• State Resolved
  • Locked Locked
  • Replies 4 replies
  • Subscribers 83 subscribers
  • Views 1354 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

F28M36P63C2: Flash Programming failure when CSM is locked

Giannis Roussos
Expert 2290 points
Part Number: F28M36P63C2
Other Parts Discussed in Thread: CONTROLSUITE

I am trying to modify the flash programming example for the Concerto F28M36 to run with the CSM locked. When I include the flash sector I want to program to the secure zone, then erase succeds but programming fails with FMSTAT = 0x1010 (PGV and CSTAT set).

I started from the Controlsuite example and have done the following modifications:

  • Text and ramfuncs load section is now only sector N (was sector N + M)
  • modified Z1_GRABRAM = 0xFFFFFFFE so the C0 RAM is in Secure Zone 1
  • Modified Z1_GRABSECT = 0xFFFFFFD7 so that sectors K + L are in secure zone 1
  • Changed the default Z1 CSM password to a value containing 1s and 0s

So in summary, all running code is either in Flash sector N or RAM C0, both belonging to Secure Zone 1. As far as I can understand, this way I should be able to program Flash belonging to Secure Zone 1 without unlocking the CSM, but this is not working.

The example tries to erase and then program sectors K and L, and when I add those to secure Zone 1 via GRABSECT then the Programming Commands results in FMSTAT=0x1010, and when reading the Flash area with the Memory browser (after unlocking via On-chip flash tool), everything is 0xFF.

I have tried reducing the PLL clock but still get the same results, any help appreciated!

  • 0
    TI__Guru* 87155 points
    Giannis,

    I think even erase is not working for you - since Flash is already in erased state, the function is not reporting a failure.

    (1) Can you try writing a value of '01' for the SEM field in SECZONEREQUEST register? Don't forget to write the KEY value.

    (2) Can you check to make sure that all the functions in Fapi_UserDefinedFunctions.c file are also executed from Zone 1 RAM?

    Our security expert is not available now. I will ask him to take a look at this post for further analysis if needed.

    Thanks and regards,
    Vamsi
  • 0 in reply to Vamsi Gudivada
    Expert 2290 points

    Hi Vamsi,

    I tried setting SEM=01 in SECZONEREQUEST and it worked! Thank you for the advice, though I should note that this register is only mentioned in the Flash section of the F28M36 TRM but nowhere in the CSM section, though it is closely related to the CSM operation, as in my case, while the requirement for SEM=01/10 when CSM is locked is found in a note in the register description. Finally, I could not find any mention of SECZONEREQUEST, let alone its function, in the driverlib or processor headers, driverlib manual or the ControlSuite example (which gave the wrong impression that all that was needed for CSM locking was to ensure code was running from secure RAM).

    So, thank you again and hopefully this will be better described so that other people don't stumble upon it as I did.

    Giannis

  • 0 in reply to Giannis Roussos
    TI__Guru* 87155 points

    Giannis,

    Glad that I could help.  I will file a ticket internally to pass your feedback to our security documentation team.

    Thanks and regards,
    Vamsi

  • 0
    Expert 2290 points

    Hi Vivek,

    glad I could help. I think that this details should be also mentioned in the Flash Programming ControlSuite Example, and possibly also add a function in hw_flash.c to handle setting the semaphore.

    best regards,

    Giannis