Serial Download Protocol (SDP) - program header format?

[mjbcswitzerland]

Hi All

Referring to the Serial Download Protocol (SDP) - reference chapter 9.9.2 in the IMXRT1050RM-Rev.5.
One can load a program to the processor via its write file command (eg writing it to OCR) and then jump to it using its jump_address command.

What is not clear is whether the jum address simply causes the code at the address specied by it to be executed (like setting the PC to the specified address and running) or does it expect the code found at that address to be in a specific format?

In order to check this out I looked at the program that the NXP MCU Bootutility programs using this method when it connects to the MIMXRT1050EVKB but this hasn't answered the question since its content is strange.

1. It loads its code to OCR address 0x20208200
2. At this location one sees that it has

D1 00 20 40 6D B2 21 20 00 00 00 00 00 00 00 00
20 82 20 20 00 82 20 20 00 00 00 00 00 00 00 00
00 82 20 20 48 44 01 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

3. The start of that looks to be like a reset vector (stack pointer + start address) but the stack pointer would be 0x402000d1, which is a non-existent address on the i.MX RT 1052. It is also not useful assembly code if it were the first instruction since it is a register shift command and the following instructions that would follow are also quite meaningless.

4. At 0x2028400 (just after the shown data) one then finds

00 CE 22 20 6D B2 21 20 7B 88 20 20 F1 95 21 20
7B 88 20 20 7B 88 20 20 7B 88 20 20 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 7B 88 20 20
7B 88 20 20 00 00 00 00 7B 88 20 20 7B 88 20 20
EB C3 21 20 EB C3 21 20 EB C3 21 20 EB C3 21 20
EB C3 21 20 EB C3 21 20 EB C3 21 20 EB C3 21 20
EB C3 21 20 EB C3 21 20 EB C3 21 20 EB C3 21 20
EB C3 21 20 EB C3 21 20 EB C3 21 20 EB C3 21 20
EB C3 21 20 EB C3 21 20 EB C3 21 20 EB C3 21 20
87 AC 21 20 95 B2 21 20 9D B2 21 20 A5 B2 21 20
AD B2 21 20 B5 B2 21 20 BD B2 21 20 C5 B2 21 20
CD B2 21 20 D5 B2 21 20 DD B2 21 20 E5 B2 21 20
ED B2 21 20 F5 B2 21 20 FD B2 21 20 05 B3 21 20
0D B3 21 20 15 B3 21 20 EB C3 21 20 EB C3 21 20
EB C3 21 20 EB C3 21 20 EB C3 21 20 EB C3 21 20
EB C3 21 20 EB C3 21 20 EB C3 21 20 EB C3 21 20
EB C3 21 20 EB C3 21 20 EB C3 21 20 EB C3 21 20

which is now a valid reset vector (SP 0x2022ce00) and start address 0x2021b26d. (Note that this address was in fact also at 0x20208204 so the start address appears twice).
Analysing the code starting at 0x2021b26d it is valid code which sets the VTOR to 0x20208400 and sets the stack pointer to 0x2022ce00. Also the addresses after this reset vector are all valid interrupt vector addresses.

Therefore it is seen that a standard reset vector is used (but not a the jump address) but it is not used in the reset vector case since its startup code emulates it by copying the value at 0x20208400 to the SP.

But the question still remains as to "how the jump to 20208200 actually gets the code to start executing at 0x2021b26d" since it can't actually start executing the instruction at 0x2028200?
Then the questions arises as to why there is a block of zeros between the start and the reset vector, with a few values too [such as 48 44 01 00 which happens to be the exact size of the program that was locaed!]?

Is the jump address expected to have some sort of header like this at the start (which is looking very likely) and if so, is it specified somewhere?

Thanks in advance!

Regards

Mark

[jeremyzhou]

Hi @mjbcswitzerland ,
Thank you for your interest in NXP Semiconductor products and for the opportunity to serve you.
To provide the fastest possible support, I'd highly recommend you to refer to the post.
Have a great day,
TIC

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[mjbcswitzerland]

Update:
https://www.nxp.com/docs/en/nxp/application-notes/AN12238.pdf
Here I see that it is an IVT boot header. Therefore the question is probably answered.

Regards

Mark