Forum Rule: Always post complete source code & details to reproduce any issue!
Results 1 to 6 of 6

Thread: Teensy 4.0 Recovery program in QSPI Flash

  1. #1
    Member
    Join Date
    Mar 2014
    Location
    Switzerland
    Posts
    94

    Teensy 4.0 Recovery program in QSPI Flash

    Hi All

    I understand that by holding the button down on the Teensy 4 for 15s will cause the reference program stored at the end of the QSPI flash to be loaded so that a "known-good" program runs.

    I see that the code is located at 0x601ff000 and occupies the last 4k of space but is it protected in any way? What happens if a mass erase were to be executed so that all of the QSPI flash were deleted? In such a situation (the code is no longer there) is it possible to brick the board by loading code that does something very wrong or can the boot loader chip always recover, irrespective of whether the small recovery code is present or not?

    Thanks

    Regards

    Mark

  2. #2
    Quote Originally Posted by uTasker View Post
    Hi All

    I understand that by holding the button down on the Teensy 4 for 15s will cause the reference program stored at the end of the QSPI flash to be loaded so that a "known-good" program runs.

    I see that the code is located at 0x601ff000 and occupies the last 4k of space but is it protected in any way? What happens if a mass erase were to be executed so that all of the QSPI flash were deleted? In such a situation (the code is no longer there) is it possible to brick the board by loading code that does something very wrong or can the boot loader chip always recover, irrespective of whether the small recovery code is present or not?

    Thanks

    Regards

    Mark
    That sector (0x1000 bytes) is locked as Read-only. So no it can't be erased or changed.

    See this thread for related information.

    https://forum.pjrc.com/threads/60118...ogram-Question

  3. #3
    Member
    Join Date
    Mar 2014
    Location
    Switzerland
    Posts
    94
    Thanks.
    I checked the status registers of the W25Q16 and find
    0x44 for register 1 and
    0x03 for register 2
    This interprets to having the last 4k protected and the protection locked until the next power cycle.
    Also I verified that it can't be erased in this state.

    Regards

    Mark

  4. #4
    Quote Originally Posted by uTasker View Post
    Thanks.
    I checked the status registers of the W25Q16 and find
    0x44 for register 1 and
    0x03 for register 2
    This interprets to having the last 4k protected and the protection locked until the next power cycle.
    Also I verified that it can't be erased in this state.

    Regards

    Mark

    Can you tell me how I can see the registers of the W25Q16?

  5. #5
    Member
    Join Date
    Mar 2014
    Location
    Switzerland
    Posts
    94
    >>Can you tell me how I can see the registers of the W25Q16?

    One needs to program the FlexSPI's look-up table with the commands to read registers 1 and 2 and have an FlexSPI driver to execute the instructions. I understand that there is EEPROM emulation in the Teensyduino library that probably allows register 1 reading, and the register 2 interface is almost identical.

    According to the data sheet of the W25Q16 the "Power Supply Lock-Down" state stops the status register from being written to again until the next power-down (which blocks changing the protection) but that this only persists "until the next power cycle", after which it is no loner restricted. Whether I do a power cycle the same state is found and so I am wondering whether the power-on-reset is being controlled by the boot loader chip, which always re-writes this state(?). The control bits are essentially non-volatile bits which are programmed each time (although maybe no when the "Power Supply Lock-Down" is written) so I also wonder whether there could be wear on the register when it is programmed after every power cycle(?). The "One Time Program" mode could also be used to block any further modifications to the protection settings, but maybe this was too extreme in case there were future need to modify something (?)

    Regards

    Mark

  6. #6
    Quote Originally Posted by uTasker View Post
    >>Can you tell me how I can see the registers of the W25Q16?

    One needs to program the FlexSPI's look-up table with the commands to read registers 1 and 2 and have an FlexSPI driver to execute the instructions. I understand that there is EEPROM emulation in the Teensyduino library that probably allows register 1 reading, and the register 2 interface is almost identical.

    According to the data sheet of the W25Q16 the "Power Supply Lock-Down" state stops the status register from being written to again until the next power-down (which blocks changing the protection) but that this only persists "until the next power cycle", after which it is no loner restricted. Whether I do a power cycle the same state is found and so I am wondering whether the power-on-reset is being controlled by the boot loader chip, which always re-writes this state(?). The control bits are essentially non-volatile bits which are programmed each time (although maybe no when the "Power Supply Lock-Down" is written) so I also wonder whether there could be wear on the register when it is programmed after every power cycle(?). The "One Time Program" mode could also be used to block any further modifications to the protection settings, but maybe this was too extreme in case there were future need to modify something (?)

    Regards

    Mark


    I read somewhere on this Forum Paul saying the area is irreversibly set to read-only. Leading me to believe it was written to with the one time write command.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •