This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TMS320F2800155-Q1: TMS320F2800155 Secure boot issue

Part Number: TMS320F2800155-Q1

Issue Description: After configuring Secure Boot, flashing the .out file followed by the .hex file, the program fails to execute. Detailed Secure Boot configuration can be found in the attached dcsm.asm file. The hex utility interface is configured as follows:  boot_ex1_user_cmac_key.txt

boot_ex1_flash_hex_lnk_cpu1.cmd

 

The following is the OTP configuration diagram. 
First, I performed the operation to configure dual-pin boot, using GPIO24 and GPIO32. The pin state was 11, corresponding to the boot of the secure flash memory.

Here are my key values.

 

I subsequently configured Zone2 and attempted to start with pin 0. The configuration is shown in the figure.

 

Also attached is the CAMC value configuration:

 

The corresponding camc value for hex is

I have already tried using simulation startup and writing to the secure flash memory for startup. First, I burned the.out file to run, then I burned the hex file. At this point, the secure flash memory startup seems to be successful. I saw the value of 0x03 at the address 0x0000002. However, after writing to the OTP, I was unable to start. Firstly, when the zone1 pin dependencies were set to GPIO24, GPIO32, and 11, I selected secure startup, but it failed to start successfully. Later, I tried starting at pin 0, but the result was the same - burning the hex file failed to run. Could you please help me identify where the problem lies? cmackey I have made the modifications. Now the example is 0xFFFFFFF, which is the one I modified later. I have also synchronized the code. But it still doesn't work.
;----------------------------------------------------------------------
; Zone 1
;----------------------------------------------------------------------
     .sect "dcsm_otp_z1_linkpointer"
      .retain
      .long 0x00003FE0
      .long 0x00003FE0
      .long 0x00003FE0
    
     .sect "dcsm_otp_z1_jlm_enable"
      .retain
      .long 0xFFFF000F     ;Z1OTP_JLM_ENABLE
;;     .sect "dcsm_otp_z1_jtag_pswdh"
;;      .retain
;;      .long 0x4BFFFFFF     ;Z1OTP_JTAGPSWDH0
;;      .long 0x3FFFFFFF     ;Z1OTP_JTAGPSWDH1

     .sect "dcsm_otp_z1_cmac_key"
      .retain
      .long 0xFFFFFFFF     ;Z1OTP_CMACKEY0
      .long 0xFFFFFFFF     ;Z1OTP_CMACKEY1
      .long 0xFFFFFFFF     ;Z1OTP_CMACKEY2
      .long 0xFFFFFFFF     ;Z1OTP_CMACKEY3
  
     .sect "dcsm_otp_z1_pswdlock"
      .retain
      .long 0xFB7FFFFF
      
     .sect "dcsm_otp_z1_crclock"
      .retain
      .long 0x7FFFFFFF
 .sect "dcsm_otp_z1_gpreg"
      .retain
      .long 0x5AFF1820     ;Z1OTP_GPREG1 = Z1_BOOTPIN
      .long 0x5Affffff     ;Z1OTP_GPREG2
      .long 0x0A24040A     ;Z1OTP_GPREG3 = Z1OTP_BOOTDEF_LOW
      .long 0xFFFFFFFF     ;Z1OTP_GPREG4 = Z1OTP_BOOTDEF_HIGH
     .sect "dcsm_zsel_z1"
      .retain
      .long 0x12345678     ;Z1OTP_CSMPSWD0 (LSW of 128-bit password)
      .long 0x17fFFFFF     ;Z1OTP_CSMPSWD1
      .long 0x12345678     ;Z1OTP_CSMPSWD2
      .long 0x12345678     ;Z1OTP_CSMPSWD3 (MSW of 128-bit password)
 
      .long 0x55555555     ;Z1OTP_GRABSECT1
      .long 0x55555555     ;Z1OTP_GRABSECT2
      .long 0x55555500     ;Z1OTP_GRABSECT3
      .long 0x0000AAAA     ;Z1OTP_GRABRAM1
      .long 0xFFFFFFFF     ;Reserved
      .long 0xFFFFFFFF     ;Reserved

      .long 0xFFFE0000     ;Z1OTP_EXEONLYSECT1
      .long 0x0000FFF0     ;Z1OTP_EXEONLYSECT2
      .long 0x000000FF     ;Z1OTP_EXEONLYRAM1
      .long 0xFFFFFFFF     ;Reserved
      .long 0x12345678     ;Z1OTP_JTAGPSWDL0
      .long 0x6f7fffff     ;Z1OTP_JTAGPSWDL1    
;----------------------------------------------------------------------

; For code security operation,after development has completed, prior to
; production, all other zone select block locations should be programmed
; to 0x0000 for maximum security.        
; If the first zone select block at offset 0x10 is used, the section 
; "dcsm_rsvd_z1" can be used to program these locations to 0x0000.
; This code is commented out for development.

;       .sect "dcsm_rsvd_z1"
;        .loop (1e0h)
;              .int 0x0000
;        .endloop


;----------------------------------------------------------------------
; Zone 2
;----------------------------------------------------------------------

   .sect "dcsm_otp_z2_linkpointer"
      .retain
      .long 0x00003FE0
      .long 0x00003FE0
      .long 0x00003FE0

     .sect "dcsm_rsvd_z2"
      .retain
      .long 0xFFFFFFFF     ;Reserved
     .sect "dcsm_otp_z2_pswdlock"
      .retain
      .long 0x1F7FFFFF
      
     .sect "dcsm_otp_z2_crclock"
      .retain
      .long 0x3FFFFFFF
 .sect "dcsm_otp_z2_gpreg"
      .retain
      .long 0x5AFFFFFF     ;Z2OTP_GPREG1 = Z2_BOOTPIN
      .long 0x5AFFFFFF     ;Z2OTP_GPREG2
      .long 0xFFFFFF0A     ;Z2OTP_GPREG3 = Z2OTP_BOOTDEF_LOW
      .long 0xFFFFFFFF     ;Z2OTP_GPREG4 = Z2OTP_BOOTDEF_HIGH
     .sect "dcsm_rsvd1_z2"
      .retain
      .long 0xFFFFFFFF     ;Reserved
      .long 0xFFFFFFFF     ;Reserved

     .sect "dcsm_zsel_z2"
      .retain
      .long 0x12345678     ;Z2OTP_CSMPSWD0 (LSW of 128-bit password)
      .long 0x5bfFFFFF     ;Z2OTP_CSMPSWD1
      .long 0x12345678     ;Z2OTP_CSMPSWD2
      .long 0x12345678     ;Z2OTP_CSMPSWD3 (MSW of 128-bit password)
 
      .long 0xAAAAAAAA     ;Z2OTP_GRABSECT1
      .long 0xAAAAAAAA     ;Z2OTP_GRABSECT2
      .long 0xAAAAAA00     ;Z2OTP_GRABSECT3
      .long 0x0000AAAA     ;Z2OTP_GRABRAM1
      .long 0xFFFFFFFF     ;Reserved
      .long 0xFFFFFFFF     ;Reserved


      .long 0xFFFFFFFF     ;Z2OTP_EXEONLYSECT1
      .long 0x0000FFF0     ;Z2OTP_EXEONLYSECT2
      .long 0x000000FF     ;Z2OTP_EXEONLYRAM1
      .long 0xFFFFFFFF     ;Reserved
      .long 0xFFFFFFFF     ;Reserved
      .long 0xFFFFFFFF     ;Reserved


;----------------------------------------------------------------------

; For code security operation,after development has completed, prior to
; production, all other zone select block locations should be programmed
; to 0x0000 for maximum security.        
; If the first zone select block at offset 0x10 is used, the section 
; "dcsm_rsvd_z2" can be used to program these locations to 0x0000.
; This code is commented out for development.

;       .sect "dcsm_rsvd_z2"
;        .loop (1e0h)
;              .int 0x0000
;        .endloop


;----------------------------------------------------------------------
; End of file
;----------------------------------------------------------------------
  • There is a problem with uploading the picture. Please provide the picture again.

     The hex utility interface is configured as follows: 

    boot_ex1_user_cmac_key.txt

    boot_ex1_flash_hex_lnk_cpu1.cmd

     

    The following is the OTP configuration diagram. 
    First, I performed the operation to configure dual-pin boot, using GPIO24 and GPIO32. The pin state was 11, corresponding to the boot of the secure flash memory.

    Here are my key values

    .

     

    I subsequently configured Zone2 and attempted to start with pin 0. The configuration is shown in the figure.

     

    Also attached is the CAMC value configuration:

     

    The corresponding camc value for hex is

  • Can you confirm the CMAC key you programmed in OTP was matching the CMAC key you specified in the boot_ex1_user_cmac_key.txt file?

    Did you modify the boot_ex1_flash_hex_lnk_cpu1.cmd file? I think the length here may actually need to be 0x2000 to correspond with a 16KB range, since each address holds two bytes.

    Thank you,

    Luke

  • HI Luke:

    I can confirm that my CMACKEY is consistent.I have reviewed all the procedures. The length given here is 0x4000. At the same time, I have performed an operation, using simulation for secure boot, that is, writing the secure boot data at OD00 and 0D04. At this point, the secure boot was successful. The determination of success is that the value in 0x000002 is 0x03. Do you need to confirm that the address length must be exactly 0x2000 on your side?

  • Could someone please take a look at this issue?

  • Hi Tao,

    You have locked the device so how are you writing the secure boot data at 0D00 and 0D04 ? Are you unlocking JTAG (by disabling the ECSL) and then connecting and writing it ?

    If the simulation is working then issue could be with OTP programming. Have you checked that all the OTP programing values are correct and also the bootmode pin values are driven properly ?

    You could also try standalone boot option by writing appropriate value (see below snapshot) so that with CCS connected, device boots using the BOOTMODE pins and OTP value so that you can see what is happening -

    Regards,

    Vivek Singh