IAP via JTAG on LPC1754 #3

[petervanhoomiss]

I am not able to program the first 512 bytes of memory in sector0 on any of my chips. I can write to all other sectors, and to the top of sector0. Is this first 512 bytes reserved memory? There are two words at the bottom of the memory adress 0x0 and 0x4 that read 0xFC1F0010 and 0x8100FF1F. 

[petervanhoomiss]

So on page 15 of UM10360 it lists 0x0-0x400 as active interrupt vectors. I am still able to write to 0x200-0x400 but not 0x000-0x200. I have tried using different sized writes but nothing seems to work. 

[Carlos_Mendoza]

Hi Peter,

As you mention, the flash space 0f 0x00 and 0x400 contains the vector interrupts, to erase this area, the interrupts should be relocated to another place in flash or RAM.  Another thing to be aware of is that the Sector 0 (0x00 - 0xFFF) contains CRP and the valid checksum for booting, if the vector table changes, you need to calculate the checksum of the vectors 0 - 6 and place the 2s compliment at location 0x1C otherwise the software will not run.  Because of this we advise caution when erasing sector 0.

Hope it helps!

Best Regards,
Carlos Mendoza
Technical Support Engineer

[petervanhoomiss]

Hey Carlos,

That is super helpful! Thank you. This also explains why I now have a bench of chips who's cores lock up when I write to core registers....

So just to clarify, the steps for erasing and programming sector0 are:

1) Relocate interrupt table to RAM by writing new address to VTOR (0xE000ED04)

   a)Does this also include relocating the checksum with 0x1C offset?

2) Erase sector0 with erase sector IAP command.

3) Program secotr0 with copy ram to flash command

   a) Check that data includes 2s comp checksum at 0x1C

4) Restore VOTR to 0x0

5) Power cycle

Also for future reference, where could I have found the information about the checksum?

And what algorithm do you use to calculate this checksum? Is it a CRC? What polynomial do you use?

EDIT

So I got a couple of fresh chips mounted to my breakout board and read off the flash and I am confused. It reads:

0x0 : 0x10001FFC

0x4 : 0x1FFF0081

0x8 - 0x7C : 0x0

0x80 : 0x4018F8DF

0x84 : 0x5010F8DF

0x88 : 0xEA056826

0x8C : 0x60260606

0x90 : 0xF000F8DF

0x94 : 0x1FFF0201

0x98 : 0xFFFBFFF

0x9C : 0x40F0C3C0

0xA0 - 0x1FC : 0x0

0x200 -> : 0xFFFFFFFF

So first I don't see any checksum. And second, what is the data at 0x80-0x9C? Does this data need special handling as well? Also are these addresses in between the blocks supposed to be 0x0? I had been writing in random data to all flash routines which is what i think bricked my chips, so I am trying to be more careful here. 

/EDIT

Best Regards,

Peter 

[Carlos_Mendoza]

Hi Peter,

 
Yes, those steps need to be followed. The checksum is part of the vector table so it will also be relocated.

You can find more information about the checksum on the following links:

https://community.nxp.com/message/630662

https://community.nxp.com/thread/388993

https://forum.sparkfun.com/viewtopic.php?t=2512

Hope it helps!

Best Regards,
Carlos Mendoza
Technical Support Engineer

[petervanhoomiss]

Hey Carlos,

Theses steps are not working for me. I am still unable to write to the first 256bytes of sector0. Do you have and suggestions or further information I can read up on?

Peter

[Carlos_Mendoza]

Hi Peter,

 
The data at 0x80 is part of the information in vector table. It is better to write 0xFF to the rest of the sector 0.

Could you tell me the steps you are following and commands you are using? Are you getting a return code from the "Copy RAM to Flash" command? Are you erasing just the Sector 0? Have you tried erasing all sectors?

Thanks in advance for your response!

Best Regards,
Carlos Mendoza
Technical Support Engineer

[petervanhoomiss]

Hey Carlos,

I have tried erasing only sector0, and all for flash, as well as portions of flash. I verify the IAP command return after every command to ensure CMD_SUCCESS.

Here is a detailed breakdown of my current programming algorithm:

*Initialization

Power Chip

Reset Low

Wait 300uS

Reset High 

Wait 300uS

Reset TAP

Read IDCODE DP

Request Power CTRLSTAT

Verify Power CTRLSTAT

Read AP IDR starting with AP 0 untill I find AHB_AP(MEM_AP) (Is normally AP0 and is on LPC1754)

Write CSW 0x23000042 (No INC, 32BIT)

Write TAR CCLKCFG_Addr (0x400FC10C)

Write DRW 0x3 (sets clock divider to 3+1 of 4MHz resulting in 1MHz core clock)

Write TAR CCLKCFG_Addr (0x400FC104)

Write DRW 0x0 (Just to ensure we are using default (PLL0)

---From here I will just say write to address, with writes to TAR, DRW, and CSW for auto INC being implied---

***Erase Chip

*Move Vector Table

Write DHCSR 0xA05F0003 (to stop core)

Verify DHCSR (core stopped)

Copy data from 0x0-0x1F to 0x10000200

Write VOTR to 0x10000200

*Prepare Sectors

Write 0xFFFFFFFF to 0x10000380

Write 50 to 0x10000300   (IAP prepare sector)

Write 0x0 to 0x10000304   (Start Sector Number)

Write 0x11 to 0x10000308   (End Sector Number)

Write 0x10000300 to r0 (Done through DCRDR)

Write 0x10000380 to r1 (Done through DCRDR)

Write 0x1FFF1FF0 to PC (Done through DCRDR) 

Write DHCSR 0xA05F0001 (to start core)

Verify 0x0 at 0x10000380

Write DHCSR 0xA05F0003 (to stop core)

*Erase Sectors

Write 0xFFFFFFFF to 0x10000380

Write 52 to 0x10000300   (IAP erase sectors)

Write 0x0 to 0x10000304   (Start Sector Number)

Write 0x11 to 0x10000308   (End Sector Number)

Write 1000 (0x3EB) to 0x1000030C   (Core Clock FREQ)

Write 0x10000300 to r0 (Done through DCRDR)

Write 0x10000380 to r1 (Done through DCRDR)

Write 0x1FFF1FF0 to PC (Done through DCRDR) 

Write DHCSR 0xA05F0001 (to start core)

Verify 0x0 at 0x10000380

Write DHCSR 0xA05F0003 (to stop core)

--When I read data at this point from 0x0-0x1FF it has not been erased. Data at 0x200-end of flash is erased--

*Reset

Write 0x05FA0004 to ARICR_Addr (0xE000ED0C) (Request reset)

Wait 1000uS

Write 0x05FA0000 to ARICR_Addr (0xE000ED0C) (Unrequest reset)

Write VOTR to 0x10000200

 ***Write Page (Values used are for sector0 sectors are incremented for sector being written to)

*Write Ram Stack

Write DHCSR 0xA05F0001 (to start core)

Write data to be programmed into RAM starting at 0x10000400

Write DHCSR 0xA05F0003 (to stop core)

*Prepare Sector

Write 0xFFFFFFFF to 0x10000380

Write 50 to 0x10000300   (IAP prepare sector)

Write 0x0 to 0x10000304   (Start Sector Number)

Write 0x11 to 0x10000308   (End Sector Number)

Write 0x10000300 to r0 (Done through DCRDR)

Write 0x10000380 to r1 (Done through DCRDR)

Write 0x1FFF1FF0 to PC (Done through DCRDR) 

Write DHCSR 0xA05F0001 (to start core)

Verify 0x0 at 0x10000380

Write DHCSR 0xA05F0003 (to stop core)

*Copy RAM to Flash

Write 0xFFFFFFFF to 0x10000380

Write 51 to 0x10000300   (IAP copy RAM to Flash)

Write 0x0 to 0x10000304   (Addr of Target Location)

Write 0x10000400 to 0x10000308   (Addr of RAMStack)

Write 256 to 0x10000308   (Bytes to write)

Write 1000 (0x3EB) to 0x10000310   (Core Clock FREQ)

Write 0x10000300 to r0 (Done through DCRDR)

Write 0x10000380 to r1 (Done through DCRDR)

Write 0x1FFF1FF0 to PC (Done through DCRDR) 

Write DHCSR 0xA05F0001 (to start core)

Verify 0x0 at 0x10000380

Write DHCSR 0xA05F0003 (to stop core)

--When I read data at this point from 0x0-0x1FF it has been partially programmed. Some areas have correct data but many do not. Most words have at least one bit error, some have several. Data at 0x200-end of flash is programmed correctly and has no errors--

Thanks for your assistance.

Best Regards,

Peter 

[petervanhoomiss]

Carlos,

I am also getting the same results when replacing start core command 

Write DHCSR 0xA05F0001 (to start core)

with 

Write DHCSR 0xA05F0001 (to start core)

Write DHCSR 0xA05F0009 (to disable interrupts)

Best Regards,

Peter

[jonathanfeucht]

I believe the issue is you need to set the Memory Mapping Control register (MEMMAP - 0x400FC040) to 0x1. If it is set to 0x0, the vector table is remapped to the Boot ROM; setting it to 1 configures the device for "User mode", meaning the vector table is mapped to on-chip flash memory at address 0x0.

[petervanhoomiss]

Thanks Carlos,

So then the checksum is actually just a simple sum, got it. 

Then I only have two questions left:

What is the significance of the data at 0x80?

Does all of the data need to be written to 0x0 for the rest of the page? Or is writing unused data to 0xFFFFFFFF acceptable?

Best regards,

Peter