MPC5516 Flash Programming Through Nexus/JTAG

[trevorlin]

Hi all,

I'am currently working on a project on an mpc5516 microcontroller.

after reference AN3283 ( MPC5500 Flash Programming Through Nexus/JTAG )

I have complete basic function ( include single step, GPR access, SPR access, OnCE Memory Access ).

but I have problem about run H7F SSD .

1. initial MMU

2. Initial SRAM

3. upload Standard Software H7F Driver to internal SRAM .

   ( I chose VLE type driver )

4. verify H7F driver whether correct or not ?

   ( in this step , all of data are same as previous upload )

5. pointer R1 to stacktop

6. pointer R3 to SSD_flashconfig

7. pointer PC to FlashInit address minus 4

8. start GO and Exit by OnCE Command 

9. polling E200z1 core return to debug mode .

   at this time, e200z1 doesn't return to debug mode .

If anyone has experience about this issue, please help us to solves this issue.

Thanks a lot,

Trevor

[danmaneu]

Hello, I have a similar issue - FlashInit for VLE (from Standard Software C90LC Driver v1.0.4/xPC567xK_C90LC/driver/vle/s-record_driver) has se_blr instruction at the end:

 

What is the best way to handle this?

[lukaszadrapa]

Hi,

I have already met this problem. See the text below that I wrote some time ago. It refers to e200z0 but it doesn't matter:

The code shown below is at the end of all flash driver functions:

if (pSSDConfig->BDMEnable)

{

     #ifdef VLE_ASM

          asm ( "se_sc " ); /* generate system call interrupt */

     #else

          asm ( "sc " );

     #endif

}

The "se_sc" causes the e200z0 core to take IVOR8 interrupt. For external debug tools - flash programming routines, the "se_sc" can be replaced by all zeroes instruction opcodes (se_illegal or bkpt = all binary zeroes psedo-insturction). So, replace the "se_sc" instruction near the end of the function with the "0x0000" or alternatively, initialize IVPR and IVOR8 registers to point to a location in the SRAM where you have 0x0000. Actually, IVOR8 on e200z0h is fixed to 0x80, so initialize the IVPR in such a way that at the address (IVPR || 0x080) there is the all zeroes instruction opcode. In external debug mode, execution of 0x0000 opcode causes the MCU to enter Debug Mode. (OCR[FDB] must be set and DBCR0[EDM] must be set). Refer to 8.4.7.5 in the e200z0 Power Architecture Core Reference Manual. Another option is to configure instruction breakpoint at address (IVPR || 0x080). This will also cause the core to enter Debug Mode upon execution of "se_sc".

Notice that se_sc (or sc) is not the last instruction in C-array. Actually the C code at the end of FlashInit looks like this: …

if (pSSDConfig->BDMEnable)

     { //asm ( "mr r3,returnCode" ); /* save the return code to R3 */

     #ifdef VLE_ASM

          asm ( "se_sc " ); /* generate system call interrupt */

     #else

          asm ( "sc " );

     #endif } return

     returnCode;

}

If I disassemble this code (I simply put the code into new CodeWarrior project) then it gives this result:

00000020: 0002 se_sc

00000022: 481F se_li r31,1

00000024: 01F3 se_mr r3,r31

00000026: 51810014 e_lwz r12,20(rsp)

0000002A: 7D8FF120 mtcrf 0xff,r12

0000002E: C7F1 se_lwz r31,28(rsp)

00000030: C6E1 se_lwz r30,24(rsp)

00000032: C901 se_lwz r0,36(rsp)

00000034: 0090 se_mtlr r0

00000036: 21F1 se_addi rsp,0x0020

00000038: 0004 se_blr

So, the position of "0002" is a few words before the end of c-array.

Hope this will help.

Best Regards,

Lukas

[rebecca_l_oostd]

Hi Lukas,

I'm looking at the c-array (non-VLE) version of FlashInit, and I see a 0x00000000 toward the end of the array:

const unsigned long FlashInit_C[]  =
{
0x9421FFF0, 0x93E1000C, 0x83E30000, 0x80BF0000, 0x54AA0673
, 0x4182000C, 0x3BE00020, 0x480000E8, 0x54BF97BF, 0x4182000C
, 0x8183000C, 0x818C00E0, 0x38C00000, 0x90C30018, 0x90C3001C
, 0x54A6677E, 0x28060004, 0x7CAC28F8, 0x558CB73A, 0x7FFF6378
, 0x40800010, 0x39800002, 0x7D863030, 0x48000030, 0x2C060004
, 0x4082000C, 0x38C0000A, 0x48000020, 0x2C060005, 0x4082000C
, 0x38C0000C, 0x48000010, 0x2C060006, 0x4082000C, 0x38C00006
, 0x90C30014, 0x54AC00C7, 0x41820034, 0x54AC010F, 0x41820018
, 0x3D800005, 0x91830008, 0x39600004, 0x91630018, 0x48000054
, 0x3D800002, 0x91830008, 0x39600004, 0x91630014, 0x48000040
, 0x54ABD29A, 0x3CCB0004, 0x3C800004, 0x7C062040, 0x90C30008
, 0x40810010, 0x54AC8FBC, 0x398C0002, 0x91830018, 0x3D800008
, 0x7C066040, 0x40810010, 0x3D86FFF8, 0x558C7C7E, 0x9183001C
, 0x81830024, 0x387F0000, 0x83E1000C, 0x38210010, 0x2C0C0000
, 0x41820008, 0x00000000, 0x4E800020
, 0x4D504348, 0x37467846, 0x49333233

}; /* Total Size = 76 words */

I'm having the same problem as the previous poster on an MPC5566 with e200z6 core. I've verified that the FlashInit array has been written to the MPC5566's RAM, as well as ssdConfig, but calling Go+Exit OnCE command and polling the OSR for debug mode never returns. The OCR[FDB] was set too. Is there something else I'm missing?

Thanks in advance!