LPC1756 SBL fails to flash

[lpcware]

Content originally posted in LPCWare by robertpalmerjr on Fri Nov 14 08:25:51 MST 2014
I'm using an LPC1756 and adding an SBL, starting with the AN11258 (I2C secondary boot loader)

I started with the Slave SBL firmware.  This is the piece that executes on boot and will check whether or not there is user code.  I have not incorporated the user code yet.

The project builds fine but when I try to flash the AFX file to the chip, it fails, every time.  From LPCXpresso, I tried using the both debug (with program before debug) and the flashing tool that is built in.  Both fail at the very end of the flashing process, as soon as it exits reset.

I was able to track it down to the SBL_APICall.  If I comment out this call, it will flash correctly and I can even debug it.  I have validated that the SBL will receive a user code image, write that user code image to FLASH and execute the user code image.

However, as soon as I uncomment the SBL_APICall, it fails (falls into one of the exception handlers) as soon as the FLASHing is done and it exits reset.

Here is the original source code for the call (with these lines in, SBL FLASH fails, with them out, SBL FLASH succeeds):

__SECTION(text_Flash_SBL_API, SBL_APICall) void SBL_APICall(uint32_t API, uint8_t* pData) {
    SBL_APICall_Handler(API, pData);
}

Here is the disassembly output from the .lss file

Disassembly of section .text_Flash2:

00000ff0 <SBL_APICall>:
 *                      In case the SBL_CMD_HANDLER_FUNC is called, It should be 
 *                          the received command over bus. 
 * @return       None.
 **********************************************************************/
__SECTION(text_Flash_SBL_API, SBL_APICall) void SBL_APICall(uint32_t API, uint8_t* pData) {
    SBL_APICall_Handler(API, pData);
 ff0:f7ff bacb b.w58a <SBL_APICall_Handler>

It appears that the correct brach instruction is getting put into the correct location in memory.

Here is my memory map (properties -> C/C++ Build -> MCU Settings):

Flash     Flash_SBL         Flash     0x00000000     0x00000ff0
Flash     Flash_SBL_API     Flash2    0x00000ff0     0x00000010
RAM       RamLoc16          RAM       0x10000000     0x00003c00
RAM       RAM_FWDAT         RAM2      0x10003c00     0x00000400
RAM       RamAHB16          RAM3      0x2007c000     0x00004000

I compared the .bin file from the two versions (one with and one without the SBL_APICall).  They are identical up to the point of between the end of the main code and the SBL_APICall.  The version WITH the call is filled with 00's up to 0xFF0 and then has the SLB_APICall code at 0xFF0.

Should the fill be 0xFF's instead of 0x00's?

What is going wrong or what should I be looking at/looking for?  I'm obviously missing something, but just can't figure out what.

Thanks,
Robert

[lpcware]

Content originally posted in LPCWare by robertpalmerjr on Fri Nov 14 12:18:44 MST 2014
Here is the flash programming command:
crt_emu_cm3_nxp -g -2 -vendor=NXP -pLPC1756 -s250 -flash-load-exec "<path>/Release/Bootloader.axf"

It fails with error code 138

Here is the output of the flash programming:

Ni: LPCXpresso Debug Driver v5.2 (Apr 26 2013 19:51:18 - crt_emu_cm3_nxp build 1153)
Pc: (  0) Reading remote configuration
Nc: Looked for chip XML file in /Applications/lpcxpresso_5.2.4_2122/lpcxpresso/bin/LPC1756.xml

Nc: Looked for vendor directory XML file in /Applications/lpcxpresso_5.2.4_2122/lpcxpresso/bin/nxp_directory.xml

Nc: Found generic directory XML file in /Applications/lpcxpresso_5.2.4_2122/lpcxpresso/bin/crt_directory.xml

Pc: (  5) Remote configuration complete
Pc: ( 30) Emulator Connected
Pc: ( 40) Debug Halt
Pc: ( 50) CPU ID
Nc: Emu(2): Conn&Reset. DpID: 2BA01477. Info: FTWN9IJGA
Nc: SWD Frequency: 250 KHz. RTCK: False. Vector catch: False.
Nc: Packet delay: 0  Poll delay: 0.
Nc: Loaded LPC175x_6x_256.cfx: LPC175x_6x (256K) Apr 22 2013 12:14:30  On-chip Flash Memory

Nc: NXP: LPC1756  Part ID: 0x00000000
Pc: ( 65) Chip Setup Complete
Nt: Connected: was_reset=false. was_stopped=false
Cr:v Registered license, download limit of 128K
Pc: ( 70) License Check Complete
Nt: Loading ELF file 'Bootloader.axf' at location 00000000
Nt: Writing 3576 bytes to 0000 in Flash (assumed clock: 4.0MHz)
Pb: 1 of 1 (  0) Writing pages 0-0 at 0x00000000 with 3576 bytes
Ps: (  0) Page  0 at 00000000
Ps: (  0) Page  0 at 00000000: 3576 bytes
Nt: Erased/Wrote page  0-0 with 3576 bytes in 1053msec
Pb: (100) Finished writing Flash successfully.
Nt: Flash write Done
Nt: Loading ELF file 'Bootloader.axf' at location 00000FF0
Nt: Writing 4 bytes to 0FF0 in Flash (assumed clock: 4.0MHz)
Pb: 1 of 1 (  0) Writing pages 0-0 at 0x00000FF0 with 4 bytes
Ps: (  0) Page  0 at 00000FF0

So it appears that the first part writes correctly, but that the last 4 bytes don't.  Do flash write requests have to being on a page boundary?  Should these last 4 bytes be combined into the same write as the first 3576 bytes?