• State Resolved
  • Locked Locked
  • Replies 10 replies
  • Subscribers 82 subscribers
  • Views 520 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TMS320F2809: Determine if existing design uses CSM passwords

John Treubig
Prodigy 155 points

Part Number: TMS320F2809

Tool/software:

How would I determine if an existing design set any of the CSM passwords?  I have an existing TMS320F2809 design that I'm attempting to migrate to a TMS320F2800156.  The existing design uses CC 3.3 and I have the source code.   We have a utility that can update the FLASH using SCI / Wait Boot, so I know that the Flash isn't locked down to prevent update.  I assume that one of the source code files was modified if CSM passwords are in place.  I just don't know where to look.

Thanks in advance.

John

  • 0
    TI__Mastermind 28580 points

    Hi John,

    Do you know the location of the CSM passwords in memory? Are you able to read this memory location to determine if it's been modified? This information should be in the technical reference manual for F2809

    Thank you,

    Luke

  • 0 in reply to Luke Jones
    Prodigy 155 points

    Good point and I will check.  I have the ability to regenerate the objects as well and I can check the output files at those locations.  Won't be able to do this until 3/3.

    Thanks,

    John

  • 0 in reply to John Treubig
    TI__Mastermind 28580 points

    Understood, let me know when you have an update.

    Thank you,

    Luke

  • 0 in reply to Luke Jones
    Prodigy 155 points

    Hi Luke,

    From the map file it looks like the passwords should be located at 03f7f80

    csm_rsvd 0 003f7f80 00000076
    003f7f80 00000076 DSP280x_CSMPasswords.obj (csm_rsvd)

    codestart
    * 0 003f7ff6 00000002
    003f7ff6 00000002 DSP280x_CodeStartBranch.obj (codestart)

    csmpasswds
    * 0 003f7ff8 00000008
    003f7ff8 00000008 DSP280x_CSMPasswords.obj (csmpasswds)

    From the 2809 datasheet: 

    0x3F 7F80 – 0x3F 7FF5 -> Program to 0x0000 when using the Code Security Module

    From the ROM file used to load the chip:

    :207F80000000000000000000000000000000000000000000000000000000000000000000E1
    :207F90000000000000000000000000000000000000000000000000000000000000000000D1
    :207FA0000000000000000000000000000000000000000000000000000000000000000000C1
    :207FB0000000000000000000000000000000000000000000000000000000000000000000B1
    :207FC0000000000000000000000000000000000000000000000000000000000000000000A1
    :207FD000000000000000000000000000000000000000000000000000000000000000000091
    :207FE000000000000000000000000000000000000000000000000000000000000000000081
    :0C7FF00000000000000000000000000085

    It is my belief that we are using CSM passwords but the next line in the ROM file has me puzzled because this is supposed to be the csmpasswds.

    :107FF800FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF89

    Is this because this location (03f7ff8) has already been programmed when the passwords are set?

    John

  • 0 in reply to John Treubig
    TI__Mastermind 28580 points

    Hey John,

    I may not have time to respond to look into this until tomorrow, apologies for the delayed response.

    Thank you,

    Luke

  • 0 in reply to Luke Jones
    Prodigy 155 points

    I think I'm beginning to understand the CMS passwords in that I initially thought there were different passwords for each section of Flash/Ram.  I believe that all 8 words are required to invoke CMS.  Let me know if that is correct.

    Thanks,

    John

  • 0 in reply to John Treubig
    TI__Mastermind 28580 points

    Hey John,

    That's correct, all sections of flash and RAM should be associated with a single set of passwords.

    Thank you,

    Luke

  • 0 in reply to Luke Jones
    Prodigy 155 points

    Hi Luke

    I talked with our vendor that builds the old board and got some interesting information.  He said that passwords are not used on the CPU.  Since we program 00s to csm_rsvd area and FFs to csmpasswds area, does csmpasswds control of whether csm_rsvd is looked at?

    0x3F 7F80 – 0x3F 7FF5 -> Program to 0x0000 when using the Code Security Module

    If csmpasswds controls usage of csm_rsvd, then the statement above misleads me.  It seems the better wording would be: Program to 0x0000 when using the Code Security Module (csmpasswds are set). 

    Its beginning to look like our code zeroed out csm_rsvd in case csmpasswds were set. 

    Let me know your thoughts,

    John

  • 0 in reply to John Treubig
    TI__Mastermind 28580 points

    Hi John,

    I am actually unable to locate the F2809 TRM on ti.com at the moment to get clarity on this. I will get back to you once I'm able to find it, unless you're able to send it to me.

    Thank you,

    Luke

  • +1 in reply to Luke Jones
    TI__Mastermind 28580 points

    Hey John,

    Apologies for the delayed response. This device is so old it has no general purpose TRM, but has individual publications for each IP, was not aware of this.

    From looking at the memory map in the device datasheet, it seems the only memory location affecting security is 0x3F7FF8 to 0x3F7FFF. I see several advisories in the SysCtrl document repeating the following statement in one way or another:

    0x3F 7F80 – 0x3F 7FF5 -> Program to 0x0000 when using the Code Security Module

    You can easily find all these statements in the Sysctrl guide by searching for 0x3f7f80.

    However none of these statements provide a justification for WHY these addresses must be programmed to all 0s.

    If the reason for this is important to you I can consult others on are team who might be familiar with this, however this is a very old device so I may be unable to provide a definitive answer. Nonetheless the programming of csm_rsvd locations to all 0s follows the documentation's instructions so I don't think this is a concern.

    Thank you,

    Luke