Lukas,
I'm still having issues getting serial boot mode to work on a MPC5605B device. When I write a very small piece of code, the RAppID BL Tool works fine, but anything over about 10K of code causes the boot loader to hang and time out before loading finishes. I thought I'd just write my own bootloader, but I seem to be missing some information. The protocol described in the RM doesn't match what the RAppID BL trace window displays. When I load the MCU using the same s-record file to blink the LED, it works when using RAppID BL and loading directly across the JTAG port, cut does not work using my custom bootloader. My bootloader follows the protocol defined in the reference manual, RAppID BL appears to use a different protocol.
From the Reference Manual:
Table 5-8. UART boot mode download protocol
Protocol
step Host sent message BAM response message Action
1 64-bit password(MSB first) 64-bit password Password checked for validity and compared against
stored password.
2 32-bit store address 32-bit store address Load address is stored for future use.
3 VLE bit + 31-bit number of bytes(MSB first)
VLE bit + 31-bit number of bytes (MSB first)
Size of download are stored for future use.
Verify if VLE bit is set to 1
4 8 bits of raw binary data 8 bits of raw binary data 8-bit data are packed into a 32-bit word. This word is
saved into SRAM starting from the “Load address”.
“Load address” increments until the number of data
received and stored matches the size as specified in the
previous step.
5 None None Branch to downloaded code
RAppID BL doesn't have an option to simply program SRAM. Erase and Program is the only option for loading code into the processor. Skipping past the section in the trace window that's doing "BTL" (by the way - what's BTL?) the trace window has the following:
TX: 01 00 00 00 aa aa aa aa
RX: ff 00 00 fe 00 00 00 00 Init
TX: 02 01 00 00 40 00 01 00
RX: ff 00 01 fe 00 00 00 00 Erasing
TX: 10 02 00 00 02 e0 aa aa
RX: ff 00 02 fe 00 00 00 00 Erasing
TX: 22 03 02 36 02 47 02 58
^ My code starts here and continues on the subsequent lines
RX: ff 00 03 00 40 00 01 0C
The first two bytes transmitted by RAppID appear to be some sort of header, with the second byte being a counter that increments with each message. Is the first byte a command byte? If so, what does it mean? (All of the "command bytes" while the app is being uploaded are 22.)
The reference manual indicates that whatever the host sends to the MCU, is echoed back. This does not appear to be what is happening with the RAppID BL tool as can be seen in the records copied from the trace window above.
(From reference manual):
“The communication is done in half duplex manner, whereby the transmission from the host is followed by the microcontroller transmission mirroring the transmission back to the host:
— "If data is correct, the host can continue to send data.
— "If data is not correct, the host stops transmission and the microcontroller enters static mode.”
The last messages transmitted by the RAppID BL, copied from the trace window are here:
TX: 22 56 00 00 00 00 00 00 APP 99%
TX: 22 57 00 00 00 00 00 00 APP 99%
TX: 22 58 00 00 00 00 00 00 APP 100%
TX: 22 59 00 00 00 00 00 00 APP 100%
TX: 22 5A 00 00 FF FF FF FF APP 100%
TX: 20 5B 08 40 00 01 00 AA Start Application
I can't find any documentation for the last transmitted message that says "Start Application" Where is information available about this?
When my simple bootloader program executes, it transmits the data as described in the reference manual, and the data goes across and is reflected back, but it doesn't branch to the start address once the last data byte has been transmitted.
Is there a document that describes what the RAppID BL tool is transmitting, the protocol it is using, and what the extra bytes (command? Counter?) transmitted are? Is more information available than what is in the reference manual about serial boot mode? I have and have read the manual embedded in RAppID BL tool. I'd be happy to use the RAppID tool if it didn't crash (always with a timeout error message) before it finishes loading.
Here are my questions:
The following was snipped from the RAppID BL trace window across the transition from "BTL" to loading the App:
TX: 00 00 00 00 BTL 99%
TX: 00 00 00 00 BTL 99%
TX: 00 00 00 00 BTL 99%
TX: 00 00 00 00 BTL 100%
TX: 01 00 00 00 AA AA AA AA
RX: FF 00 00 FE 00 00 00 00 Init
TX: 02 01 00 00 40 00 01 00
RX: FF 00 01 FE 00 00 00 00 Erasing
TX: 10 02 00 00 02 E0 AA AA
RX: FF 00 02 FE 00 00 00 00 Erasing
TX: 22 03 02 36 02 47 02 58 APP 0%
TX: 22 04 78 00 00 A7 78 00 APP 0%
TX: 22 05 01 19 18 21 06 F8 APP 0%
TX: 22 06 48 00 D0 01 2C 00 APP 1%
TX: 22 07 D1 01 78 00 00 AD APP 1%
I'm using an XPC56XX EVB Motherboard and an XPC560B daughtercard with an SPC5605B processor on it.
thanks,
ken