Hi,
I am trying to implement the DCSM module and am running in to some issues with the TI Flash library F021_API_F2837xD_FPU32.lib.
To give some background info as to what settings I am trying to use from the DCSM: I am trying to secure all Flash & RAM regions to Zone 1 of the DSCM so I have set GRABMR & GRABSECT TO 0xAAAAAAAA in Zone 1 OTP. I want to enable PSWDLOCK so I have written a value other than all 1's to the PSWDLOCK register for Zone 1. As I mentioned, I am mainly interested in securing all Flash & RAM regions to Zone 1. I am running in to some trouble with the TI Flash API after I have secured Zone 1 with the options that I mentioned. To give a better idea here is a screen shot of my OTP ( I have a password set that is not all 1's, I have just blocked it out in the screen shot):
I am also doing dummy reads on all registers that are outlined in Zone1 under section 3.13.2 of the TRM as to not cause improper interactions with other modules on the TMS320:
void DummyReads(void){
uint32_t dummyVar = 0;
dummyVar = HWREG(0x703F0);
dummyVar = HWREG(0x78000);
dummyVar = HWREG(0x78004);
dummyVar = HWREG(0x78008);
dummyVar = HWREG(0x78010);
dummyVar = HWREG(0x78014);
dummyVar = HWREG(0x78018);
dummyVar = HWREG(0x7801E);
dummyVar = HWREG(DCSM_Z1_BASE + DCSM_O_Z1_LINKPOINTER);
dummyVar = HWREG(0x78030);
dummyVar = HWREG(0x78032);
dummyVar = HWREG(0x78034);
dummyVar = HWREG(0x78036);
}
I am also attaching excerpts from the .map file for the file I am flashing so you can see where the library is located in memory:
output attributes/
section page origin length input sections
-------- ---- ---------- ---------- ----------------
.TI.ramfunc
* 0 00086000 00000875 RUN ADDR = 00008000
00086000 00000259 F021_API_F2837xD_FPU32.lib : FlashStateMachine.obj (.text:__Fapi_setupFlashStateMachine)
00086259 0000019d : Program.obj (.text:_Fapi_issueProgrammingCommand)
000863f6 00000088 : Read.obj (.text:__Fapi_loopRegionForValue)
0008647e 00000042 : BlankCheck.obj (.text:_Fapi_doBlankCheck)
000864c0 00000034 : Init.obj (.text:_Fapi_initializeAPI)
000864f4 0000002e : Utilities.obj (.text:_Fapi_calculateFletcherChecksum)
00086522 0000002d : FlashStateMachine.obj (.text:__Fapi_issueFsmCommand)
0008654f 0000002c : Utilities.obj (.text:__Fapi_divideUnsignedLong)
0008657b 00000025 : FlashStateMachine.obj (.text:_Fapi_setActiveFlashBank)
000865a0 00000022 : FlashStateMachine.obj (.text:_Fapi_isAddressEcc)
000865c2 00000022 : FlashStateMachine.obj (.text:__Fapi_setupSectorsForWrite)
000865e4 00000020 : Async.obj (.text:_Fapi_issueAsyncCommandWithAddress)
00086604 0000001a : Utilities.obj (.text:_Fapi_waitDelay)
0008661e 00000016 : Read.obj (.text:_Fapi_flushPipeline)
00086634 0000000d : Utilities.obj (.text:__Fapi_scaleCycleValues)
00086641 00000001 --HOLE-- [fill = 0]
00086642 0000000c : Init.obj (.ebss) [fill = 0]
0008664e 0000000b : Utilities.obj (.text:__Fapi_calculateOtpChecksum)
00086659 0000000a : FlashStateMachine.obj (.text:_Fapi_checkFsmForReady)
00086663 000000b1 flash.obj (.text)
00086714 000000b5 flash.obj (.TI.ramfunc)
000867c9 000000a8 Fapi_UserDefinedFunctions.obj (.TI.ramfunc)
00086871 00000004 sysctl.obj (.TI.ramfunc)
page address name ---- ------- ---- 0 00008642 _Fapi_GlobalInit 0 000084f4 _Fapi_calculateFletcherChecksum 0 00008659 _Fapi_checkFsmForReady 0 0000847e _Fapi_doBlankCheck 0 0000861e _Fapi_flushPipeline 0 000084c0 _Fapi_initializeAPI 0 000085a0 _Fapi_isAddressEcc 0 000085e4 _Fapi_issueAsyncCommandWithAddress 0 00008259 _Fapi_issueProgrammingCommand 0 000087c9 _Fapi_serviceWatchdogTimer 0 0000857b _Fapi_setActiveFlashBank 0 00008842 _Fapi_setupBankSectorEnable 0 000087cb _Fapi_setupEepromSectorEnable 0 00008604 _Fapi_waitDelay
I am also going to attach the code for the linker file that we are using:
MEMORY
{
PAGE 0 : /* Program Memory */
/* Memory (RAM/FLASH) blocks can be moved to PAGE1 for data allocation */
/* BEGIN is used for the "boot to Flash" bootloader mode */
BEGIN : origin = 0x080000, length = 0x000002
RAMM0 : origin = 0x000122, length = 0x0002DE
RAMD0 : origin = 0x00B000, length = 0x000800
// RAMLS0 : origin = 0x008000, length = 0x000800
// RAMLS1 : origin = 0x008800, length = 0x000800
RAMLS0_1 : origin = 0x008000, length = 0x001000
RAMLS2 : origin = 0x009000, length = 0x000800
RAMLS3 : origin = 0x009800, length = 0x000800
RAMLS4 : origin = 0x00A000, length = 0x000800
RESET : origin = 0x3FFFC0, length = 0x000002
/* Flash sectors */
FLASHA : origin = 0x080002, length = 0x001FFE /* on-chip Flash */
FLASHB : origin = 0x082000, length = 0x002000 /* on-chip Flash */
FLASHC : origin = 0x084000, length = 0x002000 /* on-chip Flash */
FLASHD : origin = 0x086000, length = 0x001F48 /* on-chip Flash */
LOCKSTATUS : origin = 0x087F48, length = 0x000008
SEGMENT_HEADER : origin = 0x087F50, length = 0x0000B0
DCSM_ZSEL_Z1_LINK : origin = 0x78000, length = 0x000010
DCSM_ZSEL_Z1_PWDLOCK : origin = 0x78010, length = 0x000010
DCSM_ZSEL_Z1_P0 : origin = 0x78030, length = 0x000020
PAGE 1 : /* Data Memory */
/* Memory (RAM/FLASH) blocks can be moved to PAGE0 for program allocation */
BOOT_RSVD : origin = 0x000002, length = 0x000120 /* Part of M0, BOOT rom will use this for stack */
RAMM1 : origin = 0x000400, length = 0x000400 /* on-chip RAM block M1 */
RAMD1 : origin = 0x00B800, length = 0x000800
RAMLS5 : origin = 0x00A800, length = 0x000800
RAMGS0 : origin = 0x00C000, length = 0x001000
RAMGS1 : origin = 0x00D000, length = 0x001000
RAMGS2 : origin = 0x00E000, length = 0x001000
RAMGS3 : origin = 0x00F000, length = 0x001000
RAMGS4 : origin = 0x010000, length = 0x001000
RAMGS5 : origin = 0x011000, length = 0x001000
RAMGS6 : origin = 0x012000, length = 0x001000
RAMGS7 : origin = 0x013000, length = 0x001000
}
SECTIONS
{
/* Allocate program areas: */
.cinit : > FLASHA PAGE = 0, ALIGN(4)
.pinit : > FLASHA, PAGE = 0, ALIGN(4)
.text : >> FLASHA | FLASHB | FLASHC | FLASHD PAGE = 0, ALIGN(4)
codestart : > BEGIN PAGE = 0, ALIGN(4)
.segmentHeader : > SEGMENT_HEADER
#ifdef __TI_COMPILER_VERSION__
#if __TI_COMPILER_VERSION__ >= 15009000
GROUP
{
.TI.ramfunc
{ -l F021_API_F2837xD_FPU32.lib, source\flash.obj (.text)}
} LOAD = FLASHD,
RUN = RAMLS0_1,
LOAD_START(_RamfuncsLoadStart),
LOAD_SIZE(_RamfuncsLoadSize),
LOAD_END(_RamfuncsLoadEnd),
RUN_START(_RamfuncsRunStart),
RUN_SIZE(_RamfuncsRunSize),
RUN_END(_RamfuncsRunEnd),
PAGE = 0
#else
GROUP
{
ramfuncs
{ -l source\flash.obj (.text)}
} LOAD = FLASHD,
RUN = RAMLS0_1,
LOAD_START(_RamfuncsLoadStart),
LOAD_SIZE(_RamfuncsLoadSize),
LOAD_END(_RamfuncsLoadEnd),
RUN_START(_RamfuncsRunStart),
RUN_SIZE(_RamfuncsRunSize),
RUN_END(_RamfuncsRunEnd),
PAGE = 0
#endif
#endif
/* Allocate uninitalized data sections: */
.stack : > RAMM1 PAGE = 1
.ebss : >> RAMLS5 | RAMGS0 | RAMGS1 PAGE = 1
.esysmem : > RAMLS5 PAGE = 1
/* Initalized sections go in Flash */
.econst : >> FLASHA | FLASHB | FLASHC | FLASHD PAGE = 0, ALIGN(4)
.switch : > FLASHA PAGE = 0, ALIGN(4)
.reset : > RESET, PAGE = 0, TYPE = DSECT /* not used, */
dcsm_zsel_z1 : > DCSM_ZSEL_Z1_P0, PAGE = 0
dcsm_zsel_link_pointer : > DCSM_ZSEL_Z1_LINK, PAGE = 0
flash_lock_status : > LOCKSTATUS, PAGE = 0
dcsm_zsel_z1_pwdlock : > DCSM_ZSEL_Z1_PWDLOCK, PAGE = 0
}
/*
//===========================================================================
// End of file.
//===========================================================================
*/
From what I can see, this library resides within the FLASHD region & runs out of the RAMLS0_1 region, both of which I have allocated to Zone 1.
I also see that in the TRM it outlines the following in section 3.13.3.1:
"However, reprogramming devices that already contain a custom password require the password to be supplied to the Flash utilities in order to unlock the device to enable programming. In custom programming solutions that use the Flash API supplied by TI, unlocking the CSM can be avoided by executing the Flash programming algorithms from secure memory."
Because of this, to my understanding, I should be able to run these flash functions just fine without unlocking the TMS320 as they are in a secure zone that is allocated to Zone 1, but this has not been the case. Prior to locking the TMS320 I had no issues running these flash functions, but now that the TMS320 has been locked I can not seem to run some of the functions from this library without them failing (specifically the _Fapi_doBlankCheck function). Even after putting the TMS320 into the WAIT_BOOT state & running the code in a debugger after it has been unlocked I am now seeing these functions fail which is what is especially confusing to me as prior to locking the TMS320 these functions executed just fine. I even have other TMS320s that are unlocked that I have loaded the same code on to and it functions just fine.
Does anyone have any clue as to why these functions would be failing after enabling the CSM & ECSL?
Thank you,
Thomas Hickey
