SPNA232A July 2016 – October 2019 RM41L232 , RM41L232 , RM42L432 , RM42L432 , RM44L520 , RM44L520 , RM44L920 , RM44L920 , RM46L430 , RM46L430 , RM46L440 , RM46L440 , RM46L450 , RM46L450 , RM46L830 , RM46L830 , RM46L840 , RM46L840 , RM46L850 , RM46L850 , RM46L852 , RM46L852 , RM48L530 , RM48L530 , RM48L540 , RM48L540 , RM48L730 , RM48L730 , RM48L740 , RM48L740 , RM48L940 , RM48L940 , RM48L950 , RM48L950 , RM48L952 , RM48L952 , RM57L843 , RM57L843 , TMS570LC4357 , TMS570LC4357 , TMS570LC4357-EP , TMS570LC4357-EP , TMS570LC4357-SEP , TMS570LC4357-SEP , TMS570LS0232 , TMS570LS0232 , TMS570LS0332 , TMS570LS0332 , TMS570LS0432 , TMS570LS0432 , TMS570LS0714 , TMS570LS0714 , TMS570LS0714-S , TMS570LS0714-S , TMS570LS0914 , TMS570LS0914 , TMS570LS10106 , TMS570LS10106 , TMS570LS1114 , TMS570LS1114 , TMS570LS1115 , TMS570LS1115 , TMS570LS1224 , TMS570LS1224 , TMS570LS1225 , TMS570LS1225 , TMS570LS1227 , TMS570LS1227 , TMS570LS20206 , TMS570LS20206 , TMS570LS20206-EP , TMS570LS20206-EP , TMS570LS20216 , TMS570LS20216 , TMS570LS20216-EP , TMS570LS20216-EP , TMS570LS2124 , TMS570LS2124 , TMS570LS2125 , TMS570LS2125 , TMS570LS2134 , TMS570LS2134 , TMS570LS2135 , TMS570LS2135 , TMS570LS3134 , TMS570LS3134 , TMS570LS3135 , TMS570LS3135
This application report explains how to utilize the features of the Advanced JTAG Security Module (AJSM) contained on Hercules devices. It is the responsibility of the developer to protect the AJSM key. Failure analysis is not an option, unless the AJSM key is provided. The lock can be changed, but that information should be provided to TI, if possible.
Project collateral and source code mentioned in this document can be downloaded from the following URL: http://www.ti.com/lit/zip/spna232.
Hercules, Code Composer Studio are registered trademarks of Texas Instruments.
All other trademarks are the property of their respective owners.
The AJSM has four features: a TIprogrammed visible unlock code, a customer defined 128-bit key protected by ECC, a scan path for unlocking the JTAG scan chain, and a key for permanently locking a device. The devices shipped from TI are programmed with the visible unlock code; any other value will result in locking a device. You can lock the device by programming any number of bits and your ECC. If all the bits are programmed (0), the device will be permanently locked.
The AJSM key is stored in memory that only allows changing 1s to 0s. TI ships the devices programmed with the 128-bit visible unlock code at address 0xF00000000 and your ECC.
TI Visible Unlock Code (TMS570 [Big Endian] ECC) 0xF00000000: 0xEFFDFFFF 0xFFFFFFFF 0xFFFDFFFE 0xFFEFFFFF ECC: 0xFFFF
This code is mainly 1s to allow for a custom key effective to 123 bits. The ECC is calculated based on the device's endianness. Hercules TMS570 devices are big endian, their visible unlock code ECC has been designed to be all 1s so any key can be selected. Hercules RM devices are little endian, their visible unlock code ECC will be 0xEDCO. Because the ECC is not all 1s, some custom unlock code values will not be possible. Read the value at 0xF000000 for your devices specific AJSM unlock code and 0xF0040000 for the ECC.
Because the ECC is calculated for the device endianness, the ECC for little endian devices will be 0xEDC0, limiting the custom key effective to 115 bits.
There is an erratum for silicon versions before Rev. B that limits the custom key effective to 54 bits. Rev. B silicon was fixed so that the visible unlock code was the same as the other devices in the family and the ECC is 0xEDED for both big and little endian devices. The effective number of bits for Rev. B and later RM57 and TMS570LC4x devices is 119 bits.