Freescale Semiconductor Application Note Document Number: AN2295 Rev. 13, 10/2013 Developer’s Serial Bootloader by: Pavel Lajsner, Pavel Krenek, Petr Gargulak 1 Project objectives The developer's serial bootloader offers to user easiest possible way how to update existing firmware on most of Freescale microcontrollers in-circuit.
Project objectives modifications to be done in-circuit. The serial bootloader offers a zero-cost solution to applications already equipped with a serial interface and SCI pins available on a connector.
FC protocol description • • 1.3 implements all features as simply as possible, excluding checksums, and so forth. The target size is less than 500 B for the 8-bit MCUs. The USB version of bootloaders included drivers for the communication over the USB. For this bootloaders is needed 8KB memory available (HCS08JM and MCF51JM). The Kinetis K and L series have a similar sizes (less than 2 KB).
FC protocol description The following is a simplified state diagram that shows separate states of the bootloader, which is described in this document: POWER-ON RESET SOURCE TEST RESET HOOK-UP COMMUNICATION USER TIME-OUT CODE CALIBRATION QUIT COMMANDS ERASE READ WRITE IDENT Figure 2. Simplified flow diagram of the bootloader application 2.1 Initial hook-up Several methods can be used to enter bootloader mode. Several other solutions use a “certain level on certain pin” method.
FC protocol description characters can be interpreted differently instead of original 0xFC sent out by the PC (Figure 3). The 0xFC pattern check on the MCU side can be eliminated completely, which saves MCU memory.
FC protocol description If the MCU transmits to the PC at an unmatched data rate, the PC receives (and accepts) characters that are different from the 0xFC character. The PC accepts all characters from the mentioned set (0xFF, 0xFE, 0xFC, 0xF8, 0xF0, 0xE0, 0xC0, 0x80, and 0x00). If a character is received, an ACK is immediately sent back to the MCU. After the MCU recognizes this answer, it enters the next phase, Slave frequency calibration. 2.2.
FC protocol description PC ACK IS SENT AT UNCERTAIN DATA RATE HOOK-UP TIME-OUT zero pulse NO-ZERO TIME-OUT break NO-BREAK TIME-OUT ACK CALIBRATION UNSUCCESSFUL OR ONLY ROUGH CORRECTION DONE zero pulse CALIBRATION SUCCESSFUL NO-BREAK TIME-OUT ACK NO-ZERO TIME-OUT MCU break FROM NOW ON, THE COMMUNICATION IS AT THE CORRECTLY SPECIFIED DATA RATE ACK IS SENT AT CORRECT DATARATE ACK ONLY 0XFC CHARACTER CAN BE RECEIVED Figure 4.
FC protocol description 2.4 Interpreting MCU commands After communication between MCU and PC is established, then MCU enters the main command interpreter loop. The MCU executes simple commands to reprogram its own nonvolatile memory. The communication is conducted on a master-slave mechanism: the PC issues the commands, the MCU executes them and acknowledges the completion of each command either by data or single ACK character.
FC protocol description This command is immediately issued by the PC after communication is established. The purpose of the ident command is to notify the PC about several basic properties of the MCU being programmed. All multibyte fields are sent with MSB first. • Version number and capability table - 1 byte BIT 7 RCS 6 CRCS 5 4 RESERVED 3 2 1 0 VERSION NUMBER Figure 7. Version number and capability table • • • • 2.4.
FC protocol description PC TO MCU COMMAND I ($49) VERSION AND CAPS. START END BOOTLOADER MEM MEM USER TABLE INTERRUPT ERASE VECTOR TABLE BLOCK SIZE WRITE BLOCK SIZE BOOTLOADER DATA ID STRING 0 CRC MCU TO PC RESPONSE Figure 8. Ident command (FC protocol version 1, M68HC08) 2.4.3 FC protocol version 2 (HCS08) and FC protocol version 3 (large M68HC08) Version 2 of the protocol is for HCS08 MCUs; version 3 is for large M68HC08 (HC08 with two or more FLASH memory banks).
FC protocol description 2.4.4 Erase command The erase command (coded as ‘E’, $45) has only address field, length or data fields are not present. The start address is a 2-byte field, MSB first. If the CRC capability of serial protocol is enabled, then the 16 bits(2 bytes) follows with CRC-CCITT checksum. The MCU erases the address block where the specified address resides. The length of block to be erased is equal to the erase-block size (typically depends on hardware).
FC protocol, version 1, M68HC908 implementation The MCU sends this number of read bytes to the PC. If the CRC capability of serial protocol is enabled, then the 16 bits(2 bytes) follows with CRC-CCITT checksum. PC TO MCU COMMAND R ($52) START ADDRESS LENGTH CRC BINARY DATA MCU TO PC RESPONSE CRC Figure 12. Read command 2.4.7 Quit command The quit command (coded as ‘Q’, $51) has no address or data fields. Execution of bootloader code is immediately finished, and the user code is started.
FC protocol, version 1, M68HC908 implementation 0xFFFF INTERRUPT VECTOR TABLE 0xFFDC UNIMPLEMENTED AREA 0xFE00 THIS AREA OF FLASH IS PROTECTED USING FLBPR REGISTER BOOTLOADER CODE 0xFCC0 BOOTLOADER USER TABLE 0xFC80 FLASH MEMORY AVAILABLE ON MC68HC908KX8 MCU FLASH MEMORY AVAILABLE FOR USER CODE FREE MEMORY AREA FOR USER CODE 0xE000 UNIMPLEMENTED AREA 0x0100 RAM 0x0040 I/O REGISTERS 0x0000 Figure 14. Simplified example of memory allocation in MC68HC908KX8 3.
FC protocol, version 1, M68HC908 implementation • • • • • • 3.3 $FC80 - Address of Bootloader user table. $FFDC - Start address of MCU interrupt vector table. $0040 - Length of MCU erase block. $0020 - Length of MCU write block. 0,0,0,0,0,0,0,0 - Bootloader data. No strictly defined syntax; different M68HC08 implementations provide different values (for example, the sixth value in the MC68HC908KX8 implementation is the value of the internal clock generator [ICG] trim register after calibration).
FC protocol, version 1, M68HC908 implementation INTERRUPT VECTOR TABLE RESET VECTOR 0xFFFE INTERRUPT VECTOR 1 0xFFEC INTERRUPT VECTOR 2 0xFFEA INTERRUPT VECTOR 3 0xFFE8 BOOTLOADER CODE 0xFE00 ... 0xFFE0 INTERRUPT VECTOR 16 0xFFDE INTERRUPT VECTOR 17 EXIT ... 0xFFDC START BOOTLOADER USER TABLE 0xFCC0 JMP USER INT. VECT. 17 0xFD00 0xFCBB JMP USER INT. VECT. 16 0xFCB8 ... 0xFC84 JMP USER INT. VECT. 3 0xFC81 JMP USER INT. VECT. 2 0xFC8E JMP USER INT. VECT.
FC protocol, version 1, M68HC908 implementation 3.3.1 S19 file Because the bootloader operation must be transparent to the user S19 file, another piece of intelligence is built into the PC master code (instead of the MCU slave). The relocation works as follows: If the data from an S19 record corresponds to an address in the interrupt vector table, the value is relocated into the corresponding area in the bootloader user table, including a JMP instruction (opcode $CC).
FC protocol, version 1, M68HC908 implementation 3.5 M68HC08 system limitations This section summarizes limitations that must be considered when using the bootloader with the user application. 3.5.1 Memory occupied One of the most important requirements is to use the smallest code possible. Typical M68HC908 implementations are between 300 to 500 bytes, including the bootloader user table.
FC protocol, version 2, HC9S08 implementation with an external voltage, VTST, present on the IRQ pin (normal monitor mode). Because this feature is completely dedicated to bootloader code protection, it is unavailable to the user application code. If the value for FLPBR appears in the user S19 code, a warning is displayed. Such an occurrence should be omitted from user S19 code. Some families have the FLASH block protection register stored in RAM instead (the MC68HC908JK/JL Families are like this).
FC protocol, version 2, HC9S08 implementation 0xFFFF INTERRUPT VECTOR TABLE 0xFFC0 NONVOLATILE REGISTERS 0xFFB0 THIS AREA OF FLASH IS PROTECTED BOOTLOADER CODE 0xFE00 RELOCCTOR TABLE 0xFDC0 FLASH MEMORY AVAILABLE ON MC9S08GB/GT60 MCU FLASH 58772 BYTES 0x182C FLASH MEMORY AVAILABLE FOR USER CODE HIGH PAGE REGISTERS 0x1800 FLASH 1920 BYTES 0x1080 RAM 0x0080 I/O REGISTERS 0x0000 Figure 16. Simplified example of memory allocation in MC9S08GB/GT60 4.
FC protocol, version 2, HC9S08 implementation • • • • • • • • • 4.
FC protocol, version 2, HC9S08 implementation INTERRUPT VECTOR TABLE RESET VECTOR (bootloader start) 0XFFFE BOOTLOADER CODE 0XFFB0 START original interrupt vector table is empty (unused) its content is relocated EXIT 0XFFC0 0XFE00 RELOCATED INTERRUPT VECTOR TABLE RESET VECTOR INTERRUPT VECTOR 1 INTERRUPT VECTOR 2 INTERRUPT VECTOR 3 0XFDFE 0XFDEC 0XFDEA 0XFDE8 ... 0XFDC4 INTERRUPT VECTOR 30 INTERRUPT VECTOR 31 0XFDC2 0XFDC0 USER CODE START (RESET) INTERRUPT ROUTINE 1 INTERRUPT ROUTINE 2 ...
FC protocol, version 2, HC9S08 implementation of the bootloader code. This allows the transparent operation of all other resets (such as illegal address and so forth) with only a small additional delay caused by testing of the SRS register and executing associated jump instructions. 4.5.2 Hardware reset In some implementations, pin reset (caused by external reset pin) is a valid source of reset for the bootloader to start.
FC protocol, version 3, large M68HC08 implementation 5 FC protocol, version 3, large M68HC08 implementation This section describes features specific to the protocol version 3 of the bootloader. This is intended for large HC08s (with two or more FLASH memory banks or, more precisely, with two or more separated FLASH memory areas). The format of the Ident command from version 2 is used; the rest remains same as with protocol version 1 (HC08) namely Interrupt vector table relocation.
FC protocol, version 4, ColdFire (V1) 0x0001FFFF BOOTLOADER 0x001FB000 USER FLASH 120 KB Nonvolatile registers INIT_SP RESET_APP FLASH MEMORY AVAILABLE FOR USER CODE FLASH MEMORY AVAILABLE ON MCF51JM128 0x00000410 0x00000400 Flash memory 0x000001C0 INTERRUPT VECTOR TABLE INIT_SP RESET_BL 0x00000000 Figure 18. Simplified Example of Memory Allocation in MCF51JM128 6.1.1 Memory allocation The bootloader code occupies the top of the FLASH memory (the highest memory address space).
FC protocol, version 4, ColdFire (V1) • • • • • • • $00410 - Start address of reprogrammable area #2 $1FAFF - End address of reprogrammable area #2 + 2 $00000 - Address of the relocated interrupt vector table (value 0 means not allocated) $00000 - Start address of the MCU interrupt vector table (value 0 means not allocated) $00400 - Length of the MCU erase blocks $00080 - Length of the MCU write blocks ‘MCF51xxxx/USB’ - Identification string, zero terminated.
FC protocol, version 4, ColdFire (V1) starts instead of the bootloader code. This allows the transparent operation of all other resets with only a short additional delay caused by testing of the SRS register and executing associated jump instruction. 6.1.5 ColdFire system limitations This section summarizes the limitations that must be considered when using the bootloader with the user application. 6.1.5.1 Memory occupied One major thing is to use the smallest code possible.
FC protocol, version 4, ColdFire (V1) 0x0001FFFF FLASH MEMORY AVAILABLE FOR USER CODE FLASH 120 KB FLASH MEMORY AVAILABLE ON MCF51JM128 0x00003800 RELOCATED INTERUPT VECTOR TABLE 0x00003000 BOOTLOADER CODE Nonvolatile registers INTERRUPT VECTOR TABLE 0x00000410 THIS AREA OF FLASH IS PROTECTED 0x00000400 0x00000000 Figure 20. Simplified example of memory allocation in MCF51JM128 version B 6.2.
FC protocol, version 4, ColdFire (V1) • • • • • $03000 - Address of the relocated interrupt vector table. $001BC - Start address of the MCU interrupt vector table. $00400 - Length of the MCU erase blocks. $00080 - Length of the MCU write blocks. ‘MCF51JM128/USB’ - Identification string, zero terminated. Information to be displayed on the PC screen. 6.2.4 Limitations This section summarizes the limitations that must be considered when using the bootloader with the user application. 6.2.4.
FC protocol, version 4, ColdFire (V1) The following figure represents the interrupt vector table relocation explanation (ColdFire V1 - B): INTERRUPT VECTOR TABLE INIT SP RESET_Bootloader 0X00000004 BOOTLOADER CODE ADDR. OF INTERRUPT VECTOR 3 ADDR. OF INTERRUPT VECTOR 4 0x0410 START ADDR. OF INTERRUPT VECTOR 5 ADDR. OF INTERRUPT VECTOR 110 EXIT 0x000001BC ADDR. OF INTERRUPT VECTOR 111 0x2FFF RELOCATED INTERRUPT VECTOR TABLE 0x00003800 JMP USER INT. VECT. 111 JMP USER INT. VECT. 110 ...
FC protocol, version 5, Kinetis 7 FC protocol, version 5, Kinetis This section describes features specific to the protocol Version 5 of the bootloader. This was created for a better compatibility with new Kinetis families of the MCUs. Protocol 4 for the ColdFire MCUs version B (protected version) is the basis for the Kinetis protocol version 5. The bootloader for the Kinetis MCUs includes an additional capability for CRC control.
FC protocol, version 5, Kinetis Kinetis K60 Example of modification ICF file in IAR6.4 // default linker file define symbol __ICFEDIT_region_ROM_start__ define symbol __code_start__ = 0x00000410; = 0x00000000; // modified linker file for Kinetis K60 with 512KB flash memory define symbol __ICFEDIT_region_ROM_start__ = 0x00004000; define symbol __code_start__ = 0x000004400; Example of modification LCF file in CodeWarrior 10.2 # Default linker command file.
FC protocol, version 5, Kinetis 7.2 Interrupt vector table redirection The FLASH block protection technique also protects the interrupt vector table from being overwritten, so some method must be used to relocate these vectors to the different locations. To do this, the bootloader user table is used.
FC protocol, version 5, Kinetis • • • • • • • • 7.
FC protocol, version 5, Kinetis INTERRUPT VECTOR TABLE 0x00000000 INIT SP RESET Bootloader 0x00000004 BOOTLOADER CODE 0x410 Bootloader START BOOTLOADER INTERRUPT VECTOR TABLE PROTECTED EXIT Redirection 0x000001C0 USER CODE 0xd00 0x4400 - 0x7FFFF USER APPLICATION 0x00004400 APPLICATION INTERRUPT VECTOR TABLE 0x00004000 Figure 25. Interrupt Vector Table Relocation Explanation for Kinetis (Version 5) 7.7 Correct setting of configuration file Bootloader configuration file bootloader_cfg.
FC protocol, version 5, Kinetis /** USER SETTINGS OF KINETIS MCU */ /** Kinetis ARM Cortex-M4 model */ //K10_50MHz K11_50MHz K12_50MHz K10_72MHz K10_100MHz K10_120MHz //K20_50MHz K21_50MHz K22_50MHz K20_72MHz K20_100MHz K20_120MHz //K30_72MHz K30_100MHz //K40_72MHz K40_100MHz //K50_72MHz K51_72MHz K50_100MHz //K60_100MHz K60_120MHz //K70_120MHz /** Kinetis ARM Cortex-M0+ model */ //KL0_48MHz //KL1_48MHz //KL2_48MHz KL25_48MHz #define KINETIS_MODEL K60_100MHz /* the /* // // in the case of using USB VIRTUA
FC protocol, version 5, Kinetis Number of UART & GPIO pin for receiver (Rx) #define BOOT_UART_GPIO_PIN_RX 17 Number of UART & GPIO pin for transmitter (Tx) #define BOOT_UART_GPIO_PIN_TX 16 /**************************************************/ /* Actual used PIN reset setting */ #define BOOT_PIN_ENABLE_PORT_BASE PORTC_BASE_PTR #define BOOT_PIN_ENABLE_GPIO_BASE PTC_BASE_PTR #define BOOT_PIN_ENABLE_NUM 9 Following macros allows using of voluntary bootloader features: Read command feature allows to check th
MCU slave software – The MCU with bigger/equal flash than 64 KB (2048 B flash protection block): In this case the start of the user application should start on the second protection block plus vector table size. The vector table basically should be placed on the start of second protection block. – The MCU with smaller flash than 64KB: In this case the user application should start on 0x800 with interrupt vectors and the application follows above the interrupt table.
MCU slave software . FLASH Memory Use (in Bytes) Clock Source ROM Routines Usage Calibration Conducted Table 2. Target implementation comparison SCI MC68HC908AP AP8/AP16/ AP32/AP64 592 32768 Hz XTAL or external clock. Yes, different version No Hardware 512 64 MC68HC908AB/AS/AZ AB32/AS32/AZ32 AS60/AZ60 640 4.9152MHz XTAL No No Hardware 128 64 MC68HC908EY EY16 384 ICG Yes Yes Hardware 64 32 512 32768 Hz XTAL or external clock.
MCU slave software FLASH Memory Use (in Bytes) Clock Source ROM Routines Usage Calibration Conducted Table 2.
MCU slave software FLASH Memory Use (in Bytes) Clock Source ROM Routines Usage Calibration Conducted Table 2. Target implementation comparison (continued) SCI MCF51AC128 MCF51AC256 1116 MCG No No Hardware 1024 128 MCF51AG96 MCF51AG128 1120 ICS No No Hardware 1024 128 MCF51EM128 MCF51EM256 1284 ICS No No Hardware 1024 128 MCF51JM64 MCF51JM128 1116 MCG No No Hardware 1024 128 MCF51JM64 MCF51JM128 8000 12MHz external clock No No USB 2.
MCU slave software The on-chip FLASH programming routines simplify the bootloader and improve memory usage. The communication between the MCU and PC uses a Standard Serial Channel (SCI).
MCU slave software 8.1.1 Internal Clock Generator (ICG) — initialization The ICG is simple to initialize because the ICG is active and the clock monitor is disabled after reset. The only action required is the modification of ICG multiply register. Then, the ICGS flag (bit 2) of the ICG control register indicates whether the ICG is stable after the frequency change. ICGMRINIT LOOP: 8.1.2 EQU MOV BRCLR $20 #ICGMRINIT,ICGMR 2,ICGCR,LOOP ; set 9.
MCU slave software TXA BEQ FAST: CMP BGE ASLA ADD BRA SLOW: CMP BLT ASLA SUB ICGDONE: STA OOR: RTS SLOW #$40 OOR #$80 ICGDONE #$C0 OOR ;FEW CYCLES THAN EXPECTED, SO TRIM BY SPEEDING ;UP f OP .
MCU slave software RESET NOT POR SRSR RESET SOURCE TEST USER CODE START POR CAUSED RESET MCU CONFIG ... EXECUTE ILLEGAL OPERATION SEND ACK AND WAIT FOR ANSWER TIMEOUT EXPIRED YES ? NO ...
MCU slave software 8.2.1 Software-SCI transmit char routine A detailed description of the software-SCI transmit and receive subroutines is provided in this section. They both are based on a 16-bit timer and the output-compare event is polled in the background loop.
MCU slave software ;******************************************************************************************* SCITX: PSHH PSHX BCLR LDHX STHX BSET BCLR 7,TSC ONEBIT TMOD 4,TSC 5,TSC ; and clear TOF MOV BRA #9,BITS SCITX1 ; number of bits + 1 ; jump to loop LSRA BCC DATALOW ; clear timer ; run timer TXDCLR SCITX2: ; shift out lowest bit TXDSET SKIP2 DATALOW: TXDCLR BCLR SCITX1: BRCLR DBNZ ; skip next two bytes 7,TSC 7,TSC,SCITX1 ; and clear TOF ; wait for TOF BITS,SCITX2 ; and loop for next
MCU slave software ENTER INITIALIZE AND FEED 16-BIT TIMER WITH 1.5 BIT TIME WAIT FOR TIMER FLAG WAIT FOR RXD LOW TIMER FLAG RECEIVED? RXD LOW ? NO YES NO SHIFT-IN RECEIVE CHAR AND CLEAR MSB YES RUN TIMER RXD PIN IS SET SET OR CLEAR? SET BIT COUNTER TO 9 SET MSB CLEAR FEED 16-BIT TIMER WITH 1 BIT TIME CLEAR TIMER FLAG DECREMENT BITS AND TEST? =0 STOP TIMER EXIT Figure 30. Software-SCI receive char routine Developer’s Serial Bootloader, Rev.
MCU slave software ;******************************************************************************************* SCIRX: BRRXDLO SCIRX ; loop until RXD high (idle) SCIRXNOEDGE: PSHH PSHX BCLR 7,TSC ; and clear TOF LDX LDA LSRX RORA STX STA ONEBIT ONEBIT+1 BSET 4,TSC TMODH TMODL ; clear timer SCIRX1: BRRXDHI SCIRX1 ; loop until RXD low (wait for start bit) BCLR MOV 5,TSC #9,BITS ; run timer ; number of bits + 1 7,TSC,SCIRX2 ; wait for TOF SCIRX2: BRCLR LSRA BRRXDLO RXDLOW ORA #$80 RXDLOW: LDHX
MCU slave software SKIP1 MACRO DC.B ENDM $21 ; BRANCH NEVER (saves memory) SKIP2 MACRO DC.
MCU slave software 8.3 MC68HC908GP On-chip FLASH programming routines are not available in MC68HC908GP MCU. Therefore, all FLASH programming must be done by the bootloader, as demonstrated in this section. MC68HC908GP MCUs are primarily targeted for use with a low-cost 32.768 kHz crystal. Because the frequency of the crystal is known, no calibration is performed, which saves MCU memory. Therefore, this MCU uses the Known MCU communication speed method.
MCU slave software RESET SRSR RESET SOURCE TEST NOT POR USER CODE START POR CAUSED RESET MCU CONFIG ICG, SCI INIT EXECUTE ILLEGAL OPERATION SEND ACK AND WAIT FOR ANSWER ACK RECEIVED YES BEFORE TIMEOUT NO SEND ACK 1 WAIT FOR COMMAND 2 YES IDENT? NO YES SEND IDENT DATA 2 ERASE? NO WRITE? YES RECEIVE ADDRESS CALL ERASE NO READ? YES NO QUIT? NO YES RECEIVE ADDRESS RECEIVE ADDRESS RECEIVE LENGTH RECEIVE LENGTH RECEIVE DATA SEND DATA 2 ROUTINE IN ROM COPY ERASE COPY WRITE ROU
MCU slave software • • ERASE_ALG — whole FLASH erase routine WR_ALG — whole WRITE erase routine Because the flow is straightforward, no flowchart is provided. Basically, the sequence of events is executed according to FLASH erasing/programming specifications.
MCU slave software LDA STA D_US LDHX TXS LDHX MOV WR_ALG_L1: PULA STA AIX D_US DBNZ #%00001001 FLCR #T5US ; set HVEN, keep PGM ; wait 5us #DAT ; prepare addresses ADRS LEN,POM X #1 #T30US POM,WR_ALG_L1 ; wait 30us ; copy desired block of data LDA STA D_US #%00001000 FLCR #T5US ; keep HVEN, PGM off ; wait 5us CLRA STA D_US FLCR #T1US ; HVEN off ; wait 1us RETWR ; finish with ACK (& restore STACK before) JMP WR_ALG_END: END Figure 34.
MCU slave software MC68HC908GP and MC68HC908GR MCUs are primarily targeted for use with a low-cost 32.768 kHz crystal. Because the frequency of the crystal is known, no calibration is performed, which saves MCU memory. Therefore, these MCUs use the Known MCU communication speed method. 8.5 MC68HC908MR MC68HC908MR MCUs are motor-control oriented members of the M68HC08 Family. The MC68HC908MR MCUs have no on-chip FLASH programming routines available.
MCU slave software 8.7.2 Single-Wire communication Because of the small number of pins on MC68HC908QT devices, the single-wire SCI version has been developed to keep the number of pins occupied by communication to a minimum. Figure 36 illustrates an example single-wire RS-232 interface. The single-wire option has been ported to MC68HC908JK/JL and MC68HC908LB bootloader because they also use a software SCI. VDD 10k RXD RS-232 CONNECTION TTL/232 SHIFTER MC68HC908QT/QY MCU TXD Figure 36.
MCU slave software 8.9 MC68HC908AP MC68HC908AP devices are members of the M68HC08 Family that have two SCIs (the SCI channel must be selected at compile time). MC68HC908AP MCUs have ROM on-chip FLASH programming routines available. The calling convention is slightly different from other M68HC08s (same as MC68HC908LJ devices). Because of the internal oscillator’s simplicity, it does not have the accuracy and stability of the RC oscillator or the XTAL oscillator.
PC bootloader master software required for USB are also inside the JW32 folder of the AN2295SW software package. Alternatively, the latest on-line version of the PC drivers is available on the ZSTAR summary page (RD3152MMA7260Q). NOTE Although serial COM emulation on the JW32 has been successfully tested in Linux, a Linux port of hc08sprg executable of the AN2295 bootloader master was not tested together with theJW32 bootloader USB implementation. 8.
PC bootloader master software The following figure displays the bootloader master flowchart: START NO ENOUGH ARGUMENTS ? X(0) CALIBRATE MCU YES OK? INIT UART NO CHECK S19 IMAGE TO FIT X(4) YES OK? NO X(1) DISPLAY WARNING IF NOT READ MCU INFO YES SURE? OPEN S19 FILE OK? NO X(5) OK? X(2) PROGRAM MCU PRINT MCU INFO YES OK? WAIT (HOOK) FOR MCU RESET OK? NO SET UP INTERRUPT VECTOR TABLE X(3) YES X($FF) YES YES NO NO OK? NO NO X(8) YES UNHOOK MCU CLOSE UART X(6) YES EXIT
PC bootloader master software • 9.2 — hc08sprg.h — main.c M68HC(S)08, ColdFire and Kinetis specific programming files: — prog.c 8-Bit and 32-Bit MCU image operations To perform the necessary operations with the code, the master software keeps a binary image of the memory. In addition, it stores the information about whether an actual byte is to be programmed into the MCU is stored.
PC bootloader master software 9.3 UART manipulations In seriallinux.c or serialw32.c, depending on the platform used, the following UART manipulation functions are defined: int int int int int int init_uart(char* nm); close_uart(void); send_break10(void); flush_uart(int out, int in); wb(const void* data, unsigned len); rb(void* dest, unsigned len); The pair int init_uart(char* nm) and int close_uart(void) manage opening (initialization) and closing of the specified UART port.
PC bootloader master software void CRC_AddByte(unsigned short *pCrc, unsigned char data) void CRC_AddWord(unsigned short *pCrc, unsigned short data) void CRC_Add3Bytes(unsigned short *pCrc, unsigned long data) void CRC_AddLong(unsigned short *pCrc, unsigned long data) void CRC_AddByteArray(unsigned short *pCrc, unsigned char* data, int size) void CRC_AddString(unsigned short *pCrc, unsigned char* str) void CRC_ResetCRC(unsigned short *pCrc, unsigned short seed) unsigned short CRC_GetCRC(unsigned short *pCrc
Master applications user guides int read_blk(unsigned adr, int len, BYTE *dest) int prg_blk(unsigned a, int len) The actual implementation is straightforward and follows the rules described in Interpreting MCU commands. 9.6.7 Main programming loop The core of the bootloader’s programming capabilities is implemented in the function int prg_area(unsigned start, unsigned end).
Master applications user guides 10.1 Bootloading operation (command line version) Open a command prompt in the Linux or Windows directory where the copy of hc08sprg executable and S19 files are. Assuming the serial board is connected to, for example, a second serial port (COM3 /dev/ttyS1, with speed sets to 115200 bd/s and short trim is used) and is not yet powered on, invoke the bootloader using following sequence: hc08sprg.exe 3:D* 115200 k60_test.s19 Figure 38.
Master applications user guides Figure 39. First stage of bootloading Confirm by pressing ‘y’ and bootloading (FLASH reprogramming) will continue. The user application will then start. Developer’s Serial Bootloader, Rev.
Master applications user guides Figure 40. Bootloading completed 10.1.1 Memory boundary overlap example If the user tries to bootload an application that will not fit in the actual MCU memory, a warning message is displayed. The user may decide to continue, but some memory locations may be programmed incorrectly (the user code is either out of available FLASH memory or it overlaps with the bootloader code). Developer’s Serial Bootloader, Rev.
Master applications user guides Figure 41. Memory boundary overlap example Developer’s Serial Bootloader, Rev.
Master applications user guides 10.2 Bootloading operation (windows version) A version of the PC master application is also present (based on the same source codebase) in the Windows user friendly form. The application allows carrying out individual steps with the bootloader and also automatic steps as with the command line version. Figure 42. Windows based PC master application Developer’s Serial Bootloader, Rev.
Master applications user guides 10.2.1 10.2.1.1 How to use the Windows version of master application Open the “win_hc08sprg.exe” Figure 43. The PC master release folder This is stored in release folder of PC master applications. 10.2.1.2 Setup the application for connection with target 1 2 3 4 Figure 44. Setup the application for connection with target 1. Select the right Communication port. In case that the port is not in list, try to re scan communication ports in your PC by button “Rescan”. 2.
Master applications user guides — Short TRIM - check if the target is configured to used short clock calibration (trim) pulse. 3. Select the S19 file - To add the new S19 file into list use the “Open S19” button, for reuse the any file that has been already opened just select it from the combo box. 4. Connect the target - hit the button “Connect” and run the target with bootloader startup options enabled 10.2.1.3 Using the Windows version of master application 4. 5. 6. 1. 7. 8. 9. 10. 2. 3. 11.
Merging bootloader and application images 5. Erase - this button invokes erase of whole user flash memory area. 6. Blank check - this command check the memory if it’s erased. The command is implemented by read command. 7. Program - the button try to download the prepared image to the target. Be sure that before this operation the target memory is already erased. 8. Compare - this button compare the content of the target memory with prepared image 9.
References Application S19 file box Bootloader S19 file box MCU type select box Output S19 file name box Bootloader protocol box Vector table definition boxes Log window Exit button Start conversion button Figure 46. The AN2295 S19 Merge tool 12 References For additional information, refer to these documents from the Freescale Semiconductor website, freescale.com • AN2295SW: Contains all of the software files for this application note in a zip file.
References • • • • • • • ZSTARRM: Wireless Sensing Triple Axis Reference design CFPRM: ColdFire® Family Programmer’s Reference Manual K60P100M100SF2RM: K60 Sub-Family Reference Manual AN3942: Flash Programming Routines for the HCS08 and the ColdFire (V1) devices The Master applications user guides: Section 10, Master applications user guides The description of Kinetis version of protocol including the changes in user application: Section 7, FC protocol, version 5, Kinetis The quick start guide how to modi
How to Reach Us: Home Page: freescale.com Web Support: freescale.com/support Information in this document is provided solely to enable system and software implementers to use Freescale Semiconductor products. There are no express or implied copyright licenses granted hereunder to design or fabricate any integrated circuits or integrated circuits based on the information in this document. Freescale reserves the right to make changes without further notice to any products herein.
References Developer’s Serial Bootloader, Rev.
