Flash Management for Firmware Development
521
SNIU028A – February 2016 – Revised April 2016
Copyright © 2016, Texas Instruments Incorporated
Flash Memory Programming, Integrity, and Security
17.3 Flash Management for Firmware Development
During the development phase, the main goal is to avoid activating flash security.
There are several ways to do this, depending on the situation.
17.3.1 Best Practice for Firmware Development
The best practice for firmware development is very simple.
•
Never make the program flash checksum correct.
The disadvantages of this method are:
1. The device must always be connected to the PMBus and told to start executing
2. Anyone with the proper tools can read the flash – there is no security.
17.3.2 Firmware Development with "Backdoors"
Sometimes there are situations where development level firmware is required to start automatically with no
PMBus interface command to start it. In this case, the program flash checksum must be programmed.
There may also be cases where flash security is desired for firmware under development. Again, the
checksum must be programmed, preventing the device from going to ROM mode.
In this case, if reprogramming is desired, some kind of backdoor must be provided to clear the checksum.
There are several backdoor techniques described below. Any one of them is adequate if used properly.
For a robust and easy to use solution, however, the use of 2 or more backdoors is strongly suggested.
The techniques are:
•
I/O line based backdoors
•
Communications port based backdoors
17.3.3 I/O Line Based Backdoors
This backdoor can provide security, if done properly. It starts with the firmware checking an I/O line at
startup – before the rest of the system is initialized – and branching to the backdoor if the I/O line is in the
proper state.
The big advantage of the I/O line based backdoor is that firmware changes are unlikely to make it stop
working. Since it is at the very beginning of the code, changes later in the code should not affect it.
The simplest way involves just branching straight to the code that clears the flash. In this case, the code
can erase the entire flash, preventing others from being able to read it. There are several ways to do this:
17.3.3.1 Serial Port Based Backdoor
The serial port backdoor is most useful if the serial port is being used for primary to secondary
communication. The serial port (RX) pin can be programmed as an input and its state read. If the line is
high, the serial port is in its normal state. If it is low, then the flash should be cleared. It may be necessary
to put in a pull up resistor if chip transmitting is absent or powered down. It is also necessary to ensure
that the other chip will not transmit data when the UCD3138 is coming out of reset. If this is done, the
UART RX pin can be used as a backdoor, and as an RX pin. This mode is used in the UCD3138
introductory lab training programs.
Advantages
1. Doesn’t waste an I/O line
2. Can be triggered by other chip via serial port
Disadvantages
1. Pull up may be needed
2. Other chip must avoid transmitting at sampling time (just after reset)