TMS320F28075: Processor getting locked: C28xx_CPU1: Failed unlocking device (zone 1) after reset.

Lauren,

Is this the first time they tried to program this specific device?  If not, were they able to program it successfully previously?

Please suggest them to check their linker cmd file and map file to ensure that nothing is mapped to the DCSM configuration space?  

I feel they might have mapped something in that area in a previous program iteration.  Please check.

Thanks and regards,

Vamsi

They've seen this problem with 2 separate firmware projects at this point. Out of a batch off 20-50 boards at a time, they'll see about 5-10 of these boards get that error. These control boards use the same TMS320F28075 chip. They're not using any DCSM features in out firmware.

 On boards that do fail, most of the boards that fail have their zone 1 OTP (0x78000 to 0x781FF) all set to 0's. Zone 2's OTP section (0x00078200) remains all 0xFFFF's.

 Their linker cmd files make no references to the DCSM sections.

 Name                     origin           length          used        unused      

 output section    page     origin                           length                       attributes/input sections

Lauren,

I am not asking about the F2807x_Headers_nonBIOS.cmd (and associated map).  

I am asking about the application's linker cmd file (like the one you see at C2000Ware_3_04_00_00\device_support\f2807x\headers\cmd) and it's map.

However, in the map file snippet, I see it says that the Z1 and Z2 are NOLOADs.

Couple of things to check:

1) Did they get any warning during compilation on unmapped sections?  Something like: Creating output section "XXX" without a SECTIONS specification?  If yes, that may get allocated anywhere in the defined memory map in linker cmd.  If that gets mapped to DCSM area, it can cause lock problems.

2) On the failing boards, did they notice any dips on the voltage lines during the flash operations?  Make sure the operating voltages are maintained as per the datasheet spec.

3) Repeating my previous question from first reply: Is this the first time they tried to program this specific device?  If not, were they able to program it successfully previously? 

Thanks and regards,
Vamsi

Hi Vamsi,

There aren't any warnings generated regarding the output sections when doing a clean build, and this problem has happened between multiple control board families using different test fixtures and power supplies. To answer your question regarding have they successfully programmed this part before, they've seen this problem with 2 separate firmware projects at this point. Out of a batch off 20-50 boards at a time, they'll see about 5-10 of these boards get that error. These control boards use the same TMS320F28075 chip. They're not using any DCSM features in out firmware. The other boards outside of those 5-10 that have errors work properly. 

They recently ran a batch of control boards, and it appears that some of these DSPs are not coming in completely erased. None of these boards have been programmed by them yet, all that was done was to them was basic checking for shorts. They have 3 controls boards right now, 2 have the Zone 1 OTP section has been programmed, and one board where Zone 1 is fine, but also has some program in flash that they do not recognize. In the pictures below they're using UniFlash to read the memory.

 They had a fourth board that also had a different program preloaded that was different from Board 1's program, but that one was loaded with their program to test it.

 Board 1 - Zone 1 OK, Unknown program in Flash

Board 2 - Zone 1 OTP is all 0's. All user Flash (0x80000 to 0xBFFFF) are all 0's as well.

Board 3 - Zone 1 OTP -> It looks like a password has been set in the ZoneSelectBlock2's CSMPSWDx words.

The Z1-LINKPOINTERs, PSWDLOCK, CRCLOCK, BOOTCTRL are all 0's

Here is the link pointer location in 0x5f000. It looks like it is selecting Zone Select Block 2, but I imagine because the PSWDLOCK word is all 0's, it will hide the password so we can't unlock this one either.

Is there a socket board they could use to try and read the DSP before soldering it onto the board? 

Lauren,

I asked our security expert to take a look at this.  Please expect a reply in a day or two.

Thanks and regards,

Vamsi 

Hi Vamsi,

Any update on this?

Lauren,

Sorry for the delay. I will remind our security expert again.

Thanks and regards,
Vamsi

Hi Lauren,

Sorry for late reply !!

From the snapshot your have sent, look like password have been programmed and since I can see the password value, it means PSWDLOCK is not locked. User should be able to use this password to unlock the zone and then perform the flash operation. Right ? Did they try it and it's not working ? 

By default all the device should have erased flash and OTP. If something is programmed in these devices then it means someone tried to connect to these device with CCS and during that process OTP and flash got programmed. 

Regards,

Vivek Singh