C2000 CSM使用方法

The code security module (CSM) is a security feature incorporated in 28x devices. It prevents access/visibility to on-chip memory to unauthorized persons—that is, it prevents duplication/reverse engineering of proprietary code.
The word secure means access to on-chip memory is protected. The word unsecure means access to onchip secure memory is not protected — that is, the contents of the memory could be read by any means (through a debugging tool such as Code Composer Studio™, for example).

• DSP28***_CSMPasswords.asm
  

• 将128-bit全部设为
  • 1
    
  意味着不加密，即所谓的”unsecure”。
• 将128-bit全部设为
  • 0
    
  意味着永久加密，此时芯片不可被解密，即无法再进行编程，也无法读取其中的程序和数据。一般情况下，不要进行此设置。
• 如果设置了128-bit中的低64-bit（即不为全
  • 1
    
  ），会触发所谓的ECSL(Emulation Code Security Logic)功能，这时如需使用仿真器下载程序，需要进行些特殊设置，下文会对此进行详细讨论。
  

[backcolor=rgba(255, 255, 255, 0.45)]此时ECSL功能没有被触发，只要在仿真器设置中正确填入密码即可正常下载程序。以CCS v6.0及XDS100V3仿真器为例，设置界面如图所示：

DSP20151130163640.png (87.69 KB )

下载附件

2020-12-11 16:40 上传

图中设置的CSM密码为

• 0xAAAABBBBCCCCDDDDFFFFFFFFFFFFFFFF
  

In addition to the CSM, the emulation code security logic (ECSL) has been implemented to prevent unauthorized users from stepping through secure code. Any code or data access to flash, user OTP, L0 memory while the emulator is connected will trip the ECSL and break the emulation connection.

When initially debugging a device with the password locations in flash programmed (that is, secured), the emulator takes some time to take control of the CPU. During this time, the CPU will start running and may execute an instruction that performs an access to a protected ECSL area. If this happens, the ECSL will trip and cause the emulator connection to be cut.

C28xx: Error connecting to the target: (Error -1015 @ 0x0) Device is not responding to the request. Device may be locked, or the emulator connection may be unreliable. Unlock the device if possible (e.g. use wait in reset mode, and power-cycle the board). If error persists, confirm configuration and/or try more reliable JTAG settings (e.g. lower TCLK). (Emulation package 5.1.450.0)

C28xx: Flash Programmer: Device is locked or not connected. Operation cancelled.
C28xx: Error Writing Flash @ Address 0x003F74C6 of Length 0x00000016 (page 0)
C28xx: GEL: File: D:\Forklift\MS8000V10\Project\Release\MS8000V10.out: Load failed.

[backcolor=rgba(255, 255, 255, 0.45)]同时会有一个对话框提示：

DSP20151130165534.png (20.21 KB )

下载附件

2020-12-11 16:40 上传

• The first is to use the Wait-In-Reset emulation mode, which will hold the device in reset until the emulator takes control. The emulator must support this mode for this option.
• The second option is to use the “Branch to check boot mode” boot option. This will sit in a loop and continuously poll the boot mode select pins. You can select this boot mode and then exit this mode once the emulator is connected by re-mapping the PC to another address or by changing the boot mode selection pin to the desired boot mode.
  

[backcolor=rgba(255, 255, 255, 0.45)]简而言之，第一种方法是保持器件处于复位状态直至仿真器接管器件，这需要仿真器与器件的支持；第二种方法是通过BOOT引脚的配置，使得DSP进入一个所谓的”Branch to check boot mode”，然后再连接仿真器。
我使用的XDS100v3仿真器并不支持第一种方法，在仿真器设置中”Halt the target on a connect”一项是不可选的，如图所示：

DSP20151130170550.png (45.02 KB )

下载附件

2020-12-11 16:40 上传

此时只能采用第二种方法，然而第二种方法中的”Branch to check boot mode”具体指什么文档中并没有很明确的指出来。不过TI的Wiki Page上给出了正确的操作方法：

Q: Why does Code Composer Studio give me an emulator error when I try to connect to my locked device?

• Disconnect your emulator.
• Set your boot pins for “WAIT” boot mode. Note: on 2833x/2823x this is documented as the “loop to check” boot mode.
• Reset y**ice.
• Reconnect your emulator.At this point you should be able to proceed and unlock y**ice.
  

[backcolor=rgba(255, 255, 255, 0.45)]简而言之，对于2803x系列单片机来说，需要使DSP先复位进入Wait模式后再连接仿真器就可以顺利下载程序了。至于如何进入Wait模式，在器件参考手册中可以查到，以28031为例，上电时将GPIO34拉低即可（GPIO34默认情况下有内部上拉）：

DSP20151130171526.png (25.79 KB )

下载附件

2020-12-11 16:40 上传