CCS/TMS320F28034: How can I unlock my flash using code.

James,

The dummy reads are supposed to come before you write the passwords. Try this and see if it works.

- David

I changed my unlock function as you suggest and still my flash remains locked. This is my function with dummy reads first.

#define STATUS_FAIL 0
#define STATUS_SUCCESS 1
//#pragma CODE_SECTION(CsmUnlock,"ramfuncs");
Uint16 CsmUnlock()
{
volatile Uint16 temp;



// Perform a dummy read of the password locations
// if they match the key values, the CSM will unlock

temp = CsmPwl.PSWD0;
temp = CsmPwl.PSWD1;
temp = CsmPwl.PSWD2;
temp = CsmPwl.PSWD3;
temp = CsmPwl.PSWD4;
temp = CsmPwl.PSWD5;
temp = CsmPwl.PSWD6;
temp = CsmPwl.PSWD7;

// Load the key registers with the current password. The 0xFFFF's are dummy
// passwords. User should replace them with the correct password for the DSP.

asm(" EALLOW");
CsmRegs.KEY0 = 0x1111;
CsmRegs.KEY1 = 0x2222;
CsmRegs.KEY2 = 0x3333;
CsmRegs.KEY3 = 0x4444;
CsmRegs.KEY4 = 0x5555;
CsmRegs.KEY5 = 0x6666;
CsmRegs.KEY6 = 0x7777;
CsmRegs.KEY7 = 0x8888;
__asm(" EDIS");

// If the CSM unlocked, return succes, otherwise return
// failure.
if (CsmRegs.CSMSCR.bit.SECURE == 0)
return STATUS_SUCCESS;
else
return STATUS_FAIL;

}

Sorry I replied to myself when I should have replied to you David.
I am wondering if I can get someone to spend a bit of time with me to get a solution to this. I tried all yesterday to get the flash to unlock with the code above. I even tried putting the function in secure ram to see if that is the problem with no luck. There really has to be something undocumented or I am missing something in the documentation. I should mention that code skin is able to unlock it but I am not able to from my app with the code above. What could codeskin be doing that I am not? I am desperate for a solution as this problem is holding up the shipment of my product. I would be very grateful if you could offer some more advice.

James,

I'll make an example program and test.

One thing though: have you tried listing your passwords in reverse order in your program?

- David

James,

I tested and things work as they are supposed to. I can unlock the CSM using exactly your code (with my passwords of course).

1) Try reversing the order of your passwords in the program.
2) Are you running this code from flash or secure RAM? Since the PWL in flash are protected by the CSM module, you can only do dummy reads of them from secure memory.

[Update 2018Apr27, 1056AM EDT, ALTER]: #2 above is incorrect.  You can do the dummy reads from unsecure memory.

Regards,
David

Hi David. Still no luck with reversing the password. I as well read some documentation that suggests that it be run from secure RAM
This is my function with the password reversed. I believe I am running from secure memory. My map file shows the address of my function at 98333 as follows. Would you say that is a good place to run from?
0 00009833 _CsmUnlock

#pragma CODE_SECTION(CsmUnlock,"ramfuncs");
Uint16 CsmUnlock()
{
volatile Uint16 temp;



// Perform a dummy read of the password locations
// if they match the key values, the CSM will unlock

temp = CsmPwl.PSWD0;
temp = CsmPwl.PSWD1;
temp = CsmPwl.PSWD2;
temp = CsmPwl.PSWD3;
temp = CsmPwl.PSWD4;
temp = CsmPwl.PSWD5;
temp = CsmPwl.PSWD6;
temp = CsmPwl.PSWD7;

// Load the key registers with the current password. The 0xFFFF's are dummy
// passwords. User should replace them with the correct password for the DSP.

__asm(" EALLOW");
CsmRegs.KEY0 = 0x8888;
CsmRegs.KEY1 = 0x7777;
CsmRegs.KEY2 = 0x6666;
CsmRegs.KEY3 = 0x5555;
CsmRegs.KEY4 = 0x4444;
CsmRegs.KEY5 = 0x3333;
CsmRegs.KEY6 = 0x2222;
CsmRegs.KEY7 = 0x1111;


// If the CSM unlocked, return succes, otherwise return
// failure.
Uint16 status = CsmRegs.CSMSCR.bit.SECURE;
__asm(" EDIS");
if (status == 0)
return STATUS_SUCCESS;
else
return STATUS_FAIL;

}

I even tried this with no luck. Just to take the password order out of the equation. I set the password to all 0xaaaa's
#pragma CODE_SECTION(CsmUnlock,"ramfuncs");
Uint16 CsmUnlock()
{
volatile Uint16 temp;



// Perform a dummy read of the password locations
// if they match the key values, the CSM will unlock
__asm(" EALLOW");
temp = CsmPwl.PSWD0;
temp = CsmPwl.PSWD1;
temp = CsmPwl.PSWD2;
temp = CsmPwl.PSWD3;
temp = CsmPwl.PSWD4;
temp = CsmPwl.PSWD5;
temp = CsmPwl.PSWD6;
temp = CsmPwl.PSWD7;

// Load the key registers with the current password. The 0xFFFF's are dummy
// passwords. User should replace them with the correct password for the DSP.


CsmRegs.KEY0 = 0xaaaa;
CsmRegs.KEY1 = 0xaaaa;
CsmRegs.KEY2 = 0xaaaa;
CsmRegs.KEY3 = 0xaaaa;
CsmRegs.KEY4 = 0xaaaa;
CsmRegs.KEY5 = 0xaaaa;
CsmRegs.KEY6 = 0xaaaa;
CsmRegs.KEY7 = 0xaaaa;


// If the CSM unlocked, return succes, otherwise return
// failure.
Uint16 status = CsmRegs.CSMSCR.bit.SECURE;
__asm(" EDIS");
if (status == 0)
return STATUS_SUCCESS;
else
return STATUS_FAIL;

}

James,

Try leaving your unlock function in flash instead of copying to RAM until you get this resolved.  One less variable to deal with.

The unlock procedure is very simple, and you seem to have implemented it correctly.  I'm wondering if your method for detecting the CSM status is flawed.  What do you do with the 'status' variable?  Are you using it to light an LED or something like that?

- David

I thought you had to run from secure ram? I have tried both flash and secure ram. I don't do anything with the status variable. I now that the code is still locked because Code composer refuses the connection and tells me it is locked.

James,

James Robb said:

I don't do anything with the status variable. I now that the code is still locked because Code composer refuses the connection and tells me it is locked.

James,

Have you tried unlocking it via flash plug-in GUI? Does it work there?

Also can you share your assembly code for csmunlock() function?

Regards,

Vivek Singh

The steps I follow to verify if the flash is locked.

1. I load my code with codeskin with my 0xaaaa's as the password
2. I connect with the debugger and use the on-chip flash option to set the password.
3. I recycle power on the controller which runs the unlock code.
4. I then try to run codeskin with with the wrong password. Codeskin tells me the device is locked.
5. I then put the correct password in codeskin and I am able to load code.

I think this procedure confirms that my unlock code is not working.

James,

Can you just toggle some GPIO if device becomes unsecure to see if it's working or not. Trying codeskin with incorrect password may lock the device again so it may not give correct info. I feel, your unsecure code is working fine but the way you are checking it may not work.

Regards,

Vivek Singh

This is my listing. Where can I get "flash plug-in GUI"

00000013 .sect ".text"
2395 .clink
2396 .global _CsmUnlock
2397
2398 $C$DW$313 .dwtag DW_TAG_subprogram
2399 .dwattr $C$DW$313, DW_AT_name("CsmUnlock")
2400 .dwattr $C$DW$313, DW_AT_low_pc(_CsmUnlock)
2401 .dwattr $C$DW$313, DW_AT_high_pc(0x00)
2402 .dwattr $C$DW$313, DW_AT_TI_symbol_name("_CsmUnlock")
2403 .dwattr $C$DW$313, DW_AT_external
2404 .dwattr $C$DW$313, DW_AT_type(*$C$DW$T$23)
2405 .dwattr $C$DW$313, DW_AT_TI_begin_file("../main.c")
2406 .dwattr $C$DW$313, DW_AT_TI_begin_line(0x4f7)
2407 .dwattr $C$DW$313, DW_AT_TI_begin_column(0x08)
2408 .dwattr $C$DW$313, DW_AT_TI_max_frame_size(-4)
2409 .dwpsn file "../main.c",line 1272,column 1,is_stmt,address _CsmUnlock,isa 0
2410
2411 .dwfde $C$DW$CIE, _CsmUnlock
2412
2413 ;***************************************************************
2414 ;* FNAME: _CsmUnlock FR SIZE: 2 *
2415 ;* *
2416 ;* FUNCTION ENVIRONMENT *
2417 ;* *
2418 ;* FUNCTION PROPERTIES *
2419 ;* 0 Parameter, 1 Auto, 0 SOE *
2420 ;***************************************************************
2421
2422 _CsmUnlock:
2423 $C$DW$314 .dwtag DW_TAG_variable
2424 .dwattr $C$DW$314, DW_AT_name("temp")
2425 .dwattr $C$DW$314, DW_AT_TI_symbol_name("_temp")
2426 .dwattr $C$DW$314, DW_AT_type(*$C$DW$T$303)
2427 .dwattr $C$DW$314, DW_AT_location[DW_OP_breg20 -1]
2428
2429 ;* AR4 assigned to $O$C1
2430 ;* AH assigned to _status
2431 $C$DW$315 .dwtag DW_TAG_variable
2432 .dwattr $C$DW$315, DW_AT_name("status")
2433 .dwattr $C$DW$315, DW_AT_TI_symbol_name("_status")
2434 .dwattr $C$DW$315, DW_AT_type(*$C$DW$T$23)
2435 .dwattr $C$DW$315, DW_AT_location[DW_OP_reg1]
2436
2437 .dwcfi cfa_offset, -2
2438 .dwcfi save_reg_to_mem, 26, 0
2439 00000013 FE02 ADDB SP,#2 ; [CPU_U]
2440 .dwcfi cfa_offset, -4
TMS320C2000 Assembler PC v16.9.0 Fri Apr 27 11:35:57 2018

Tools Copyright (c) 1996-2015 Texas Instruments Incorporated
C:\Users\Eng4\AppData\Local\Temp\0818010 PAGE 46

2441 00000014 7622 EALLOW
2442 00000015 761F! MOVW DP,#_CsmPwl ; [CPU_U]
00000016 0000
2443 .dwpsn file "../main.c",line 1280,column 5,is_stmt,isa 0
2444 00000017 9200! MOV AL,@_CsmPwl ; [CPU_] |1280|
2445 00000018 9641 MOV *-SP[1],AL ; [CPU_] |1280|
2446 .dwpsn file "../main.c",line 1293,column 2,is_stmt,isa 0
2447 00000019 8F00! MOVL XAR4,#_CsmRegs ; [CPU_U] |1293|
0000001a 0000
2448 .dwpsn file "../main.c",line 1305,column 21,is_stmt,isa 0
2449 0000001b D00F MOVB XAR0,#15 ; [CPU_] |1305|
2450 .dwpsn file "../main.c",line 1281,column 5,is_stmt,isa 0
2451 0000001c 9201! MOV AL,@_CsmPwl+1 ; [CPU_] |1281|
2452 0000001d 9641 MOV *-SP[1],AL ; [CPU_] |1281|
2453 .dwpsn file "../main.c",line 1282,column 5,is_stmt,isa 0
2454 0000001e 9202! MOV AL,@_CsmPwl+2 ; [CPU_] |1282|
2455 0000001f 9641 MOV *-SP[1],AL ; [CPU_] |1282|
2456 .dwpsn file "../main.c",line 1283,column 5,is_stmt,isa 0
2457 00000020 9203! MOV AL,@_CsmPwl+3 ; [CPU_] |1283|
2458 00000021 9641 MOV *-SP[1],AL ; [CPU_] |1283|
2459 .dwpsn file "../main.c",line 1284,column 5,is_stmt,isa 0
2460 00000022 9204! MOV AL,@_CsmPwl+4 ; [CPU_] |1284|
2461 00000023 9641 MOV *-SP[1],AL ; [CPU_] |1284|
2462 .dwpsn file "../main.c",line 1285,column 5,is_stmt,isa 0
2463 00000024 9205! MOV AL,@_CsmPwl+5 ; [CPU_] |1285|
2464 00000025 9641 MOV *-SP[1],AL ; [CPU_] |1285|
2465 .dwpsn file "../main.c",line 1286,column 5,is_stmt,isa 0
2466 00000026 9206! MOV AL,@_CsmPwl+6 ; [CPU_] |1286|
2467 00000027 9641 MOV *-SP[1],AL ; [CPU_] |1286|
2468 .dwpsn file "../main.c",line 1287,column 5,is_stmt,isa 0
2469 00000028 9207! MOV AL,@_CsmPwl+7 ; [CPU_] |1287|
2470 00000029 9641 MOV *-SP[1],AL ; [CPU_] |1287|
2471 .dwpsn file "../main.c",line 1293,column 2,is_stmt,isa 0
2472 0000002a 28C4 MOV *+XAR4[0],#43690 ; [CPU_] |1293|
0000002b AAAA
2473 .dwpsn file "../main.c",line 1294,column 2,is_stmt,isa 0
2474 0000002c 28CC MOV *+XAR4[1],#43690 ; [CPU_] |1294|
0000002d AAAA
2475 .dwpsn file "../main.c",line 1295,column 2,is_stmt,isa 0
2476 0000002e 28D4 MOV *+XAR4[2],#43690 ; [CPU_] |1295|
0000002f AAAA
2477 .dwpsn file "../main.c",line 1296,column 2,is_stmt,isa 0
2478 00000030 28DC MOV *+XAR4[3],#43690 ; [CPU_] |1296|
00000031 AAAA
2479 .dwpsn file "../main.c",line 1297,column 2,is_stmt,isa 0
2480 00000032 28E4 MOV *+XAR4[4],#43690 ; [CPU_] |1297|
00000033 AAAA
2481 .dwpsn file "../main.c",line 1298,column 2,is_stmt,isa 0
2482 00000034 28EC MOV *+XAR4[5],#43690 ; [CPU_] |1298|
00000035 AAAA
2483 .dwpsn file "../main.c",line 1299,column 2,is_stmt,isa 0
2484 00000036 28F4 MOV *+XAR4[6],#43690 ; [CPU_] |1299|
00000037 AAAA
2485 .dwpsn file "../main.c",line 1300,column 2,is_stmt,isa 0
2486 00000038 28FC MOV *+XAR4[7],#43690 ; [CPU_] |1300|
TMS320C2000 Assembler PC v16.9.0 Fri Apr 27 11:35:57 2018

Tools Copyright (c) 1996-2015 Texas Instruments Incorporated
C:\Users\Eng4\AppData\Local\Temp\0818010 PAGE 47

00000039 AAAA
2487 .dwpsn file "../main.c",line 1305,column 21,is_stmt,isa 0
2488 0000003a CD94 AND AH,*+XAR4[AR0],#0x0001 ; [CPU_] |1305|
0000003b 0001
2489 0000003c 761A EDIS
2490 .dwpsn file "../main.c",line 1310,column 6,is_stmt,isa 0
2491 0000003d 9A00 MOVB AL,#0 ; [CPU_] |1310|
2492 0000003e FF69 SPM #0 ; [CPU_]
2493 0000003f 5300 CMPB AH,#0 ; [CPU_] |1310|
2494 00000040 56B1 MOVB AL,#1,EQ ; [CPU_] |1310|
00000041 01A9
2495 00000042 FE82 SUBB SP,#2 ; [CPU_U]
2496 .dwcfi cfa_offset, -2
2497 $C$DW$316 .dwtag DW_TAG_TI_branch
2498 .dwattr $C$DW$316, DW_AT_low_pc(0x00)
2499 .dwattr $C$DW$316, DW_AT_TI_return
2500
2501 00000043 0006 LRETR ; [CPU_]

I added gpio as you suggest. The secure bit always comes back as 1 and sets the GPIO_Number_40 high. I also tested when the device is unlocked that the secure bit is 0 and sets the GPIO_Number_40 Low.

Uint16 CsmUnlock()
{
volatile Uint16 temp;



// Perform a dummy read of the password locations
// if they match the key values, the CSM will unlock
__asm(" EALLOW");
temp = CsmPwl.PSWD0;
temp = CsmPwl.PSWD1;
temp = CsmPwl.PSWD2;
temp = CsmPwl.PSWD3;
temp = CsmPwl.PSWD4;
temp = CsmPwl.PSWD5;
temp = CsmPwl.PSWD6;
temp = CsmPwl.PSWD7;

// Load the key registers with the current password. The 0xFFFF's are dummy
// passwords. User should replace them with the correct password for the DSP.


CsmRegs.KEY0 = 0xaaaa;
CsmRegs.KEY1 = 0xaaaa;
CsmRegs.KEY2 = 0xaaaa;
CsmRegs.KEY3 = 0xaaaa;
CsmRegs.KEY4 = 0xaaaa;
CsmRegs.KEY5 = 0xaaaa;
CsmRegs.KEY6 = 0xaaaa;
CsmRegs.KEY7 = 0xaaaa;


// If the CSM unlocked, return succes, otherwise return
// failure.
Uint16 status = CsmRegs.CSMSCR.bit.SECURE;
__asm(" EDIS");
if (status == 0)
{
GPIO_setLow(halHandle->gpioHandle, GPIO_Number_40);
return STATUS_SUCCESS;
}
else
{
GPIO_setHigh(halHandle->gpioHandle, GPIO_Number_40);
return STATUS_FAIL;
}

}

Hi James,

In your code, after writing the last KEY register can you add EALLOW instruction and then read the SECURE bit. Let me know if how it goes.

Regards,

Vivek Singh

Still no luck. Still the flash will not unlock

Uint16 CsmUnlock()
{
volatile Uint16 temp;



// Perform a dummy read of the password locations
// if they match the key values, the CSM will unlock
__asm(" EALLOW");
temp = CsmPwl.PSWD0;
temp = CsmPwl.PSWD1;
temp = CsmPwl.PSWD2;
temp = CsmPwl.PSWD3;
temp = CsmPwl.PSWD4;
temp = CsmPwl.PSWD5;
temp = CsmPwl.PSWD6;
temp = CsmPwl.PSWD7;

// Load the key registers with the current password. The 0xFFFF's are dummy
// passwords. User should replace them with the correct password for the DSP.


CsmRegs.KEY0 = 0xaaaa;
CsmRegs.KEY1 = 0xaaaa;
CsmRegs.KEY2 = 0xaaaa;
CsmRegs.KEY3 = 0xaaaa;
CsmRegs.KEY4 = 0xaaaa;
CsmRegs.KEY5 = 0xaaaa;
CsmRegs.KEY6 = 0xaaaa;
CsmRegs.KEY7 = 0xaaaa;


// If the CSM unlocked, return succes, otherwise return
// failure.
__asm(" EALLOW");
Uint16 status = CsmRegs.CSMSCR.bit.SECURE;
__asm(" EDIS");
if (status == 0)
{
GPIO_setLow(halHandle->gpioHandle, GPIO_Number_40);
return STATUS_SUCCESS;
}
else
{
GPIO_setHigh(halHandle->gpioHandle, GPIO_Number_40);
return STATUS_FAIL;
}

}

James,

Attached to this post is a simple code example that has the CSM passwords programmed, and the program unlocks the CSM.  I am blinking GPIO34 which is connected to an LED on the F28035 ControlCard I am using.  After the unlocking procedure, if the CSM is unlocked, the LED blinks fast (~5 Hz).  If the CSM is locked, the LED blinks slow (~0.5 Hz).

You may need to modify the GPIO used for your board.

Note that the clocks/PLL is not configured, so the DelayMs() macro being used is not calibrated.  It expects a 60 MHz clock, but the CPU is only running at 10/2 MHz (I think) off the internal oscillator.

I only changed the first password from 0xFFFF.  I am using 0xFFFE.  All the other passwords as still 0xFFFF.  This isn't the issue though.  I've run this program with all the passwords programmed.  I am just sending it to you like this, with the first one 0xFFFE.

Regards,

David

F28035_example_nonBIOS.zip

BTW, the project is a CCSv8.0.0 project.  You may need to install this if you are using an older version in order to load the project.

- David

I do have an older version of CCS Version: 6.1.1.00022. Can CCSv8.0.0 be installed at the same time? Is there any risk if I intall CCSv8.0.0 that it will mess up my current tools?

You can install CCSv8 in a different folder from your CCSv6. For example, c:/ti2.

Alternately, you can try making a new project and use my source files. That project is fully self-contained.

- David

Hi David,

I was able to get your project compiled with my CCSv6 tools. I used the CCS debugger to single step your code.
As soon as I get to the statement
CsmRegs.CSMSCR.bit.FORCESEC = 1;

I get a message from CCS that asks if I want to bring the device out of lower power mode. I click yes. My 28034 reboots and starts toggling the io very rapidly as if the devices is unlocked and the secure bit is equal to zero. This I expect since the password matches the one programmed in your password.asm file. The problem occurs when I recycle power. After the power is recycled the I/O
toggles slowly at the 1 second rate which suggests that the device is locked. I power cycle several times but still the device remains locked with the secure bit equal to 1. Would you not expect the device should be unlocked after power cycling since the key being written to the key registers matches the one you have programmed in the flash?