• State Resolved
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 83 subscribers
  • Views 253 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TMS320F28027: password to UNLOCK?

Friedrich Prof. Dr. Bloedow
Intellectual 710 points

Part Number: TMS320F28027
Other Parts Discussed in Thread: UNIFLASH

Hello,
after 20 years of using the TMS320xxxx with my students, it has now become necessary to password-protect my software.

First, I programmed the F28027 with the CCSV12/XDS100V2 using an LED blinking program.
Then, via UNIFLASH -> Settings & Utilities -> Code Security, I entered a test password:
Key 7 (0xAE7): FFFF
Key 6 (0xAE6): FFFF
Key 5 (0xAE5): FFFF
Key 4 (0xAE4): FFFF
Key 3 (0xAE3): FFFF
Key 2 (0xAE2): FFFF
Key 1 (0xAE1): FFFF
Key 0 (0xAE0): 8848
and clicked the "LOCK" button.

Then I closed UNIFLASH and tried to access the F28027 via the CCSV12 / XDS100V2 debugger.
As expected, this didn't work.

After that, I restarted UNIFLASH and entered the password via
UNIFLASH -> Settings & Utilities -> Code Security Password and clicked the "UNLOCK" button.

Then I received the following error message:

Error connecting to the target: (Error -1135 @ 0x0) The debug probe reported an error.
Confirm debug probe configuration and connections, reset the debug probe, and retry the operation.
(Emulation package 20.3.0.3656)

My question:

How can I reset the password to UNLOCK?

How can I access the F28027 again via the CCSV12?

Thank you for your answers.
  • 0
    TI__Genius 16690 points

    Hello,

    Have you tried putting the device in Wait boot before unlocking? 

    When the device is powered up, the CPU will start running and may execute an instruction that performs an access to a emulation code security logic (ECSL) protected area. If this happens, the ECSL will trip and cause the JTAG debug probe connection to be broken. The "wait" mode keeps this from happening by looping within the boot ROM until a JTAG debug probe is connected.

    Best,

    Matt

  • 0 in reply to Matt Kukucka
    Intellectual 710 points
    Hello,
    Thank you for the quick reply. No, I have not tried putting the device in Wait boot before unlocking.
    It seems that it's not possible to unlock the F28027 using only the UNLOCK button in UNIFLASH.
    Is that correct?
    Can I reset the password and unlock the F28027 using the following procedure?
    1. The XDS100V2 must not be connected.
    2. Wait boot: I set
        GPIO37/TDO == 1,
        GPIO34/COMP2OUT == 0,
        and TRST# == 0.
    3. Then, a RESET is performed,
    4. connecting the xds100V2 to the F28027,
    5. starting the UNIFLASH program,
    6. entering the password at the appropriate point,
    7. and pressing the UNLOCK button.
    8. Now I can change the password to 8 times 0xffff,
    9. and pressing the LOCK button resets the password.
    I would appreciate it if you could confirm that this procedure is correct.
    Sincerely, Friedrich
  • 0 in reply to Friedrich Prof. Dr. Bloedow
    TI__Genius 16690 points

    Hello,

    Friedrich Prof. Dr. Bloedow said:
    It seems that it's not possible to unlock the F28027 using only the UNLOCK button in UNIFLASH.

    Yes, once locked the CSM can prevent JTAG access if the CPU is fetching from secure resources.

    Friedrich Prof. Dr. Bloedow said:
    I would appreciate it if you could confirm that this procedure is correct.

    That procedure looks correct. The idea is to put the device in wait boot (waiting in the Boot ROM), allow the user to connect, and clear the password locations to all 1 (unsecure).

    Best,

    Matt

  • +1 in reply to Matt Kukucka
    Intellectual 710 points

    Hello,

    Everything's OK.

    I still need to erase FLASH sector A with UNIFLASH!!!!

    >To clear the programmed password, please erase Sector A of Flash memory.

    Because the PASSWORD is apparently located at the top of FLASH sector A, starting at 0x3F7FF8.

    The problem is, this also erases my program, and I have to reflash.

    Is there any way to specifically reset the PASSWORD to 0xFFFF only at 0x3F7FF8?

    Sincerely, Friedrich

  • 0 in reply to Friedrich Prof. Dr. Bloedow
    TI__Genius 16690 points

    Hello,

    Unfortunately re-programming a specific address is not possible without erasing the entire flash sector. The smallest amount of memory that can be erased at a time is a single sector.

    Best,
    Matt