• State TI Thinks Resolved
  • Locked Locked
  • Replies 7 replies
  • Answers 2 answers
  • Subscribers 82 subscribers
  • Views 746 views
  • Users 0 members are here
Support feedback
Options
Options

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Original question:

How to set the Code Security Module (CSM) password for production code for TMS320F28069 Piccolo ?

CCS/TMS320F28035: CCS/TMS320F28035 issue with PWL

Guillermo Iraola
Prodigy 30 points
Part Number: TMS320F28035
Other Parts Discussed in Thread: UNIFLASH

Tool/software: Code Composer Studio

Hi,

I am currently facing issues when trying to establish a password protection. Once I achieved to insert password properly for unlock the device, it worked, but after a blackout, the system was not longer recoverable:

My setup is the following:

- microcontroller: TMS320F28035

- debugger: XDS100 V3 REV B2

- ccs: v8.1.0.00011

- TI Uniflash: v5.0.0.2289

After reading carefully TMS320x2803x_ref_manual, and checking several threads like this one, I proceeded to create a couple of .asm files which contains:

- password protection (with no all '0's) within the PWL positions (0x3F7FF8 to 0x3F7FFF).

- 0x3F7F80 to 0x3F7FF5 addresses set to “0x0000” value in order to avoid program memory within that particular section.

password.asm file has the following code:

***************************************************

.sect "csmpasswds"

.int 0xFFFF ;PWL0 (LSW of 128-bit password)
.int 0xFFFF ;PWL1
.int 0xFFFF ;PWL2
.int 0xFFFF ;PWL3
.int 0xFFFF ;PWL4
.int 0xFFFF ;PWL5
.int 0xFFFF ;PWL6
.int 0xFFFF ;PWL7 (MSW of 128-bit password)

***************************************************

(I put values different from 0xFFFF but not all 0s)

and password_prep.asm contains the following code:

***************************************************

.sect "csm_rsvd"
.loop (3F7FF5h - 3F7F80h + 1)
.int 0x0000
.endloop

***************************************************

Both csmpasswds and csm_rsvd variables were properly linked and mapped with desired addresses:

Hence, I compiled and obtained .out file with the password protection.

After that, I connected JTAG debugger and open UniFlash tool to load corresponding image. When I browse to Memory section, if I try to check 0x3F7FF7-0x3F7FFF addresses, I could read all '0's, which means the device is in 'secure mode' (locked), which is good.

Hence, I browse to Settings & Utilities , and wrote the password that I programmed within password.asm file within the addresses 0xAE0 to 0xAE7 (key0 to key7). When I pressed Unlock button, it appeared a message in the bottom console stating that Unlock operation was successful. In order to check it, I read again 0x3F7FF7-0x3F7FFF addresses, I obtained all 'F's, which means the device is in 'unsecure mode' (unlocked). This behaviour was the expected one.

However, if I perform a blackout, and I power on the microcontoller back, I was unable to establish communication through UniFlash tool. I could not read any memory section:

I could not insert again the password for unlocking since, JTAG debugger connection is not longer successful:

Are there some errors in the steps we perform?

How could we recover the binary file or be able to load a new binary into the microcontroller?

Thanks in advance.

Guillermo

  • 0
    TI__Guru 55700 points

    Guillermo,

    Lower 64 bits of CSM password are used for ECSL (Emulation Code Security Logic) protection. This logic is used to trip the JTAG connection if unauthorized users start stepping through secure code. When any code from secure memory (without unlocking CSM) is executed JTAG will tripped. So, only way to get around this is have the device loop within BOOTROM on power-up. This can be done by using Wait boot (or) SCI boot. On powerup, BOOTROM waits in a infinite loop on both of these modes. Once you enter this mode, halt the PC and unlock the device and perform flash erase / program.

    Regards,

    Manoj

  • 0 in reply to Manoj Santha Mohan
    TI__Guru* 95315 points

    Any updates on this?

  • 0 in reply to Hareesh Janakiraman
    TI__Guru* 95315 points

    Closing due to inactivity.

  • 0 in reply to Hareesh Janakiraman
    Prodigy 30 points

    Dear Hareesh,

    As you mentioned in previous comment, TMS can be unlocked by making use of SCI boot mode. I tried with both SCI and Wait boot mode, and I was able to unlock the device, flash A sector and to flash another firmware successfully but always through JTAG.

    I am wondering if is there any chance of performing firmware update through BLE with SCI boot mode. It is working for me when firmware has no CSM password protection, but when TMS is protected, I cannot perform this action.

    My procedure is the following:

    - I set GPIO37 to 0 and GPIO34 to 1 through BLE connectivity, and I have already checked with a tester that during the process those Boot pins are properly set.

    - I use a kernel which contains Flash2803x_CsmKeys.asm file for unlocking the device when accessing to RAM.

    - I use FW File with DSP2803x_CSMPasswords.asm file for locking the device and set also 3F7F80h - 3F7FF5h memory positions to '0' value in flash.

    Is there any step that I am missing? Should I include any other file of specific function to commit this action? Is possible to update the firmware when there is still a password protection without using JTAG?

    Thank you very much.

  • 0 in reply to Guillermo Iraola
    TI__Guru* 95315 points

    It appears you are able to program the flash via BLE+SCI, as long as the device is unsecure. This means that the H/W chain is good.

    - I use a kernel which contains Flash2803x_CsmKeys.asm file for unlocking the device when accessing to RAM.

    Where do you load this kernel? It can only be loaded/run from unsecure memory. Once the part is unsecured, you can start using RAM that is protected by the CSM. See this post for details: https://e2e.ti.com/support/microcontrollers/c2000/f/171/t/821593

  • 0 in reply to Hareesh Janakiraman
    Prodigy 30 points

    Dear Hareesh J,

    Thank you very much for your reply. I carefully read the case you provided me in above comment (https://e2e.ti.com/support/microcontrollers/c2000/f/171/t/821593). According to this, it is required to modify linker command file in order to download bootloader code into RAM unsecure for unlocking the device, and after this, to perform disered action such as FW update with the pretend Flash. I am currently using microcontroller TMS320F28035, and I have found the following information regarding memory map for this specific target:

    Based on this chart, M0 or M1 are the only unsecured memory blocks available, since there is no L4-L8 memory spaces avaialble for this purpose. Is my understanding correct?

    Thank you very much.

    Guillermo

  • 0 in reply to Guillermo Iraola
    TI__Guru* 95315 points

    Yes, the procedure is as follows:

    1. Modify linker command file in order to download bootloader code into unsecure RAM for unlocking the device
    2. Unlock the device
    3. Download the flash API and application code into available RAM
    4. Perform desired action such as FW update. 

    Yes, M0 and M1 are the only two unsecure RAM blocks. Make sure you do not corrupt some other section in these blocks such as stack etc.