Teensy 4.0 Recovery program in QSPI Flash

[uTasker]

Hi All

I understand that by holding the button down on the Teensy 4 for 15s will cause the reference program stored at the end of the QSPI flash to be loaded so that a "known-good" program runs.

I see that the code is located at 0x601ff000 and occupies the last 4k of space but is it protected in any way? What happens if a mass erase were to be executed so that all of the QSPI flash were deleted? In such a situation (the code is no longer there) is it possible to brick the board by loading code that does something very wrong or can the boot loader chip always recover, irrespective of whether the small recovery code is present or not?

Thanks

Regards

Mark

 

[bigboosted]

Hi All

I understand that by holding the button down on the Teensy 4 for 15s will cause the reference program stored at the end of the QSPI flash to be loaded so that a "known-good" program runs.

I see that the code is located at 0x601ff000 and occupies the last 4k of space but is it protected in any way? What happens if a mass erase were to be executed so that all of the QSPI flash were deleted? In such a situation (the code is no longer there) is it possible to brick the board by loading code that does something very wrong or can the boot loader chip always recover, irrespective of whether the small recovery code is present or not?

Thanks

Regards

Mark

That sector (0x1000 bytes) is locked as Read-only. So no it can't be erased or changed.

See this thread for related information.

https://forum.pjrc.com/threads/60118-4-0-Restore-Program-Question

 

[uTasker]

Thanks.
I checked the status registers of the W25Q16 and find
0x44 for register 1 and
0x03 for register 2
This interprets to having the last 4k protected and the protection locked until the next power cycle.
Also I verified that it can't be erased in this state.

Regards

Mark

 

[bigboosted]

Thanks.
I checked the status registers of the W25Q16 and find
0x44 for register 1 and
0x03 for register 2
This interprets to having the last 4k protected and the protection locked until the next power cycle.
Also I verified that it can't be erased in this state.

Regards

Mark

Can you tell me how I can see the registers of the W25Q16?

 

[uTasker]

>>Can you tell me how I can see the registers of the W25Q16?

One needs to program the FlexSPI's look-up table with the commands to read registers 1 and 2 and have an FlexSPI driver to execute the instructions. I understand that there is EEPROM emulation in the Teensyduino library that probably allows register 1 reading, and the register 2 interface is almost identical.

According to the data sheet of the W25Q16 the "Power Supply Lock-Down" state stops the status register from being written to again until the next power-down (which blocks changing the protection) but that this only persists "until the next power cycle", after which it is no loner restricted. Whether I do a power cycle the same state is found and so I am wondering whether the power-on-reset is being controlled by the boot loader chip, which always re-writes this state(?). The control bits are essentially non-volatile bits which are programmed each time (although maybe no when the "Power Supply Lock-Down" is written) so I also wonder whether there could be wear on the register when it is programmed after every power cycle(?). The "One Time Program" mode could also be used to block any further modifications to the protection settings, but maybe this was too extreme in case there were future need to modify something (?)

Regards

Mark

 

[bigboosted]

>>Can you tell me how I can see the registers of the W25Q16?

One needs to program the FlexSPI's look-up table with the commands to read registers 1 and 2 and have an FlexSPI driver to execute the instructions. I understand that there is EEPROM emulation in the Teensyduino library that probably allows register 1 reading, and the register 2 interface is almost identical.

According to the data sheet of the W25Q16 the "Power Supply Lock-Down" state stops the status register from being written to again until the next power-down (which blocks changing the protection) but that this only persists "until the next power cycle", after which it is no loner restricted. Whether I do a power cycle the same state is found and so I am wondering whether the power-on-reset is being controlled by the boot loader chip, which always re-writes this state(?). The control bits are essentially non-volatile bits which are programmed each time (although maybe no when the "Power Supply Lock-Down" is written) so I also wonder whether there could be wear on the register when it is programmed after every power cycle(?). The "One Time Program" mode could also be used to block any further modifications to the protection settings, but maybe this was too extreme in case there were future need to modify something (?)

Regards

Mark

I read somewhere on this Forum Paul saying the area is irreversibly set to read-only. Leading me to believe it was written to with the one time write command.