CRP Unbricking

Due to its popularity, this page has been moved and renamed so that is addresses other ways our users have found to brick their mbeds!





6 comments:

25 Feb 2011

Hi Chris,

Thank you so much for this post, this is exactly what I am looking for!!!!

I have some questions about the steps for connecting ISP to ground:

1. Are those two pads circled, one nRESET and one ISP?

2. What does the shorting do, setting ISP or nRESET to some value? Shall I short the pads first, then plug the USB cable? Or plug the USB cable, then short the pads? How about the time for shorting, just connect the two pads once, or keep for some time?

3. What does the second step do, set ISP low? Shall I keep the top pad circled connecting with GND DIP during the whole time of unbricking (including the time of communicating with teraterm), or just connect once is ok? How about the USB cable in this step, keep it connected or disconnect it?

Chris, sorry for these basic questions. I do not have any experience on hardware before, and I tried many times, but still not succeed. When typing ? in teraterm, there is no response. So I think I must have made some mistake in the steps of setting the ISP mode.

Thanks very much!

Regards, Jessamine

27 Feb 2011

Hi Chris,

I am colleague of Jessmine. This wiki page is really helpful for us.. Thanks so much!

Following the above instruction, We entered the ISP mode and executed those commands to erase flash. But when execute "E 0 26", get a error code 19(CODE_READ_PROTECTION_ENABLED) returned. I also tried with "E 1 26", it returns 0. So it seems that sector 0 are not allowed to be erased.

As described in "ISP Erase sector command" in user manual: <This command is used to erase one or more sector(s) of on-chip flash memory. This command is blocked when code read protection level CRP3 is enabled. When code read protection level CRP1 is enabled, individual sectors other than sector 0 can be erased. All sectors can be erased at once in CRP1 and CRP2.>

I think that "CRP3" level is enabled on our board.. Do you have any idea on this case?

Thank you, Chris.

Regards, -Jin

28 Feb 2011

Hi Chris,

As Jin said above, we can erase "E 1 26", but when run "E 0 26", CODE_READ_PROTECTION_ENABLED will be returned. Is this a phenomenon of CRP3 enable? If it is, then we will give up.

If it is not a phenomenon of CRP3 enabled, then do you have any idea on why this happened, or how to solve it?

According to user manual. "CPR3 is similar to CRP2, but ISP entry by pulling P2.10 LOW is disabled if a valid user code is present in flash sector 0." Does this mean we even are not able to enter the ISP mode, if CRP3 is set?

Thank you very much!

Regards, Jessamine

27 Mar 2011

Hi All,

I have only just seen your comments.

CRP3 is the highest level of security and is permanent. Once you have enabled it, there is no way of going back. Sorry!

Thanks, Chris

13 May 2011

Hi Chris,

I have just received my new mbed (it says 'mbed-005.1' on the PCB).

I've been trying to get it to run the ISP bootloader, as per the above instructions.

However, after I short the two contacts as shown in the instructions, I plug in the USB cable but the board never goes into the ISP bootloader.

I have also tried the second method of using the jumper, but that fails too.

Every time I try this, the mbed presents its USB Disk to the PC. I guess if it got into the ISP bootloader, I would not get this behaviour?

Might it be possible that because I have a newer board, I will have to get into the ISP bootloader via some other method?

Cheers, Daniel

13 Jan 2012

There is an error in the WiKi. When CRP2 is enabled for example, you need to prepare and erase sectors 0 to 29 and not 0 to 26 like its described there. Otherwise the command isn't accepted. Despite to my earlier experiences with mbed CRP usage it seems that with the current one I am using, its not possible to use CRP at all. You can unbrick the device if CRP1 or CRP2 is set, but the CRP protected code does not start on power up. It seems that the new JTAG programming firmware does not take the LPC1768 out of reset or the bootloader is called by ISP pulling low when the JTAG is non accessible. I only read that when there is no binary on the disc this should happen, but now this seems to be true that you can't enter protected code. Does anyone know something about ?