`program-mec16xx`¶

CLI reference¶

glasgow run program-mec16xx¶

Read and write Microchip MEC16xx/MEC16xxi embedded controller integrated Flash via the JTAG interface.

This applet has been tested and works correctly on Lenovo Thinkshield-branded MEC1663 (2024 january). This applet was originally developed to support MEC1618/MEC1618i, however the latest changes and fixes have not yet been tested on this device.

Per the MEC16xx datasheets, the minimum JTAG frequency should be 1 MHz.

There are two types of erase operations that can be performed:

Emergency erase: It erases both the flash and eeprom (if the device has an eeprom), using a special JTAG sequence, which may work even in the case of boot code corruption
Non-emergency erase: (see commands erase-flash and erase-eeprom). This uses normal flash or eeprom controller commands to perform the erase, but if the target is protected, then it might fail.

Typical flash sizes:

192KiB: MEC1609(i), MEC1618(i), MEC1632, MEC1633
256KiB: MEC1663

To avoid data loss when the flash size is not known for certain, we recommend attempting to read 256KiB flash image, and analyzing the content.

usage: glasgow run program-mec16xx [-h] [-V SPEC] [--tck PIN] [--tms PIN]
                                   [--tdi PIN] [--tdo PIN] [--trst PIN]
                                   [-f FREQ] [--scan-ir-max-length LENGTH]
                                   [--scan-dr-max-length LENGTH]
                                   [--ir-lengths IR-LENGTH,...]
                                   [--tap-index INDEX]
                                   OPERATION ...

-h, --help¶: show this help message and exit

-V <spec>, --voltage <spec>¶: configure I/O port voltage to SPEC (e.g.: ‘3.3’, ‘A=5.0,B=3.3’, ‘A=SA’)

--tck <pin>¶: bind the applet I/O line ‘tck’ to PIN (default: ‘A0’, optional)

--tms <pin>¶: bind the applet I/O line ‘tms’ to PIN (default: ‘A1’, optional)

--tdi <pin>¶: bind the applet I/O line ‘tdi’ to PIN (default: ‘A2’, optional)

--tdo <pin>¶: bind the applet I/O line ‘tdo’ to PIN (default: ‘A3’, optional)

--trst <pin>¶: bind the applet I/O line ‘trst’ to PIN (optional)

-f <freq>, --frequency <freq>¶: set TCK frequency to FREQ kHz (default: 100)

--scan-ir-max-length <length>¶: give up scanning IRs longer than LENGTH bits (default: 128)

--scan-dr-max-length <length>¶: give up scanning DRs longer than LENGTH bits (default: 1024)

--ir-lengths <ir-length,...>¶: set IR lengths of each TAP to corresponding IR-LENGTH (default: autodetect)

--tap-index <index>¶: select TAP #INDEX for communication (default: select only TAP)

glasgow run program-mec16xx emergency-erase¶

usage: glasgow run program-mec16xx emergency-erase [-h]

-h, --help¶: show this help message and exit

glasgow run program-mec16xx erase-eeprom¶

usage: glasgow run program-mec16xx erase-eeprom [-h]

-h, --help¶: show this help message and exit

glasgow run program-mec16xx erase-flash¶

usage: glasgow run program-mec16xx erase-flash [-h] [-f] [-s FLASH_SIZE_BYTES]

-h, --help¶: show this help message and exit

-f, --force¶: force erasing the flash even if parts of it can’t be erased due to security settings

-s <flash_size_bytes>, --size-bytes <flash_size_bytes>¶: size of the embedded flash memory in bytes (typically 192K or 256K; a K suffix means multiply by 1024)

glasgow run program-mec16xx read-eeprom¶

usage: glasgow run program-mec16xx read-eeprom [-h] FILE

file¶: write eeprom binary image to FILE

-h, --help¶: show this help message and exit

glasgow run program-mec16xx read-flash¶

usage: glasgow run program-mec16xx read-flash [-h] -s FLASH_SIZE_BYTES [-f]
                                              [-b]
                                              FILE

file¶: write flash binary image to FILE

-h, --help¶: show this help message and exit

-s <flash_size_bytes>, --size-bytes <flash_size_bytes>¶: size of the embedded flash memory in bytes (typically 192K or 256K; a K suffix means multiply by 1024)

-f, --force¶: force reading the flash even if it would result in an incomplete image due to security settings

-b, --burst¶: use burst read for speed. this may be unreliable on some MEC16xx variants

glasgow run program-mec16xx reset-quick-halt¶

usage: glasgow run program-mec16xx reset-quick-halt [-h]

-h, --help¶: show this help message and exit

glasgow run program-mec16xx security-status¶

usage: glasgow run program-mec16xx security-status [-h]

-h, --help¶: show this help message and exit

glasgow run program-mec16xx test-lock-boot-block¶

usage: glasgow run program-mec16xx test-lock-boot-block [-h]

-h, --help¶: show this help message and exit

glasgow run program-mec16xx test-lock-data-block¶

usage: glasgow run program-mec16xx test-lock-data-block [-h]

-h, --help¶: show this help message and exit

glasgow run program-mec16xx unlock-eeprom¶

usage: glasgow run program-mec16xx unlock-eeprom [-h] PASSWORD

password¶: password to try to unlock with

-h, --help¶: show this help message and exit

glasgow run program-mec16xx write-eeprom¶

usage: glasgow run program-mec16xx write-eeprom [-h] FILE

file¶: read eeprom binary image from FILE

-h, --help¶: show this help message and exit

glasgow run program-mec16xx write-flash¶

usage: glasgow run program-mec16xx write-flash [-h] [-f] [-s FLASH_SIZE_BYTES]
                                               FILE

file¶: read flash binary image from FILE

-h, --help¶: show this help message and exit

-f, --force¶: force erasing and writing the flash even if parts of it can’t be written due to security settings

-s <flash_size_bytes>, --size-bytes <flash_size_bytes>¶: size of the embedded flash memory in bytes (typically 192K or 256K; a K suffix means multiply by 1024)