C2Prog programs the flash of TI C2000™ MCUs, from the C28x families
(F2837x, F28P65x, F28P55x and others) to the C29 devices (F29H85x). It flashes
over JTAG with an XDS probe, over a serial link, over CAN or over TCP/IP, and it
handles the F29x security workflow: key provisioning, signing, encryption and
the security configuration. The answers below are grouped by topic; click a
question to open it.
If you are new here, start with Understanding .ehx Files,
then the HSM and the F29x security states
and F29x access control with the SSU.
About C2Prog
What is C2Prog?#
C2Prog is a tool for flashing TI MCUs, with a focus on devices from the TI C2000 family. It supports multiple interfaces for programming MCU flash, such as JTAG, serial links (RS-232, 422, 485), Controller Area Network (CAN) and TCP/IP.
Is C2Prog free?#
The basic version of C2Prog is licensed as freeware, and it has no time limit. The basic license covers any legal, non-safety-critical use, including commercial applications. Certain advanced features require a “professional” license, and redistributing signed
.ehx files requires an “integration” license. See
Licensing.
What are the limitations of the free (basic) C2Prog version?#
The most important limitation is with regards to how the programming is initiated. The basic version allows reflashing from the C2Prog graphical user interface (GUI) and generating .ehx files from the command line (c2p-cli mkehx and its variants). The professional version adds command-line programming (c2p-cli load), the native C API (DLL) and the JSON-RPC server. The GDB server and the AI agent interface need no paid license.
Are all C2000 MCUs supported?#
Yes, with some very few exceptions (mostly due to device memory limitations). See readme.txt file distributed with C2prog for details.
Is there a manual?#
Yes. The current
C2Prog manual is online as a PDF, and the same manual opens from the C2Prog “Help” menu. Please do read the manual! An AI assistant with the
agentic interface registered can search it for you, including the F29x security chapters and the
c2p-cli option tables.
Interfaces, probes and boot modes
Does C2Prog support reflashing via JTAG?#
Yes, XDS adapters are supported, including the XDS110 on TI LaunchPads and controlCARDs. JTAG programming and probe detection need a TI EmuPack, which the C2Prog installer can install; c2p-cli get ccs-base-path prints the path C2Prog is configured with.
Does C2Prog support all TI Bootmodes?#
No, C2Prog only supports TI’s SCI/UART boot mode. All other interfaces are based on proprietary bootloaders developed by CodeSkin.
Why can I not select the CAN interface?#
Programming via CAN requires a custom C2Prog configuration file and bootloader.
Which USB-Serial adapter do you recommend?#
FTDI-based solutions, such the Parallax USB to Serial (RS-232) Adapter have proven to be most reliable. Since FTDI chips are also used on TI’s controlCards and LaunchPads, C2Prog works well with these evaluations boards.
Does C2Prog work over half-duplex RS-485?#
Per default, C2Prog requires as full duplex link capable of communicating at 115200 baud. However, custom configuration for half-duplex links and lower communication speeds can be provided upon request to holders of a professional license.
How do I reset my MCU into SCI bootmode?#
This depends on your MCU. You will have to read the appropriate manual. Also consult the schematic of your TI evaluation board to confirm that they are designed to support SCI bootmode.
Extended Hex (.ehx) files
What is an ehx file?#
An “extended hex” file contains not only the data to be programmed (firmware image) but also all the MCU specific settings required by C2Prog. An ehx file can also be password protected. Therefore it is the ideal format for distributing files for programming with C2Prog.
What travels inside an .ehx file?#
The firmware image, the MCU-specific programming settings, and the loaders that run on the target: the secondary bootloader (flash kernel) and, on F29x devices, the HSM runtime. On F29x devices the required certificates are generated and signed when the file is built. One file per build is therefore enough to program a part, with nothing to configure at the programming station. See
Understanding .ehx Files.
Does the .ehx password encrypt my firmware?#
No. The password protects the file in transit: an operator needs it to load and program the file. To keep the firmware itself unreadable, pair the
.ehx with a CodeSkin
secure bootloader, or on a key-provisioned F29x device use
c2p-cli mkehx-cp --encrypt, where the HSM decrypts the image on the target.
What is the integration signature of an .ehx file?#
A file built on a machine with an integration license carries a signature that identifies who produced it, so a recipient can verify its origin. c2p-cli and an AI assistant with the agentic interface can both check it.
F29x security: HSM, SSU and provisioning
What is the HSM on an F29x device?#
The Hardware Security Module is a separate subsystem on the die, based on an Arm Cortex-M4 core, with its own boot ROM, RAM, flash and debug access ports. It decides which firmware the device accepts: once customer keys are provisioned, the HSM checks the X.509 certificate of every image before it is programmed or started. The C29 CPUs reach it only over a mailbox. See
the HSM and the F29x security states.
What are HS-FS, HS-KP and HS-SE?#
They are the three security states of an F29x device. HS-FS (High Security - Field Securable) is the state a part leaves the TI factory in, where no signature is checked. HS-KP (Key Provisioned) follows key provisioning, after which every image must be signed. HS-SE (Security Enforced) follows the first security configuration, and is the state devices typically ship in. The sequence only advances, and no transition can be reversed.
Can I ship a product with the device in HS-FS?#
Yes. HS-FS needs no keys and no signing, so it is the easiest state for early development, and a product whose firmware needs no protection against replacement can ship that way. Key provisioning is what makes signatures mandatory, and it cannot be undone.
What is the SSU?#
The Safety and Security Unit is the hardware unit that checks every memory and peripheral access a C29 CPU makes against the security configuration in flash. A denied access ends in a fault to the CPU, with no operating system involved. The same configuration also holds the flash write and erase protection, the debug access and the authority to replace those rules. See
F29x access control with the SSU.
What is a security configuration (seccfg)?#
A set of data blocks in flash, one per CPU, that the SSU enforces. A block describes the links (execution contexts) of the application, the memory regions and peripheral registers each one may reach, the stacks and zones, and the device-level debug, boot and update-owner policy. The device keeps two copies and the boot ROM loads the newer one at reset.
What are SSU Modes 1, 2 and 3?#
The mode decides how much of the configuration the SSU enforces. In Mode 1 the access-protection regions are disabled, which suits development. Mode 2 enforces them against all code, including the C2Prog flash kernel. Mode 3 is the production mode: it enforces the regions and also binds the debug gates, the write and erase protection and the update owners.
How do I write a security configuration for my application?#
Two routes produce the same bytes. TI’s SysConfig generates the blocks inside the application project, and the linker places them into the .out file. C2Prog also accepts a stand-alone .lua profile that names the links, stacks and zones with their memory in kB and the peripheral register blocks each link may reach, and compiles it into the blocks. A profile is a text file, so it can be version controlled and reviewed like source, and an AI assistant can draft it for you.
Can a security configuration lock me out of my device?#
Yes, which is why C2Prog reviews one before signing it. c2p-cli mkehx-cp --explain-only prints what the configuration does, every field it commits, warnings ranked irrecoverable, lockout, caution or info, and a verdict per transport on whether the part can still be reprogrammed over UART and JTAG. A finding at the irrecoverable or lockout level stops the command unless --allow-irreversible is given. The review needs no signing key and no device.
How do I key provision an F29x device?#
Three commands build the artifacts: c2p-cli mkkeys generates the key pairs into a keyset, mkkpcert builds the key-provisioning certificate from it, and mkehx-kp packages that certificate with TI’s keywriter runtime into one .ehx file. Two inputs come from TI’s OTP Keywriter package for the part and are specific to the silicon revision. Review the certificate before programming it, because the fields it writes are one-time fuses, and power-cycle the part afterwards so the new state takes effect.
Which silicon revisions support key and code provisioning?#
Key provisioning and code provisioning run on F29H85x silicon revisions B and more recent. Programming in the HS-FS state works on every revision.
What is anti-rollback on an F29x device?#
The HSM keeps a minimum software revision in one-time fuses for each type of image: the application, the HSM runtime and the security configuration. A certificate whose revision is below the minimum for its type no longer authenticates, so an older image cannot be programmed back onto the device. Key provisioning sets the first minimums. An application can raise a minimum later through the HSM runtime. A minimum can never be lowered.
How does C2Prog set the software revision of an image?#
The
--swrv option of
c2p-cli mkehx-cp sets the revision of every certificate C2Prog signs: the application and security-configuration certificates, and the flash kernel and HSM runtime it adds for code provisioning. The
--hsmrt-swrv option gives the HSM runtime a revision of its own. Both default to 1, so a device whose minimum has been raised needs Extended Hex files built at or above the new minimum. The minimums themselves are set at key provisioning with the
--sr-sbl,
--sr-hsmrt and
--sr-ssu options of
mkkpcert. The
mkkpcert consequence report warns when a minimum affects the flash kernel or the HSM runtime that C2Prog adds. See the
manual.
Can I get help with anti-rollback?#
Yes. CodeSkin provides custom solutions for setting and managing anti-rollback, e.g. a revision scheme for your releases, or raising a minimum at the right point of a field update. Updates then stay compatible with the minimums your devices already hold. Contact us at
info@codeskin.com.
Can C2Prog sign with the backup key?#
An F29x device can be key provisioned with two key sets: the secondary keys (SMPK and SMEK) and a backup set (BMPK and BMEK). mkkpcert programs both by default (--keycnt=2). mkehx-cp --keyrev=backup signs with the backup key. With --encrypt it also encrypts with the backup encryption key. The default is the secondary set. A device accepts backup-signed images only once its key revision has been switched to the backup set.
How do I rotate to the backup key?#
Switching a device to its backup keys is permanent and goes through the HSM runtime with a certificate signed by both keys. Before the switch is committed, the HSM image, the application and the security configuration must be re-provisioned signed with the backup key, in the same power cycle. A device switched without that re-provisioning no longer boots. CodeSkin’s custom solutions support key rotation, including the dual-signed certificate and the re-provisioning and switch as part of your update flow. Contact us at
info@codeskin.com.
Can I keep my signing key in a hardware token?#
Yes. c2p-cli signs from a keyset, from a PEM file, or from a PKCS#11 token such as a USB HSM, where the private key never leaves the token. The manual has a chapter on the PKCS#11 setup.
Do I need Code Composer Studio for the F29x security workflow?#
No. Certificate generation, signing and encryption all happen in c2p-cli on the build machine, with no OpenSSL step and no second tool from TI. JTAG programming does need a TI EmuPack for the probe drivers, which the C2Prog installer can provide.
Debugging and automation
Can I debug a C2000 device with C2Prog?#
C2Prog ships a GDB server,
c2p-gdb-server, and a Lua scripting client,
c2p-gdb. Together they read and write memory and registers, halt, step, reset, and set breakpoints and watchpoints on C28x and C29x devices, from a shell, a build pipeline or an AI assistant. Both need no paid license. See
Debugging TI C2000 with the C2Prog GDB Server.
Can I read a variable while my application keeps running?#
Yes. With --non-intrusive the server attaches without halting the target, so status, memory and register reads leave the application running. Addresses come from the .map file: on C28x devices they are 16-bit word addresses, on C29x devices byte addresses.
Does C2Prog replace Code Composer Studio for debugging?#
No. Standard GDB clients do not understand the C28x or C29x architecture, so there is no source-level debugging: you work with addresses from the .map file rather than variable names and line numbers. CCS remains the tool for stepping through C source. The C2Prog tools fit scripted tests, CI jobs and coding assistants.
Can I flash and test from a CI pipeline?#
Yes.
c2p-cli load flashes from the command line under a professional license, and
c2p-gdb runs a script against the target and reports one JSON document plus an exit status that names the failure class.
mkehx generation runs on the free basic license, which suits a post-build step in Code Composer Studio. See
Flashing TI C2000 from Simulink with c2p-cli for a build-flow example.
AI assistants and the agentic interface
How do I register C2Prog with my AI assistant?#
C2Prog includes an MCP server that lets an AI assistant search the C2Prog manual and inspect your setup. In the C2Prog GUI, open “Help > Set up AI agent integration…”, select the agent hosts you use and click “Register”. From a shell,
c2p-agent register registers every supported host installed on your computer. A host that is already running has to be restarted before it picks up the server. See
The C2Prog Agentic Interface for details.
What can an AI assistant do with C2Prog?#
It can search the C2Prog manual, report how your target is connected, read memory and registers from a running device, check an
.ehx file, and draft, generate and explain F29x security configurations. Halting, resetting, stepping and writing are separate tools your agent host can ask you to approve. See
The C2Prog Agentic Interface.
Does the agentic interface send my firmware or manual to the cloud?#
The c2p-agent MCP server runs locally on your machine, and the manual search and the C2Prog tools run there as well. What your AI assistant does with the answers depends on the agent host you registered, so review that host’s own data handling. Firmware programming is not exposed over the interface at all.
Which AI agent hosts are supported?#
The server is host-agnostic: any MCP-compatible host can launch it, including Claude Code, Codex, Claude Desktop, Cursor, VS Code in GitHub Copilot agent mode, OpenCode and Gemini CLI. c2p-agent register --status lists every host it recognizes with its configuration file.
Troubleshooting
My clock rate is not supported!#
Contact us for a custom kernel. And do not use the wrong frequency setting as this may damage your MCU!
C2Prog gets stuck after kernel download!#
After the kernel has been downloaded, the RS-232 communication rate is increased to 115200 baud for the transmission of the flash-code. Make sure that your hardware (RS-232 driver) supports this elevated transmission rate.
Communication is not established with my 28x!#
C2Prog uses the autobaud feature of the 28x to establish the initial communication; the default baud rate is 38400. For some hardware with a low clock frequency this rate is too high, and needs to be reduced by editing the target configuration file. Please contact us for support.
I get an “echo error” during bootload!#
Try this sequence:
- Configure GPIO for SCI bootmode (see TI technical reference)
- Power-cycle / reset MCU
- Start programming (e.g. click on “Program” button in C2Prog GUI)
If you still get an “echo error”, then most likely your PC is communicating too fast resulting in bytes getting lost. The data transmission during bootload can be tweaked by editing the target configuration file. Please contact us for support.
I get a “Sector violation” error!#
This means that your hex-file contains data that does not fall into a valid flash sector. Please double-check your linker command file and make sure that only flash data is linked to page 0.
I get a “CRC generation created a violation” error!#
You have checked the “Append Checksum” option but C2Prog was unable to find room in Flash for the generated 32-bit CRC value. See
CRC record generation and the manual for details on the generation and placement of the CRC record.
I am unable to program the OTP!#
Make sure that the “Allow OTP Programming” option is checked. Note that OTP flashing is not supported on all MCUs. Also note that the “Append Checksum” option is not allowed when programming OTP.
I am unable to program via a Bluetooth modem!#
C2Prog typically modifies the baudrate between the different loading stages. This approach is not compatible with a Bluetooth modem. To support such devices, you will need to request a custom configuration file for communicating at a fixed rate.
A JTAG attach fails with Connect:95. What does that mean?#
The debug port is not open. Either the probe is disconnected or unpowered, or on an F29x device the active security configuration keeps the CPU access port closed. Check the detected probes first; on an F29x device in SSU Mode 3 a debug gate has to open for the password C2Prog presents.
Still stuck, or missing a question here? Email info@codeskin.com,
and have a look at the blog and the download page.