mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-09-09 16:05:59 +00:00
Nemanja Nedeljkovic
b81966c419
The AT32 battery-domain helper at32_bpr_write_dt1() enabled the ERTC (ertcen) but never selected an ERTC clock source (ertcsel stayed NOCLK). Writing the ERTC write-protection register (ERTC->wp) requires the ERTC to be clocked, so with no source the write stalled the APB once the CPU ran at the full PLL clock (288MHz, 144MHz APB); it only survived on the slow HICK clock. The bootrom reaches this via check_goto_flash_mode() -> system_bpr_chk_clear() while reading/clearing the "enter flash mode" magic the OS sets on a software reset. That runs after ConfigSystemClocks() (the button branch needs SpinDelayUs()/the timer clock, so the clock must be up first), i.e. at 288MHz, so the bootrom hung and the device never re-enumerated into the bootloader until a physical USB replug. Fix: select the ERTC clock (HEXT/20, as the tick HAL does) before touching the ERTC registers. HEXT is running by the time this executes, so the wp write no longer stalls. The fix is contained in the AT32 HAL (sys_hw_at32.c, which only builds for AT32/PM5); the shared bootrom flow and its ConfigSystemClocks()-first ordering (needed by AT91/RDV4 SpinDelayUs) are unchanged.