lock_flash and lock_bootprot currently support only locking the whole flash and locking the maximal leading flash chunk (32k).
An optional numerical parameter is added. It can be specified in decimal or 0x prefixed hexadecimal.
For samd21 'lock_bootprot 0' locks the first 32k of flash while 'lock_bootprot 6' locks the first 512 bytes. 'lock_bootprot 0' is equivalent to 'unlock_bootprot'.
Similarly, 'lock_flash <number>' locks the flash segments corresponding to zeros in the binary representation of the given number.
'lock_flash 0xffff' is equivalent to 'unlock_flash'.
If the optional parameter is not given both commands work as previously.
The SAMD09 CPU is used in boards such as the Adafruit Seesaw. It has a
smaller amount of memory and flash than other SAMD ports.
This was tested with an Adafruit Seesaw. These boards come with preloaded
firmware. As a test, the firmware was dumped and flash was erased. Then,
flash was verified to be all zeroes. Finally, the firmware was loaded
back in:
(gdb) p/x *(unsigned int *)0@32
$8 = {0x20000f88, 0x1db, 0x1d1, 0x1d9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d9, 0x0, 0x0, 0xf5, 0x1081, 0x1d9, 0x1d9, 0x1d9, 0x1d9, 0x1d9, 0x1d9, 0x1d9, 0x0, 0x1d9, 0x1d9, 0x25e9, 0x0,
0x0, 0x1d9, 0x1d9, 0x1d9}
(gdb) dump ihex memory flash.ihex 0 8192
(gdb) mon erase_mass
Erase successful!
(gdb) p/x *(unsigned int *)0@32
$9 = {0xffffffff <repeats 32 times>}
(gdb) load flash.ihex
Loading section .sec1, size 0x2000 lma 0x0
Start address 0x00000000, load size 8192
Transfer rate: 5 KB/sec, 910 bytes/write.
(gdb) p/x *(unsigned int *)0@32
$10 = {0x20000f88, 0x1db, 0x1d1, 0x1d9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d9, 0x0, 0x0, 0xf5, 0x1081, 0x1d9, 0x1d9, 0x1d9, 0x1d9, 0x1d9, 0x1d9, 0x1d9, 0x0, 0x1d9, 0x1d9, 0x25e9, 0x0,
0x0, 0x1d9, 0x1d9, 0x1d9}
(gdb)
Signed-off-by: Sean Cross <sean@xobs.io>
Various SAMD devices have different amounts of memory. Up until now, all
SAMD devices have had the same amount, and therefore this value was
hardcoded to 32k of RAM and 256k of flash.
Add a parameter to the description field and set it to default to the
previous values. Use this description field when adding memories to the
target definition.
Signed-off-by: Sean Cross <sean@xobs.io>
Workaround for CMSIS-DAP/Bulk debugger orbtrace that returns NO_ACK
with high values of TRNCNT. Perhaps only STM32F767 needs write to DHCSR
with high occupancy to catch the device in a moment not sleeping.
Expect signal integrity errors when using jumper cables. Often probes switch
the SWJ GPIO with highest speed, resulting in possible reflections. Additional
ground wires may help. If there is isolation between probe and targets,
additional ground wires are a must or ground shift will wrack the transfer!
Stlink does not like low level access and aborts with STLINK_SWD_DP_ERROR.
Either our implementation still has faults or stlink can not handle
MINDP devices with BMP/Firmware also seemm not to like low level access,
either du to some hidden error in BMP or by design
the sdid bits correspond to s32k14x as well as s32k11x but i only have
access to the k14x variants so didn't bother w/ the k11x variants.
the memory/flash sizes also can come from the sdid bits, but the
splits still need to come from a lookup.
E.g. AP1 on a STM32WLE5 points to a ROM table, but access to the ROM table
via AP1 hangs forever.
- Substantial reduce timeout when wait for a response. Valid access should
succeed fast.
- Abort AP access to free DP for other accesses
- Don't throw exception, only set dp->fault
- React on higher level
If the RP2040 is using the ring oscilator (ROSC) rather than the crystal
oscilator (XOSC) then flashing program will take much longer. As the XOSC is not
enabled at boot we should not assume it will be enabled before the debugger is
connected (or indeed at all), thus should use the longer timeout during load
commands.
Increasing spinner timeout to 500 means `tc_printf` is not called during
the `_flash_range_erase`. This is important as `_flash_range_erase` is
used when loading. This fixes the issue:
https://github.com/blacksphere/blackmagic/issues/875
Also adding spinner timeout counter to reduce bus traffic.
- RP2040 show both DPs
- Multidrop test with STM32L552 and STM32H745 allows selection
with "-m 0x4500041" (H7), "-m 1" (L552) or "-m 0x01002927" (RP2040)
This adds support for the STM32WL series in stm32l4.c. These parts have
the same flash registers layout as the L4 series, but a different base.
Since there are already two sets of registers in this target file, this
adds support for register maps that can be customized for each device
ID.
This adds a TRY_CATCH around the adiv5_ap_read_id() in
adiv5_component_probe() and resets the DP when that happens.
It seems like the STM32WLE5 comes with the AP of the inactive core
enabled in a way that does not make it detectable, and the current code
times out and leaves the whole device hanging.
Catching the timeout and calling adiv5_dp_abort() seems to restore the
device to a useable state.
Tested on Seed LoRa-E5 (STM32E5JC).
STM32WLE5 has the same dual core chip as STM32WL5. For the second
core, the additional AP can be see, but access to e.g. CIDR0 for that
Romtable fails.
Aborting the scan too if again the second read of CIDR0 fails makes
sense anyways!
This adds support for the NXP S32K148. This is an automotive-grade part
that is derived from the Kinetis line, so it has a very similar
interface to other parts in the family.
Signed-off-by: Sean Cross <sean@xobs.io>
**Summary**
Modifications to fix flash support on the lpc546xx:
- fix IAP entrypoint to be `0x03000204`, not the value at that address
- add a reset and attach sequence before erasing flash sectors. there's
little documentation around this, but experimentally, erasing sector 0
fails when the ROM bootloader is mapped to it (on reset). stepping the
chip once and attaching is enough to snap the chip out of it, permitting
flash erase on sector 0.
- add a few test commands to the lpc546xx table (read_uid, erase/write
sector, etc).
- write the magic CRC value when writing to sector 0
(`lpc_flash_write_magic_vect`).
- move the lpc546xx probe to before the lpc43xx probe, to prevent
getting the lpc546xx into Lockup when reading an illegal memory location
during lpc43xx probing
Fixes#786.
I don't 100% understand the reset/load sequence of this part, but these
changes are sufficient to program and debug the part now.
I didn't do a detailed analysis of what pyocd (via st-link hardware
adapter) and segger jlink do to handle the same, but both of those
worked without modification, so there's some difference in the
sequence they're using.
**Testing**
Verified I can now successfully erase and write an executable in sector
0 (and other sectors).
Verified the new commands work correctly.
Especially needed when leaving the debugger or during debug unit power-up.
ARM Debug Interface Architecture Specification ADIv5.0 to ADIv5.2
tells to clock the data through SW-DP to either :
- immediate start a new transaction
- continue to drive idle cycles
- or clock at least 8 idle cycles
Implement last option to favour correctness over slight speed decrease
Implement only for adapters where we assemble the seq_out_parity in our code,
as on firmware, ftdi and jlink. Hopefully the high level adapters do it right.
Reverts 2c33cde63f and
cde7726b87
This adds support for the NXP S32K118. This is an automotive-grade part
that is derived from the Kinetis line, so it has a very similar
interface to other parts in the family.
Signed-off-by: Sean Cross <sean@xobs.io>
It seems, writing to DHCSR fails silent when the device is sleeping.
Reading DHCS during sleep may return nonsense.
Repeated write may at some point catch the device running and succeed.
With devices sleeping for long time and running on faster clock the
chance for a successful hotplug gets smaller.
- Try hard to halt a sleeping device
- Prepare vector catch and enable all debug units by TRACENA
- Release reset
- Apply device specific fixes
-- STM32F7: Store old value of DBGMCU_CR, enable debug in sleep in
DBGMCU before reading PIDR and restore DBGMCU on detach.
Signed-off-by: Uwe Bonnes <bon@elektron.ikp.physik.tu-darmstadt.de>
* stm32h7: Don't tc_printf from flash functions
Receving an 'O' packet while flashing confuses GDB and then
weird stuff happens.
* Replace tc_printf with DEBUG_WARN
Firmware BMP with ENABLE_DEBUG=1 will print WARN and INFO as before.
PC-Hosted BMPwill alway print to stderr. Warn is printed unconditional,
INFO, GDB, TARGET, DONGLE and WIRE will print if their appropriate bit in
cl_debuglevel is set via the -v verbose command line argument.
INFO will go to stdout with -t or -l.
* Rename variant_string
Files efm32 samd samx5x uses same function name that collides during
linking (checked with gcc10)
Signed-off-by: Alexey 'Alexxy' Shvetsov <alexxyum@gmail.com>
* Also make xxx_variant_string static
Signed-off-by: Alexey 'Alexxy' Shvetsov <alexxyum@gmail.com>
Option bytes are not accessible with level 1 protection, so
Use FLASH_OPTCR(x)
Fix crash with "mon opt write xxxx"
Handle option manipulation better when HW Watchdog fuse is set
Allow abbreviated "mon option x<yyy>" commands
Thanks to Dave Marples <dave@marples.net> for input.
- Issue only one reset. Start with SRST. Only if not seen, use SYSRESETREQ
- Wait for release of DHCSR_S_RESET_ST before issuing more commands
- Add timeout to catch reset line stuck low
- Remove AP errors
It appears the Travis version of gcc-arm-none-eabi doesn't allow the %x
printf format specifier for size_t arguments, in contrast with the
version I'm running on Ubuntu 18.04 (15:6.3.1+svn253039-1build1).
Adds a target driver for Microchip SAM D51 / E5x family.
Tested on SAMD51G19A and SAMD51J19A. According to the datasheet, the
D51 / E5x family share the same core feature set, differing only in the
addition of CAN (E51) or ethernet controllers (E53/54). All members of
the family should be equivalent from a debug and programming perspective.
-Wall on gcc8 otherwise warns without -Wno-cast-function-type but older
GCCs/CLang choke on that argument:
error: unknown warning option '-Wno-cast-function-type'; did you mean
'-Wno-bad-function-cast'? [-Werror,-Wunknown-warning-option]
This adds 24 byte to the binary, as some functions are now called with
additional dummy arguments:
"Pushing and popping garbage to keep the system happy"
It's a global symbol and LTO will complain if the one in this file and
the one in EFM32 target are inconsistent.
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
The datasheet specifies the EEFC_BASE(0) is at `0x400E0A00` and EEFC_BASE(1) is at `0x400E0C00` which means they're spaced 0x200 bytes apart rather than 0x400.
dragonmux
arpadbuermen
Uwe Bonnes
Frank Kunz
Sean Cross
Koen De Vleeschauwer
fabalthazar
SG
dpc
Thiadmer Riemersma
Björn Mellström
James Turton
Fabio Baltieri
Alex Norman
Noah Pendleton
Aaron Lindsay
Stoyan Shopov
mean
Jonathan Giles
Noah Pendleton
jbuonagurio
Richard Meadows
Gareth McMullin
Eivind Alexander Bergem
Damien Merenne
David Lawrence
Francesco Valla
Fredrik Ahlberg
Valmantas Paliksa
Dömötör Gulyás
Thomas Bénéteau
Alexey Shvetsov
Sid Price
Artur Maciuszonek
Ken Healy
Kirill Zhumarin
dpslwk
Sylvain Munaut
Stephen Roe
Simon Rasmussen