SLAU847E October 2022 – May 2025 MSPM0L1105 , MSPM0L1106 , MSPM0L1116 , MSPM0L1117 , MSPM0L1227 , MSPM0L1227-Q1 , MSPM0L1228 , MSPM0L1228-Q1 , MSPM0L1303 , MSPM0L1304 , MSPM0L1304-Q1 , MSPM0L1305 , MSPM0L1305-Q1 , MSPM0L1306 , MSPM0L1306-Q1 , MSPM0L1343 , MSPM0L1344 , MSPM0L1345 , MSPM0L1346 , MSPM0L2227 , MSPM0L2227-Q1 , MSPM0L2228 , MSPM0L2228-Q1
The debug subsystem supports several methods for restricting access to the device through the SWD interface. The debug access policy is determined by the user configuration specified in the NONMAIN flash region.
There are 4 levels of access control, given in Table 30-3. By default, products shipped from TI arrive in a "debug enabled" state where the device is fully open. This state is not recommended for production. For production, TI recommends changing the debug configuration to password protected, debug disabled, or SWD disabled.
| DEBUGSS Function | Debug Configuration | |||
|---|---|---|---|---|
| Debug Enabled (default) | Debug Enabled with Password | Debug Disabled | SWD Disabled | |
| SW-DP (debug port) | EN | EN | EN | DIS |
| CFG-AP | EN | EN | EN | DIS |
| SEC-AP | EN | EN | EN | DIS |
| ET-AP | EN | EN w/ PW | DIS | DIS |
| AHB-AP (CPU Debug) | EN | EN w/ PW | DIS | DIS |
| Debug Configuration | SWDP_MODE | DEBUGACCESS |
|---|---|---|
| Debug Enabled (default) | AABBh | AABBh |
| Debug Enabled with Password | AABBh | CCDDh |
| Debug Disabled | AABBh | 5566h |
| SWD Disabled | 5566h | 5566h |
When debug is set to enabled with password, the debug access command together with the user-specified debug access password must be provided to the DEBUGSS mailbox, and a BOOTRST must be issued. The password for access control is stored in NONMAIN utilizing the PWDDEBUGLOCK registers. Depending on the SOC implentation the password is either 128-bit plain text or 256-bit SHA-256 hash value. Refer to the data sheet for device-specific features.
When debug is disabled, the SW-DP is disabled during the boot process and any commands previously sent to the mailbox are ignored during boot. Following boot, any attempt to connect to the SW-DP is ignored.
Permanently lock debug access to the device by configuring the NONMAIN flash region to disable debug access while also configuring the NONMAIN flash region as statically write protected (locked). Locking the NONMAIN configuration has the added security of preventing the bootstrap loader (BSL) and application code from changing the debug security policy.
| Debug Function | Debug Access Control | Factory Reset | Mass Erase |
|---|---|---|---|
| Register Name | PWDDEBUGLOCK | PWDFACTORYRESET | PWDMASSERASE |
To enable a password on a debug function write a 128-bit hex value split into four 32-bit words into the respective password register.
Example: Factory Reset Password Configuration
To enable a password on a debug function write the SHA-256 digest of the 128-bit plain text password into the respective registers.
Example: Factory Reset Password Configuration
Determine the desired 128-bit plain text password
0xCAFECAFE12345678A5A5C3C30000FFFF