [7:0]
Available for customer use
Содержание EMBER EM358 series
Страница 2: ...EM358x 2 Rev 0 4 ...
Страница 7: ...EM358x Rev 0 4 7 ...