This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TMS320F280025C: DCSM - Brick after calling DCSM_unlockZone1CSM() with wrong password

Part Number: TMS320F280025C
Other Parts Discussed in Thread: UNIFLASH

Hi,

I'm trying out the DCSM feature of the C2000 microcontrollers eval boards and it seems to work so far. Now I uploaded

first a project, that includes DCSM with the following features:

Then I wanted to flash the application again with a minor modification in it, but I did not change anything in the .syscfg tool (did not mark update the linkpointer). I unlocked the controller with UNIFLASH and the correct password and downloaded the file to the controller successfully. It looks like there is only the firmware on the controller and I cannot unlock the controller anymore with the password I used and also when I increment the linkpointer by one and use the new mask for the password, I get no access. Did I brick the controller? Can I somehow reverse this?

Edit: I tried to verify what actually the problem is on another EVAL board, and it looks like it does not come from not changing the linkpointer, but from using a wrong password instead in the application.

I tried to see, if a wrong password can be detected like this:

    DCSM_CSMPasswordKey psCMDKey;

    psCMDKey.csmKey0 = 0xEFFFFFFF;
    psCMDKey.csmKey1 = 0x47FFFFFF;
    psCMDKey.csmKey2 = 0xFFFFFFFF;
    psCMDKey.csmKey3 = 0xFFFFFFFF;

    // Unlock the zone 1, driverlib.
    DCSM_unlockZone1CSM(&psCMDKey);

    // check if it is unlocked.
    if(DCSM_getZone1CSMSecurityStatus() == DCSM_STATUS_LOCKED) {
        statusCode.status = UNLOCK_ERROR;
    }

So what actually happen when I run this is, that first the controller seems to stop when flashed initially. Then after a hardware reset, it boots the application like normal. I don't understand, how DCSM_unlockZone1CSM() with a wrong key can actually brick my controller? In the end, I want only allow applications with the correct pw, so how can I achieve this and can I somehow reverse this brick?

  • Hi Sebastian,

    We assigned this to our security expert.  Please expect a reply in a day or two.

    Thanks and regards,

    Vamsi

  • Hi,

    I don't understand, how DCSM_unlockZone1CSM() with a wrong key can actually brick my controller?

    Device does not get brick because of this function. This function is only writing 128 bit password into KEYx registers. If it does not match then zone will remain lock and no access will be allowed to device. Are you able to connect to CCS ? If yes, please check the security settings at address 0x78000. If you see all the values 0x0 then check the value in LINKPOINTER register in CCS register view. Let me know what value you see.

    Regards,

    Vivek Singh

  • Hi

    It looks like I'm unable to connect to the target, at least in UNIFLASH (tried to unlock). Where can I just connect to the target in CCS? I only find the debug/run session, which leads to the same error.

    Yes, it does not make sense, that this function can brick the controller, but it looks like it sent the controller into the void when it was called and after the restart it could not be unlocked again. 

  • What is the password value you are using to unlock ? In the function I see 0x EFFF_FFFF for KEY0 where as value in the other snapshot I see it as 0xFFFF_FFFF. Also please note that on secure device you need to use the WAITBOOT to be able to connect to JTAG. Please try changing the BOOTPIN settings to WAITBOOT and then connect to CCS or UNIFLASH.

    Regards,

    Vivek Singh

  • Hi Vievek,

    Thanks, I could solve it by changing the boot mode. The thing is, it initially worked with the boot from flash mode, but then I think because of the above modification ( I tried 0xEFFFFFFF on purpose to test, if it can be unlocked)  the application probably always bricked somehow did not let unlock the device.