MPC5748G jump address from bootloader to App

barkly_lin · ‎07-25-2018

Hi

I got a bootloader, and application, try to jump from bootloader/main() to application.

What jumping address is correct?

Here is detail configuration of my test environment:

My bootloader:

MEMORY
{

flash_rchw : org = 0x00FA0000, len = 0x4
cpu0_reset_vec : org = 0x00FA0000+0x10, len = 0x4
cpu1_reset_vec : org = 0x00FA0000+0x14, len = 0x4
cpu2_reset_vec : org = 0x00FA0000+0x04, len = 0x4

m_text : org = 0x1000000, len = 1024K
m_vectors_ram : org = 0x40000000, len = 0xC00
m_data : org = (0x40000000+0xC00), len = 768K-0xC00
}

My application:

MEMORY
{

flash_rchw : org = 0x00FA4000, len = 0x4
cpu0_reset_vec : org = 0x00FA4000+0x10, len = 0x4
cpu1_reset_vec : org = 0x00FA4000+0x14, len = 0x4
cpu2_reset_vec : org = 0x00FA4000+0x04, len = 0x4

m_text : org = 0x1100000, len = 2048K
m_vectors_ram : org = 0x40000000, len = 0xC00
m_data : org = (0x40000000+0xC00), len = 768K-0xC00
}

Then I flash both ELF file into flash like this

Now I add jump funciton in bootloader's main() as below:

//Jump to Flash/boot header : 0x00F04000
asm("e_lis %r12,0x00FA");
asm("e_or2i %r12,0x4000");
asm("mtlr %r12");
asm("se_blrl");

Why it does not work? Is jumping address 0x00FA4000 wrong?

Thanks in advance.

cholland · ‎07-25-2018

Ok,

Why it does not work? Is jumping address 0x00FA4000 wrong? Yes. There is only 005A there, not the programs code.

The Bootloader elf file you have in the pic is the project name. It even says "Project".

That being said...

There is a couple of ways to add the Bootloader to the main project. (Lauterbach, etc..)

Compiling multiple projects in S32DS IDE?

Create a .bin from the bootloader. (Almost the same way you create an .srec, except you create a .bin file) (Search for how to create an Srecord)

Then add the following line(s) to the linker file

MEMORY
{

flash_rchw : org = 0x00FC0000, len = 0x4
cpu0_reset_vec : org = 0x00FC0000+0x10, len = 0x4
cpu2_reset_vec : org = 0x00FC0000+0x04, len = 0x4

m_bootloader : org = 0x00FC8000, len = 0x224K /* Bootloader additions */
m_text : org = 0x01000000, len = 1280K
m_data : org = 0x40000000, len = 192K

}

/* Bootloader additions */
TARGET(binary)
INPUT(Serial_Bootloader.bin)
OUTPUT_FORMAT(default)

SECTIONS
{
/* Bootloader additions */
.my_boot :
{
KEEP(Serial_Bootloader.bin (.data))
} > m_bootloader

Of course you will have to copy the .bin to the Apps debug directory, or optionally add search paths to the project.

That will load both the App and bootloader as 1 project.

Now, you need to change the bootheader Jump address location in the App.

(The app will jump to the Apps code, so you have to change it to jump to the Bootloaders Program code)

const uint32_t __attribute__ ((section(".rchw"))) RCHW1 = RCHW_VAL;
#if defined(MPC574xP) || defined(MPC5777C) || defined(MPC577xK)
const uint32_t __attribute__ ((section(".cpu0_reset_vector"))) RCHW2 = (uint32_t)ENTRY_POINT;
#else
#if defined(TURN_ON_CPU0)
const uint32_t __attribute__ ((section(".cpu0_reset_vector"))) RCHW2_0 = (uint32_t)0xFC8000; <-- Change This To jump to bootloader instead of the App
#endif

Ok, so now the boot header will jump to the Bootloader instead of the App.

Now, you want the bootloader to be able to jump to the App.

I am having a bit of trouble with this. It's where I am currently at.

You can look at the registers to see what's going on.

/*********************************************/
/* Run function at address */
//typedef void func(void);
//func* fnPtr = (func*)0x01000000;
//fnPtr();

/*********************************************/
/* Load Address of Reset Vector (Directly) */
__asm__(" e_lis %r3, 0x0100");
__asm__(" e_ori %r3,%r3,0x0000");
__asm__(" se_mtlr %r3");
__asm__(" se_blr");

/*********************************************/
/* Load Address of Reset Vector (Indirectly)
asm("e_lis %r12,0x00FC");
asm("e_or2i %r12,0x0010");
asm("e_lwz %r0,0(%r12) ");
asm("mtlr %r0");
asm("se_blrl");
*/

The Indirect loads the address at offset 0x10.

The direct loads the address directly.
If you look at the memory, you should see something like the following

**********************************************
FLASH BOOT HEADER
[00FC0000] 005A0002 FFFFFFFF FFFFFFFF FFFFFFFF
[00FC0010] 00FC8000 FFFFFFFF FFFFFFFF FFFFFFFF (Jumps to Bootloader code)
[00FC8000] 709FE405 7080C000 70780520 54640010 (Bootloader code)
[01000000] 709FE405 7080C000 70780520 54640010 (Application code)
**********************************************

barkly_lin · ‎07-25-2018

Hi Chris,

I followed instruction to modify *.ld:

MEMORY
{

flash_rchw : org = 0x00FA4000, len = 0x4
cpu0_reset_vec : org = 0x00FA4000+0x10, len = 0x4
cpu1_reset_vec : org = 0x00FA4000+0x14, len = 0x4
cpu2_reset_vec : org = 0x00FA4000+0x04, len = 0x4

m_bootloader : org = 0x00FA0000, len = 1024K
m_text : org = 0x1100000, len = 2048K
m_vectors_ram : org = 0x40000000, len = 0xC00
m_data : org = (0x40000000+0xC00), len = 768K-0xC00
}

TARGET(binary)
INPUT(V31_Bootloader_20180716_Z4_0_Z4_0.bin)
OUTPUT_FORMAT(default)

SECTIONS
{
.rchw :
{
KEEP(*(.rchw))
} > flash_rchw

.cpu0_reset_vector :
{
KEEP(*(.cpu0_reset_vector))
} > cpu0_reset_vec

.cpu1_reset_vector :
{
KEEP(*(.cpu1_reset_vector))
} > cpu1_reset_vec

.cpu2_reset_vector :
{
KEEP(*(.cpu2_reset_vector))
} > cpu2_reset_vec

/* Bootloader additions */
.my_boot :
{
KEEP(V31_Bootloader_20180716_Z4_0_Z4_0.bin (.data))
} > m_bootloader

Then I get this error build the project(release):

:/nxp/s32ds_power_v2017.r1/cross_tools/powerpc-eabivle-4_9/bin/../lib/gcc/powerpc-eabivle/4.9.4/../../../../powerpc-eabivle/bin/real-ld.exe: section .rchw LMA [00fa4000,00fa4003] overlaps section .my_boot LMA [00fa0000,01005e83]
collect2.exe: error: ld returned 1 exit status
make: *** [makefile:74: BlinkingLEDs_20180709_Z4_0.elf] Error 1

I thought that bootloader's boot header and its main code could be located in different part of flash(non-continuously), right?

For example, I allocate flash memory like this:

0x00FA_0000 -> bootloader's boot head

0x00FA_4000 -> app's boot head

0x0100_0000 ~ 0x010F_FFFF, len = 1M -> bootloader

0x0110_0000 ~ 0x011F_FFFF, len = 2M -> BlinkingLEDs app

When system power on, it supposes fnd the first valid boot header at 0x00FA_0000, then boot up from bootloader vector.

Then bootloader can jump to BlinkingLEDs app in main() as below:

asm("e_lis %r12,0x00FA");
asm("e_or2i %r12,0x4010");
asm("mtlr %r12");
asm("se_blrl");

Is it correct?

cholland · ‎07-26-2018

>>I thought that bootloader's boot header and its main code could be located in different part of flash(non-continuously), right?

Correct

I'm not sure, but your bootloader is probably bigger than 4000.

m_bootloader : org = 0x00FA0000, len = 1024K <-- BOOT APPLICATION

flash_rchw : org = 0x00FA4000, len = 0x4 <--- BOOT HEADER

You could trying switching them.

What you could do to just 'get it working' is:

Put the bootheader at FC0000

Put the bootloader at FC8000

Put your App Code at 0x01000000

This shows the bootheader at FC0000

The Reset Vector is at FC0010

The Bootloader is at FC80000

The Applicaiton is at 01000000

barkly_lin · ‎07-30-2018

Hi Chris

Just change bootheader at FC0000, bootloader start address at FC8000.

Bootloader size changed to 128KB

Bootloader Config1..settings\com.freescale.s32ds.cross.wizard.prefs

flashSize=20000
flashStart=FC8000 -> It suppses to be FC8000, not FC80000.

Bootloader Config2.\Project_Settings\Linker_Files\MPC5748G_flash.ld

MEMORY
{

flash_rchw : org = 0x00FC0000, len = 0x4
cpu0_reset_vec : org = 0x00FC0000+0x10, len = 0x4
cpu1_reset_vec : org = 0x00FC0000+0x14, len = 0x4
cpu2_reset_vec : org = 0x00FC0000+0x04, len = 0x4

m_text : org = 0xFC80000, len = 128K

When I try to flash Bootloader release version, it failed.

CMD>EM

Erasing.
Module has been erased.
CMD>PM

Programming.
Processing Object File Data ...

.
Programmed.
CMD>VC
Verifying object file CRC-16 to device ranges ...
block 00FC0000-00FC0003 ...
Ok.
block 00FC0010-00FC0013 ...
Ok.
Checksum Verification Successful. (Cumulative CRC-16=$7586)

CMD>RE

Initializing.
MPC574xC Device detected.
Target has been RESET and is active.

Starting reset script (C:\NXP\S32DS_Power_v2017.R1\eclipse\plugins\com.pemicro.debug.gdbjtag.ppc_1.7.2.201709281658\win32\gdi\P&E\s32e200_mpc574xg.mac) ...
REM This script is compatible with MPC574xG devices.
REM Clean GPRs to remove residual data after using algorithm
REM Initialize all of the Main SRAM - 768KB
Initializing RAM from $40000000 to $400BFFFF.

Reset script (C:\NXP\S32DS_Power_v2017.R1\eclipse\plugins\com.pemicro.debug.gdbjtag.ppc_1.7.2.201709281658\win32\gdi\P&E\s32e200_mpc574xg.mac) completed.

MPC574xG Device detected.
Interrupt command received. Halting execution. -> system stuck here !?

If I change 0x00FC0000 to 0x00FA0000 as below:

flash_rchw : org = 0x00FA0000, len = 0x4
cpu0_reset_vec : org = 0x00FA0000+0x10, len = 0x4
cpu1_reset_vec : org = 0x00FA0000+0x14, len = 0x4
cpu2_reset_vec : org = 0x00FA0000+0x04, len = 0x4

Flash success, why can't I use 0x00FC0000?

Any idea about that?

barkly_lin · ‎07-30-2018

BTW, how do I make sure entire flash memory has been erased when I reprogrammed it?

cholland · ‎07-31-2018

I'm not sure what you mean?

Either the Lauterbach or Multilink debugger will erase, then reprogram the flash.

If you are talking about the Bootloader, you don't want to erase the entire flash memory.

You just want to erase the partitions where the application code is located.

There are utilities and scripts to erase / program flash.

Search for Standard Software Driver v1.1.0

Regards,

barkly_lin · ‎07-31-2018

Hi Chris

Well, I mean flash via S32 DS(Open SDA interface).

I'm wondering if set boot header at 0x00F8_C000, and change it to 0x00FC_0000, will the contain of 0x00F8_C000 also be erased after I do "Flash"?

You mentioned about Standard Software Driver v1.1.0, is it MPC5xxx_EEE_DRIVER.exe?

Thanks,

cholland · ‎08-01-2018

Look here under device drivers

MPC574xB/C/G|32-bit MCU|Gateway|NXP

cholland · ‎08-01-2018

>>Well, I mean flash via S32 DS(Open SDA interface).

I don't know anything a bout Open SDA.

>>You mentioned about Standard Software Driver v1.1.0, is it MPC5xxx_EEE_DRIVER.exe?

No. One is Eeprom Emulation, the Other is Generic Flash manipulation.

Thanks,