Main Site Documentation

Panda Bricked? Made a mistake using IAP


#1

So I was doing some tinkering this weekend with my Panda and thought it would be fun to load FEZopen onto my board.

I read I would need to get the erase firmware file from GHI to get this going but I thought I was smart and had a simple work around to erase the firmware and unlock the chip.

Here is what I did:

The reason the ISP and JTAG are locked is due to the CRP register being set to CRP3 mode. So I firgured this is easy, all I do is use IAP to erase all the flash sectors save for sector 0 which is dubbed the boot sector and is locked from writing using IAP commands.

So I went ahead and prepped sectors 1 - 27 for writing and then erased, and low and behold nothing. The chip is dead. It wasn’t until after I realized my mistake. The CRP register is located at address 0x1FC which is still in sector 0 (The sector you can’t erase using IAP!). So now my secondary bootloader has been blown away (which was my intention), but unfortunately CRP is still enable disallowing me access through ISP or JTAG access.

As far as I understand I have put this chip in an unrecoverable state now, can anyone else comment as to the validity of my assertion? Anyone have an idea of how to get out of this state?

I’m assuming anyone that can help, will know what I am talking about, all the terminology I am using is available in the user manual for the LPC23XX series.


#2

I didn’t know you can’t erase sector0 from IAP! Where did you read this?

Also, with RLP being open to everyone, why are you looking into FEZopen instead of RLP?
RLP gives you the best of all worlds, you get a very stable firmware compiled with RVDS (very expensive compiler), you get all GHI’s exclusive features, and at the same time, you can add whatever drivers you like using GCC (a free compiler). Not only that, you also get “tasks” in RLP which is basically a real-time extension to RLP.


#3

Just the curious type really, with another Panda on the way I thought it would be nice to have a raw ARM dev board as I don’t have one :).

Section 8.3 in the user manual specifies this in the description of the IAP Erase command:

“This command is used to erase a sector or multiple sectors of on-chip flash
memory. The boot sector can not be erased by this command. …”

I am assuming the boot sector is sector 0, I believe sector 0 is where the onboard bootloader that allows for the ISP capability is stored.


#4

It is a special (per request) order from GHI for a blank board.


#5

I was already aware as I stated of this fact, I just thought there should be a simple way of erasing a chip if you knew what you were doing…

Clearly not…


#6

Have you been able to chat to the ISP monitor via UART0 (Flash Magic)?

I looked at this a while back (only have a Domino, so no Panda to test). Table 527 of the LPC23XX user manual (UM10211, Rev. 03) was confusing. It looked like CRP3 disabled ISP override using P2.10, but Mode pin is on P2.3 Without owning a Panda, or able to interrogate it’s ISP, I gave up at that point…


#7

ISP is actually the only method I have of communication at this point as I don’t have a JTAG debugger anyways. I have been unsuccessful over ISP, I did verify I could communicate before doing this by deploying over UART using the mode pin.

Maybe Gus could comment on this but I’m pretty sure the mode pin will only relate to GHI’s bootloader, not the builtin one from NXP which is entered by holding P2.10 pin low during a reset.


#8

Entering the NXP loader is disables at CRP3


#9

Right, as is the source of my problem as I was unable to clear CRP using just IAP. The question was relating to the MODE pin, if it only has an affect on the GHI NETMF bootloader or if there is possibly another feature relating to the chip itself that uses this pin.


#10

MODE is only used in GHI stuff, not NXP


#11

I hate to prolong this thread, but I had a similar plan to Luke’s. That is, when my new batch of Panda IIs is delivered tomorrow, I wanted to use JTAG to wipe one of the “older” Pandas to have a blank board to play with using Crossworks. Is it possible to completely wipe the LPC2387 with JTAG, or is a protection bit set that will prohibit this?
Sorry if this sounds dumb, but I come from PIC where the protection can be overridden by completely wiping the chip.
Yes, it’s a waste of a cute Panda, but doing RLP got me interested in ARM chips, and I have enough of them to sacrifice one. And the Arduino format is really nice. The other commercial boards with LPC are “overloaded”.


#12

You can order from GHI and request that you receive a blank FEZ. Please understand that we only do this to help out as much as we can as GHI’s business is in selling NETMF board. There are plenty of ARM boards out there with JTAG.

And with RLP, you really get the best of both worlds, native and managed all together so you do not even need a blank board unless you want to run Python on the board for example…but still you lose the huge amount of work GHI put into an easy-to-use firmware.


#13

Thanks Gus. I’m not bailing out - as I mentioned I just bought a bunch of new ones. The form-factor is nice, though. Maybe a possible spin-off market for Arduino users. Especially with the great MCI SDCard interface.
I’ll ask my German supplier about this. The customs hassle is always a pain here. Thanks for the help.
The answer then, is that the chip cannot be wiped.