Commit 6d5b4d709c causes failed assert
when JTAG transport is selected:
src/target/arm_adi_v5.h:346: dap_queue_ap_read:
Assertion `ap->dap->ops != ((void *)0)' failed.
As check_security runs early in examine-start event, dap->ops must
be checked.
Change-Id: Ibd8312a3c668fbce834eed9790eabeed794117aa
Signed-off-by: Tomas Vanek <vanekt@fbl.cz>
Reviewed-on: http://openocd.zylin.com/3712
Tested-by: jenkins
Reviewed-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
The Linksys WAG200G router has a TI AR7 SoC and a 4MB Flash layout
similar to the Netgear DG834v3 router [1].
Below is an example of a successful flash recovery, using a TUMPA,
connected to the MIPS EJTAG 2.6 header (JP102) of the router.
WAG200G [2] TUMPA [3]
Desc Pin Pin Desc
------------------------
nTRST 1 3 nTRST
TDI 3 5 TDI
TDO 5 13 TDO
TMS 7 7 TMS
TCK 9 9 TCK
nSRST 11 15 RST
GND 2 4 GND
Note that nSRST is optional to halt the CPU, but is required to probe
the flash. For instance, recover the kernel with:
$ sudo ./src/openocd -s tcl \
-f interface/ftdi/tumpa.cfg \
-f tools/firmware-recovery.tcl \
-c 'board linksys-wag200g;
reset_config srst_only;
flash_part kernel /path/to/kernel.bin;
shutdown'
[1] https://wiki.openwrt.org/toh/linksys/wag200g
[2] https://www.linux-mips.org/wiki/JTAG#JTAG_headers
[3] http://www.tiaowiki.com/w/TIAO_USB_Multi_Protocol_Adapter_User's_Manual#20_PIN_JTAG_Connector
Change-Id: I952ba9f706e2e4f8f95ca03a5fa58f391ca030b6
Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
Reviewed-on: http://openocd.zylin.com/3776
Tested-by: jenkins
Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
As per the documentation, used "disabled" as the value to disable, as this
is the same value to disable the telnet and tcl server.
Change-Id: Idc4a8580098ec1107dcc6e1f59e817ecdebc38ac
Signed-off-by: Sandeep Mistry <s.mistry@arduino.cc>
Reviewed-on: http://openocd.zylin.com/3175
Tested-by: jenkins
Reviewed-by: Cristian Maglie
Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
Update to latest libjaylink version and incorporate API changes.
The major change in libjaylink is a rework of the device discovery.
Please test device discovery extensively, especially with multiple
devices connected. All other changes in libjaylink are of minor
importance for OpenOCD.
Change-Id: I9a50e83f59557505ce29809c7762c5df1cec10eb
Signed-off-by: Marc Schink <openocd-dev@marcschink.de>
Reviewed-on: http://openocd.zylin.com/3735
Reviewed-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Steven Stallion <stallion@squareup.com>
Tested-by: jenkins
Reviewed-by: Paul Fertser <fercerpav@gmail.com>
Currently, the log verbosity of libjaylink is not accessible from the
user interface. Therefore, changing the log verbosity of libjaylink is
only possible from within the J-Link driver source code which is not
acceptable for end users.
Output the libjaylink log messages through the logging module of
OpenOCD rather than directly to stderr.
Change-Id: I6bf7bf8f4c8a12fb9e955eeced68224545fa0b5c
Signed-off-by: Marc Schink <openocd-dev@marcschink.de>
Reviewed-on: http://openocd.zylin.com/3701
Tested-by: jenkins
Reviewed-by: Paul Fertser <fercerpav@gmail.com>
Add log_vprintf_lf() to enable the possibility to output log messages
with a variable argument list.
Change-Id: I7fd6e93db63a7d98f662df2881a42e4d923c3848
Signed-off-by: Marc Schink <openocd-dev@marcschink.de>
Reviewed-on: http://openocd.zylin.com/3709
Tested-by: jenkins
Reviewed-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Paul Fertser <fercerpav@gmail.com>
Cortex-M7 has autoincrement range only 1024 bytes,
surprisingly smaller than M3, M4.
Change-Id: I35ff1f0e093aac4af79f98eb3b8058d4295942d1
Signed-off-by: Tomas Vanek <vanekt@fbl.cz>
Reviewed-on: http://openocd.zylin.com/3737
Tested-by: jenkins
Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
Large flash parts time out when unlocking. Mass erase time is specified
as 32 seconds worst case for some parts. Automatic mass erase is
probably not using x8 parallelism, though, but a too large timeout
shouldn't hurt.
Also, use the new define instead of hardcoded timeout when mass
erasing.
Change-Id: Ib5af60d52ed7d53277bfe7176c4c44f79d3a26bc
Signed-off-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Reviewed-on: http://openocd.zylin.com/3738
Tested-by: jenkins
Reviewed-by: Spencer Oliver <spen@spen-soft.co.uk>
* port to new migen
* streamline package/part specification
* add pullup (Series3, Series6) and pullnone (Series7) for unused pins
as xilinx impact/vivado do it.
* specify respective toolchains
* build Series7 with vivado (broader support, faster)
* point to prebuilt bitstreams at https://github.com/jordens/bscan_spi_bitstreams
Change-Id: Ibfef3d78f855b754425f3e6131e2e49fa111e09a
Signed-off-by: Robert Jordens <jordens@gmail.com>
Reviewed-on: http://openocd.zylin.com/3173
Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Tested-by: jenkins
Reviewed-by: Robert Jördens
Reviewed-by: William D. Jones
Reviewed-by: Tim "mithro" Ansell <mithro@mithis.com>
The code memory size was a bug and seemed to be working by
accident since there happened to be 256 pages in the device that was
tested on which corresponded to 256kb.
Also don't fail if memory size != expected memory size based on hwid
as this hwid is unstable and should be used only for debug/diagnostics.
Change-Id: I4e98f7498a36c53fc51783eddfdaba704d30e3ca
Signed-off-by: Michael Dietz <mjdietzx@gmail.com>
Reviewed-on: http://openocd.zylin.com/3510
Tested-by: jenkins
Reviewed-by: Jiří Pinkava <j-pi@seznam.cz>
Reviewed-by: Tomas Vanek <vanekt@fbl.cz>
Currently if ftdi device is removed, OpenOCD will stall forever.
Only kill -9 will help in this case.
This patch makes use of libusb timeout functions and
trying to break out of while loop if some error is detected.
[andreas.fritiofson@gmail.com]: Add missing retval check
Change-Id: I97506190e376026705f14ef9fe37dc811b99b3ac
Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
Signed-off-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Reviewed-on: http://openocd.zylin.com/3419
Reviewed-by: Andreas Färber <afaerber@suse.de>
Tested-by: jenkins
arm-none-eabi target triplet defaults to Little Endian, and so far any
submitted machine code snippets have been verified to be Little Endian.
However a user might override [ARM_]CROSS_COMPILE with an armeb toolchain,
potentially resulting in invalid machine code.
Let's be safe and enforce Little Endian mode for assembler and compiler.
Change-Id: I9cefe24689eaded25d60ffb1f254b254e8d76f9d
Signed-off-by: Andreas Färber <afaerber@suse.de>
Reviewed-on: http://openocd.zylin.com/3498
Tested-by: jenkins
Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Kinetis family employs strange concept of Flash Configuration Field at
address 0x400 of program flash. Writing incorrect data to FCF may
permanently lock the device.
The change introduces 'kinetis fcf_source protection' mode. In this mode
write of flash image data to FCF is prevented. FCF data build from
protection (set by 'flash protect' command) are written instead.
FCF data are written also just after erase of relevant sector. It
protects device from locking security by reset or power cycle after erase.
prot_blocks array is used as protection blocks have bigger size than sectors.
Alignment and padding programming sections is rewritten to fix
writing with not section boundary aligned begin.
Change-Id: I9fc8bd37d6f627fb8ed7abb7f7560e78a740b195
Signed-off-by: Tomas Vanek <vanekt@fbl.cz>
Reviewed-on: http://openocd.zylin.com/3562
Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Tested-by: jenkins
Add kinetis_ftfx_decode_error() to show flash error type in human
readable message.
Add kinetis_ftfx_prepare() to prepare flash module just once in
command (not each time kinetis_ftfx_command() is called).
Change target_read/write_memory() to target_read/write_u8/32().
Make ftfx_fstat parameter of kinetis_ftfx_command() optional.
Longword flash write:
Fix huge memory leak after write of unaligned block.
Check flash address alignment properly.
Do not fill whole padding buffer but its end after original data.
Remove duplicite padding.
Change-Id: Ia5e312909f68d3cc724c8cbffe1cd903b9102124
Signed-off-by: Tomas Vanek <vanekt@fbl.cz>
Reviewed-on: http://openocd.zylin.com/3561
Tested-by: jenkins
Reviewed-by: Steven Stallion <stallion@squareup.com>
Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Originally flash/nor infrastructure assumed protection blocks identical
to erase sectors. This assumption is not valid for many flash types.
Driver code fixed the problem either by increasing sector size to
size of protection block or by defining more protection block than
really existed in device. Both cases had drawbacks.
The change retains compatibility with the old driver.
Updated driver can set protection blocks table independent
of sector table.
Change-Id: I27f6d267528ad9ed9fe0a85f05436a8ec17603a4
Signed-off-by: Tomas Vanek <vanekt@fbl.cz>
Reviewed-on: http://openocd.zylin.com/3545
Tested-by: jenkins
Reviewed-by: Steven Stallion <stallion@squareup.com>
Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
The change prevents starting mass_erase in unstable state of MCU
(RESET/WDOG loop).
mass_erase of secured MCU using manual reset button is supported.
Timeouts are measured by timeval_ms() instead of iteration count.
mass_erase timeout prolonged to 16 seconds because aborting
mass_erase in progress (deasserting reset) leaves the device
in security locked state.
Change-Id: I6605532df56080a54c2a1dfe49094e3db4ce534a
Signed-off-by: Tomas Vanek <vanekt@fbl.cz>
Reviewed-on: http://openocd.zylin.com/3551
Tested-by: jenkins
Reviewed-by: Steven Stallion <stallion@squareup.com>
Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Kinetis driver checks MDM STAT register to detect secured state of MCU.
Original version often reported a blank device as secured one.
Change #3010 has not fixed all false reports.
After changes in arm_adi_v5 infrastructure secured devices was not detected
at all.
New algorithm uses multiple MDM STAT reads and counts MDM_STAT_SYSSEC and
MDM_STAT_FREADY bits. Both secured MCU and MCU locked-up in RESET/WDOG loop
are detected reliably.
Detection is run in both kx.cfg and klx.cfg from examine-start event,
not examine-end as before. Event is configured only for non hla adapter.
Minor fix in klx.cfg: commented out adapter_khz 24000 in reset-init.
Such frequency is not supported in VLPR CPU mode and with JTAG.
Change-Id: I2ec2b68c45bde9898159cd15fbdcbcfa538c41d9
Signed-off-by: Tomas Vanek <vanekt@fbl.cz>
Reviewed-on: http://openocd.zylin.com/3547
Tested-by: jenkins
Reviewed-by: Steven Stallion <stallion@squareup.com>
Reviewed-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
NXP (nee Freescale) documents the mass erase procedure using the MDM-AP
block in AN4835. Existing support for this feature did not properly
handle boards without SRST. This patch updates the mass_erase command
such that it works correctly on these boards. Additionally, the core is
left in a halted state once complete to prevent reset loops due to the
watchdog as reported by some users.
Since the MDM-AP provides an additional method of halting and resetting
the core that is disconnected from the DAP, additional commands are
provided to manage this state. These commands are particularly helpful
when connecting to a target with an unknown state.
Change-Id: I40f006d5d964befb12b019c5d509988decdd3f91
Signed-off-by: Steven Stallion <stallion@squareup.com>
Reviewed-on: http://openocd.zylin.com/3540
Tested-by: jenkins
Reviewed-by: Tomas Vanek <vanekt@fbl.cz>
