Unlocking a Tiva C with Bad Oscillator Settings

Christopher Parish

Other Parts Discussed in Thread: TM4C1231D5PM, UNIFLASH

I recently built a custom board based around the TM4C1231D5PM microcontroller. Deciding to skip the eval board, I went for broke and developed my own “eval” card with the other components I’m going to be using for my project. In addition to the uC above, I also picked up an XDS100 JTAG programmer from TI’s web store to debug the thing.

In the course of my tinkering I may or may not have accidentally programmed in some bad oscillator settings and locked myself out of the chip. I was hoping the XDS100 supported the unlock procedure, but it looks like the LM Flash programmer software doesn’t support that JTAG adaptor.

I do remember reading a section (4.3.4.3) in the datasheet listing an unlock procedure should one do exactly what I have done. The only problem is, I can’t seem to get the unlock procedure to work. Again, I don’t have the launchpad eval board, all I have is my custom board and the XDS100.

Using an Arduino, I’ve pumped in the unlock procedure. Reset is asserted low and held before and when the device is powered up, TMS is held high as 64 TCKs are clocked in, the JTAG-to-SWD command is clocked in on TMS and stable from the rising edge to falling edge of TCK (LSB first) followed by 64 more clocks with TMS high, then the SWD-to-JTAG command, repeated for a total of 10 mode switches, Reset is de-asserted, I wait a few seconds, and finally cycle the power. Still, I can’t connect to the device.

I will post the waveforms from the logic analyzer later today, but I’m at a bit of a loss here. I know the board is fine because I swapped out the chip with a spare and it worked until I again (with a long string of expletives) flashed it with the same defective main oscillator settings. (For reference, I’m using the internal oscillator with OSC0 tied to GND and OSC1 NC per the datasheet’s recommendations for internally clocked applications).

Any ideas would be great. I have an eval board on order (since I know that can reset the chips), but I would like to not have to wait for it to arrive.

UPDATE - Waveforms:

1. Overall Signal

2. Close up on beginning pattern. After looking at the XDS100 JTAG waveforms, I noticed that the "reset" of 50 or more TCKs is done at a slower speed than the rest of the actual data, so I've emulated that as well. (Also, I know that TMS wasn't high during the slow ~50 clocking of TCK after the first, but I've corrected that and it still doesn't work)

3. Coming out of slow TCKs into actual data. The Jtag-to-swd command, 0xE79E, is clocked in at 333kHz with the transitions while TCK is low and data stable throughout TCK high.

over 11 years ago

0 Christopher Parish over 11 years ago

Prodigy 40 points

I know it's bad etiquette to reply to my own post, but for Google's sake I think I fixed the problem. It seems that when I shifted out the data MSB first, everything worked perfectly, the device reset, and I could talk to it again.

The datasheet gives the JTAG-to-SWD command as a binary number 0b1110 0111 1001 1110, stating to shift out the data LSB first, but that wasn't working for me. I instead sent the data MSB first (starting from the left, moving right) and it erased the device. This might boil down to an endianness confusion problem on my part, but there's the answer for anyone who's run into the same problem.

For TI: It would be really awesome if CCS or some other utility could do this with the XDS100. It's strange that a $15 eval board can perform a development function an $80 JTAG debugging dongle can't. But I'm not complaining.

0 PAk over 11 years ago in reply to Christopher Parish

Mastermind 7015 points

Christopher Parish said:
For TI: It would be really awesome if CCS or some other utility could do this with the XDS100. It's strange that a $15 eval board can perform a development function an $80 JTAG debugging dongle can't. But I'm not complaining.

They have promised that next release of Uniflash will include this fuction. Hope they will release it soon.

BTW, would you like to share your arduino code for unlocking?

0 Christopher Parish over 11 years ago in reply to PAk

Prodigy 40 points

I gave up on the arduino software after about 1 minute and went back to atmel studio, but this should work in either IDE. In case it's not obvious, this was a late night hack and isn't pretty. There's no input, you just plug it in, it waits 10 seconds holding the Tiva in reset (should you want to power up the target uC), then issues the reset.

/*
 * Tiva_Recovery.c
 *
 * This program issues the correct sequence to chip erase the Tiva Ti ARM microcontrollers
 */ 

//Connect these to the dead tiva
//PB0 - TCK
//PB1 - TMS
//PB2 - Reset

#define F_CPU 16000000

#include <avr/io.h>
#include <util/delay.h>

void clockToggle1()
{
	_delay_us(1);
	PORTB |= (1<<PB0);
	_delay_us(1);
	PORTB &= ~(1<<PB0);
}

void clockToggle10()
{
	_delay_us(10);
	PORTB |= (1<<PB0);
	_delay_us(10);
	PORTB &= ~(1<<PB0);
}

inline void send1()
{
	PORTB |= (1<<PB1);
	clockToggle1();
}

inline void send0()
{
	PORTB &= ~(1<<PB1);
	clockToggle1();
}

void jtagToSWD()
{
	for(int i = 0; i<64 ; i++)
	{
		clockToggle10();
	}
	_delay_us(1);
	//Now send 0xE79E (1110 0111 1001 1110) but do it MSB first
	send1();	
	send1();	
	send1();	
	send0();	
	send0();	
	send1();	
	send1();	
	send1();	
	send1();	
	send0();	
	send0();	
	send1();	
	send1();	
	send1();	
	send1();	
	send0();
	
	PORTB |= (1<<PB1);
	_delay_us(1000);
}

void SWDToJTAG()
{
	for(int i = 0; i<64 ; i++)
	{
		clockToggle10();
	}
	_delay_us(1);
	//Now send 0xE79E (1110 0111 0011 1100) but do it MSB first
	send1();	
	send1();	
	send1();	
	send0();	
	send0();	
	send1();	
	send1();	
	send1();	
	send0();	
	send0();	
	send1();	
	send1();	
	send1();	
	send1();	
	send0();	
	send0();
	PORTB |= (1<<PB1);
	_delay_us(1000);
}

int main(void)
{
	//PB0 - "JTAG" clock
	//PB1 - "JTAG" TMS signal
	PORTB = (1<<PB0|1<<PB1|0<<PB2);
	DDRB = (1<<PB0|1<<PB1|1<<PB2);
	
	_delay_us(10000000);
	PORTB &= ~(1<<PB0);
	_delay_us(100);
	
	jtagToSWD();
	SWDToJTAG();
	
	jtagToSWD();
	SWDToJTAG();
	
	jtagToSWD();
	SWDToJTAG();
	
	jtagToSWD();
	SWDToJTAG();

	jtagToSWD();
	SWDToJTAG();
	PORTB |= (1<<PB2);//Reset
}

0 PAk over 11 years ago in reply to Christopher Parish

Mastermind 7015 points

Thank you Christopher.

This is a great contribution!!

Regards

Arm-based microcontrollers

Arm-based microcontrollers forum

Unlocking a Tiva C with Bad Oscillator Settings