CCS/TMS320F28054F: How to secure this device with the original OTP contents all 0s

Hi,

It look like the password values have been programmed for Z1 hence Z1 is secure. That is why you are seeing values in Z1 OTP as 0x0. On the new (un-programmed) device you'll see these values as ALL_1 (just like Z2). To reprogram these values you need to unlock Z1 by using the password which are programmed. I assume you do not know the password values but if you have the .out/map file which you have tried earlier,  please check if there is anything mapped at Z1 password locations. If yes then you have to concert the .out to hex file ( check this thread - and try to extract the password value which was  programmed. One you know the password, use this to unlock Z1 and program new linkpointer value and other security settings at new Zone_Select_Block location (as per new linkpointer).

If you can not find the password values then you need to replace the part.

Hope this helps.

Regards,

Vivek Singh

Hi, Vivek

1. I'm pretty sure I didn't program the DSP,since I get a totally new PCB board. The situation is the same.

2. I just connect the new board with CCS6.0. The console window shows Zone 1 is secure. It's difficult to me to understand.

    I check the Register window, the ZR of Z1 is 0x0040,which means when I connect the device ,the CCS read the password according the 28054F.gel.

    And the ZR register just shows the device has the password when this device comes out of manufacture,which is not all 1s, and no 0s too.

3. I use the on-chip flash to unlock the device.

  for Z2,  with password all 1s, the result is the device is unlocked.

  for Z1,   with password all 1s, the result is that error ocurred when unlock this zone. 

3. Do you have a spare 28054F device in your hand? Would you please do a test for me ?Just connect the device to see if the CCS console window shows the Zone1 in secure state.

Best regards

Arrow

Picture below is the process of connecting and unlocking device.

Hi,

3. Do you have a spare 28054F device in your hand? Would you please do a test for me ?Just connect the device to see if the CCS console window shows the Zone1 in secure state.

We have tested these devices in past and never saw this issue. Also no other customer has reported this issue. If you have more devices/boards, please check them as well. If you see this issue on multiple devices then send us the screen shot of this device (top view).

Regards,

Vivek Singh

Hi, Vivek

1. I have tested tens of boards. They all totally the same.

    Due to the time difference, I'm off duty now. I will send you the making code  screen shot of these device to you tomorrow morning.

2. I have discussed with the AE of TI In ShangHai office. They now have the 28054M controlcard which they found is nomal. Howerver they don't have the

    28054F chip around.

3. I also have a 28035 controlcard in my hand. I checked this device.  I can read the 0x003F7FF8~0x003F7FFF,which is all 1s.

    I just want to show that I did test the device in the right way.

best regards

Arrow

Hi, Vivek

below is the screenshop to the device (top view)

best regards

Arrow

Hi,

Thanks. Are these device programmed with some data in flash (factory programmed) before you get to access or nothing is suppose to be programmed into flash.

Regards,

Vivek Singh

Hi,

I think nothings is supose to be programmed into flash.Because  I checked the FLASH A to FLASH J and all are 1s.

Recently I applied 10 pieces of 28054M for TI.

I replaced the 28054F with 28054M. However the situation is the same. I cannot read the Zone1 OTP region which is all 0s to me .

What I do is just to use the 28054M.gel File  to connect the CCS  with the  board.

By the way , I used the program from motorware for 2805x.

In the  hal.c  source file,  some lins  are strange:

HAL_Handle HAL_init(void *pMemory,const size_t numBytes)
{
  uint_least8_t cnt;
  HAL_Handle handle;
  HAL_Obj *obj;

  volatile int tmp;

  ENABLE_PROTECTED_REGISTER_WRITE_MODE;

  tmp = *(int *)0x003D7A18;
  tmp = *(int *)0x003D7A19;
  tmp = *(int *)0x003D7A1a;
  tmp = *(int *)0x003D7A1b;
  *(int *)0xB90 = 0xCEEC;
  *(int *)0xB91 = 0x4CA7;
  *(int *)0xB92 = 0xAAEB;
  *(int *)0xB93 = 0x7030;

  DISABLE_PROTECTED_REGISTER_WRITE_MODE;

If the chip is unsecure(factory made), why I need this section program?

Best Regards

Arrow

Ok, look like these are some specific parts which you ordered. I am checking on this further and will revert back to you soon.

Vivek Singh

Hi, Vivek

I'd like to know if there is any progress now.


Thanks a lot
Arrow

Hi, Vivek

I find someone had the similiar problem as I do. But there's no result for that thread.
This is his thread path:
e2e.ti.com/.../460922
the tile is 'How to get the update value of memory map register of Z1_LINKPOINTER（0xB80） in DCSM module on TMS320F2805x device'

best regards
Arrow

Hi,
Yes, this clarifies me that why I cannot secure Zone1.

Here's two more questions:
1. Does all 28054F/28054M has this issue, or just some in the past? Because what I used were manufactured in 2015 and my FAE in Shanghai offcie, said their 28054M has no issue about this.

2. As I told above, yes, I can use Zon2 for my security case. However, If I allocate all Flashs into Zone2(not exeonly,just belongs to it), The CAN bus communication is OK, but the motor doesn't run.
This maybe comes out due to the Instaspin ROM which is secured by Zone1.

So, in this case, how can I secure my program and ensure the motor's normal working?
Does this question belong to your forum case or should I post a new thread in Instaspin Forum?

Best Regards

Arrow

OK, I'll do some test to see if there is any conflict.

Regards
Arrow

Hi,Vivek

I find out that there is data transfer between Zone1 and Zone2.
Now I fix this problem.
Thanks, and your advice is really helpful.

Arrow