SPRUJ79 November 2024 F29H850TU
When password-based authorization is enabled for C29DBGEN or a user ZONE, the associated register bit field (C29DBGEN.ENA, ZONE_DBG.ZONEx) is ignored by the SSU. Instead, the user scans a 128-bit password into the appropriate internal key register using the SEC-AP, and the SSU hardware compares the scanned-in password to a predefined password that is preloaded from the SECCFG sector during device boot. If the password matches, then the SSU opens debug access to the requested resource.
There are two levels of ZONE debug authorization that can be enabled by password authentication: full debug, and partial debug. These are controlled using the full debug password and partial debug password respectively. When a user scans in a password for debug authorization, the SSU performs the following sequence:
To enable C29DBGEN or open debug access to a zone when using password-based authentication, scan the appropriate command as defined in Table 10-4 into the SEC-AP PASSWORD_ID register, and then scan in the 128-bit password into the SEC-AP password registers (PASSWORD1, PASSWORD2, PASSWORD3, PASSWORD4). Note that there is a single password scan required for both full and partial ZONE debug. The SSU first compares the scanned in password to the full debug password. If there is a match, then full debug is enabled for the ZONE. If there is a mismatch, then the SSU compares the scanned in password to the partial debug password to determine whether to enable partial debug for the ZONE.
Value | Command |
---|---|
0x0 | Reserved for internal use |
0x1 | ZONE1 Debug Password Scan |
0x2 | ZONE2 Debug Password Scan |
0x3 | ZONE3 Debug Password Scan |
0x4 | C29DBGEN Unlock Password Scan |
Others | Reserved for future use |
For C29DBGEN, there is only one password that controls debug access. When the user scans in a password matching the C29DBGEN password, the SSU unlocks the Test Access Ports (TAPs) for all application CPUs in the device. The HSM also has control over the application CPU TAPs. When the HSM is present, both C29DBGEN and the corresponding HSM debug enable control must be active for debug access to the C29x CPU TAP to be opened. If either C29DBGEN or the HSM denies access, then the C29x CPU TAP remains closed.
C29DBGEN does not override ZONE debug authorization. Even with C29DBGEN active, a password-protection ZONE must still be unlocked for the debugger to access any memory-mapped resources in that ZONE. C29DBGEN only controls access to the CPU TAPs.