Restricted SWD access

[dmiv]

I have LPC55S16-EVK board.
I implemented an SWD interface on my own controller. But I faced with following problem. SWD works correctly on programmed LPC55S16. I can read, blank check, start/stop core and so on. But if I erase LPC55S16 (no matter by me or by MCUXpresso ) the only thing i can do by SWD is read/write IDCODE, CTRL/STAT..( Debug Port) registers. Any access to AP registers is restricted. I program LPC55S16  by MCUXpresso and get access again.
What's wrong I do? Are there additional steps i must do while flash is erased?

Thank you

[diego_charles]

Hi @dmiv 

I hope that you are doing excellent

Could you describe further how did you implemented your SWD interface, which debug probe are you using and how did you perform an erase to the flash?

The MCU has a feature called debug mailbox (DM-AP), which always remains enabled to the external world. The thing is that there is a pseudo script where the AP and DP registers are selected to communicate with the DM. You could try to see if you are able to access to the DM-AP, to narrow down this. Please check section Debug session with uninitialized/invalid flash image or ISP mode of the UM11295.

We have an application called flash programing tips, where we provide guidelines and recommendations for manage the flash memory. Flash Programming Tips for LPC5500 Series, there are interesting things like: ensuring that the core clock is under 100 MHz when doing flash operations, avoid erasing any the PFR region etc.

Also, the AN Hardware Design Guidelines for LPC55(S)xx Microcontrollers, provides recommendations for the SWD interface, for example to which pins add pull resistors, that may help to double check you SWD interface.

All the best,

Diego.

[dmiv]

Hi Diego,

Thank you for answer

I do not quite understand your question about how i implemented SWD. I have my own programmer in which implemented SWD that works for numerous devices including Cortex-M0, M3, M4, M23 and M33. 

And as for erasing the flash...I can erase one by my own code ( sample in LPC55S1x/LPC551x User manual ) and by MCUXpresso IDE v11.3.1_5262. The result is the same. Namely I lose the access after erasing and access gets back after programming by MCUXpresso.

Second, as i understand to get access to the debug mailbox i have to have access to AP. But i dont have one. I have access only to DP. Let me know if i'm wrong. 

I  checked the section Debug session with uninitialized/invalid flash image or ISP mode of the UM11295 you referred and it starts from "When the device boots, there may be no valid image in the boot media (erased flash, isn't it?), ..., and debug access is disabled for security reasons." Does that mean that i haven't access in case of erased flash. But how does MCUXpresso (link-2) get it?

And finally, for some reasons i must use only SWD interface.

[diego_charles]

Hi @dmiv 

Many thanks for your reply!

Which firmware  is running your own programmer?  Is  able to run the J-Link firmware ?

Could you show me to which DP and AP registers are you trying to access  and how are you writing to them? This to try   to replicate your issue on my own.

On the LPC55s16, there are two access ports CPU0 AP and DM-AP (debug mailbox Access port) The DM-AP ,  is always open to the external world, so I think that you should be able to access to its corresponding  DP and AP registers, even after a mass erase on the flash. if you can only access to the DM-AP (although it is not our target here ) this could help also us to narrow down the issue.

Attached a screenshot , where I access to the DM-AP, after performing a mass erase with the J-link firmware.

Diego

[dmiv]

Hi NXP TechSupport,

I have three simple and straight linked questions.

1. Have you any documentation besides "LPC55S1x-LPC551x User manual" and "LPC55S1x_PDS" about low-level DM-AP? No scripts and no J-Link.

2.

If yes, is there any way i can get it?

If no, is there any particular man i have to contaсt to ask a question?

3. Not exactly a question but anyway..

If you wouldn't mind answering the both questions above.

[diego_charles]

Hi @dmiv 

Many thanks for your patience so far.

Regarding  1. Have you any documentation besides "LPC55S1x-LPC551x User manual" and "LPC55S1x_PDS" about low-level DM-AP? No scripts and no J-Link.

Unfortunately, we do not have further documentation to provide . I would recommend to check with our partners who develop SWD interfaces and SW,  that it is ARM with the CMSIS DAP,  Segger, PE-Micro etc., to see which kind of further support could provide.

Regarding your other questions, as this is not a regular inquiry, I am still checking this and I will let you know my feedback.

Diego.

[diego_charles]

Hi @dmiv 

Thank you for your patience.

By default, when a LPC55 boots  with the flash erased, it will enter to the ROM bootloader or ISP mode. 

According to the UM11295, section  51.6 Debug session protocol  :

On LPC55S1x/LPC551x parts, when program control is in ROM memory context (i.e.,
instructions are fetched from the ROM memory address range during the boot process),
the debug access port (AP) of CPU0 is disabled irrespective of device life-cycle state or
DCFG_SOCU settings. This mechanism is referred to as 'Boot-ROM protection' in this
manual. 

Therefore, what you are probably facing is the Boot-ROM protection, which disables access to the Core 0 DAP . However, there are several ways to start a debug session for different scenarios .The section 51.6.1 Debug session with uninitialized/invalid flash image or ISP mode  (that we mentioned before ) describes is one of those ways that fits your scenario with  the erased flash.

In other words, the Debug mailbox , or DM-AP,  is the AP  that can  help to get out of the Boot-ROM protection and  start a  debug session , gaining  access to the Core 0 AP.  The   APSEL = 2 is the index for the DM-AP, as this  AP its NXP implementation.

Regarding the pseudocode and your situation of not being follow our Debug mailbox script further, unfortunately, we are not able to test with the same tools. However, the DM-AP access should be granted  by  the LPC55, as it comes out of fabric or does not have any other modification.  

To develop low level SWD algorithms you may refer to the ARM Cortex M33 Processor Technical Reference manual   and the  ARM Debug Interface Architecture Specification ADIv5.0 to ADIv5.2  ( as the M33 follow Arm debug interface (ADI) 5.0 to 5.2 spec).

Additionally, If you would like to get more support on the develop of  your own programmer you may contact our Professional Engineering services Team, who can evaluate your request, or any other of our partners who develop similar algorithms. As this labor is out of the scope of our support team at this community.

Please accept my apologies for the delay, and any inconvenience.

Diego.

[dmiv]

Hi Diego,

Thank you so much for answer.

I handled the problem. Using script as a sample and knowing your hint about undocumented AP = 2 i managed to go around a bootloader and then it's all down on the old scheme without mailbox. It just was important and critical to figure out the right delays. 

[dmiv]

Hi Diego,

I cannot get through to DM-AP.

In according with sample in LPC55S1x-LPC551x User manual, i sent 0x020000F0 ( why APSEL = 2!!!??? ) to SELECT register and got 0x002A0000. And this is the only success i achieved. 

Is there somewhere additional documentation in which it described a lowest layer? If  we need to, i can officially ask on behalf of the company and sign the NDA.

Again, the use Link, j-Link, scripts and so on is not acceptable for us, We use our own hardware and software.  

[dmiv]

Diego,

I'm really do appreciate you're trying to help me. Thanx.

Concerning  firmware. I have my own programmer with my own hardware and software. It doesn't know anything about J-Link.

I use regular way to get through to device. 

pseudo code below

1. enter. 

reset

50(256) clocks

0xe79e

50(256) clocks

read IDCODE( ( A32 << 3 ) | ( RnW << 2 ) | ( APnDP << 1 ) | 1 | (0xa0 or 0x80) )

2. 

CTRL_STAT_CDBGPWRUPREQ | CTRL_STAT_CSYSPWRUPREQ | CTRL_STAT_ORUNDETECT to CTRL/STAT

Here i want to get IDR. 

send to SELECT appropriate A32, RnW, APnDP 

If flash is not erased i get it. If flash is erased i get 0(zero) and swd_response_ok. 

if i try to read/write DP registers i get it. If i try to read/write AP register i get 0 always.

I traced LPC55s16 when MCUXpresso was programming it and found out that MCUXpresso is doing the same things as i'm doing. Up to a point, at least. It a difficult to track far away.

Anyway, thank you for your consultation and advices. I got what you're talking about. I mean mailbox. And will be trying to get to the device. I'll let you know if there's any progress.

Dmitry