• State
  • Locked Locked
  • Replies 23 replies
  • Subscribers 22 subscribers
  • Views 14692 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

LaunchPad CC2650 Bricked - Uniflash

JOHN ESQUIAGOLA
Prodigy 90 points
Other Parts Discussed in Thread: UNIFLASH, CC2650, CC1310, CC1350

I was using Uniflash to put the demo example in Launchpad CC2650.  Linux ubuntu 14.04.

Uniflash is running on Linux ubuntu 14.04. It was working fine.

But, after some time .. it is bricked.

I am receiving the message: THIS DEVICE IS BLOCKED

And, when I try to mass erase .. I receive:

10/27/2016, 11:44:50 PM] GEL: Cortex_M3_0: MassErase(): Initializing.
[10/27/2016, 11:44:50 PM] GEL: Cortex_M3_0: MassErase(): Issuing Board Reset.
[10/27/2016, 11:44:51 PM] GEL: Cortex_M3_0: MassErase(): Mass erase complete.
[10/27/2016, 11:44:51 PM] GEL: Cortex_M3_0: GEL Output: Memory Map Initialization Complete.
[10/27/2016, 11:44:52 PM] Status: IcePick_C: Error connecting to the target: (Error -241 @ 0x0) A router subpath could not be accessed. A security error has probably occurred. Make sure your device is unlocked. (Emulation package 6.0.407.3)

Please, help me.

How can unlocked it?

  • 0
    TI__Genius 11740 points
    Hi John,

    It's possible you may have blocked out JTAG access, if this is the case, you'll have to order a replacement.

    Here's another thread with the same issue as you:

    e2e.ti.com/.../533970

    Regards,
    -Rebel
  • 0 in reply to A. Rebel
    Prodigy 90 points

    I am using the USB interface of the board. Not JTAG connection.
    Anyway, I think I must be able to access directly the JTAG ports regarding to unlock the device.

    Do you know how I can do that?

  • 0 in reply to JOHN ESQUIAGOLA
    Guru 735685 points
    The USB interface is connected to XDS110 debugger on CC2650 LaunchPad and the debugger is connected to CC2650 by jtag. It should work without problem. I suggest you to use a windows desktop and run Flash Programmer 2 to do mass erase.
  • 0 in reply to YiKai Chen
    Prodigy 90 points
    I have tried twice with the windows Flash Programmer, the message is the same "The device is locked".
    I have used the xdsdfu (linux command line) too. Tool say the firmware is update but when I try to use with Uniflash or FlashProgrammer( windows) the device continues in locked state.
    Uniflash is an official TI program to program the MCU .. and it was working fine.
    How come it is blocking the MCU ?
    It is really annoying and frustating for linux users .
  • 0 in reply to JOHN ESQUIAGOLA
    Prodigy 95 points
    Hey I just wanted to throw out there that we have the same problem with UniFlash but with the CC1310-launchpad. We can't mass erase it. We stored the factory stock program, that worked. We loaded an ELF file example from ti-rtos download, that worked. Then we went to reflash the factory stock program with a binary write and that broke our chip :-/. Also, the CC1310 CCFG Flash addresses aren't given in the TRM. I'm a firm believer that every TRM should have a "N Ways to Brick Your Chip" section right up top.
  • 0 in reply to Andrew Pikul
    Prodigy 95 points
    Hey, I wanted to follow up with a correction. The factory stock program didn't break the chip- it was the 'hello' example. In fact, that example that TI gives you in the TI-RTOS seem to be configured to completely lock the chip after you use them. It writes all 0's to the CCFG register.

    :-/
  • 0 in reply to Andrew Pikul
    Prodigy 90 points

    So, the problem is on TI side.
    How come TI brick the chip after hello program?

    Where is TI support to verify this information?

  • 0 in reply to Andrew Pikul
    Prodigy 45 points
    Hi all, I work with Andrew, I wanted to add a correction.
    The board was bricked after I used the binary option in UniFlash although the compiled file was actually an ELF file.
    So as a result it ended up writing over CCFG with zeros disabling debugging. Turns out it was a user issue on my part.
  • 0 in reply to Oliver Chubet
    Prodigy 90 points
    So, if you use the binary option you brick the board. Then, Uniflash needs to pop-up a warning in this case !!
    I dont remenber if I did that, I don't think so but it can be possible.
    Maybe the correct flow is :

    - Not use Binary option ( In what case you use it ?)
    - Use HEX or ELF for programming
  • 0 in reply to JOHN ESQUIAGOLA
    Prodigy 240 points

    Hi,

    I got the same problem after I chose load "Binary option".

    Now I can't debug on ccs or load program on uniflash

    What should I do.

  • 0 in reply to Khoa Nguyen Tuan
    Guru 735685 points
    I suggest you to use a windows desktop and run Flash Programmer 2 to do mass erase.
  • 0 in reply to YiKai Chen
    Prodigy 240 points

    I force mass erase in Flash Programmer 2 successfully .

    then I chose Action: erase  option and get this error

    Initiate access to target: XDS-L1000323.
Failed to read target memory.
Error while reading memory range. Address 0x40091090.
Debug interface is locked. Aborting action. Only forced  mass erase is possible.
Reset target ...
Reset of target successfull.

    it's still lock and get this error on CCS

    IcePick_C: Error connecting to the target: (Error -241 @ 0x0) A router subpath could not be accessed. A security error has probably occurred. Make sure your device is unlocked. (Emulation package 6.0.576.0)

  • 0 in reply to Khoa Nguyen Tuan
    Guru 735685 points

    Do you modify CCFG to block debugger interface in your application?

  • 0 in reply to YiKai Chen
    Prodigy 240 points
    I did :

    1/ Choose "keep CCFG" => force mass erase => Action : erase => Failed
    2/ uncheck "keep CCFG" => force mass erase => Action : erase => Failed

    what should I do
  • 0 in reply to Khoa Nguyen Tuan
    Guru 735685 points
    If you cannot rescue it using mass erase, I suggest you to ask for replacement from www.ti.com/.../faq-returns-and-refunds.page
  • 0 in reply to YiKai Chen
    Prodigy 240 points

    haiz,

    Why no one from TI read this topic and help me ?

  • 0 in reply to Khoa Nguyen Tuan
    Guru 735685 points
    Do you try to ask for replacement from www.ti.com/.../faq-returns-and-refunds.page ?
  • 0 in reply to YiKai Chen
    Prodigy 240 points
    No, I haven't

    I can't update my person information. Page always shows I have to fill all the information box even I already filled it.

    I hope someone from TI can check my situation.
  • 0 in reply to Khoa Nguyen Tuan
    TI__Guru**** 317180 points
    Khoa Nguyen Tuan: It sounds like you have overwritten the ccfg area in the flash. If you do this you will not be able to do a mass erase and you have to replace the device.
  • 0
    Prodigy 200 points

    I have the CC1310, CC1350 and CC2650 Launchpads and quickly ran into this "bricking" problem when experimenting with them.  If you're not careful with writing to the CCFG area, you'll set a flag that will put the MCU's into an infinite loop.  I've described the issue in some detail below.  I have created a tool that may get your boards unbricked by invoking the mass erase function of the WUC TAP that theoretically circumvents the MCU core.

    A board can become bricked if an incorrect program is written to flash and the IMAGE_VALID flag in CCFG area is set (to 0x0). The MSP432 has a similar issue, except that its "IMAGE_VALID" flag is located at address 0 and is considered 'set' if that word is anything other than 0xFFFFFFFF. In both cases, when something is programmed to flash, the internal boot sequence will jump to address 0x0 to execute the user program. If nothing is programmed to flash, (it was erased), then the ROM bootloader is activated. But otherwise, if a bad instruction is present (any non-instruction value), a USAGE FAULT is generated. Then when the fault handler tries to execute further instructions which are also invalid, a HARD FAULT is generated and the CPU enters a LOCKUP state. For TI MCU devices, a system reset is activated. Now, this sequence will occur rapidly and repeatedly and will prevent the debugger from accessing the CPU registers.

    Fortunately, the CC13xx and CC26xx devices have a JTAG chain that includes a special test TAP called the WUC (wake up controller). This TAP contains a flash erase command that can be activated independent of the CPU and its debug TAP (DAP) state. The factory reset option for fm_load (--factory_reset) will perform a flash erase which clears the IMAGE_VALID flag and gets the CPU back into a state where a debugger can attach. Note that if the JTAG system has been locked out with CCFG settings, this function won't work and the unit will be truly unrecoverable.

    The tool is called 'fm_load.exe' and can be downloaded from here: https://github.com/firmwaremodules/iotfirmware/tree/master/tools.  It works on Windows PCs.

    The tool will work, or it won't.  Note that I've managed to get my CC2650 Launchpad into a state that this tool will no longer recover from.

    Here's what you do.  At the command prompt type:

    fm_load -t cc2650f128 --factory_reset

    Good luck!

  • 0 in reply to Evan Ross
    Prodigy 240 points

    Hi,

    Thank you for your help.

    I tried but I return connection failed then auto close.

  • 0 in reply to Khoa Nguyen Tuan
    Prodigy 200 points

    Without any command line arguments, the tool will attempt to auto-detect all supported connected targets. Since your target is known to be "bricked", it is not accessible via the DAP at this point and the failure to connect is expected.

    What you need to do is add the --factory_reset argument, along with the specific target type: -t cc2650f128

    You would see the following if the cc2650 Launchpad could be successfully recovered.  At the very least you should see "Attempting to factory reset board..."

    C:\firmwaremodules>fm_load -t cc2650f128 --factory_reset
Firmware Module System Firmware Loader v1.2.65
Copyright (c) 2016 Firmware Modules Inc.
License: github.com/.../LICENSE
Firmware loader for XDS110 with TI MSP432, CC13xx, CC26xx devices.

Attempting to factory reset board...
XDS110 (02.03.00.02) with CMSIS-DAP L1000588 []
INFO:root:DAP JTAG MODE initialised
INFO:root:DAP JTAG MODE initialised
INFO:root:Detecting target... cc2650f128rgz
INFO:root:6 hardware breakpoints, 4 literal comparators
INFO:root:CPU core is Cortex-M3
INFO:root:4 hardware watchpoints
Success!

  • 0 in reply to Evan Ross
    Prodigy 240 points

    Hi,

    the command windown run very fast then it auto close.

    I can't do or type anything.