cc26xx ROM bootloader COMMAND_MEMORY_READ

Hi Maciek,

Did you follow the procedure under 'To successfully receive a packet, the following steps must be performed:" in 8.2.1 Packet Handling?

Best wishes

Hi,
my apologizes for late reply... but there were some important issues.

Yes, I did follow the instruction from 8.2.1, except I didn't wait indefinitely... I just waited until timeout. I mean, I waited for ACK to the COMMAND_MEMORY_READ which I received after quite long time and then waited until timeout for response (sending 0s) but nothing has been sent back by the bootloader. I will extend the timeout to see what happens.

Thanks

There is no need to wait indefinitely, as you see in step 4 a COMMAND_MEMORY_READ gives back an ACK and then a response almost immediately. Note that also you should ACK the response from the bootloader when it returns data from the command.

If you are not seeing anything then the bootloader state is probably out of sync with your program from some previous read/write attempts.

Regards,
Svend

Hi Svend,

yup, I thought so too, that tere is no need to wait indefinitely, until I tried to use this command.

Just want to highlight that writing to flash works OK, then reading CRC32 of the stored flash image too, as presented on the screen shots below:

Seding COMMAND_CRC32

reception of ACK from boot and the calculated CRC32:

Here is what I got while sending COMMAND_MEMOERY_READ right after COMMAND_CRC32 - reading from flash address 0x00000000:

above command has been ACK-nowledged by the ROM-boot after ~12ms:

and there is no response, even though I was sending zero byte indefinitely.

This command reads from a specified memory mapped start address, therefore it should bepossible to read from flash, as it is possible to write there.

Regards,

Maciek

Hi Svend,

I Like your waveform, but i have question about Step 3 and Step 4.
if i used COMMAND_DOWNLOAD to DOWNLOAD Flash image (*.Bin),
Can i use COMMAND_MEMORY_READ to Read Flash image??

Because i need Read Flash to check COMMAND_DOWNLOAD is success,
or i need have other way to check Flash image??

Best Regard,
Miller

Maciek,

The images you have provided are too small to view properly. Can you modify your post with larger images?
.:svend

Miller,

You can either use COMMAND_READ or COMMAND_CRC32.
The fastest way (for mass production) would be to read back the CRC checksum and compare to a computer-side generated checksum to validate that programming worked.

.:svend

Hi Svend,

Thank for your answered.
but,
The bootloader chapter of the TRM (SWCU117) have no complete information about COMMAND_MEMORY_READ

Can i get more detail information about COMMAND_MEMORY_READ??
Ex :
The specified "Access Type" must be either 0 or 1.
____The value of 0 forces 8-bits read accesses.
____The value of 1 forces 32-bits read accesses.
The specified "Number of Accesses" gives the number of 8- or 32-bits read accesses.
____Max value for Number of Accesses is 63 for Access Type = 1.
____Max value for Number of Accesses is ???? for Access Type = 0.

Can i Read 256 Byte From Flash image by send once COMMAND_MEMORY_READ??
what packet format of bootloader response ?? (about COMMAND_MEMORY_READ)

I have trouble. (i use SSI Interface)

When i Send COMMAND_MEMORY_READ to Bootloader :  09  5C  2A  20  00  10  00  01  01 (refer picture)

i get Response : ACK (0xCC)

and get Data : 06  49  5D  92  99  C1

But, when i Send COMMAND_MEMORY_READ to Bootloader :  09  44  2A  18  00  00  00  01  01 (refer picture) 

i get Response : NACK (0x33)

and get Data : 00 00 00 00 00 00

Why can't i Read Address 0x18000000 Data ??

Because the bootloader chapter of the TRM (SWCU117) account of that the flash starts at address 0x1800 0000(on CC26xx).

so I need Download Flash image (*.Bin) to cc26xx (Start Addr 0x1800 0000) by bootloader,

What different about   COMMAND_DOWNLOAD + COMMAND_GET_STATUS  and  COMMAND_MEMORY_WRITE??

Best Regard,
Miller

Hi Miller,

The missing memory read / write functions will be added. For now you can find them below. Note that the TRM command numbers for memory write/read is incorrect, the correct ones are found in my previous post.

COMMAND_MEMORY_READ
This command reads a specified number of elements with a specified access type (8- or 32 bits) from a specified memory mapped start address and returns the read data in a separate communication packet. The requested amount of data must be less than the max size of a communication packet.
The specified Access Type must be either 0 or 1. The value of 0 forces 8-bits read accesses. The value of 1 forces 32-bits read accesses.
The specified Number of Accesses gives the number of 8- or 32-bits read accesses.
Max value of Number of Accesses is 253 for Access Type = 0.
Max value for Number of Accesses is 63 for Access Type = 1.

The format of the packet including the command is as follows:

unsigned char ucCommand[9];
ucCommand[0] = <size=9>;
ucCommand[1] = <checksum>;
ucCommand[2] = COMMAND_MEMORY_READ;
ucCommand[3] = Memory Map Address [31:24];
ucCommand[4] = Memory Map Address [23:16];
ucCommand[5] = Memory Map Address [15:8];
ucCommand[6] = Memory Map Address [7:0];
ucCommand[7] = Access Type [7:0];
ucCommand[8] = Number of Accesses [7:0];

COMMAND_MEMORY_WRITE
This command writes the received data in accesses with specified width (8- or 32 bits) from a specified memory mapped start address. Data to be written must be contained in same packet as the command.
The access width is given by the specified Access Type. The Access Type must be either 0 or 1. The value of 0 forces 8-bits write accesses. The value of 1 forces 32-bits write accesses
The number of data bytes received is given by the packet size byte. Max number of data bytes for access width 0 is 247 and 244 for access width 1.
Note that this command will not succeed writing to any flash or OTP memory.

The format of the packet including the command is as follows:

unsigned char ucCommand[(From 9 to 255)];
ucCommand[0] = <size=(From 9 to 255);
ucCommand[1] = <checksum>;
ucCommand[2] = COMMAND_MEMORY_WRITE;
ucCommand[3] = Memory Map Address [31:24];
ucCommand[4] = Memory Map Address [23:16];
ucCommand[5] = Memory Map Address [15:8];
ucCommand[6] = Memory Map Address [7:0];
ucCommand[7] = Access Type [7:0];
ucCommand[8] = Data [7:0];
.
.
ucCommand[9 + (packet size - 9)] = Data [7:0] or Data[31:24];

Hi svendbt,

i have another question that at previous post

Best Regard,
Miller

Miller Guo said:

Because the bootloader chapter of the TRM (SWCU117) account of that the flash starts at address 0x1800 0000(on CC26xx).

This is not correct, we will have that fixed. The boot loader is partially re-used from CC2538 and it seems the documentation was not updated for the CC26XX. Sorry about that.

Miller Guo said:

Why can't i Read Address 0x18000000 Data ??

Because 0x18000000 is not a valid address. Flash starts at 0x00000000, RAM starts at 0x20000000, peripherals start at 0x40000000.

Miller Guo said:

What different about   COMMAND_DOWNLOAD + COMMAND_GET_STATUS  and  COMMAND_MEMORY_WRITE??

CMD_MEMORY_WRITE cannot write to flash but will only do direct accesses using the CPU. This means you can write to e.g. system SRAM, memory mapped peripherals etc.

Regards,

Svend

Hi svendbt,

Thank you very much for your answers.
I finally get address 0x0000 0000 Data that was downloaded(COMMAND_DOWNLOAD + COMMAND_GET_STATUS).

Best Regard,
Miller

Hi svendbt,

Thank you very much for your answers.
I can get address 0x0000 0000 Data that was downloaded(COMMAND_DOWNLOAD + COMMAND_SEND_DATA).
I use CCS 6.1.0.

What Flash address range About cc2650 ?? (Start at 0x00000000~0x0001FFFF??)

Now, i want to update Flash Image via COMMAND_DOWNLOAD + COMMAND_SEND_DATA.
But, what file format i can download to flash directly?? (*.out ?? , *.hex?? , *.Bin?? or other)
....
I use Project SimpleBLEPeripheral and SimpleBLEPeripheralStack,
and go to options and check the box for .hex file. ( check "口Enable ARM Hex Utility" )
I can get two (*.hex) file from CCS6.1.0 after built,
but, the two (*.hex) file data are different with data that read from Flash by COMMAND_MEMORY_READ (From Addr 0x0000 0000).
Why ??
...
How can i get correct file to update Flash Image ??
Even, have i send wrong address??


Best Regard,
Miller

Miller Guo said:

What Flash address range About cc2650 ?? (Start at 0x00000000~0x0001FFFF??)

Correct.

Miller Guo said:

Now, i want to update Flash Image via COMMAND_DOWNLOAD + COMMAND_SEND_DATA.

But, what file format i can download to flash directly?? (*.out ?? , *.hex?? , *.Bin?? or other)

You could use a clear-text file such as Intel HEX, merge the two HEX files from application and stack with a script or manually (remove the end of file entry from the first file) and convert the "super-hex" to a binary file with a tool such as Hex2bin (http://hex2bin.sourceforge.net/).

Then you parse your data with your bootloader program and flash the device with this.

Miller Guo said:

I can get two (*.hex) file from CCS6.1.0 after built,
but, the two (*.hex) file data are different with data that read from Flash by COMMAND_MEMORY_READ (From Addr 0x0000 0000).

The Intel Hex file is encoded. More info here: http://en.wikipedia.org/wiki/Intel_HEX

Regards,

Svend

Hi svendbt,

Thank you very much for your answers.

But, i am having a big trouble now.

When i Follow this operational process:

Step 1. Send COMMAND_READ_MEMORY to Read Flash Data (0x0000 0000~0x0001 FFFF), and saved as "A File (*.Bin, 128KB)".

Step 2. Send COMMAND_Bank_Erase to Erase Flash.

Step 3. Send COMMAND_DOWNLOAD + COMMAND_SEND_DATA to Download  "A File (*.Bin, 128KB)"  to Flash (0x0000 0000~0x0001 FFFF).

Then, CC2650 did not respond any information, even ACK and NAK.

...

i try to used SmartRF Flash Programmer 2 1.5 to erase Flash, But was Failed.

Status : 

>Initiate access to target: XDS-06EB12200F93A.
>Failed to read target memory.
>Error while reading memory range. Address 0x40091090.
>Start flash erase ...
>Unable to halt target CPU
>Reset target ...
>Reset of target successfull.

...

And Then, i try to used CCS6.1.0 to debug (download), i get Failed Information. 

i found that i maybe set All CCFG to 0x00 (0x0000 0000 ~ 0x0001 F000), When i send COMMAND_DOWNLOAD + COMMAND_SEND_DATA.

i guess that is why error happened.

How can i rebuild cc26xx ??

...

When i send COMMAND_READ_MEMORY to Read Addr 0x0001 D000~0x0001 DFFF, 

Why is i always get different data at fragmentary Address??

...

Best Regard,

Miller

Can you try updating to the latest Smart RF Flash Programmer 2 (v1.6) and test again? Also, make sure you have the physical reset pin connected to the debugger for Halt-In-Boot to work properly.

If you fill in CCFG with zeroes and don't have a program in the flash the vector table at start of flash will contain only FF's. This is not a memory mapped location and the Cortex M3 will trigger a Hard Fault exception and consequently go into lockup since the Hard Fault vector is also only FF's.

Svend

Hi Svend,

i used SmartRF Flash Programmer 2 (v1.6) to erase Flash again, But was still Failed.

(i try to implement at other SmartRF06 Evaluation Board that are same fail )

 

Status :
>Initiate access to target: XDS-06EB122024CDA.
>Failed to read target memory.
>Error while reading memory range. Address 0x40091090.
>Start flash erase ...
>Unable to halt target CPU
>Reset target ...
>Reset of target successfull.

...

Just Like You Said.

if i fill in Flash (0x0000 0000 ~ 0x0001 F000) with correct Data; but fill in CCFG with zeroes (0x0001 F000 ~ 0x0001 FFFF),
(When i send COMMAND_DOWNLOAD + COMMAND_SEND_DATA.)

Then, the Cortex M3 will trigger a Hard Fault exception and consequently go into lockup.

This is means that the cc26xx was can't do anything even download flash imgae??

Can i rescue cc26xx from Failed??  if yes, How??

...

Best Regard,

Miller

Hi Miller,

If you fill the -entire- CCFG with zeroes then you have:

- Locked down all JTAG DAP/TAPs
- Disabled boot loader
- Locked erase/write access to all flash pages
- Many other configuration bits are set to a wrong value.

You have unfortunately bricked the device to a non-recoverable state.

I highly recommend filling in CCFG with the data created from the application image.
When you create a normal application HEX file then the example CCFG settings will be a part of this image. It will probably be a good idea to include this in your bootloader flashing.

Regards,
Svend

Hi svendbt,

Thank you very much for your answers.

Best Regard,
Miller

i have the same problem.......is it solved?

Bijendra,

Please start a new post with your questions. This thread contains a lot of information and from your post it is not possible to understand what your issue is.

Thanks,
Svend