How to set lockbits on ATiny3227?

[Uwne]

Hi,

how I can set the lock bits on ATiny3227 devices to protect the device for read out?
On old ATinys it was very ease to do with AVR Studio, but I have no idea how to set them with updi.

Thanks!
Uwne

[SpenceKonde]

Hm, well that's interesting. SerialUPDI doesn't offer a way to - it's not even clear to me how you do it. Probably by writefuse command command against address 0x0A? It's never explicitly stated (they seem allergic to documenting anything related to the lockbits, as if it will blow open their security to tell people how to use it (hopefully not...), ie, at an offset of 10 from the start of the fuses... but it's entirely possible that SerialUPDI will reject an attempt to write to fuse10, since it knows there are only 10 fuses, and that the 11th fuse isn't a valid fuse.I've never tried to set the lockbits. I imagine it could be done with avrdude and a updi programmer without any complications. C5 = unlocked, any other value = locked, and they set it to 0x3A to lock it, (values are 0b11000101 and 0b00111010 respectively. The Dx-series made it 4 bytes long - every nybble of the unlocked value a 5 or a C. I suspect that there is some deep reason that those numbers are harder to glitch the chip into reading from the lockbits than a randomly chosen value.

(supposedly that's how places usually break into locked chips - they play with the voltage (and clock if they can), trying to make it glitch in just the right way - hence why it's more secure to require it read values other than all 1's or all zeros.
And I wager that there are certain addresses that they make sure never hold the unlock value, for that matter... I'll bet there are other addresses that they avoid having that magic value in.....)

[mechatroniks-git]

Here's how I do it, the only method I found at the time at worked, was pymucprog, adjust your COM port and attiny to attiny3227

pymcuprog -t uart -u COM8 -d attiny1614 write -m lockbits -l 0

to chip erase, when locked

pymcuprog -t uart -u COM8 -d attiny1614 erase -C

To confirm it's locked, use this to read the userrow, which should work when unlocked, but spit errors when locked.

pymcuprog -t uart -u COM8 -d attiny1614 read -m user_row

[Uwne]

Thanks Spence an mechatroniks-git. I will give it a try. First I need to swap the programmer, I still use jtag2updi.
Maybe I can try with my Pickit4, still need to set in into AVR Mode to use UPDI, never tried.

[coderatchance]

Looking into locking the 3217 , indeed, there is no explicit instructions how to tackle this, or is it?
In past, this was done on tiny45 via the AVRDUDE,
below is a script example, however, I am wondering, if we can use the same concept and fuses on the 3217?

Best

#!/bin/bash

-- change the fuse -- slowly B100, deselect divide the clock by 8, including set the BOD on 2.7V ?

avrdude -P usb -c usbasp -b 115200 -p ATtiny45 -s -U lfuse:w:0xe2:m -U efuse:w:0xff:m -U hfuse:w:0xdd:m -B100


-- perform chip erase?

-- now quickly B1 upload the program -- 

avrdude -P usb -c usbasp -b 115200 -p ATtiny45 -s -U flash:w:/Users/xxx/Desktop/xxx_Ver_on_ATTiny_original.ino.hex -B1

-- avrdude -P usb -c usbasp -b 115200 -p ATtiny45 -s -U flash:w:/Users/xxx/Desktop/xxx_Ver_on_ATTiny_no_ledSig.ino.hex -B1

-- at the end lock the chip, otherwise is not possible to do the programming, Mode 3 : further programming and verification disabled

avrdude -P usb -c usbasp -b 115200 -p ATtiny45 -s -U lock:w:0xFC:m


echo it works?

[hmeijdam]

I am using Avrdudess to lock and unlock these tinies.

Connecting a CH340 with diode serial adapter to the UPDI pin and despite it tells me that the MCU is not supported I can chenge the lockbits from 0x5C to something else, to lock the device. After that change I can't read the contents.

To unlock it again, set the lockbit to 0xC5 and tick "Erase flash and EEPROM" and the Force (-F) flag.

programming and locking in one go is also possible. Just select the hexfile you want to program, change the lockbit to e.g. 0xC4 and press "Program!"

[coderatchance]

Great! Thanks for posting this, unfortunately, I am on MAC, hence the command line, anyway, would you please post the line circled with the red?

I guess this is the command line for the AVRDUDE!

[hmeijdam]

Did you give it a try?

https://blog.zakkemble.net/avrdudess-a-gui-for-avrdude/

Linux & macOS
Can be ran using Mono.
Has not been tested on macOS, but should work. Might need the --arch=32 argument.
mono --arch=32 avrdudess.exe

-c serialupdi -p t204 -P COM32 -b 187500 -F -U flash:w:"C:\Users\Hans\Desktop\test.hex":i -U lock:w:0xC4:m

[hmeijdam]

And for unlocking / erasing
-c serialupdi -p t204 -P COM32 -b 187500 -F -V -e -U flash:v:"C:\Users\Hans\Desktop\test.hex":i -U lock:w:0xC5:m

You will need a relatively new version (7.0) of Avrdude

[coderatchance]

Got it to lock, apparently, because it works, however, I cannot overwrite it .
Do I need to first unlock/erase the chip with the above snipet ?
What about just "erase" it?

[hmeijdam]

Yes, the unlock is done by the erase, and setting the lockbit to 0xC5 again.

[coderatchance]

Tryin to use:

imac@iMacs-iMac ~ % avrdude -P /dev/cu.usbmodem14401 -b 115200 -c jtag2updi -p ATtiny3216 -t

avrdude: AVR device initialized and ready to accept instructions

Reading |                                                    | 0% 0.00savrdude: jtagmkII_program_enable(): bad response to enter progmode command: RSP_ILLEGAL_MCU_STATE
avrdude: jtagmkII_program_enable(): bad response to enter progmode command: RSP_ILLEGAL_MCU_STATE
avrdude: jtagmkII_read_byte(): bad response to read memory command: RSP_ILLEGAL_MCU_STATE
avr_read(): error reading address 0x0000
    read operation not supported for memory "signature"
avrdude: error reading signature data for part "ATtiny3216", rc=-2
avrdude: error reading signature data, rc=-2
avrdude: jtagmkII_program_disable(): bad response to leave progmode command: RSP_ILLEGAL_MCU_STATE

avrdude done.  Thank you.****

--- where I want to do the erase, but somehow I cannot get into it ?

[hmeijdam]

add -e

And if you want to set the lockbit back at 0xC5 add -U lock:w:0xC5:m

[coderatchance]

It works, however, the chip is still locked?

avrdude: Version 7.0
         Copyright (c) Brian Dean, http://www.bdmicro.com/
         Copyright (c) Joerg Wunsch

         System wide configuration file is "/usr/local/etc/avrdude.conf"
         User configuration file is "/Users/imac/.avrduderc"
         User configuration file does not exist or is not a regular file, skipping

         Using Port                    : /dev/cu.usbmodem14401
         Using Programmer              : jtag2updi
         Overriding Baud Rate          : 115200
JTAG ICE mkII sign-on message:
Communications protocol version: 1
M_MCU:
  boot-loader FW version:        1
  firmware version:              6.00
  hardware version:              1
S_MCU:
  boot-loader FW version:        1
  firmware version:              6.00
  hardware version:              1
Serial number:                   00:00:00:00:00:00
Device ID:                       JTAGICE mkII
         AVR Part                      : ATtiny3216
         RESET disposition             : dedicated
         RETRY pulse                   : SCK
         Serial program mode           : yes
         Parallel program mode         : yes
         Memory Detail                 :

                                           Block Poll               Page                       Polled
           Memory Type Alias    Mode Delay Size  Indx Paged  Size   Size #Pages MinW  MaxW   ReadBack
           ----------- -------- ---- ----- ----- ---- ------ ------ ---- ------ ----- ----- ---------
           signature               0     0     0    0 no          3    1      0     0     0 0x00 0x00
           prodsig                 0     0     0    0 no         61   61      0     0     0 0x00 0x00
           sernum                  0     0     0    0 no         10    1      0     0     0 0x00 0x00
           osccal16                0     0     0    0 no          2    1      0     0     0 0x00 0x00
           osccal20                0     0     0    0 no          2    1      0     0     0 0x00 0x00
           tempsense               0     0     0    0 no          2    1      0     0     0 0x00 0x00
           osc16err                0     0     0    0 no          2    1      0     0     0 0x00 0x00
           osc20err                0     0     0    0 no          2    1      0     0     0 0x00 0x00
           fuses                   0     0     0    0 no          9   10      0     0     0 0x00 0x00
           fuse0       wdtcfg      0     0     0    0 no          1    1      0     0     0 0x00 0x00
           fuse1       bodcfg      0     0     0    0 no          1    1      0     0     0 0x00 0x00
           fuse2       osccfg      0     0     0    0 no          1    1      0     0     0 0x00 0x00
           fuse4       tcd0cfg     0     0     0    0 no          1    1      0     0     0 0x00 0x00
           fuse5       syscfg0     0     0     0    0 no          1    1      0     0     0 0x00 0x00
           fuse6       syscfg1     0     0     0    0 no          1    1      0     0     0 0x00 0x00
           fuse7       append      0     0     0    0 no          1    1      0     0     0 0x00 0x00
           fuse8       bootend     0     0     0    0 no          1    1      0     0     0 0x00 0x00
           lock                    0     0     0    0 no          1    1      0     0     0 0x00 0x00
           data                    0     0     0    0 no          0    1      0     0     0 0x00 0x00
           userrow     usersig     0     0     0    0 no         32   32      0     0     0 0x00 0x00
           flash                   0     0     0    0 no      32768  128      0     0     0 0x00 0x00
           eeprom                  0     0     0    0 no        256   64      0     0     0 0x00 0x00

         Programmer Type : JTAGMKII_PDI
         Description     : JTAGv2 to UPDI bridge
         M_MCU HW version: 1
         M_MCU FW version: 6.00
         S_MCU HW version: 1
         S_MCU FW version: 6.00
         Serial number   : 00:00:00:00:00:00
         Vtarget         : 5.0 V

avrdude: AVR device initialized and ready to accept instructions

Reading |                                                    | 0% 0.00savrdude: jtagmkII_program_enable(): bad response to enter progmode command: RSP_ILLEGAL_MCU_STATE
avrdude: jtagmkII_program_enable(): bad response to enter progmode command: RSP_ILLEGAL_MCU_STATE
avrdude: jtagmkII_read_byte(): bad response to read memory command: RSP_ILLEGAL_MCU_STATE
avr_read(): error reading address 0x0000
    read operation not supported for memory "signature"
avrdude: error reading signature data for part "ATtiny3216", rc=-2
avrdude: error reading signature data, rc=-2
avrdude: jtagmkII_program_disable(): bad response to leave progmode command: RSP_ILLEGAL_MCU_STATE

avrdude done.  Thank you.

imac@iMacs-iMac ~ % 

[hmeijdam]

What command line did you enter?

https://avrdudes.github.io/avrdude/7.1/avrdude_3.html#Option-Descriptions

You may want to read some of Avrdude documentation to understand what all the arguments do.

[coderatchance]

avrdude -P /dev/cu.usbmodem14401 -b 115200 -c jtag2updi -p ATtiny3216 -V -v -e -U flash:v:"/Users/imac/Desktop/My_hex_files/QT_3_2_16.ino.hex":i -U lock:w:0xC5:m

I am not really sure whether there should be a capital -V or small , etc.
I guess the best would be to delete the whole lock bits...

[hmeijdam]

-v
Enable verbose output. More -v options increase verbosity level.
-V
Disable automatic verify check when uploading data.

Both are not really important

Does this work?

avrdude -P /dev/cu.usbmodem14401 -b 115200 -c jtag2updi -p ATtiny3216 -V -v -v -v -v -e -U flash:w:"/Users/imac/Desktop/My_hex_files/QT_3_2_16.ino.hex":i -U lock:w:0xC5:m

(i added 4 x -v, then you get verbosity output level 4, which is a LOT of feedback about the whole operation.

[coderatchance]

Thanks, will give it a go, but why is a simple erase not working is above me?
The funny thing is that the chip and its app is working without a problem, I cannot access it at all :) not with the command line , nor with the Arduino ide, which is actually programming via avrdude...

imac@iMacs-iMac ~ % avrdude -P /dev/cu.usbmodem14401 -c jtag2updi -p ATtiny3216 -e 

avrdude: AVR device initialized and ready to accept instructions

Reading |                                                    | 0% 0.00savrdude: jtagmkII_program_enable(): bad response to enter progmode command: RSP_ILLEGAL_MCU_STATE
avrdude: jtagmkII_program_enable(): bad response to enter progmode command: RSP_ILLEGAL_MCU_STATE
avrdude: jtagmkII_read_byte(): bad response to read memory command: RSP_ILLEGAL_MCU_STATE
avr_read(): error reading address 0x0000
    read operation not supported for memory "signature"
avrdude: error reading signature data for part "ATtiny3216", rc=-2
avrdude: error reading signature data, rc=-2
avrdude: jtagmkII_program_disable(): bad response to leave progmode command: RSP_ILLEGAL_MCU_STATE

avrdude done.  Thank you.

imac@iMacs-iMac ~ % 

[hmeijdam]

That's exactly how a locked chip should behave. The program is there, but you cannot read it.

It seems to me that your programmer has problems reading the signature byte of the chip.

You may give it a try and add the -F (Force) argument to see if it continues after failing to read the chip signature information.

-F

Normally, AVRDUDE tries to verify that the device signature read from the part is reasonable before continuing. Since it can happen from time to time that a device has a broken (erased or overwritten) device signature but is otherwise operating normally, this options is provided to override the check. Also, for programmers like the Atmel STK500 and STK600 which can adjust parameters local to the programming tool (independent of an actual connection to a target controller), this option can be used together with ‘-t’ to continue in terminal mode. Moreover, the option allows to continue despite failed initialization of connection between a programmer and a target.

[coderatchance]

Did as suggested , but now luck :/

avrdude -P /dev/cu.usbmodem14401 -c jtag2updi -p ATtiny3216 -F -e

or

avrdude -P /dev/cu.usbmodem14401 -c jtag2updi -p ATtiny3216 -F -t

wondering if the -F is at the right place, meanwhile I have tried the other chip and works, so, indeed.
But how to remove the lock from the chip?
The thing is that in past, when programming the t45, I would just delete it and flash it again, but here this it not working...
Have a feeling once it is locked you can say goodbye to it :)

[SpenceKonde]

That was my hackjob to keep jtag2updi from getting into a hung state from which it required a power cycle to be revived. It gives the illegal mcu state if it gets no response (the protocol provides no more specific error).

[hmeijdam]

I am using a 2 dollar CH340G usb to serial adapter with a signal diode between RX and TX.. It has no problem programming at Turbo speed and I can lock unlock at will. So I suspect it has something to do with the programmer you are using.

[coderatchance]

Currently , I am on Arduino UNO, jtag2updi... however, I can quickly switch to the USB to TTL CP2102 , was reading a bit about the programming problems with these modules, I should give a go ! Its even listed here as a useful programmer...

https://github.com/SpenceKonde/AVR-Guidance/blob/master/UPDI/jtag2updi.md

[hmeijdam]

This is the one I am using. Not €2 but €3 ........for 5 of them

no need for a resistor, just a diode between RX and TX, and that way the RX/TX leds also still work as expected.