Hello Don
I have attached a binary file for the FRDM-KL26Z which runs KBOOT 2.0.0 on UART0 (as well as USB-MSD [accepts binary and SRECs] and KBOOT HID on USB) - the UART part is the same as for a KL16.
When I look at the UART0 registers when it is connected they are at:

It looks like you may have a missing clock or something for the UART in your case since it looks to be signaling that it is in the process of sending something but never terminates. Your C4 is strange since it is usually 0x0f (16x oversampling) but it may be a typo and not be relevant.
The attached binary was built with the uTasker loader that has ported KBOOT functionality (in combination with various other loader modes that can be used at the same time) to almost all Kinetis parts [http://www.utasker.com/docs/uTasker/uTaskerSerialLoader.pdf]. It is a smaller footprint version using a small OS that makes code much simpler to maintain, customise or extend and allows KBOOT operation to be tested in its Kinetis simulator. Since its drivers automatically match to the part no development/porting work is required when moving between chips types.
Regards
Mark
P.S. Below is also a KBOOT UART + HID protocol implementation showing how easy it actually is in this environment (HW independent and so runs on any Kinetis part)
uTasker developer and supporter (+5'000 hours experience on +60 Kinetis derivatives in +80 product developments)
Kinetis: http://www.utasker.com/kinetis.html
#include "config.h"
#define OWN_TASK TASK_APPLICATION
#define STATE_INIT 0x0000
#define STATE_ACTIVE 0x0001
#define RX_QUEUE_SIZE 256
#define KBOOT_REPORT_ID_COMMAND_OUT 1
#define KBOOT_REPORT_ID_DATA_OUT 2
#define KBOOT_REPORT_ID_COMMAND_IN 3
#define KBOOT_REPORT_ID_DATA_IN 4
#define KBOOT_COMMAND_TAG_ERASE_ALL 1
#define KBOOT_COMMAND_TAG_ERASE_REGION 2
#define KBOOT_COMMAND_TAG_READ_MEMORY 3
#define KBOOT_COMMAND_TAG_WRITE_MEMORY 4
#define KBOOT_COMMAND_TAG_FILL_MEMORY 5
#define KBOOT_COMMAND_TAG_FLASH_SECURITY_DISABLE 6
#define KBOOT_COMMAND_TAG_GET_PROPERTY 7
#define KBOOT_COMMAND_TAG_RECEIVE_SBFILE 8
#define KBOOT_COMMAND_TAG_EXECUTE 9
#define KBOOT_COMMAND_TAG_CALL 10
#define KBOOT_COMMAND_TAG_RESET 11
#define KBOOT_COMMAND_TAG_SET_PROPERTY 12
#define KBOOT_COMMAND_TAG_MASS_ERASE 13
#define PROPERTY_VERSION 1
#define PROPERTY_PERIPHERALS 2
#define PROPERTY_FLASH_START_ADD 3
#define PROPERTY_FLASH_SIZE_BYTES 4
#define PROPERTY_FLASH_SECTOR_SIZE 5
#define PROPERTY_FLASH_BLOCK_CNT 6
#define PROPERTY_AVAILABLE_CMDS 7
#define PROPERTY_CRC_CHECK_STATUS 8
#define PROPERTY_VERIFY_WRITES 10
#define PROPERTY_MAX_PACKET_SIZE 11
#define PROPERTY_RESERVED_REGIONS 12
#define PROPERTY_VALID_REGIONS 13
#define PROPERTY_RAM_START_ADD 14
#define PROPERTY_RAM_SIZE_BYTES 15
#define PROPERTY_SYS_DEVICE_ID 16
#define PROPERTY_FLASH_SEC_STATE 17
#define PROPERTY_UNIQUE_DEVICE_ID 18
#define KBOOT_SERIAL_START_BYTE 0x5a
#define KBOOT_SERIAL_ACK 0xa1
#define KBOOT_SERIAL_NAK 0xa2
#define KBOOT_SERIAL_ACK_ABORT 0xa3
#define KBOOT_SERIAL_COMMAND 0xa4
#define KBOOT_SERIAL_DATA 0xa5
#define KBOOT_SERIAL_PING 0xa6
#define KBOOT_SERIAL_PING_RESPONSE 0xa7
const unsigned char ucAck[] = {KBOOT_SERIAL_START_BYTE, KBOOT_SERIAL_ACK};
const unsigned char ucNak[] = {KBOOT_SERIAL_START_BYTE, KBOOT_SERIAL_NAK};
const unsigned char ucPingResponse[] = {KBOOT_SERIAL_START_BYTE, KBOOT_SERIAL_PING_RESPONSE, 0x00, 0x01, 0x01, 'P', 0x00, 0x00, 0x78, 0x04};
static unsigned char *ptrFlashAddress = 0;
static unsigned long ulProg_length = 0;
extern void fnApplication(TTASKTABLE *ptrTaskTable)
{
static int iInputLength = 0;
static QUEUE_HANDLE SerialPortID = NO_ID_ALLOCATED;
static unsigned char ucSerialInputMessage[RX_QUEUE_SIZE] = {0};
static int iAppState = STATE_INIT;
static unsigned char ucInputMessage[HEADER_LENGTH] = {0};
QUEUE_HANDLE PortIDInternal = ptrTaskTable->TaskID;
if (STATE_INIT == iAppState) {
TTYTABLE tInterfaceParameters;
tInterfaceParameters.Channel = LOADER_UART;
tInterfaceParameters.ucSpeed = SERIAL_BAUD_57600;
tInterfaceParameters.Config = (CHAR_8 + NO_PARITY + ONE_STOP + CHAR_MODE);
tInterfaceParameters.ucDMAConfig = 0;
tInterfaceParameters.Rx_tx_sizes.RxQueueSize = RX_BUFFER_SIZE;
tInterfaceParameters.Rx_tx_sizes.TxQueueSize = TX_BUFFER_SIZE;
tInterfaceParameters.Task_to_wake = OWN_TASK;
if ((SerialPortID = fnOpen(TYPE_TTY, FOR_I_O, &tInterfaceParameters)) != NO_ID_ALLOCATED) {
fnDriver(SerialPortID, (TX_ON | RX_ON), 0);
}
iAppState = STATE_ACTIVE;
}
while (fnRead(PortIDInternal, ucInputMessage, HEADER_LENGTH) != 0) {
if (TIMER_EVENT == ucInputMessage[MSG_SOURCE_TASK]) {
if (T_RESET == ucInputMessage[MSG_TIMER_EVENT]) {
fnResetBoard();
}
else if (T_MESSAGE_TIMEOUT == ucInputMessage[MSG_TIMER_EVENT]) {
fnWrite(SerialPortID, (unsigned char *)ucNak, sizeof(ucNak));
iInputLength = 0;
}
else {
fnJumpToValidApplication(1);
iAppState = STATE_ACTIVE;
}
}
}
while (fnRead(SerialPortID, &ucSerialInputMessage[iInputLength], 1) != 0) {
if (iInputLength == 0) {
if (ucSerialInputMessage[0] == KBOOT_SERIAL_START_BYTE) {
iInputLength = 1;
uTaskerMonoTimer(OWN_TASK, (DELAY_LIMIT)(0.1 * SEC), T_MESSAGE_TIMEOUT);
}
}
else {
uTaskerMonoTimer(OWN_TASK, (DELAY_LIMIT)(0.1 * SEC), T_MESSAGE_TIMEOUT);
if (iInputLength == 1) {
switch (ucSerialInputMessage[1]) {
case KBOOT_SERIAL_PING:
fnWrite(SerialPortID, (unsigned char *)ucPingResponse, sizeof(ucPingResponse));
break;
case KBOOT_SERIAL_DATA:
case KBOOT_SERIAL_COMMAND:
iInputLength = 2;
continue;
case KBOOT_SERIAL_ACK:
break;
}
uTaskerStopTimer(OWN_TASK);
iInputLength = 0;
}
else if (iInputLength == 2) {
iInputLength++;
}
else {
iInputLength++;
if (iInputLength == (ucSerialInputMessage[2] + 6)) {
unsigned short usCRC = fnCRC16(0, ucSerialInputMessage, 4);
usCRC = fnCRC16(usCRC, &ucSerialInputMessage[6], ucSerialInputMessage[2]);
uTaskerStopTimer(OWN_TASK);
if (usCRC != ((ucSerialInputMessage[5] << 8) | (ucSerialInputMessage[4]))) {
fnWrite(SerialPortID, (unsigned char *)ucNak, sizeof(ucNak));
}
else {
fnWrite(SerialPortID, (unsigned char *)ucAck, sizeof(ucAck));
if (ucSerialInputMessage[1] == KBOOT_SERIAL_COMMAND) {
ucSerialInputMessage[2] = KBOOT_REPORT_ID_COMMAND_OUT;
}
else {
ucSerialInputMessage[4] = ucSerialInputMessage[2];
ucSerialInputMessage[5] = ucSerialInputMessage[3];
ucSerialInputMessage[2] = KBOOT_REPORT_ID_DATA_OUT;
}
if (fnHandleKboot(SerialPortID, KBOOT_UART, (KBOOT_PACKET *)&ucSerialInputMessage[2]) != 0) {
uTaskerMonoTimer(OWN_TASK, (DELAY_LIMIT)(1 * SEC), T_RESET);
}
}
iInputLength = 0;
}
}
}
if (iInputLength >= RX_QUEUE_SIZE) {
iInputLength = 0;
}
}
}
static void fnHandlePropertyGet(unsigned long ulPropertyTag, unsigned long ulMemoryID, KBOOT_PACKET *ptrKBOOT_response)
{
#define BOOT_LOADER_NAME 'K'
#define BOOT_LOADER_MAJOR_VERSION 2
#define BOOT_LOADER_MINOR_VERSION 0
#define BOOT_LOADER_BUGFIX 0
#define kStatus_Success 0
#define kStatus_Fail 1
#define kStatus_ReadOnly 2
#define kStatus_OutOfRange 3
#define kStatus_UnknownProperty 10300
#define kStatus_ReadOnlyProperty 10301
#define kStatus_InvalidPropertyValue 10302
#define KB_SUPPORTS_FLASH_ERASE_ALL 0x00000001
#define KB_SUPPORTS_FLASH_ERASE_REGION 0x00000002
#define KB_SUPPORTS_READ_MEMORY 0x00000004
#define KB_SUPPORTS_WRITE_MEMORY 0x00000008
#define KB_SUPPORTS_FILL_MEMORY 0x00000010
#define KB_SUPPORTS_FLASH_SECURITY_DISABLE 0x00000020
#define KB_SUPPORTS_GET_PROPERTY 0x00000040
#define KB_SUPPORTS_RECEIVE_SB_FILE 0x00000080
#define KB_SUPPORTS_EXECUTE 0x00000100
#define KB_SUPPORTS_CALL 0x00000200
#define KB_SUPPORTS_RESET 0x00000400
#define KB_SUPPORTS_SET_PROPERTY 0x00000800
#define KB_SUPPORTS_FLASH_ERASE_ALL_UNSECURE 0x00001000
#define KB_SUPPORTS_FLASH_PROGRAM_ONCE 0x00002000
#define KB_SUPPORTS_FLASH_READ_ONCE 0x00004000
#define KB_SUPPORTS_FLASH_READ_RESOURCE 0x00008000
#define KB_SUPPORTS_CONFIGURE_QUAD_SPI 0x00010000
#define KB_SUPPORTS_RELIABLE_UPDATE 0x00100000
#define SUPPORTED_KBOOT_COMMANDS (KB_SUPPORTS_FLASH_ERASE_REGION | KB_SUPPORTS_WRITE_MEMORY | KB_SUPPORTS_GET_PROPERTY | KB_SUPPORTS_RESET)
const unsigned long version_info = ((BOOT_LOADER_NAME << 24) | (BOOT_LOADER_MAJOR_VERSION << 16) | (BOOT_LOADER_MINOR_VERSION << 8) | (BOOT_LOADER_BUGFIX));
unsigned long ulStatus = kStatus_Success;
unsigned long ulResponseData[4];
int iDataLength = 1;
int iNoStatus = 0;
int iDataIndex = 4;
int iDataRef = 0;
int iDataPairs = 0;
switch (ulPropertyTag) {
case PROPERTY_VERSION:
ulResponseData[0] = (unsigned long)version_info;
break;
case PROPERTY_FLASH_START_ADD:
ulResponseData[0] = FLASH_START_ADDRESS;
break;
case PROPERTY_FLASH_SIZE_BYTES:
ulResponseData[0] = SIZE_OF_FLASH;
break;
case PROPERTY_FLASH_SECTOR_SIZE:
ulResponseData[0] = FLASH_GRANULARITY;
break;
case PROPERTY_AVAILABLE_CMDS:
ulResponseData[0] = SUPPORTED_KBOOT_COMMANDS;
break;
case PROPERTY_RESERVED_REGIONS:
iNoStatus = 0;
iDataLength = 4;
iDataPairs = 0;
ulResponseData[0] = FLASH_START_ADDRESS;
ulResponseData[1] = (_UTASKER_APP_START_ - 1);
ulResponseData[2] = RAM_START_ADDRESS;
ulResponseData[3] = (RAM_START_ADDRESS + (SIZE_OF_RAM/2));
break;
case PROPERTY_RAM_SIZE_BYTES:
ulResponseData[0] = SIZE_OF_RAM;
break;
case PROPERTY_FLASH_SEC_STATE:
#if defined FLASH_CONTROLLER_FTMRE
ulResponseData[0] = ((FTMRH_FSEC & FTMRH_FSEC_SEC_UNSECURE_FLAG) == 0);
#else
ulResponseData[0] = ((FTFL_FSEC & FTFL_FSEC_SEC_UNSECURE) == 0);
#endif
break;
default:
iDataLength = 0;
ulStatus = kStatus_UnknownProperty;
break;
}
if (iNoStatus == 0) {
ptrKBOOT_response->ucData[iDataIndex++] = (unsigned char)ulStatus;
ptrKBOOT_response->ucData[iDataIndex++] = (unsigned char)(ulStatus >> 8);
ptrKBOOT_response->ucData[iDataIndex++] = (unsigned char)(ulStatus >> 16);
ptrKBOOT_response->ucData[iDataIndex++] = (unsigned char)(ulStatus >> 24);
ptrKBOOT_response->ucData[3]++;
}
while (iDataLength-- != 0) {
ptrKBOOT_response->ucData[iDataIndex++] = (unsigned char)ulResponseData[iDataRef];
ptrKBOOT_response->ucData[iDataIndex++] = (unsigned char)(ulResponseData[iDataRef] >> 8);
ptrKBOOT_response->ucData[iDataIndex++] = (unsigned char)(ulResponseData[iDataRef] >> 16);
ptrKBOOT_response->ucData[iDataIndex++] = (unsigned char)(ulResponseData[iDataRef] >> 24);
ptrKBOOT_response->ucData[3]++;
iDataRef++;
}
while (iDataPairs-- != 0) {
ptrKBOOT_response->ucData[3]--;
}
ptrKBOOT_response->ucLength[0] = (unsigned char)iDataIndex;
}
static void fnReturnResponse(QUEUE_HANDLE hInterface, int iInterfaceType, KBOOT_PACKET *ptrKBOOT_response)
{
if (iInterfaceType == KBOOT_UART) {
unsigned char ucSerialHeader[6];
unsigned short usCRC;
ucSerialHeader[0] = KBOOT_SERIAL_START_BYTE;
ucSerialHeader[1] = KBOOT_SERIAL_COMMAND;
ucSerialHeader[2] = ptrKBOOT_response->ucLength[0];
ucSerialHeader[3] = 0;
usCRC = fnCRC16(fnCRC16(0, ucSerialHeader, (sizeof(ucSerialHeader) - 2)), ptrKBOOT_response->ucData, ptrKBOOT_response->ucLength[0]);
ucSerialHeader[4] = (unsigned char)usCRC;
ucSerialHeader[5] = (unsigned char)(usCRC >> 8);
fnWrite(hInterface, ucSerialHeader, sizeof(ucSerialHeader));
fnWrite(hInterface, ptrKBOOT_response->ucData, ptrKBOOT_response->ucLength[0]);
}
else {
fnWrite(hInterface, (unsigned char *)ptrKBOOT_response, sizeof(KBOOT_PACKET));
}
}
extern int fnHandleKboot(QUEUE_HANDLE hInterface, int iInterfaceType, KBOOT_PACKET *ptrKBOOT_packet)
{
int iReturn = 0;
KBOOT_PACKET KBOOT_response;
uMemset(&KBOOT_response, 0, sizeof(KBOOT_response));
switch (ptrKBOOT_packet->ucCommandType) {
case KBOOT_REPORT_ID_COMMAND_OUT:
KBOOT_response.ucCommandType = KBOOT_REPORT_ID_COMMAND_IN;
switch (ptrKBOOT_packet->ucData[0]) {
case KBOOT_COMMAND_TAG_GET_PROPERTY:
{
unsigned long ulPropertyTag = (ptrKBOOT_packet->ucData[4] | (ptrKBOOT_packet->ucData[5] << 8) | (ptrKBOOT_packet->ucData[6] << 16) | (ptrKBOOT_packet->ucData[7] << 24));
unsigned long ulMemoryID = (ptrKBOOT_packet->ucData[8] | (ptrKBOOT_packet->ucData[9] << 8) | (ptrKBOOT_packet->ucData[10] << 16) | (ptrKBOOT_packet->ucData[11] << 24));
KBOOT_response.ucData[0] = (ptrKBOOT_packet->ucData[0] | 0xa0);
fnHandlePropertyGet(ulPropertyTag, ulMemoryID, &KBOOT_response);
}
break;
case KBOOT_COMMAND_TAG_WRITE_MEMORY:
case KBOOT_COMMAND_TAG_ERASE_REGION:
{
unsigned long ulStartAddress;
unsigned long ulLength;
ulStartAddress = (ptrKBOOT_packet->ucData[4] | (ptrKBOOT_packet->ucData[5] << 8) | (ptrKBOOT_packet->ucData[6] << 16) | (ptrKBOOT_packet->ucData[7] << 24));
ulLength = (ptrKBOOT_packet->ucData[8] | (ptrKBOOT_packet->ucData[9] << 8) | (ptrKBOOT_packet->ucData[10] << 16) | (ptrKBOOT_packet->ucData[11] << 24));
if (KBOOT_COMMAND_TAG_ERASE_REGION == ptrKBOOT_packet->ucData[0]) {
if ((ulStartAddress >= UTASKER_APP_START) && (ulStartAddress < (unsigned long)UTASKER_APP_END)) {
if ((ulStartAddress + ulLength) > (unsigned long)UTASKER_APP_END) {
ulLength = ((unsigned long)UTASKER_APP_END - ulStartAddress);
}
fnEraseFlashSector((unsigned char *)ulStartAddress, (MAX_FILE_LENGTH)ulLength);
}
}
else {
ptrFlashAddress = (unsigned char *)ulStartAddress;
ulProg_length = ulLength;
}
KBOOT_response.ucLength[0] = 12;
KBOOT_response.ucData[0] = 0xa0;
if (iInterfaceType == KBOOT_UART) {
KBOOT_response.ucData[3] = 2;
}
else {
KBOOT_response.ucData[2] = 2;
}
KBOOT_response.ucData[8] = ptrKBOOT_packet->ucData[0];
}
break;
case KBOOT_COMMAND_TAG_RESET:
iReturn = 1;
KBOOT_response.ucLength[0] = 12;
KBOOT_response.ucData[0] = 0xa0;
if (iInterfaceType == KBOOT_UART) {
KBOOT_response.ucData[3] = 2;
fnDriver(hInterface, (RX_OFF), 0);
}
else {
KBOOT_response.ucData[2] = 2;
}
KBOOT_response.ucData[8] = ptrKBOOT_packet->ucData[0];
break;
case KBOOT_COMMAND_TAG_ERASE_ALL:
case KBOOT_COMMAND_TAG_READ_MEMORY:
case KBOOT_COMMAND_TAG_FILL_MEMORY:
case KBOOT_COMMAND_TAG_FLASH_SECURITY_DISABLE:
case KBOOT_COMMAND_TAG_RECEIVE_SBFILE:
case KBOOT_COMMAND_TAG_EXECUTE:
case KBOOT_COMMAND_TAG_CALL:
case KBOOT_COMMAND_TAG_SET_PROPERTY:
case KBOOT_COMMAND_TAG_MASS_ERASE:
_EXCEPTION("Use detected - investigate....");
break;
}
fnReturnResponse(hInterface, iInterfaceType, &KBOOT_response);
break;
case KBOOT_REPORT_ID_DATA_OUT:
{
unsigned short usBuff_length = ptrKBOOT_packet->ucLength[0];
if ((ptrFlashAddress >= (unsigned char *)UTASKER_APP_START) && (ptrFlashAddress < UTASKER_APP_END)) {
if ((ptrFlashAddress + usBuff_length) > UTASKER_APP_END) {
usBuff_length = (unsigned short)(ptrFlashAddress - UTASKER_APP_END);
}
if (usBuff_length > ulProg_length) {
usBuff_length = (unsigned short)ulProg_length;
}
fnWriteBytesFlash(ptrFlashAddress, ptrKBOOT_packet->ucData, usBuff_length);
ptrFlashAddress += usBuff_length;
ulProg_length -= usBuff_length;
if (ulProg_length == 0) {
KBOOT_response.ucCommandType = KBOOT_REPORT_ID_COMMAND_IN;
KBOOT_response.ucLength[0] = 12;
KBOOT_response.ucData[0] = 0xa0;
if (iInterfaceType == KBOOT_UART) {
KBOOT_response.ucData[3] = 2;
}
else {
KBOOT_response.ucData[2] = 2;
}
KBOOT_response.ucData[8] = KBOOT_COMMAND_TAG_WRITE_MEMORY;
fnWriteBytesFlash(0, 0, 0);
fnReturnResponse(hInterface, iInterfaceType, &KBOOT_response);
}
}
}
break;
}
return iReturn;
}
extern unsigned short fnCRC16(unsigned short usCRC, unsigned char *ptrInput, unsigned long ulBlockSize)
{
while (ulBlockSize--) {
usCRC = (unsigned char)(usCRC >> 8) | (usCRC << 8);
usCRC ^= *ptrInput++;
usCRC ^= (unsigned char)(usCRC & 0xff) >> 4;
usCRC ^= (usCRC << 8) << 4;
usCRC ^= ((usCRC & 0xff) << 4) << 1;
}
return usCRC;
}
extern void fnJumpToValidApplication(int iResetPeripherals)
{
if ((*(unsigned long *)fnGetFlashAdd((unsigned char *)_UTASKER_APP_START_) != 0xffffffff) && (*(unsigned long *)(fnGetFlashAdd((unsigned char *)_UTASKER_APP_START_) + 4) != 0xffffffff)) {
if (iResetPeripherals != 0) {
uDisable_Interrupt();
#if (defined USB_INTERFACE && defined USB_MSD_HOST_LOADER && defined USB_HOST_SUPPORT)
USB_HOST_POWER_OFF();
#endif
RESET_PERIPHERALS();
}
#if !defined _WINDOWS
start_application(_UTASKER_APP_START_);
#endif
}
}
extern void fnUserHWInit(void)
{
if ((FORCE_BOOT() == 0)) {
_DELETE_BOOT_MAILBOX();
fnJumpToValidApplication(0);
}
}