Note
If a device is reset while the password locations are all zero or an unknown value, the device will be
permanently locked unless a method to run the flash erase routine from secure SARAM is embedded
into the flash or OTP. Care must be taken when implementing this procedure to avoid introducing a
security hole.
User accessible registers (eight 16-bit words) that are used to unsecure the device are referred to as KEY
registers. These registers are mapped in the memory space at addresses 0x00 0AE0 - 0x00 0AE7 and are
EALLOW protected.
In addition to the CSM, the emulation code security logic (ECSL) has been implemented to prevent unauthorized
users from stepping through secure code. Any code or data access to flash, user OTP, L0 memory while the
debug probe is connected will trip the ECSL and break the debug probe connection. To allow emulation of
secure code, while maintaining the CSM protection against secure memory reads, you must write the correct
value into the lower 64 bits of the KEY register, which matches the value stored in the lower 64 bits of the
password locations within the flash. Note that dummy reads of all 128 bits of the password in the flash must still
be performed. If the lower 64 bits of the password locations are all ones (unprogrammed), then the KEY value
does not need to match.
When initially debugging a device with the password locations in flash programmed (that is, secured), the debug
probe takes some time to take control of the CPU. During this time, the CPU will start running and may execute
an instruction that performs an access to a protected ECSL area. If this happens, the ECSL will trip and cause
the debug probe connection to be broken. Two solutions to this problem exist:
1. The first is to use the Wait-In-Reset emulation mode, which will hold the device in reset until the debug probe
takes control. The debug probe must support this mode for this option.
2. The second option is to use the “Branch to check boot mode” boot option. This will sit in a loop and
continuously poll the boot mode select pins. You can select this boot mode and then exit this mode once the
debug probe is connected by re-mapping the PC to another address or by changing the boot mode selection
pin to the desired boot mode.
Note
Reserved Flash Locations When Using Code Security
For code security operation,
all addresses between 0x3F 7F80 and 0x3F 7FF5 cannot be used as
program code or data, but must be programmed to 0x0000
when the Code Security Password is
programmed. If security is not a concern, then these addresses may be used for code or data. The
128-bit password (at 0x3F 7FF8 - 0x3F 7FFF) must not be programmed to zeros. Doing so would
permanently lock the device.
Addresses 0x3F 7FF0 through 0x3F 7FF5 are reserved for data variables and should not contain
program code.
System Control and Interrupts
SPRUH18I – JANUARY 2011 – REVISED JUNE 2022
TMS320x2806x Microcontrollers
53
Copyright © 2022 Texas Instruments Incorporated
Содержание TMS320 2806 Series
Страница 2: ......