• State Answer Suggested
  • Locked Locked
  • Replies 9 replies
  • Answers 1 answer
  • Subscribers 31 subscribers
  • Views 3112 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AJSM locking and unlocking of TMS570LS0332

Sreekanth Reddy Challa
Expert 1320 points
Other Parts Discussed in Thread: TMS570LS0332, TMS570LS0232, TMS570LS3137

Hi,

I am using TMS570LS0332 in my design. I found in the datasheet of the micro controller that it has AJSM locking and unlocking mechanism by which we can block the access to the device using JTAG connection.  I am using CCS Version: 6.1.0.00104 and XDS200 JTAG emulator. 

I would like to know the procedure to unlock the device. Can Code composer studio be used for unlocking the device?  If so , is there any document which describes the procedure for locking and unlocking?

Thanks in advance.

Best regards,

Sreekanth challa

  • 0
    TI__Expert 6985 points

    Sreekanth,

    I think we were in contact about this some month ago.
    The AJSM (unlock) support was added to CCS, please refer to the following post for more details: e2e.ti.com/.../1910307

    Best Regards,
    Christian

  • 0 in reply to Christian Herget
    Expert 1320 points
    Hi christian,

    Thanks for the response. I have gone through the document and post regarding this. I am not able to write to 0xF0000000 location using Flash API in my code. Flash API i executing from RAM.

    I am not sure why. The following are lines code i used for programming 0xF000 0000.

    uint32_t fapi_status;

    uint32_t Freq_In_MHz= SYS_CLK_FREQ;

    uint32_t tempAjsm[4] = {
    0xDFFDFFFF, 0xFFFFFFFF,
    0xFFFDFFFE, 0xFFEFFFFF
    };

    fapi_status = Fapi_initializeFlashBanks( Freq_In_MHz );

    while( FAPI_CHECK_FSM_READY_BUSY != Fapi_Status_FsmReady );

    fapi_status = Fapi_setActiveFlashBank((Fapi_FlashBankType)0);

    while( FAPI_CHECK_FSM_READY_BUSY != Fapi_Status_FsmReady );

    fapi_status = Fapi_enableBanksForOtpWrite(0xFFU);

    while( FAPI_CHECK_FSM_READY_BUSY != Fapi_Status_FsmReady );

    fapi_status = Fapi_issueProgrammingCommand(
    (uint32_t *)(0xF0000000),
    (uint8_t *)((uint32_t)(&tempAjsm[0])),
    16, NULL, 0, Fapi_AutoEccGeneration);

    while( Fapi_checkFsmForReady() == Fapi_Status_FsmBusy );

    fapi_status = Fapi_disableBanksForOtpWrite();

    return fapi_status;

    Thanks & Best Regards,
    Sreekanth Reddy Challa
  • 0 in reply to Sreekanth Reddy Challa
    Expert 1320 points

    Hi,

    I have used the AJSM project which was provided in some other post to lock TMS570LS0232.

    I could program the controller. Now i am getting the following error if i am trying to access the device.

    Status: CortexR4: File Loader: Verification failed: Values at address 0xF0000000 do not match Please verify target memory and memory map.


    Does this mean controller is locked? 1651.AJSM.zip

    Thanks & best Regards,

    Sreekanth Challa

  • 0 in reply to Sreekanth Reddy Challa
    TI__Guru 68930 points
    Can you just 'connect' to the CPU without trying to download your program?
    That is a better test.
  • 0 in reply to Anthony F. Seely
    Expert 1320 points

    Hi anthony,

    Can use the option shown in the attached file below to check the status of JTAG? (i.e., either locked or good)

    Thanks and Best Regards,

    Sreekanth Reddy Challa

  • 0 in reply to Sreekanth Reddy Challa
    TI__Guru 68930 points
    No because this just tests the outer most scan chain and that will be in-tact even with the security feature locked.
    (Because to unlock you need to scan).

    What I meant is can you launch the target configuration file [without doing any sort of "Debug As" because we don't want your code to start downloading.

    View the "Target Configurations" window, pick your correct CCXML file for the target board & emulator and then right click and select "Launch Selected Configuration"

    This should bring up a Debug window with the CCXML file and then under this in a 'tree' view the name of the emulator and CPU.
    It should have an "X" on the emulator/cpu for disconnected.

    Try to connect there - if you cannot then it's a better indication that the part is locked.

    -Anthony
  • 0 in reply to Anthony F. Seely
    Expert 1320 points

    Hi Anthony,

    I have done the steps you have specified in your response. The attached file is the snap shot of code composer studio.

    In the snap shot, i see it as suspended. Which means it is not locked.  I have used AJSM project for downloading the Key into flash.  Do you have any sample project which i can use to lock the controller. I am using TMS570LS0232 in my project.

    Thanks & Best Regards,

    Sreekanth Reddy Challa

  • 0 in reply to Sreekanth Reddy Challa
    TI__Expert 6985 points

    Sreekanth,

    I used the following C source in the past to lock a device with the AJSM:

    #pragma DATA_SECTION(AJSM_Key, "AJSM_Sec"); /* Specify Memory Section to link the key to */
#pragma DATA_ALIGN  (AJSM_Key, 16);         /* Ensure alignment to 128Bit = 16Byte */
#pragma RETAIN      (AJSM_Key);             /* Ensure that the Key will be linked */

// 0xEFFDFFFF, 0xFFFFFFFF, 0xFFFDFFFE, 0xFFEFFFFF   0xED_C0
const unsigned int AJSM_Key[4] = {0xEFFDFFFFul, 0xFFFFFFFFul, 0xFFFDFFFEul, 0xFFEFFFFFul}; /* Original */

    Above programs the original key, so the device will not get locked, below programs a real key:

    #pragma DATA_SECTION(AJSM_Key, "AJSM_Sec"); /* Specify Memory Section to link the key to */
#pragma DATA_ALIGN  (AJSM_Key, 16);         /* Ensure alignment to 128Bit = 16Byte */
#pragma RETAIN      (AJSM_Key);             /* Ensure that the Key will be linked */

const unsigned int AJSM_Key[4] = {0xAECD0000ul, 0xAECD0001ul, 0xAECD0002ul, 0xAECD0003ul};

/*
 * New OTP			= AECD0000 AECD0001 AECD0002 AECD0003
 * Visible Key		= EFFDFFFF FFFFFFFF FFFDFFFE FFEFFFFF
 */

    The key used in the example above is the key which is in the readme of the old unlock tool:

    Example 1

New OTP			= AECD0000 AECD0001 AECD0002 AECD0003
Visible Key		= EFFDFFFF FFFFFFFF FFFDFFFE FFEFFFFF
   
			    Word0    Word1    Word2    Word3
Visible Key XOR New OTP	= 4130ffff 5132fffe 5130fffc 5122fffc  

			    Word3    Word2    Word1    Word0
Key to be scanned	= 5122fffc 5130fffc 5132fffe 4130ffff
			  |				    |
			  |_bit128			    |_bit0

    To make my examples work, you need to modify the linker command file. TI used the following LCF for the TMS570LS3137 device:

    /*----------------------------------------------------------------------------*/
/* TMS570LS313xFlashLnk.cmd                                                 */
/*                                                                            */
/* (c) Texas Instruments 2011, All rights reserved.                           */
/*                                                                            */

/* USER CODE BEGIN (0) */
/* USER CODE END */


/*----------------------------------------------------------------------------*/
/* Linker Settings                                                            */
--retain="*(.intvecs)"

/*----------------------------------------------------------------------------*/
/* Memory Map                                                                 */
MEMORY{
/* Bank 0 */
    VECTORS (X)  : origin=0x00000000 length=0x00000020 vfill=0xffffffff
    FLASH0  (RX) : origin=0x00000020 length=0x0017FFE0 vfill=0xffffffff
/* Bank 1 */
    FLASH1  (RX) : origin=0x00180000 length=0x00180000 vfill=0xffffffff
/* Bank 7 (FEE) */
	FLASH7  (R)  : origin=0xF0200000 length=0x00010000 vfill=0xffffffff

/* OTP Bank 0 */
#if 1
	AJSMKey (R)  : origin=0xF0000000 length=0x00000010 vfill=0xffffffff
	AJSMECC (R)  : origin=0xF0040000 length=0x00000002 vfill=0xffffffff /* ECC={algorithm=algoR4F021, input_range=AJSMKey} */
#else
	AJSMKey (R)  : origin=0xF0000000 length=0x00000010 vfill=0xffffffff
	//AJSMECC (R)  : origin=0xF0040000 length=0x00000002 vfill=0xffffffff ECC={algorithm=algoR4F021, input_range=AJSMKey}
#endif
	/*OTP0    (R)  : origin=0xF0000010 length=0x00001FF0 vfill=0xffffffff*/
	/*OTP0ECC (R)  : origin=0xF0040002 length=0x000003FE vfill=0xffffffff ECC={algorithm=algoR4F021, input_range=OTP0}*/
/* OTP Bank 1 */
	OTP1    (R)  : origin=0xF0002000 length=0x00002000 vfill=0xffffffff
	/*OTP1ECC (R)  : origin=0xF0040400 length=0x00000400 vfill=0xffffffff ECC={algorithm=algoR4F021, input_range=OTP1}*/
/* OTP Bank 7 */
	OTP7    (R)  : origin=0xF000E000 length=0x00002000 vfill=0xffffffff
	/*OTP7ECC (R)  : origin=0xF0041C00 length=0x00000400 vfill=0xffffffff ECC={algorithm=algoR4F021, input_range=OTP7}*/

    STACKS  (RW) : origin=0x08000000 length=0x00001300
    RAM     (RW) : origin=0x08001300 length=0x0003ED00
}

/*----------------------------------------------------------------------------*/
/* Section Configuration                                                      */
SECTIONS{
    .intvecs : palign(8) {} > VECTORS
    .text    : palign(8) {} > FLASH0 | FLASH1
    .const   : palign(8) {} > FLASH0 | FLASH1
    .cinit   : palign(8) {} > FLASH0 | FLASH1
    .pinit   : palign(8) {} > FLASH0 | FLASH1

    AJSM_Sec : palign(8) {} > AJSMKey
    // AJSM_ECC_Sec : {}       > AJSMECC

    .bss     : {} > RAM
    .data    : {} > RAM
}

/*----------------------------------------------------------------------------*/
/* Misc                                                                       */
ECC {
    algoR4F021 : address_mask = 0x003ffff8 /* Address Bits 21:3 */
                 hamming_mask = R4         /* Use R4 build in Mask */
                 parity_mask  = 0x0c       /* Set which ECC bits are Even and Odd parity */
                 mirroring    = F021       /* RM4x are build in F021 */
}

/*----------------------------------------------------------------------------*/

    Please refer to this WIKI entry for more details on the linker generated ECC used in this example: 

    Best Regards,
    Christian

  • 0 in reply to Christian Herget
    Expert 1320 points

    Hi Christian & Anthony,

    Thanks for your support. I could write the following code to customer OTP memory location 0xF0000000.

        0xAECD0000,  0xAECD0001, 0xAECD0002 and 0xAECD0003

    I have verified the memory 0xF000 0000  in memory browser. The values are matching with the above values. After that, i have done power on reset of the controller by removing the supply.

    I have tested the connection as specified by Christian. I could not connect.The snap shot of the connection status as shown in the attached image.

    Best Regards,

    Sreekanth Challa