NXP Semiconductors MPC5566, Reference Manual

Page: 674 / 1268

Boot Assist Module (BAM)
MPC5566 Microcontroller Reference Manual, Rev. 2
Freescale Semiconductor 16-15
Each step of the process must complete before the next step starts.
1. Download the 64-bit password.
The host computer must send a FlexCAN message with ID = 0x011 that contains the 64-bit serial
download password. FlexCAN messages with other IDs or fewer bytes of data are ignored. When
a valid message is received, the BAM transmits a FlexCAN message with ID = 0x001 that
contains the data received. The host must not send a second FlexCAN message until it receives the
echo of the first message. A FlexCAN message sent before the echo is received is ignored.
The 64-bit password is validated to ensure that none of the four 16-bit halfwords have a value of
0x0000 or 0xFFFF, which are invalid passwords. A valid password must have at least one 0 and
one 1 in each halfword lane.
The BAM program then reads the disable Nexus bit [DISNEX] in the SIU_CCR register to
determine the censorship status of the MCU. If Nexus is disabled, the MCU is censored and the
password is compared to a password stored in the shadow row in internal flash memory.
If Nexus is enabled, the MCU is not censored or booting from external flash and the password is
compared to the constant value = 0xFEED_FACE_CAFE_BEEF.
If the password fails any validity tests, the MCU stops responding to all stimulus. To repeat boot
operation, the MCU needs to be reset by external reset or by watchdog. If the password is valid,
the BAM program refreshes the e200z6 watchdog timer and the next step in the protocol can be
performed.
2. Download the start address, VLE bit, and the download size.
The host computer must send a FlexCAN message with an ID = 0x012 that contains:
— 32-bit start address in internal SRAM indicating where to store the succeeding data in memory;
— 32-bit number containing a 1-bit variable length encoded (VLE) flag followed by a 31-bit
length field that contains the number of data bytes to receive and store in memory before
switching to execute the code just loaded.
The start address is expected on a 32-bit word boundary, therefore the least significant 2 bits of the
address are ignored. FlexCAN messages with other IDs or fewer data bytes are ignored.
Set the VLE bit in the serial download data (most significant bit in the LENGTH word) if the code
to download uses VLE instructions.
When a valid message is received, the BAM transmits a FlexCAN message with an ID = 0x002
that contains the received data. The host computer must not send another FlexCAN message until
it receives the echo from the previous message. A FlexCAN message sent before the echo is
received is ignored.
3. Download the data.
The host computer must send a succession of FlexCAN messages with ID = 0x013 that contains
raw binary data (the data length is variable). Each data byte received is stored in MCU memory,
starting at the address specified in the previous step and incrementing through memory until the
number of data bytes received and stored in memory matches the number specified in the previous
step. FlexCAN messages with ID values other than 0x013 are ignored.
When a valid message is received, the BAM transmits a FlexCAN message with an ID = 0x003
that contains the data received. The host computer must not send another FlexCAN message until