f2837xD DCSM programming

Anish,

This example has two files, "DCSM_Z1_ZoneSelectBlock.asm" and "DCSM_Z2_ZoneSelectBlock.asm" which need to be modified by user to program the required security settings in the device. By default all the setting in these files are made 0xFFFF_FFFF which is state of erased USER-OTP. Plese note that these setting gets programmed into USER-OTP (OTP - ONE TIME PROGRAMMABLE) memory. So user need to be carefull with some of these settings becasue if wrong values are programmed, then it can not be erased.

Please refer the device TRM "http://www.ti.com/lit/pdf/spruhm8" to understand the security architecture on this device.

Regards,

Vivek Singh

Hi , 

I have made the following changes in the program . I am not able to load the program in successfully. 

Please tell me where I am going wrong in the program . 

changes made to DCSM_Z1_ZoneSelectBlock.asm : 

;// TI File $Revision: /main/2 $
;// Checkin $Date: December 7, 2011   18:25:13 $
;//###########################################################################
;//
;// FILE:	F2837x_DCSM_Z1_ZoneSelectBlock._asm
;//
;// TITLE:	F2837x Dual Code Security Module Zone 1 Zone Select Block Values.
;// 
;// DESCRIPTION:
;//
;//         This file is used to specify Z1 DCSM OTP and zone select
;//         values to program into the Zone 1 zone select locations in OTP
;//         Value depends on Linkpointer).
;//
;//         In addition, the 60 reserved values after the zone select block 
;//         are all programmed to 0x0000 as well.
;//
;//###########################################################################
;//
;// Original source based on D.A.
;// 
;// $TI Release: F2837xD Support Library v120 $
;// $Release Date: Fri Aug 22 15:22:27 CDT 2014 $
;//###########################################################################

; !!IMPORTANT!!: The "dcsm_otp_z1" section contains the Z1 LINKPOINTER which 
; determines the location of the Z1 Zone Select block.  If the LINKPOINTER 
; is changed, then the "dcsm_zsel_z1" section in the *_dcsm_lnk_cpu1.cmd command linker 
; file must also change to an address decoded from the value specified 
; in the Z1-LINKPOINTER location. 

; The "dcsm_zsel_z1" section contains the actual Z1 Zone Select Block values 
; that will be linked and programmed into to the DCSM Z1 OTP Zone Select block
; in OTP.  
; These values must be known in order to unlock the CSM module. 
; All 0xFFFFFFFF's (erased) is the default value for the password locations (PWL).

; It is recommended that all values be left as 0xFFFFFFFF during code
; development.  Values of 0xFFFFFFFF do not activate code security and dummy 
; reads of the Z1 DCSM PWL registers is all that is required to unlock the CSM.  
; When code development is complete, modify values to activate the
; code security module.

      .sect "dcsm_otp_z1"
	  
	  .long 0xFFFFFFFF     ;Z1-LINKPOINTER1
	  .long 0xFFFFFFFF     ;Reserved
	  .long 0xFFFFFFFF     ;Z1-LINKPOINTER2
	  .long 0xFFFFFFFF     ;Reserved
	  .long 0xFFFFFFFF     ;Z1-LINKPOINTER3
	  .long 0xFFFFFFFF     ;Reserved
	  .long 0xFFFFFFFF     ;Reserved
	  .long 0xFFFFFFFF     ;Reserved
	  .long 0xFFFFFFFF     ;Z1-PSWDLOCK
	  .long 0xFFFFFFFF     ;Reserved
	  .long 0xFFFFFFFF     ;Z1-CRCLOCK
	  .long 0xFFFFFFFF     ;Reserved
	  .long 0xFFFFFFFF     ;Z1-JTAGLOCK
	  .long 0xFFFFFFFF     ;Reserved
	  .long 0xFFFFFFFF     ;Reserved
	  .long 0xFFFFFFFF     ;Z1-BOOTCTRL

      .sect "dcsm_zsel_z1"

      .long	0xFFFFFFFF		;Z1-EXEONLYRAM
      .long	0xFFFFFFFF		;Z1-EXEONLYSECT
      .long	0xFFFFFFFF		;Z1-GRABRAM
      .long	0x55555555		;Z1-GRABSECT
	  
      .long	0x22221111 		;Z1-CSMPSWD0 (LSW of 128-bit password)  //0x22221111
      .long	0x44443333 		;Z1-CSMPSWD1							//0x44443333
      .long	0x66665555 		;Z1-CSMPSWD2    						//0x66665555
      .long	0x88887777 		;Z1-CSMPSWD3 (MSW of 128-bit password)  //0x88887777
	  
;----------------------------------------------------------------------

; For code security operation,after development has completed, prior to
; production, all other zone select block locations should be programmed
; to 0x0000 for maximum security.        
; If the first zone select block at offset 0x10 is used, the section 
;"dcsm_rsvd_z1" can be used to program these locations to 0x0000.
; This code is commented out for development.

       .sect "dcsm_rsvd_z1"
       .loop (1e0h)
             .int 0x0000
        .endloop

;//===========================================================================
;// End of file.
;//===========================================================================

      

changes made to 2837xD_dcsm_lnk_cpu1.cmd  :

/* this linker command file is to be included if user wants to use the DCSM feature on the device
 * DCSM  means Dual Zone Code Security Module.
 * This linker command file works as an addendum ot the already existing Flash/RAM linker command file
 * that the project has.
 * The sections in the *_ZoneSelectBlock.asm source file is linked as per the commands given in the file
 * NOTE - please note fill=0xFFFF, this helps if users include this file in the project by mistake and 
 * doesn't provide the needed proper *_ZoneSelectBlock.asm sources . 
 * Please refer to the Blinky DCSM example in the controlsuite examples for proper usage of this.
 * 
 * Once users are confident that they want to program the passwords in OTP, the sDSECT section type can be removed.
 * 
*/ 

MEMORY
{
PAGE 0 :  /* Program Memory */
 
   /* Part of Z1 OTP.  LinkPointers/PSWD LOCK/CRC LOCK/JTAG lock/ Boot Ctrl */
   DCSM_OTP_Z1_P0	: origin = 0x78000, length = 0x000020
   /* Part of Z2 OTP.  LinkPointers/PSWD LOCK/CRC LOCK/JTAG lock/ Boot Ctrl */
   //DCSM_OTP_Z2_P0	: origin = 0x78200, length = 0x000020, fill = 0xFFFF
   
   /* DCSM Z1 Zone Select Contents (!!Movable!!) */
   /* Part of Z1 OTP.  Z1 password locations / Flash and RAM partitioning */
   DCSM_ZSEL_Z1_P0	: origin = 0x78020, length = 0x000010
   
   /* DCSM Z1 Zone Select Contents (!!Movable!!) */
   /* Part of Z2 OTP.  Z2 password locations / Flash and RAM partitioning  */
  // DCSM_ZSEL_Z2_P0	: origin = 0x78220, length = 0x000010, fill = 0xFFFF
}


SECTIONS
{
   dcsm_otp_z1		: > DCSM_OTP_Z1_P0		PAGE = 0
//   dcsm_otp_z2		: > DCSM_OTP_Z2_P0		PAGE = 0
   
   dcsm_zsel_z1		: > DCSM_ZSEL_Z1_P0		PAGE = 0
 //  dcsm_zsel_z2		: > DCSM_ZSEL_Z2_P0		PAGE = 0
		 
}

/*
//===========================================================================
// End of file.
//===========================================================================
*/

And Changes in the blinky file :

#include "F28x_Project.h"     // Device Headerfile and Examples Include File

void DcsmZ1Unlock(void);

void main(void)
{

	//Uint16 Status;

// Step 1. Initialize System Control:
// PLL, WatchDog, enable Peripheral Clocks
// This example function is found in the F2837xD_SysCtrl.c file.
    InitSysCtrl();

// Step 2. Initialize GPIO:
// This example function is found in the F2837xD_Gpio.c file and
// illustrates how to set the GPIO to it's default state.
    InitGpio();
    GPIO_SetupPinMux(31, GPIO_MUX_CPU1, 0);
    GPIO_SetupPinOptions(31, GPIO_OUTPUT, GPIO_PUSHPULL);

    //  Unlock CSM
    //
    //  If the API functions are going to run in unsecured RAM
    //  then the CSM must be unlocked in order for the flash
    //  API functions to access the flash.
    //  If the flash API functions are executed from secure memory
    //  then this step is not required.
        DcsmZ1Unlock();


//     Status = DcsmZ1Unlock();
//     if(Status != STATUS_SUCCESS)
//     {
//    	//What do I put here ?
//     }

// Step 3. Clear all interrupts and initialize PIE vector table:
// Disable CPU interrupts
    DINT;

// Initialize the PIE control registers to their default state.
// The default state is all PIE interrupts disabled and flags
// are cleared.
// This function is found in the F2837xD_PieCtrl.c file.
    InitPieCtrl();

// Disable CPU interrupts and clear all CPU interrupt flags:
    IER = 0x0000;
    IFR = 0x0000;

// Initialize the PIE vector table with pointers to the shell Interrupt
// Service Routines (ISR).
// This will populate the entire table, even if the interrupt
// is not used in this example.  This is useful for debug purposes.
// The shell ISR routines are found in F2837xD_DefaultIsr.c.
// This function is found in F2837xD_PieVect.c.
    InitPieVectTable();

// Enable global Interrupts and higher priority real-time debug events:
    EINT;  // Enable Global interrupt INTM
    ERTM;  // Enable Global realtime interrupt DBGM

// Step 6. IDLE loop. Just sit and loop forever (optional):
    for(;;)
    {
        //
        // Turn on LED
        //
    	GPIO_WritePin(31, 0);
        //
        // Delay for a bit.
        //
    	DELAY_US(1000*500);

        //
        // Turn off LED
        //
    	GPIO_WritePin(31, 1);
        //
        // Delay for a bit.
        //
    	DELAY_US(1000*500);

    }

}




void DcsmZ1Unlock(void)
{
	volatile long int *CSM = (volatile long int *)0x5F000; //CSM register file
	volatile long int *CSMPWL = (volatile long int *)0x78028; //CSM Password location (assuming default Zone sel block)
	volatile int tmp;
	int I;
	// Read the 128-bits of the CSM password locations (PWL)
	//
	for (I=0; I<4; I++) tmp = *CSMPWL++;
	// If the password locations (CSMPWL) are all = ones (0xFFFF),
	// then the zone will now be unsecure. If the password
	// is not all ones (0xFFFF), then the code below is required
	// to unsecure the CSM.
	// Write the 128-bit password to the CSMKEY registers
	// If this password matches that stored in the
	// CSLPWL then the CSM will become unsecure. If it does not
	// match, then the zone will remain secure.
	// An example password of:
	// 0x11112222333344445555666677778888 is used.
	*CSM++ = DcsmZ1Regs.Z1_CSMKEY0;//0x22221111; // Register Z1_CSMKEY0 at 0x5F010
	*CSM++ = DcsmZ1Regs.Z1_CSMKEY1;//0x44443333; // Register Z1_CSMKEY1 at 0x5F012
	*CSM++ = DcsmZ1Regs.Z1_CSMKEY2;//0x66665555; // Register Z1_CSMKEY2 at 0x5F014
	*CSM++ = DcsmZ1Regs.Z1_CSMKEY3;//0x88887777; // Register Z1_CSMKEY3 at 0x5F016
}

Regards

Anish

Hi Anish,

Using memory watch window, please check if the passwords locations have been programmed properly. If these are porgrammed then you need to have the DcsmZ1Unlock() function in CCS Gel file to enable the code loading. Let me know what value you see at apssword location in memory watch window.

Regards,

Vivek Singh

Hi Vivek, 

The values I can see at the password locations are all 0xFFFFFFFF . So the passwords are not  programmed properly yet. 

Also I see the Z1- GRABSect has a value 5555 1555 instead of 5555 5555 in the memory.  Is that also wrong ?

Regards

Anish

Anish,

Value of Z1-GRABSect does not look correct. Bit 15:14 have been programmed with a value 0 which is not correct because value 0 makes that particular sector inaccessible. Any idea, how this got programmed to value '0'? Are you using that sector in your code? If not then you can exclude the erase for that sector by selecting the "Necessary Sectors Only (for Program Load)" under "Erase Settings" option in "On-Chip Flash" tool.

Please note that security settings are in OTP (One Time Programmable) so you can not change the value once programmed. If user want to change the security settings then they have to move the LINK POINTER to next "Zone Select Block" location and program the security settings at new locations. Please refer TRM for more detail on this and let me know if you have further queries.

Regards,

Vivek Singh

Hi Vivek .

I am confused as to how this works .

In my program , in the Z1- Zone select block , the address = 0x78020 . So at address 0x78026 , I can see 5555 5555 as I have given in the program .

Now on the On-Chip Flash tool , I can see address for Z1-GRABSECT as (0x5F01C) . At this address my value is 5555 1555 as I stated before . Could you tell me what the difference is between the two. Do I need to program in 5555 5555 from here ?  I would like to know what is the purpose of changing GrabSect  from here ?

Kind Regards

Anish