CC1352P: Bootloader protocol for CC1352P. Bootloader stop communication after loading firmware onto flash

Hi Yury,

Could you share exactly what you are doing? How many bytes are you writing to the device, how is the download command formatted etc? Are you getting NACK and ACKs as expected?

Hi M-W,

The sequence is next:

1. Remove last page on flash. It allows run from Bootloader after reset. Boot detects that flash is damaged and runs BootLoader. The backdoor mechanism can not be implemented because no available button that i can use for backdoor.
2. Send 0x55 0x55. Wait for ACK
3. Send command COMMAND_GET_CHIP_ID. Wait for ACK. Read length. Read CRC. Read Data structure (length-2). Check that data are as expected.
4. Send ACK if OK
5. Send command COMMAND_MEMORY_READ with the address to read 0x4003002C. Wait for ACK. Read length. Read CRC. Read Data structure (length-2). Check that flash size is as expected (360448‬ bytes).
6. Send ACK if OK
7. Read bin file. The file size is 360448 bytes. IDE: Code Composer Studio
8. Remove all sectors onto flash COMMAND_SECTOR_ERASE (44 sectors). Wait for ACK and read Status (COMMAND_GET_STATUS) after each sector erasing.
9. Now i am ready to send data. Send Command COMMAND_DOWNLOAD. Data to send: 0B A6 21 00 00 00 00 00 05 80 00. Length, CRC, Command, Start Address 4 bytes, and DataForTransfer (0x58000) MSB first. Wait for ACK
10. Send data:

bytesLeft = 360448;//this is size of file. Code Composer Studio creates bin file with the size of the available flash. (352KB)
dataIdx = 0; 
while(bytesLeft) 
{ 
  bytesInTransfer = min(248, bytesLeft);
  if(!BL_SendData(&fileData[dataIdx], bytesInTransfer)) 
    return FALSE; 
  if(!BL_GetStatus()) 
    return FALSE; 
  bytesLeft -= bytesInTransfer;
  dataIdx += bytesInTransfer;	
}

BL_SendData function prepare buffer, send it to device and wait for ACK.
Data structure to send: FB 34 24 + data. Where 0xFB - length. 0x34 - CRC(unique for each package), 0x24 - Command ID, and data with the length 0xFB-3 .
Last package length is 0x6B with the data length 0x6B-3.

BL_GetStatus() send command COMMAND_GET_STATUS. Wait for ACK. Read length one byte. Read CRC and Read length-2 bytes data. Check that data is 0x40 (COMMAND_RET_SUCCESS) and send ACK to device if OK.

After i am trying to check CRC or reset device, but device is not responding.
For CRC i send to device: 0F AC 27 00 00 00 00 00 05 80 00 00 00 00 00.
Where 0x0F - length. 0xAC - crc. 0x27 - command. 4 bytes - start address. 4 bytes - bytes count(360448), and 4 bytes of zeroes

When i send ACK to device, the buffer to send is 2 bytes:0x00 0xCC

Yury

Hi Yury,

In your use case, is the host another IC or is it an computer? Have you seen this document before?

http://www.ti.com/lit/an/swra466b/swra466b.pdf

Hi M-W,

Host is an computer. Yes Bootloader interface is done according to that document and according to source code from that document.

Now i have checked. sblAppEx.exe demo app from the document and it's working OK with blinky_backdoor_select_btn26x2.bin firmware. I will check why my app is not working 

Config area - last  bytes at bin file from example and my bin file are different. May be need change  Code Composer Studio Settings to change some data at Config area.

Yury