How to re-flash RTL8710BN with Jlink and W25Q64FV memory?

[12345]

H! Anybody had a sucess in re-flash this module with another flash other than the 2MB that comes with the module?
Because it seems that with the tools that come with sdk4.0 only works with 1MB flash ic. Because I can only write flash one time after that it hangs with W25Q64FV. Does it need to change the flash loader? Anybody knows the flash size that is supported in the jlink tools of sdk4.0?

 

[pvvx]

UART ROM-FLASHER , без Jtag.
Alpha-Test version...

MJIOT-AMB-03 FLASH = 2MBytes.

 

[12345]

UART ROM-FLASHER , без Jtag.
Alpha-Test version...

MJIOT-AMB-03 FLASH = 2MBytes.

I have two problems. 1) I use linux. 2)SDK tools (based on Jlink scripts) seens to support only support 1MB and SDK 4.0 can't make a full image (RTL8710BN have a different flash layout than RTL8710A it includes SystemData section and others ) And it's bad that SDK4.0 boot.bin is only 4KB. I had managed to boot the device mixing boot section from the original dump(W25Q16DV) that came with the module with SystemData.
I had written OTA1 and OTA2 generated by sdk4.0 to the standart adress as stated in datasheet. But it refuses to boot correctly. How to check if the images generated by sdk4.0 are valid? What pin on the module do you connect to ground to enter uart-rom boot? With Jlink it seems that I can't erase the flash only write

[inline]
<RTL8195A>
ROM:[V0.1]


FLASHRATE:4


BOOT TYPE:0 XTAL:40000000


IMG1 DATA[1764:10002000]


IMG1 ENTRY[8000353:100021c5]


IMG1 ENTER


read_mode idx:0, flash_speed idx:6


calibration_result:[1:37:19][1:25]


calibration_result:[2:23:13][1:17]


calibration_result:[3:0:0][ff:ff]


calibration_ok:[1:37:19]


FLASH CALIB[NEW OK]


OTA2 ADDR[477083b0]


OTAx SELE[83281a08]


OTA2 USE


OTA2 SIGN[deadbeef:deadbeef]


OTA2 signature wrong, select OTA1


IMG2 DATA[0x800f200:2872:0x10005000]


IMG2 SIGN[RTKWin(10005008)]


IMG2 ENTRY[0x10005000:0x800b12d]


===== Enter Image 2 ====


RTL8195A[HAL]: Hard Fault Error!!!!


RTL8195A[HAL]: R0 = 0x7735940


RTL8195A[HAL]: R1 = 0x0


RTL8195A[HAL]: R2 = 0x46e10


RTL8195A[HAL]: R3 = 0xf000f8df


RTL8195A[HAL]: R12 = 0x0


RTL8195A[HAL]: LR = 0x800b165


RTL8195A[HAL]: PC = 0xf000f8de


RTL8195A[HAL]: PSR = 0x61000200


RTL8195A[HAL]: BFAR = 0xe000ed38


RTL8195A[HAL]: CFSR = 0x1


RTL8195A[HAL]: HFSR = 0x40000000


RTL8195A[HAL]: DFSR = 0x0


RTL8195A[HAL]: AFSR = 0x0


RTL8195A[HAL]: PriMask 0x0


RTL8195A[HAL]: BasePri 0x0


RTL8195A[HAL]: SVC priority: 0x00


RTL8195A[HAL]: PendSVC priority: 0x00


RTL8195A[HAL]: Systick priority: 0x00

[/inline]

 

[pvvx]

What pin on the module do you connect to ground to enter uart-rom boot?]

Pin [inline]A30[/inline] (GPIOA_30)

<RTL8195A>
ROM:[V0.1]
FLASHRATE:4
UARTIMG_Download 2
Open xModem Transfer on Log UART...

 

[12345]

@pvvx HI! Thanks for the rtltool.py! Now I can read / write erase my W25Q64. My only problem now is to load a new application on OTA2 partition. I edited system partition (0x9000) for it load from OTA2 and corrected the flash parameters. I compile the demo that comes with sdk4.0 on realtek_amebaz_example folder and choosed for it make a OTA2 image on application.mk. After making the necessary changes for it, compile on linux it generates image2_all_ota2.bin. But if I load it to 0x80000 and I get the follow log:

I saw UM0111 pdf and it says in one section about Image header. What about the field at 0x0c (adress) because in my generated OTA2 image it is all 00 it could be the same problem? Do you know how this field is generated? I do not know if it's a header problem or application: (

 <RTL8195A>
ROM: [V0.1]


FLASHRATE: 4


BOOT TYPE: 0 XTAL: 40000000


IMG1 DATA [1764: 10002000]


IMG1 ENTRY [8000353: 100021c5]


IMG1 ENTER


read_mode idx: 0, flash_speed idx: 0


calibration_result: [1: 5: 11] [9: d]


calibration_result: [2: 13: 7] [1: d]


calibration_result: [3: 3: 3] [1: 3]


calibration_ok: [2: 13: 7]


FLASH CALIB [NEW OK]


OTA2 ADDR [8080000]


OTAx SELE [fffffff8]


OTA2 USE


OTA2 SIGN [35393138: 31313738]


IMG2 DATA [0x80cb860: 4228: 0x10005000]


IMG2 SIGN [RTKWin (10005008)]


IMG2 ENTRY [0x10005000: 0x808014d]


===== Enter Image 2 ====


RTL8195A [HAL]: Hard Fault Error !!!!


RTL8195A [HAL]: R0 = 0x7735940


RTL8195A [HAL]: R1 = 0x0


RTL8195A [HAL]: R2 = 0x46e10


RTL8195A [HAL]: R3 = 0xf000f8df


RTL8195A [HAL]: R12 = 0x0


RTL8195A [HAL]: LR = 0x8080185


RTL8195A [HAL]: PC = 0xf000f8de


RTL8195A [HAL]: PSR = 0x61000200


RTL8195A [HAL]: BFAR = 0xe000ed38


RTL8195A [HAL]: CFSR = 0x1


RTL8195A [HAL]: HFSR = 0x40000000


RTL8195A [HAL]: DFSR = 0x0


RTL8195A [HAL]: AFSR = 0x0


RTL8195A [HAL]: PriMask 0x0


RTL8195A [HAL]: BasePri 0x0


RTL8195A [HAL]: SVC priority: 0x00


RTL8195A [HAL]: PendSVC priority: 0x00


RTL8195A [HAL]: Systick priority: 0x00
[/ code]

 

[pvvx]

EMW3080
MiCO.iO - 开发者中心，提供全面的物联网开发文档资料 (На других модулях, не EWM3080, данная прошивка требует включения RDP...)

 

[12345]

@pvvx this last firmware (MICO ) have a wrong signature if I use the default bootloader that cames with my module (also editing the img to jump to the correct adress)
I'am writting OTA2 img to 0x08080000 and I edited OTA2 img adress to 20 00 08 08 but it still hard fault
Do you have a working OTA2 img generated by SDK4.0?

 

[pvvx]

OTA адрес бывает разный. Зависит от очень многого.
Прошивки от MICO не стоит писать в свой модуль. Они переписывают eFuse - в них стоит защита от копирования (RDP) и могут убить ваш модуль, если вы в этом не разбираетесь
А файл от MICO привел для примера, где в одной Flash много блоков прошивок.

OTA прошивка собирается со своим *.ld файлом по своим адресам исполнения в Flash (XIP).
Простое перемещение блока ota в flash не годится

Пример сборки sdk4.0 для серии "B" вложен.
Папку mkb необходимо скопировать в директорию самой sdk40b.
Получите оба OTA файла. Но поля размещения в Flash в них не прописаны.

 

[12345]

@pvvx Yes I know about ld placement area... I will have to make a pause on BN series still no luck

 

[pvvx]

@12345 Прописывать адрес в image2_all_ota1.bin/image2_all_ota2.bin не требуется. Работает с 0x00000000. Записывать надо в Flash по адресу в *.ld
Пример сборки с SDK4.0 и записью с rtltool.py - приложен.