TM4C1294NCPDT: Firmware protection from reading on the TM4C129NCPDT / EK-TM4C1294XL / TM4C12xx chips.

John Piliounis

Expert 1690 points

Part Number: TM4C1294NCPDT
Other Parts Discussed in Thread: EK-TM4C1294XL

Hello Amit, Eric, David & all @ the forum.

Is there any way to protect the flash firmware code on the TM4C129NCPDT / EK-TM4C1294XL / TM4C12xx chips from reading?

Using some specific debug _DBG_ register maybe?

Or somehow disabling JTAG? Is this possible and how that could be done?

Thank you very much.

John

P.S. Of course with the ability for mass erase later using LM Flash Programmer over JTAG

over 8 years ago

0 Amit Ashara over 8 years ago

TI__Guru**** 244400 points

Hello John

Yes, it is possible to disable Debug port. There are two methods to do the same

1. One is to convert JTAG pins to GPIO function
2. Use the BOOTCFG register bits DBG0 and DBG1 to disable the JTAG function and commit the register so that with the next power up the JTAG is disabled. An unlock sequence can override it though but it would erase the flash as well. So the data will not be extractable.

0 John Piliounis over 8 years ago in reply to Amit Ashara

Expert 1690 points

O.K. Amit.

Understood.

Thank you very much.

Best regards,

John

0 Amit Ashara over 8 years ago in reply to John Piliounis

TI__Guru**** 244400 points

Hello John,

The Application note on JTAG (Section 5.1 and 5.2) also mentions the same. The procedure is in the datasheet for a commit operation.

www.ti.com/.../spma075.pdf

0 John Piliounis over 8 years ago

Expert 1690 points

Great,

thank you very much Amit.

John

P.S. And while locked, if in flash apropriate commands/routines

have been placed that could be activated remotely over ethernet,

then the ethernet bootloading could be initiated.

-----

0 Amit Ashara over 8 years ago in reply to John Piliounis

TI__Guru**** 244400 points

Hello John

I did not quite well understand the note that followed. Please elaborate?

0 John Piliounis over 8 years ago

Expert 1690 points

Hello Amit. We have said at the past that once the chip is bootloaded

for the first time from jtag, then from inside the flash code we can

have access to the rom of the chip where the ethernet_rom_bootloader

resides.

So, if our flash code initiates a TCP server and through this tcp server

we manage to send to the chip's source a keyword-password, then a command/

/routine can be initiated to run the ethernet_rom_bootloader. Then we'll

just have to send/serve the new firmware source to the particular IP/Port

Isn't it so?

Thank you

John

-----

0 Amit Ashara over 8 years ago in reply to John Piliounis

TI__Guru**** 244400 points

Hello John

Well, yes. However you are entering the realm of TLS/SSL implementation to implement over the network security

0 John Piliounis over 8 years ago

Expert 1690 points

Hello Amit. Yes, it is exactly as you say it.

But being inside a local yet wide farm of IoTs

over a vpn, maybe less security than TLS/SSL

may do the job. Given of course that VPNs by

default already implement their own IP level

security.

Again Amit, thank you very much and all the best,

John

-----

0 Amit Ashara over 8 years ago in reply to John Piliounis

TI__Guru**** 244400 points

Hello John

At the end it is your call, but it is our task to make sure that we provide information that is relevant.

Arm-based microcontrollers

Arm-based microcontrollers forum

TM4C1294NCPDT: Firmware protection from reading on the TM4C129NCPDT / EK-TM4C1294XL / TM4C12xx chips.