LPC546xx flash loading broken

[dlaw]

$ gdb-multiarch 
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word".
(gdb) target extended-remote /dev/ttyACM0
Remote debugging using /dev/ttyACM0
(gdb) mon swdp_scan
Target voltage: 3.3V
Available Targets:
No. Att Driver
 1      LPC54608J512 M4
 2      LPC55 Debug Mailbox 
(gdb) attach 1
Attaching to Remote target
warning: No executable has been specified and target does not support
determining executable automatically.  Try using the "file" command.
0x000006e8 in ?? ()
(gdb) load bin/bootloader.elf
Error erasing flash with vFlashErase packet

Broken in 026193a, working in c4869a5 (with a gdb rollback to <= 10). I will bisect when I have a little more time available.

[dragonmux]

Thank you for the issue report - we look forward to hearing more when you get a chance, or possibly spending some time ourself on it if we can locate a suitable target to tests against.

It's quite notable in the output you've shown that despite not being an LPC55 part, you're seeing the LPC55 support trigger and provide a second target, so that could be indicative of part of the problem.

[dlaw]

With some initial debugging I've found three different behaviors:

c4869a5 (and all pre-1.8.2): works

993c74b (and all after 1.9 but prior to #1433 fix): fails with infinite hang on load command (this was a bug which also affected LPC8xx targets)

38d0c56 through current main: fails as described above (Error erasing flash with vFlashErase packet)

• mon erase_mass appears to work
• mon erase_range fails
• mon erase_sector fails

If there is a developer with time to look into this, please let me know -- I would be happy to ship you a LPC546xx dev board.

[dragonmux]

mon erase meaning mon erase_mass we assume - this runs entirely different routines to mon erase_range, which uses the target_flash_erase() pathway to erase Flash blocks - this suggests that it's specifically a regression in lpc546xx_flash_erase() or one of the supporting routines.

We'll check if we did actually get a LPC546xx board in since the original report, and see about dissecting this code now we have some commit ranges to look at - see if we can spot something obvious that would lead to a behaviour change, etc.

[dlaw]

Yes. mon erase_mass. I corrected my comment above.

I'd be happy to test any other probe firmware versions, if you have any ideas to try.

Thanks!

[dragonmux]

👋🏼 Currently checking through the bug tracker and we're wondering if this is still broken or if after the work that was done to the LPC families support in v1.10 this is now actually fixed?

[dlaw]

Still broken in v1.10. Please let me know if there's anything you would like tested.

[dragonmux]

If you could do a build of BMDA (both v1.10.1 and latest main) and get us some logs using src/blackmagic -v 13 (info, target and protocol debugging levels enabled) that would be fantastically helpful to know where things are going wrong and start triaging this.

[dlaw]

I tested with blackmagic hosted (latest main, f1e9a33) attached to a jlink probe. Logs attached. Here is the GDB session corresponding to these logs:

$ gdb-multiarch
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word".
(gdb) target extended-remote localhost:2000
Remote debugging using localhost:2000
(gdb) mon swdp_scan
Target voltage:  3.303V
Available Targets:
No. Att Driver
 1      LPC546xxJ512 M4
 2      LPC55 Debug Mailbox 
(gdb) attach 1
Attaching to Remote target
warning: No executable has been specified and target does not support
determining executable automatically.  Try using the "file" command.
0x00000682 in ?? ()
(gdb) load bin/A0275PAM00.bootloader.elf
Error erasing flash with vFlashErase packet
(gdb) 

blackmagic_logs.txt

(I couldn't figure out how to get blackmagic hosted to see my native blackmagic probe hardware)

[DxRT]

Hi,
I have this issue with current release flashed on Black Pill (I tested Probe on stm32 and it works). I really, really need this to work because I was left without any probe (you know, loose cable with 24V) 😂

[DxRT]

I did a bit debugging during morning coffee and got this:

Resetting TAP
Change state to Shift-DR
Scanning out ID codes
Return to Run-Test/Idle
Change state to Shift-IR
Scanning out IRs
Return to Run-Test/Idle
Change state to Shift-DR
Return to Run-Test/Idle
Switching from JTAG to dormant
Switching out of dormant state into SWD
DP DPIDR 0x2ba01477 (v1 rev2) designer 0x43b partno 0xba
AP 0: IDR=24770011 CFG=00000000 BASE=e00ff000 CSW=e3000040 (AHB3-AP var1 rev2)
Halt via DHCSR(01030003): success after 8ms
ROM Table: BASE=0xe00ff000 SYSMEM=1, Manufacturer 43b Partno 4c4 (PIDR = 0x04000bb4c4)
0 0x0e000e000: Generic IP component - Cortex-M4 SCS (System Control Space) (PIDR = 0x04000bb00c DEVTYPE = 0x00 ARCHID = 0x0000)
-> cortexm_probe
CPUID 0x410fc241 (M4 var 0 rev 1)
SWD access resulted in fault, retrying
SWD access resulted in fault, retrying
SWD access resulted in fault, retrying
SWD access resulted in fault, retrying
Invalid vendor ID read
LPC546xx: Part [2] ID 0x4294264328
1 0x0e0001000: Generic IP component - Cortex-M3 DWT (Data Watchpoint and Trace) (PIDR = 0x04003bb002 DEVTYPE = 0x00 ARCHID = 0x0000)
2 0x0e0002000: Generic IP component - Cortex-M3 FBP (Flash Patch and Breakpoint) (PIDR = 0x04002bb003 DEVTYPE = 0x00 ARCHID = 0x0000)
3 0x0e0000000: Generic IP component - Cortex-M3 ITM (Instrumentation Trace Module) (PIDR = 0x04003bb001 DEVTYPE = 0x00 ARCHID = 0x0000)
4 0x0e0040000: Debug component - Cortex-M4 TPIU (Trace Port Interface Unit) (PIDR = 0x04000bb9a1 DEVTYPE = 0x11 ARCHID = 0x0000)
5 0x0e0041000: Debug component - Cortex-M4 ETM (Embedded Trace) (PIDR = 0x04000bb925 DEVTYPE = 0x13 ARCHID = 0x0000)
ROM Table: END
AP 2: IDR=002a0000 (Unknown var0 rev0)
lpc_iap_call: cmd 50 (32), params: 00000000 00000000 00000000 00000000
lpc_iap_call: Failure due to fault (3)
-> Fault at 03000205
Erase failed at 0
lpc_iap_call: cmd 50 (32), params: 00000000 00000000 00000000 00000000
lpc_iap_call: Failure due to fault (3)
-> Fault at 03000205
Erase failed at 0

LPC546xx: Part [2] ID 0x4294264328 that [2] is mine checking building etc - ignore.

It looks like debug probe is still in primary bootloader and when I added debug message to reset_attach - it seems that it isn't call at all.