This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

C6748 secure boot: JTAG debug

Other Parts Discussed in Thread: OMAP-L138

Hi,

a customer is using the Secure C6748 device and is trying to debug with JTAG on that device. The wiki indicates the following:

http://processors.wiki.ti.com/index.php/Basic_Secure_Boot_for_OMAP-L138_C6748

http://processors.wiki.ti.com/index.php/Basic_Secure_Boot_for_OMAP-L138_C6748#INI_File_Syntax

 

How to debug secure device?

Application development and debugging on a secure device is not really recommended but there is flexibility in the boot process that allow this functionality when required. The ini file for creation of secure boot images contains field called BootExitType and TAPCFG. Specifying the bootExitType as NONSECURE and TAPCFG= 0x0000FFFF will force the device to exit ROM boot in NON-secure mode and open the JTAG pins to connect the emulator.

 

However after doing that and building the secure image with that ini file, after the boot-up the customer still is not able to connect with JTAG.

Is there anything else missing?

 

Thanks,

--Gunter

 

 

  • Hi,
    You have to use "GenericSecureUartHost.exe" tool to load the binary which would do unlock the JTAG for us.
    That binary should use "TAPCFG= 0x0000FFFF" in *.ini file.

    Are you getting any hang while loading through "GenericSecureUartHost.exe" ?

    If you are using custom board then you may have to modify the "EMIF3DDR" section to match the DDR timing registers.

    Please revert to me for further clarifications if any.

    1) Create one test application, say "hello world" and build through CCS IDE then you would get *.out
    2) Convert *.out to *.bin through "SecureHexAIS_OMAP-L138.exe" tool with *.ini file.

    SecureHexAIS_OMAP-L138.exe -ini test.ini -otype binary -o hello.bin hello.out

    test.ini file should (similar) be like this,

    [General]
    busWidth=16

    BootMode=NAND

    crcCheckType=NO_CRC

    seqReadEn=ON

    [Security]
    securityType=GENERIC
    ;bootExitType = SECURENOSK
    bootExitType = NONSECURE
    ;bootExitType = SECUREWITHSK

    encryptSections=ALL

    encryptionKey=4A7E1F56AE545D487C452388A65B0C05

    genericSHASelection = SHA256


    ; |------24|------16|-------8|-------0|
    ; PLL0CFG0: | CLKMODE| PLLM | PREDIV | POSTDIV|
    ; PLL0CFG1: | RSVD | PLLDIV1| PLLDIV3| PLLDIV7|

    [PLLANDCLOCKCONFIG]
    PLL0CFG0 = 0x00180001
    PLL0CFG1 = 0x00000B05
    PERIPHCLKCFG = 0x00010064

    ; |------24|------16|-------8|-------0|
    ; PLL1CFG0: | PLLM| POSTDIV| PLLDIV1| PLLDIV2|
    ; PLL1CFG1: | RSVD | PLLDIV3|
    [PLL1CONFIG]
    PLL1CFG0 = 0x18010001
    PLL1CFG1 = 0x00000002

    ; This section lets us configure the peripheral interface
    ; of the current booting peripheral (I2C, SPI, or UART).
    ; Use with caution. The format of the PERIPHCLKCFG field
    ; is as follows:
    ; SPI: |------24|------16|-------8|-------0|
    ; | RSVD |PRESCALE|
    ;
    ; I2C: |------24|------16|-------8|-------0|
    ; | RSVD |PRESCALE| CLKL | CLKH |
    ;
    ; UART: |------24|------16|-------8|-------0|
    ; | RSVD | OSR | DLH | DLL |
    ;[PERIPHCLKCFG]
    ;PERIPHCLKCFG = 0x00000000


    ; This section allow setting the MPU1 or MPU2. If the
    ; rangenum is out of the allowed range then all the ranges
    ; (including the fixed range) take the start, end, and
    ; protection values.
    ; |------24|------16|----------8|----------0|
    ; MPUSELECT: | RSVD | mpuNum | rangeNum |
    ; STARTADDR: | startAddr |
    ; ENDADDR: | endAddr |
    ; MPPAVALUE: | mppaValue |
    [MPUCONFIG]
    MPUSELECT = 0x000001FF
    STARTADDR = 0x00000000
    ENDADDR = 0xFFFFFFFF
    MPPAVALUE = 0xFFFFFFFF



    ; This section can be used to configure the PLL1 and the EMIF3a registers
    ; for starting the DDR2 interface.
    ; See PLL1CONFIG section for the format of the PLL1CFG fields.
    ; |------24|------16|-------8|-------0|
    ; PLL1CFG0: | PLL1CFG |
    ; PLL1CFG1: | PLL1CFG |
    ; DDRPHYC1R: | DDRPHYC1R |
    ; SDCR: | SDCR |
    ; SDTIMR: | SDTIMR |
    ; SDTIMR2: | SDTIMR2 |
    ; SDRCR: | SDRCR |
    ; CLK2XSRC: | CLK2XSRC |
    ;status |= DEVICE_ExternalMemInit(0x000000C5, 0x00134832, 0x264A3209, 0x3C14C722, 0x00000492, 0x00000000);
    ;[EMIF3DDR]
    ;PLL1CFG0 = 0x18010001
    ;PLL1CFG1 = 0x00000002
    ;DDRPHYC1R = 0x000000C4
    ;SDCR = 0x0A034622
    ;SDTIMR = 0x184929C8
    ;SDTIMR2 = 0xB80FC700
    ;SDRCR = 0x00000406
    ;CLK2XSRC = 0x00000000

    ;For LCDK board
    [EMIF3DDR]
    PLL1CFG0 = 0x18010001
    PLL1CFG1 = 0x00000002
    DDRPHYC1R = 0x000000C5
    SDCR = 0x00134832
    SDTIMR = 0x264A3209
    SDTIMR2 = 0x3C14C722
    SDRCR = 0x00000492
    CLK2XSRC = 0x00000000


    ; This section allow setting the MPU1 or MPU2. If the
    ; rangenum is out of the allowed range then all the ranges
    ; (including the fixed range) take the start, end, and
    ; protection values.
    ; |------24|------16|----------8|----------0|
    ; MPUSELECT: | RSVD | mpuNum | rangeNum |
    ; STARTADDR: | startAddr |
    ; ENDADDR: | endAddr |
    ; MPPAVALUE: | mppaValue |
    ;
    ; This MPU control must happen after the DDR init or else the
    ; MPU control has no effect
    [MPUCONFIG]
    MPUSELECT = 0x000002FF
    STARTADDR = 0x00000000
    ENDADDR = 0xFFFFFFFF
    MPPAVALUE = 0xFFFFFFFF

    ; This section can be used to configure the EMIFA to use
    ; CS0 as an SDRAM interface. The fields required to do this
    ; are given below.
    ; |------24|------16|-------8|-------0|
    ; SDBCR: | SDBCR |
    ; SDTIMR: | SDTIMR |
    ; SDRSRPDEXIT: | SDRSRPDEXIT |
    ; SDRCR: | SDRCR |
    ; DIV4p5_CLK_ENABLE: | DIV4p5_CLK_ENABLE |
    ;[EMIF25SDRAM]
    ;SDBCR = 0x00004421
    ;SDTIMR = 0x42215810
    ;SDRSRPDEXIT = 0x00000009
    ;SDRCR = 0x00000410
    ;DIV4p5_CLK_ENABLE = 0x00000001

    ; This section can be used to configure the async chip selects
    ; of the EMIFA (CS2-CS5). The fields required to do this
    ; are given below.
    ; |------24|------16|-------8|-------0|
    ; A1CR: | A1CR |
    ; A2CR: | A2CR |
    ; A3CR: | A3CR |
    ; A4CR: | A4CR |
    ; NANDFCR: | NANDFCR |
    ;[EMIF25ASYNC]
    ;A1CR = 0x00000000
    ;A2CR = 0x00000000
    ;A3CR = 0x00000000
    ;A4CR = 0x00000000
    ;NANDFCR = 0x00000000

    ; This section should be used in place of PLL0CONFIG when
    ; the I2C, SPI, or UART modes are being used. This ensures that
    ; the system PLL and the peripheral's clocks are changed together.
    ; See PLL0CONFIG section for the format of the PLL0CFG fields.
    ; See PERIPHCLKCFG section for the format of the CLKCFG field.
    ; |------24|------16|-------8|-------0|
    ; PLL0CFG0: | PLL0CFG |
    ; PLL0CFG1: | PLL0CFG |
    ; PERIPHCLKCFG: | CLKCFG |
    ;[PLLANDCLOCKCONFIG]
    ;PLL0CFG0 = 0x00000000
    ;PLL0CFG1 = 0x00000000
    ;PERIPHCLKCFG = 0x00000000

    ; This section should be used to setup the power state of modules
    ; of the two PSCs. This section can be included multiple times to
    ; allow the configuration of any or all of the device modules.
    ; |------24|------16|-------8|-------0|
    ; LPSCCFG: | PSCNUM | MODULE | PD | STATE |
    ;[PSCCONFIG]
    ;LPSCCFG = 0x01030003

    ;EMIFA -> NAND
    [PSCCONFIG]
    LPSCCFG = 0x00030003

    ;GPIO
    ;[PSCCONFIG]
    ;LPSCCFG = 0x01030003


    ; This section allows setting of a single PINMUX register.
    ; This section can be included multiple times to allow setting
    ; as many PINMUX registers as needed.
    ; |------24|------16|-------8|-------0|
    ; REGNUM: | regNum |
    ; MASK: | mask |
    ; VALUE: | value |
    ;[PINMUX]
    ;REGNUM = 5
    ;MASK = 0x00FF0000
    ;VALUE = 0x00880000

    ; No Params required - simply include this section for the fast boot function to be called
    ;[FASTBOOT]

    ; This section allows configuration of one the systme IOPUs.
    ; The iopuNum field must be valid (0-5) and then mppaStart
    ; and mppaend fields allow setting a range of mppa MMRs to the
    ; same supplied mppa value.
    ; IOPUSELECT: | RSVD | iopuNum| mppaStart | mppaEnd |
    ; MPPAVALUE: | mppaValue |
    [IOPUCONFIG]
    IOPUSELECT = 0x000000FF
    MPPAVALUE = 0xFFFFFFFF

    [IOPUCONFIG]
    IOPUSELECT = 0x000100FF
    MPPAVALUE = 0xFFFFFFFF

    [IOPUCONFIG]
    IOPUSELECT = 0x000200FF
    MPPAVALUE = 0xFFFFFFFF

    [IOPUCONFIG]
    IOPUSELECT = 0x000300FF
    MPPAVALUE = 0xFFFFFFFF

    [IOPUCONFIG]
    IOPUSELECT = 0x000600FF
    MPPAVALUE = 0xFFFFFFFF

    [IOPUCONFIG]
    IOPUSELECT = 0x00060707
    MPPAVALUE = 0x00000000

    ; This section allow setting the MPU1 or MPU2. If the
    ; rangenum is out of the allowed range then all the ranges
    ; (including the fixed range) take the start, end, and
    ; protection values.
    ; |------24|------16|----------8|----------0|
    ; MPUSELECT: | RSVD | mpuNum | rangeNum |
    ; STARTADDR: | startAddr |
    ; ENDADDR: | endAddr |
    ; MPPAVALUE: | mppaValue |
    [MPUCONFIG]
    MPUSELECT = 0x000001FF
    STARTADDR = 0x00000000
    ENDADDR = 0x00000000
    MPPAVALUE = 0xFFFFFFFF


    ; This function allows the user to selectively open up the
    ; the debug TAPs of the device. Since the function is not
    ; executed until the signature is checked, it does not
    ; pose a security issue.
    ; |------24|------16|----------8|----------0|
    ; TAPSCFG: | RSVD | tapscfg |
    [TAPSCONFIG]
    TAPSCFG = 0x0000FFFF
  • Hello Titus,
    I am facing a problem with my secure C6748 (custom board), I generated binary file with .ini but not able to flash with GenericSecureUartHost.exe .
    In fact i am not receiving BOOT ME command from the secure device, I have set boot pins to UART0 boot mode. Pls suggest some means of debugging.
    Thanks,
    Nisha