OMAP-L138 doesn't securely boot from UART while running from mDDR

Giuseppe Ameno

Other Parts Discussed in Thread: OMAP-L138

Hi,

I am using a secure enabled OMAP-L138.

I am using the content of the TI Security_collateral_update.zip with our own board.

I am using the SecureHexAIS_OMAP-L138.exe with the t3_dsp_L2.out and and the t3_dsp_DDR.out. The ini file is here attached (NFF_board.ini).

While I am able to boot the dsp_sectononsec.bin generated from the t3_dsp_L2.out, the binary generated from the t3_dsp_DDR.out hangs forever ((AIS Parse): Waiting for DONE...). Logs attached. Note that I am booting from UART through the GenericSecureUartHost.exe application.

It seems we are not able to configure the mDDR @150MHz on the board with the secure enabled part on.

That's odd considering that the same configuration settings work fine on a board with a normal (non secure) OMAP-L138.

The MPU2 (for DDR2/mDDR SDRAM) seems to open up everything (by looking at the ini file).

Is there anything I am missing?

https://e2e.ti.com/cfs-file/__key/communityserver-discussions-components-files/791/NFF_5F00_board.ini

Fullscreen t3_dsp_L2.log Download

(File IO): Read 1724 bytes from file C:\Projects\Inmarsat\Phase 2\kepler repo\trunk\SW_HOST_SYS\tools\secure boot\temp\examples\example_sec2nonsec\dsp_sectononsec.bin.
(Serial Port): Opening COM3 at 115200 baud...
(AIS Parse): Read magic word 0x41504954.
(AIS Parse): Waiting for BOOTME... (power on or reset target now)
(AIS Parse): BOOTME received!
(AIS Parse): Performing Start-Word Sync...
(AIS Parse): Performing Ping Opcode Sync...
(AIS Parse): Processing command 0: 0x58535920.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Secure key loading, entering secure mode.
(AIS Parse): Processing command 1: 0x58535923.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Setting boot exit mode...
(AIS Parse): Set exit mode to 0x00000000.
(AIS Parse): Processing command 2: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 3: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 4: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 5: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 6: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 7: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 8: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 9: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 10: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 11: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 12: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 13: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 14: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 15: 0x58535921.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Loading encoded section...
(AIS Parse): Loaded 864-Byte section to address 0x00831000.
(AIS Parse): Processing command 16: 0x58535921.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Loading encoded section...
(AIS Parse): Loaded 84-Byte section to address 0x00831360.
(AIS Parse): Processing command 17: 0x58535906.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Performing jump and close...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): AIS complete. Jump to address 0x00831260.
(AIS Parse): Waiting for DONE...
(AIS Parse): Boot completed successfully.
(Serial Port): Closing COM3.

Fullscreen t3_dsp_DDR.log Download

(File IO): Read 1724 bytes from file C:\Projects\Inmarsat\Phase 2\kepler repo\trunk\SW_HOST_SYS\tools\secure boot\temp\examples\example_sec2nonsec\dsp_sectononsec.bin.
(Serial Port): Opening COM3 at 115200 baud...
(AIS Parse): Read magic word 0x41504954.
(AIS Parse): Waiting for BOOTME... (power on or reset target now)
(AIS Parse): BOOTME received!
(AIS Parse): Performing Start-Word Sync...
(AIS Parse): Performing Ping Opcode Sync...
(AIS Parse): Processing command 0: 0x58535920.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Secure key loading, entering secure mode.
(AIS Parse): Processing command 1: 0x58535923.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Setting boot exit mode...
(AIS Parse): Set exit mode to 0x00000000.
(AIS Parse): Processing command 2: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 3: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 4: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 5: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 6: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 7: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 8: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 9: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 10: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 11: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 12: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 13: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 14: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 15: 0x58535921.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Loading encoded section...
(AIS Parse): Loaded 864-Byte section to address 0xC0001000.
(AIS Parse): Processing command 16: 0x58535921.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Loading encoded section...
(AIS Parse): Loaded 84-Byte section to address 0xC0001360.
(AIS Parse): Processing command 17: 0x58535906.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Performing jump and close...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): AIS complete. Jump to address 0xC0001260.
(AIS Parse): Waiting for DONE...

Regards,

Giuseppe

over 10 years ago

0 Titusrathinaraj Stalin over 10 years ago

TI__Guru** 116100 points

Hi Giuseppe,

In your ini file, you have not enable DDR PLL (PLL1)

[PLL1CONFIG]

PLL1CFG0 = 0x18010001

PLL1CFG1 = 0x00000002

Please enable it and let me know the results.

Sample ini file is attached here and also please refer to the following TI wiki.

https://e2e.ti.com/cfs-file/__key/communityserver-discussions-components-files/791/3681.sample_5F00_ini.ini

0 Giuseppe Ameno over 10 years ago in reply to Titusrathinaraj Stalin

Prodigy 140 points

Hi Titu

My ini file configures the PLL1:

[EMIF3DDR]
PLL1CFG0 = 0x18010001
PLL1CFG1 = 0x00000002
DDRPHYC1R = 0x000000C4
SDCR = 0x02034621
SDTIMR = 0x20923249
SDTIMR2 = 0x3E141420
SDRCR = 0x00000493
CLK2XSRC = 0x00000000

Furthermore i used your sample_ini.ini file with the t3_dsp_ddr.out but the boot fails in exactly the same way (hangs forever):

(File IO): Read 1776 bytes from file C:\Projects\Inmarsat\Phase 2\kepler repo\trunk\SW_HOST_SYS\tools\secure boot\temp\examples\example_sec2nonsec\dsp_sectononsec.bin.
(Serial Port): Opening COM3 at 115200 baud...
(AIS Parse): Read magic word 0x41504954.
(AIS Parse): Waiting for BOOTME... (power on or reset target now)
(AIS Parse): BOOTME received!
(AIS Parse): Performing Start-Word Sync...
(AIS Parse): Performing Ping Opcode Sync...
(AIS Parse): Processing command 0: 0x58535920.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Secure key loading, entering secure mode.
(AIS Parse): Processing command 1: 0x58535923.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Setting boot exit mode...
(AIS Parse): Set exit mode to 0x00000000.
(AIS Parse): Processing command 2: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 3: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 4: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 5: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 6: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 7: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 8: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 9: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 10: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 11: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 12: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 13: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 14: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 15: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 16: 0x58535921.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Loading encoded section...
(AIS Parse): Loaded 864-Byte section to address 0xC0001000.
(AIS Parse): Processing command 17: 0x58535921.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Loading encoded section...
(AIS Parse): Loaded 84-Byte section to address 0xC0001360.
(AIS Parse): Processing command 18: 0x58535906.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Performing jump and close...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): AIS complete. Jump to address 0xC0001260.
(AIS Parse): Waiting for DONE...

It looks like the secure ROM bootloader does not configure the mDDR correctly.

PLEASE note that the mDDR timing settings work fine on a board with a non secure OMAP-L138 part.

Giuseppe

0 Titusrathinaraj Stalin over 10 years ago in reply to Giuseppe Ameno

TI__Guru** 116100 points

Hi Giuseppe,

Could you create "Hello world" DSP sample app and try to convert to bin with *.ini then try to load the*.bin through UART.

DDRPHYC1R = 0x000000C4
SDCR = 0x02034621
SDTIMR = 0x20923249
SDTIMR2 = 0x3E141420
SDRCR = 0x00000493
CLK2XSRC = 0x00000000

You are able to up the mDDR with the above settings on non-secure OMAP right ?

0 Titusrathinaraj Stalin over 10 years ago in reply to Giuseppe Ameno

TI__Guru** 116100 points

Hi Giuseppe,

The results seems its purely depends on DDR timing parameters.
Please look into the DDR timing register values & its calculation.

Especially SDCR register.

Also try this value for SEDCR reg => SDCR = 0x0A034622

I'm able to reproduce the problem by giving the wrong values for "EMIF3DDR"

Please re-look into this even if it worked with non-secure OMAP.

processors.wiki.ti.com/.../C674x

0 Giuseppe Ameno over 10 years ago in reply to Titusrathinaraj Stalin

Prodigy 140 points

I don't think that's the problem Titus.

When I boot the t3_dsp_L2.bin through the UART, I then try to connect Code Composer and that's what happens:

ICEPICK_C: Trouble Reading Memory Block at 0x1c10800 on Page 0 of Length 0x4
ICEPICK_C: GEL: Error while executing OnTargetConnect(): Target failed to read 0x01C10800 at (*((unsigned int *) ((0x01C10000+0x800)+(4*LPSC_num)))&0x1F) [non_form_factor_arm.gel:874] at PSC0_LPSC_enable(0, 0) [non_form_factor_arm.gel:542] at PSC_All_On_Full_EVM() [non_form_factor_arm.gel:245] at OnTargetConnect() .

Looking into the gel file:

DEVICE_mDDRConfig(unsigned int freq)
{
/*Enable the Clock to EMIF3A SDRAM*/
PSC1_LPSC_enable(PD0, LPSC_DDR);

/*If VTP claiberation enabled , then skip the VTP calibration*/
if((VTPIO_CTL & 0x00000040))
{
// Begin VTP Calibration
VTPIO_CTL |= (0x00004000); // Set IOPWRDN bit to enable input buffer powerdown enable mode
VTPIO_CTL &= ~(0x00000040); // Clear POWERDN bit (enable VTP)

// Pulse (low) CLRZ to initiate VTP IO Calibration
VTPIO_CTL |= (0x00002000); // Set CLRZ bit
VTPIO_CTL &= ~(0x00002000); // Clear CLRZ bit (CLRZ should be low for at least 2ns)
VTPIO_CTL |= 0x00002000; // Set CLRZ bit

// Polling READY bit to see when VTP calibration is done
while(!((VTPIO_CTL & 0x00008000)>>15)) {}

VTPIO_CTL |= 0x00000080; // Set LOCK bit for static mode
VTPIO_CTL |= 0x00000100; // Set PWRSAVE bit to save power
// End VTP Calibration
}

EMIF3A_SDCR |= 0x00800000; // Set BOOTUNLOCK

// **********************************************************************************************
// Setting based on 1Gbit mDDR MT46H64M16LFBF-6
// Config DDR timings
DDRCTL = (0x0 << 8) | // Reserved
(0x1 << 7) | // EXT_STRBEN
(0x1 << 6) | // PWRDNEN
(0x0 << 3) | // Reserved
(0x4 << 0); // RL (was 4)

EMIF3A_SDCR = (EMIF3A_SDCR & 0xF0000000) | // Reserved
(0x1 << 27) | // DDR2TERM1
(0x0 << 26) | // IBANK_POS
(0x1 << 25) | // MSDRAMEN
(0x0 << 24) | // DDRDRIVE1
(0x0 << 23) | // BOOTUNLOCK
(0x0 << 22) | // DDR2DDQS
(0x0 << 21) | // DDR2TERM0
(0x0 << 20) | // DDR2EN
(0x0 << 19) | // DDRDLL_DIS
(0x0 << 18) | // DDRDRIVE0
(0x1 << 17) | // DDREN
(0x1 << 16) | // SDRAMEN
(0x1 << 15) | // TIMUNLOCK
(0x1 << 14) | // NM
(0x0 << 12) | // Reserved
(0x3 << 9) | // CL
(0x0 << 7) | // Reserved
(0x2 << 4) | // IBANK
(0x0 << 3) | // Reserved
(0x2 << 0); // PAGESIZE

// Subtracting 0.5 instead of 1 so that the int is rounded up after truncating a real value
EMIF3A_SDTIMR1 = (((unsigned int) ((97.5 * freq / 1000) - 0.5)) << 25) | // tRFC (was 97.5) (new 110)
(((unsigned int) ((18.0 * freq / 1000) - 0.5)) << 22) | // tRP
(((unsigned int) ((18.0 * freq / 1000) - 0.5)) << 19) | // tRCD
(((unsigned int) ((15.0 * freq / 1000) - 0.5)) << 16) | // tWR
(((unsigned int) ((42.0 * freq / 1000) - 0.5)) << 11) | // tRAS
(((unsigned int) ((60.0 * freq / 1000) - 0.5)) << 6) | // tRC
(((unsigned int) ((12.0 * freq / 1000) - 0.5)) << 3) | // tRRD
(EMIF3A_SDTIMR1 & 0x4) | // Reserved
(((unsigned int) ((2.0 * freq / 1000) - 0.5)) << 0); // tWTR (was 2.0) (new 1.0)

// Subtracting 0.5 instead of 1 so that the int is rounded up after truncating a real value
// tRASMAX is rounded down so subtracting 1
// CAS/CL = 3
EMIF3A_SDTIMR2 = (EMIF3A_SDTIMR2 & 0x80000000) | // Reserved
(((unsigned int) ((70000 * freq / 1000) - 1)) << 27) | // tRASMAX
(0x0 << 25) | // tXP
(0x0 << 23) | // tODT (Not supported)
(((unsigned int) ((138.0 * freq / 1000) - 0.5)) << 16) | // tXSNR (was 120) (XSR) (new 138)
((138 - 1) << 8) | // tXSRD (was 200 Cycles) (XSR) (new 138)
((1 - 1) << 5) | // tRTP (1 Cycle)
(0x0 << 0); // tCKE

EMIF3A_SDCR &= ~0x00008000; // Clear TIMUNLOCK

EMIF3A_SDCR2 = 0x00000000; // IBANK_POS set to 0 so this register does not apply
EMIF3A_SDRCR = (0x1 << 31) | // LPMODEN
(0x1 << 30) | // MCLKSTOPEN
(0x0 << 24) | // Reserved
(0x0 << 23) | // SR_PD
(0x0 << 16) | // Reserved
(((unsigned int) ((7.8 * freq) + 0.5)) << 0); // RR

/*SyncReset the Clock to EMIF3A SDRAM*/
PSC1_LPSC_SyncReset(PD0, LPSC_DDR);

/*Enable the Clock to EMIF3A SDRAM*/
PSC1_LPSC_enable(PD0, LPSC_DDR);

EMIF3A_SDRCR &= ~0xC0000000; // disable self-refresh
}

It is clearly the PSC1_LPSC_SyncReset (and then the following PSC1_LPSC_enable) that fails. Is there anything we need to set in order to be able to write to the PSC1?
Note that we exit with NONSECURE and also open up all IOPUs:

[IOPUCONFIG]
IOPUSELECT = 0x000000FF
MPPAVALUE = 0xFFFFFFFF

[IOPUCONFIG]
IOPUSELECT = 0x000100FF
MPPAVALUE = 0xFFFFFFFF

[IOPUCONFIG]
IOPUSELECT = 0x000200FF
MPPAVALUE = 0xFFFFFFFF

[IOPUCONFIG]
IOPUSELECT = 0x000300FF
MPPAVALUE = 0xFFFFFFFF

Thanks,
Giuseppe

0 Titusrathinaraj Stalin over 10 years ago in reply to Giuseppe Ameno

TI__Guru** 116100 points

Hi Giuseppe,

That's good.

Yes, this what I planed to ask you to do.
Unlock the JTAG and try to connect the DSP core and run the script (CCS script or gel) to initialize the mDDR (With timing parameter)

What emulator are you using ?
XDS100v2 ?

0 Giuseppe Ameno over 10 years ago in reply to Titusrathinaraj Stalin

Prodigy 140 points

I am using the XDS560v2 and also the Lauterbach TRACE32.
The problem is exactly the same with both of them.

Regards,
Giuseppe

Processors

Processors forum

OMAP-L138 doesn't securely boot from UART while running from mDDR