TC321x Secure Debug: how to re-enable SWS with the debug key (datasheet 18.4.2)?

Alex Kafando

Title: TC321x Secure Debug: how to re-enable SWS with the debug key (datasheet 18.4.2)? Hello, We are evaluating the Secure Debug feature of the TC321x (datasheet chapter 18) and we can lock the SWS interface, but we cannot re-enable it with the debug key. Setup: - Chip: TC321x, on a prototype board (the same behaviour is expected on the TC3215X-EVK C1T357A20) - Programmer: Telink Burning EVK, SWS connection (3V3, GND, SWM -> SWS) - Tools: BDT release v5.9.3 (GUI and Cmd_download_tool.exe) - eFuse written from firmware with the SDK driver functions efuse_write() / efuse_read() What works: 1. We wrote a test debug key 0xA584F000 in eFuse bits [63:32] (EFUSE_BLOCK1). Read-back confirms the value. The board stays fully accessible. 2. We set bit [74] sws_dbg_disable (EFUSE_BLOCK2, mask 0x00000400). The lock is effective immediately: read, write, Erase, Download and Activate are all refused. The application firmware keeps running normally. What does not work (re-enable, datasheet 18.4.2): According to the datasheet, we should write byte 0xA5 to address 0x84F000 through SWS. We tried: - BDT Memory Access, type CORE, address 84F000, data A5 -> Error<0x1002>: EVK command result error - The same write just after power-on -> Error<0x1002> - Cmd_download_tool.exe 1 TC321X wc 84f000 a5 -s 1 -> "TC32 EVK: Swire error", Error<0x1002> - Cmd_download_tool.exe 1 TC321X ac -> Activate MCU error (the same command works on an unlocked board) - Secure Boot Tool > Re-enable Debug-interface, with DebugKey.txt containing A584F000 -> Error<0x1204>: Function not supported Our understanding (not confirmed): the BDT tools first perform a Swire check or an Activate before any write, and the locked chip refuses it, so the key byte may never be sent. We also noticed that the Secure Boot Tool uses a 128-bit Root Key and Debug Plaintext, which does not match the 32-bit debug_key of the TC321x. Questions: 1. Which tool and which exact procedure should be used to re-enable SWS on the TC321x with the debug key? 2. Does the write have to be done at a specific moment (for example within a time window after power-on) or with the chip in a specific state? 3. Is "Re-enable Debug-interface" supported for the TC321x in any BDT version? If yes, what is the expected DebugKey.txt format? Thank you for your help. <i class="pstatus"> 本帖最后由 Alex Kafando 于 2026-9-25 16:14 编辑 </i><br /> <br />

TL_SUNPENG

1. Select tool version **5.9.5** and choose **TC321X** as the chip model. 2. From the menu bar, select **Tool → Secure Boot Tool**. 3. To disable swire communication, do the following in order: * Set the **Secure Debug** option to **Enable**; * Fill in the **Debug Key**; * Click **Download all**.  4. To re-enable the communication interface: click the **Re-enable Debug-interface** button. A key selection prompt will appear — choose **No**, then select and load the text file. The key file is `DebugKey.txt`, whose content is an 8-digit hexadecimal string such as `00F084A5`.   <i class="pstatus"> 本帖最后由 TL_SUNPENG 于 2026-9-28 11:41 编辑 </i><br /> <br />

Alex Kafando

I followed your procedure but Download-All gives Error<0x1002> because the chip is already locked. The debug key 0xA584F000 was already written in EFUSE\_BLOCK1 and bit 74 (sws\_dbg\_disable) is already set in EFUSE\_BLOCK2 by our firmware. So I went directly to Re-enable Debug-interface with DebugKey.txt containing A584F000, but I also get Error<0x1002>. Is there a specific power sequence required? Does the chip need to be powered on or off when we click Re-enable?" <div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102959&ptid=98922" target="_blank"><font color="#999999">TL_SUNPENG 发表于 2026-9-28 11:20</font></a></font><br /> 1. Select tool version **5.9.5** and choose **TC321X** as the chip model.<br /> 2. From the menu bar, sele ...</blockquote></div><br />

TL_SUNPENG

During the Re-enable phase, the chip needs to be power-cycled (switched off and then back on). Make sure the DUT's VBAT is connected to the 3V3 supply of the programmer. <div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102972&ptid=98922" target="_blank"><font color="#999999">Alex Kafando 发表于 2026-9-28 18:09</font></a></font><br /> I followed your procedure but Download-All gives Error because the chip is already locked. The deb ...</blockquote></div><br />

TL_SUNPENG

I suspect there might be an endianness issue with the debug key. Could you try updating `DebugKey.txt` with the content `00F084A5` and testing it again?

Alex Kafando

Thank you. I updated DebugKey.txt with 00F084A5. I power-cycled the DUT during Re-enable (tried both before and after clicking the button). I still get Error<0x1002>. The debug key 0xA584F000 was written in EFUSE\_BLOCK1 using efuse\_write(). VBAT is connected to 3V3 of the programmer. Is there anything else to check? <div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102974&ptid=98922" target="_blank"><font color="#999999">TL_SUNPENG 发表于 2026-9-28 20:52</font></a></font><br /> I suspect there might be an endianness issue with the debug key. Could you try updating `DebugKey.tx ...</blockquote></div><br />

TL_SUNPENG

<div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102975&ptid=98922" target="_blank"><font color="#999999">Alex Kafando 发表于 2026-9-28 21:09</font></a></font> Thank you. I updated DebugKey.txt with 00F084A5. I power-cycled the DUT during Re-enable (tried bo ...</blockquote></div> After opening the tool, you will be prompted to update the programmer firmware — make sure to update it. Once the update is complete, power-cycle the programmer (switch it off and then back on).  If you programmed the debug key and disabled swire using the following code, then the content of the debug key text file must be `00F084A5`. In addition, the power-cycling of the DUT does not require any manual intervention — it is handled entirely by the tool controlling the 3V3 supply.    [DebugKey.7z](https://forum.telink-semi.cn/forum.php?mod=attachment&aid=MjQwMHw5NzI5YWYzNHwxNzkwNjA0NTM1fDY2fDA%3D) <i class="pstatus"> 本帖最后由 TL_SUNPENG 于 2026-9-28 22:12 编辑 </i><br /> <br />

Alex Kafando

I already updated the programmer firmware to v5.3 and power-cycled it. I still get Error<0x1002>. The DUT is power-cycled during Re-enable. DebugKey.txt contains 00F084A5. What else should I check? <div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102976&ptid=98922" target="_blank"><font color="#999999">TL_SUNPENG 发表于 2026-9-28 21:27</font></a></font><br /> After opening the tool, you will be prompted to update the programmer firmware — make sure to upd ...</blockquote></div><br />

TL_SUNPENG

Please show the current connection diagram between the programmer and the DUT — that's all for now. <div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102977&ptid=98922" target="_blank"><font color="#999999">Alex Kafando 发表于 2026-9-28 22:04</font></a></font><br /> I already updated the programmer firmware to v5.3 and power-cycled it. I still get Error. The DUT  ...</blockquote></div><br />

Alex Kafando

<div class="quote"><blockquote><font size="2"><a href="https://forum.telink-semi.cn/forum.php?mod=redirect&goto=findpost&pid=102978&ptid=98922" target="_blank"><font color="#999999">TL_SUNPENG 发表于 2026-9-28 22:20</font></a></font> Please show the current connection diagram between the programmer and the DUT — that's all for no ...</blockquote></div> Okay, here is my wiring. <i class="pstatus"> 本帖最后由 Alex Kafando 于 2026-9-28 23:44 编辑 </i><br /> <br />