Add NuMicro 8051 ICP programmer #12
Draft
+1,264
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds support for ICP programming Nuvoton NuMicro 8051 chips. It is adapted from my work here.
The reason for ICP programming being used here is that, while Nuvoton chips do have an ISP protocol, it requires an LDROM to be loaded onto the chips first. The chips do not come pre-programmed with that and have to be loaded using an ICP tool, and if we have an ICP tool, we can just program the APROM directly. The LDROM also induces substantial latency when booting, which is not really suitable for our purposes, where the chips may be resetting thousands of times during glitch attempts.
The USB wire protocol implementation here is largely derived from the XPROG one; I've tried to conform to the expectations there (putting all responses in the rambuf, putting all transmitted bulk data into the rambuf before programming, etc.)
Since this requires toggling nRST, this requires that AVR ISP be set first.
This should work for all the chips that are supported for the NuMicro CW308 target board, but I have only tested this with the N76E003, the MS51FB9AE, and the MS51FC0AE.
I have the chipwhisperer userland programmer implementation up here, but I'm going to wait until this gets into naeusb before PRing it.
The reason this is a draft is because there are a couple of points that are marked as TODO:
int N51PGM_init(void)()
, I want to be able to check to see if we are in AVRISP mode and fail if we aren't, but I do not know how to do that from the firmware.NuvoICP_Reentry_glitch()
. What this does is cause the configuration bytes to be loaded at consistent times when entering ICP mode, the idea being that we can potentially glitch a locked chip to boot into ICP mode in an unlocked state. It activates a trigger right before entry (vs. after, because the delay between entry and config load is like two microseconds) so that the config load process can be captured and glitched. However, I don't know how to toggle any of the TIO lines from the firmware, and I don't know if there's a way to manually trigger a glitch from the firmware. Any advice here?