Kinetis MicrocontrollersのトピックRe: Recovery Bootloader Mode on KL27 with BOOT ROM

Recovery Bootloader Mode on KL27 with BOOT ROM

ernestoandresri — Tue, 23 Dec 2014 22:42:51 GMT

Hello everyone.

Right now I have a microcontroller KL27 has BOOT ROM. The first time I connected to the USB port, the computer recognized it well..

From KinetisUpdater.exe I could program a small project to light a led. It worked well.

The problem is that now is not detected by the computer to continue with the tests.

That recommendation can give me for the microcontroller can enter Bootloader mode once again.
As I can set "bootloader configuration area" from processor expert and as I do when no use processor expert.

In the circuit, I have a button on the PTA4/NMI_b pin.

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

jay_heng — Wed, 24 Dec 2014 06:02:37 GMT

Hi,

The FTFx_FOPT register allows the user to customize the operation of the MCU at boot time.

If Its value is equal to 0x3d, that means “Force Boot from ROM if NMI_b pin asserted (NMI_b pin is sampled at the end of reset (when reset pin negates)). otherwise, Boot from FLASH.”

If Its value is equal to 0xff, that means "Always boot from ROM"

If Its value is equal to 0x3f, that means "Always boot from FLASH"

The above are three kind of typical configuration for boot source selection.

If you want to re-enter bootloader mode, you need to know the FOPT value on your KL27

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

china-imm-fae-b — Wed, 24 Dec 2014 15:05:26 GMT

I meet the same problem and I fixed it .

Just Like this :

#undef CONFIG_4

//#define CONFIG_4 (pointer*)0xffff3ffe

//#define CONFIG_4 (pointer*)0xffff3bfe ///< FOPT - NMI is disabled

#define CONFIG_4 (pointer*)0xffff3dfe // boot to according to PTA4 level (log. 0 - boot to ROM, log. 1 boot to FLASH)

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

ernestoandresri — Wed, 24 Dec 2014 16:09:35 GMT

thank you very much for your answers and help. Now I am clear that I do in the next program.

I think I have to desolder the chip and assemble a new one because I have no programmer to adjust these settings configuration.

I try to debug from a Freedom-KL46Z updating the OPENSDA with the "MSD-DEBUG-FRDM-KL27Z_Pemicro_v116.SDA" file. but the Kinetis Design Studio always displays the following error: "Error 17926. Unexpected Target Type MCU processor type mismatch detected.. Aborting debug session. "

Any advice to recover without external programmer?

Re: Re: Recovery Bootloader Mode on KL27 with BOOT ROM

Rick_Li — Thu, 25 Dec 2014 06:04:50 GMT

My suggest is updating the OPENSDA with "DEBUG-APP_Pemicro_v108.SDA" which is available at CW v10.6 (in subfolder "OpenSDA"), this is a general firmware but the device with this firmware will not be recognized as a USB mass device.

you can debug the target board with this firmware.

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

ernestoandresri — Fri, 26 Dec 2014 19:32:57 GMT

Hello, I have a new microcontroller and I'm ready for another try, but I want to be very sure that I will not spend the same.

Is there any way to check the Flash Option Register (FTFA_FOPT) definition from the Kinetis design studio when I compile the project? . Try to see the disassembly of the code, but it is only possible in Debug mode and OPENSDA still not working.

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

ernestoandresri — Mon, 02 Nov 2020 13:14:21 GMT

Perform some tests, but I do not understand how to set the configuration registers for the Bootloader can function after programming the Flash memory.

KDS configured to generate .bin file to program microcontroller from Bootloader.
I checked the binary file generated by a project for the KL27 Expert processor. The project has no modification, only that generated automatically. In position 0x0_040D meeting FTFA_FOPT settings generated by processor Expert with 0x3F value.

According to Table 6-2. Flash Option Register (FTFA_FOPT) definition ... 0x3F equals that will always start from the FLASH memory .. Especially the bits 6-7 (BOOTSRC_SEL = Boot from Flash) and bit 1 (BOOTPIN_OPT = Boot source configured by BOOTSRC_SEL).

For KL46Z is easy because ProcessorExpert amending LINKER and defines a memory space for these configurations and additionally generates a vector called / * Flash configuration field * / and has the values:

  /* Flash configuration field */
  __attribute__ ((section (".cfmconfig"))) const uint8_t _cfm[0x10] = {
   /* NV_BACKKEY3: KEY=0xFF */
    0xFFU,
   /* NV_BACKKEY2: KEY=0xFF */
    0xFFU,
   /* NV_BACKKEY1: KEY=0xFF */
    0xFFU,
   /* NV_BACKKEY0: KEY=0xFF */
    0xFFU,
   /* NV_BACKKEY7: KEY=0xFF */
    0xFFU,
   /* NV_BACKKEY6: KEY=0xFF */
    0xFFU,
   /* NV_BACKKEY5: KEY=0xFF */
    0xFFU,
   /* NV_BACKKEY4: KEY=0xFF */
    0xFFU,
   /* NV_FPROT3: PROT=0xFF */
    0xFFU,
   /* NV_FPROT2: PROT=0xFF */
    0xFFU,
   /* NV_FPROT1: PROT=0xFF */
    0xFFU,
   /* NV_FPROT0: PROT=0xFF */
    0xFFU,
   /* NV_FSEC: KEYEN=1,MEEN=3,FSLACC=3,SEC=2 */
    0x7EU,
   /* NV_FOPT: ??=1,??=1,FAST_INIT=1,LPBOOT1=1,RESET_PIN_CFG=1,NMI_DIS=1,??=1,LPBOOT0=1 */
    0xFFU,
    0xFFU,
    0xFFU
  };

Any change in the vector immediately modifies the .bin generated and FOPT takes the values that I want. If I check the .map after compiling for KL46 I can find that:

*(.cfmconfig)

.cfmconfig 0x00000400 0x10 ./Generated_Code/Cpu.o

0x00000400 _cfm

0x00000410 . = ALIGN (0x4)

The specific question would be: How to get this same configuration but for the KL27.

jayheng

Reviewing the binary file generated after compiling and that was programmed into the microcontroller, I find that the value of FOPT is 0x3F ..

china-imm-fae-baolei-song2013w28

If I make that definition you recommend me, there is no change in the .bin file. Researching about it, it is possible that this definition serves but when you have a file called <vectors.h> and has something to do with IAR. Processor Expert does not generate that file and therefore no change doing what you recommend me.

Yong li,

Try updating the OPENSDA with the file you gave me and it was not possible to program the microcontroller KL27. Also I installed CodeWarrior 10.6, installed all available updates and after that CW can not create a project for the KL27, maybe that's why I is not supported by the OPENSDA to upgrade your you recommended me.

thank you very much for your time and for their assistance.

__________________________________________

EDIT:

I found the following paragraph in the document "Getting Started with the Kinetis ROM Bootloader":

"The Flash Configuration Area (0x400-0x40F) should be carefully populated with known values according to the Reference Manual for the specific Kinetis platform. In particular, values for the FSEC (0x40C) and FOPT (0x40D) locations may prevent future writes to the Kinetis flash. Extra attention to ensure the correct values in your application image at these offsets is highly recommended. If your code (other than the vector table) is linked to begin at offset 0x410, then the default erased value (0xFF) of these locations will make the device secure, but mass erase will be enabled."

I keep looking for an example of how to make sure these memory locations have the correct value. :smileyangry:

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

Rick_Li — Mon, 29 Dec 2014 08:03:56 GMT

Hi Ernesto Andres Rincon Cruz,

When creating a new project in KDS, you will find there is a file with name startup_MKL27Z4.S.

the initialization of "the flash configuration area" is done by the below code:

/* Flash Configuration */

.section .FlashConfig, "a"

.long 0xFFFFFFFF

.long 0xFFFF3FFE

if you want to modify FTFA_FOPT, please just modify the corresponding place.

in a project without PE, this file is located in ./Project_Settings/Startup_Code/.

if with PE, then, this file path will be:

./SDK/platform/startup/MKL27Z4/gcc/

hope it helps!

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

ernestoandresri — Mon, 29 Dec 2014 20:02:53 GMT

Yong Li,

Thank you very much. With your instructions, able to successfully configure the bootloader option. I programmed the microcontroller and everything happens as expected. Reenters Bootloader but now I have another problem.

The settings in the memory locations are:

The values were verified in the generated .bin and were as expected.
I programmed the microcontroller using KinetisUpdater.exe... programming ended without any problems.
Try entering again into Bootloader mode and I could do it without any problems
Now I always get an error when trying to program a microcontroller again. Now I always get an error in KinetisUpdater.exe.

from blhost, you can see that answering the bootloader, but leaves no programming or erasing the flash

Apparently it is the memory register "Flash Security Register (FTFA_FSEC)" ... I had reviewed this register to set up the right way and I think I gave the correct values.

I gave the = 0xFE values corresponding to:

KEYEN = 11 Backdoor key disabled access
MEEN = 11 Mass erase is enabled
FSLACC = 11 Freescale factory Access Granted
SEC = 10 MCU security status is unsecure. (The standard shipping condition of the flash memory module is unsecure.)

something is wrong with what I'm understanding?

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

jeremyzhou — Tue, 30 Dec 2014 06:24:09 GMT

Hi Ernesto Andres Rincon Cruz,

I‘m glad to hear that you already had fixed the previous question.

About the new issue, I've also not encountered it until now, I'll contact with the KOOT solution AE about this issue and please be patient.
Have a great day,
Ping

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

jay_heng — Tue, 30 Dec 2014 07:35:18 GMT

Hello,

If you verified that FTFA_FSEC(offset 0x40c) was 0xfe in the generated .bin, Chip should be unsecure after programming, but from the error info of blhost and KinetisUpdater, seems chip was still secure(you can use 'get-property 17' to get current flash security state (should be SECURE)), When chip is secure, the flash related commands(write/read/erase-all) in ROM are disallowed, So you can't program the chip again by KinetisUpdater.

Can you help try below steps by blhost?

Step1: blhost -u -- flash-erase-all-unsecure

Step2: blhost -u -- get-property 17

Returned info should be "Flash Security State = UNSECURE"

Step3: blhost -u -- write-memory 0x0 generated .bin

Step4: blhost -u -- read-memory 0x40c 1

Returned value should be "fe"

Step5: blhost -u -- reset

Step6: blhost -u -- get-property 17

Returned info should be "Flash Security State = UNSECURE"

Step7: Press the reset button and wait 5s, you should see your app working.

If above steps work on your side, that means updating app by blhost is properly.

Contine to try below steps:

Step8: Press the reset button and run blhost -u -- get-property 17

Returned info should be "Flash Security State = UNSECURE"

Step9: Update the app by KinetisUpdater

Step10: Press the reset button and run blhost -u -- get-property 17

Returned info should be "Flash Security State = UNSECURE", if not, this security issue should be caused by KinetisUpdater.

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

jeremyzhou — Tue, 30 Dec 2014 09:00:00 GMT

Hi Ernesto Andres Rincon Cruz,

Jie Heng is my colleague and he works in KOOT solution development team, definitely as a KOOT expert.

I contacted with him about your issue and he will follow it.
Have a great day,
Ping

Re: Re: Recovery Bootloader Mode on KL27 with BOOT ROM

ernestoandresri — Wed, 31 Dec 2014 01:11:30 GMT

Hi jayheng

Thank you very much for the signs. Everything worked as you indicated. I made a video for steps are seen running. The error is generated by the "KinetisUpdater.exe" software. From blhost no problems and everything works fine.

Now I have a new detail. I'm using the USB Bootloader for KL27 ... after all, it works great.

The problem comes when entering Bootloader, the PC recognizes the USB-HID device, but sometimes enters bootloader mode but UART port . That ends BOOT USB and requires a RESET to reenter by USB-HID.

The hardware solution is to place PULL-UP resistors in PTA1 and PTA2 pins, especially in PTA1. But already made the PCB and can not take that option.

The new question is: How can I modify flash memory positions "The Kinetis Bootloader Configuration Area (BCA)", specifically the byte called "enabledPeripherals". To disable the BOOT for UART, I2C, SPI. And only allow for USB.

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

mjbcswitzerland — Wed, 31 Dec 2014 16:47:12 GMT

Hi Ernesto

I'm using the USB Bootloader for KL27 ... after all, it works great

From your video I see that it takes over a minute to load a program of 18k. This is a speed of about 300 bytes a second. If you have a large application of 258k it will require 15 minutes. I wouldn't exactly call this great since it is much faster to use the UART.

This is also what I found with the latest KBOOT (in comparison, the old HIDBootloader.exe from AN4764 will do this in a fraction of a second) - see Re: Re: Does KBOOT support KL25?

A USB loader that only achieves 300 Bytes/s is of course quite rediculous and the problem is obviously in the PC program because it obviously sends a single packet of 36 bytes out every 100ms and the embedded part could easily achieve 50x this performance. I certainly recommend that this issue is resolved because it makes the present solution almost a joke for real work.

Regards

Mark

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

jay_heng — Tue, 06 Jan 2015 08:42:07 GMT

Hi Ernesto,

You can either manually edit generated bin file to modify bca data or add static bca data section in source code. For bca detail, please refer to 《Kinetis Bootloader 1.1.0 Reference Manual》 p11. When you have programmed the app image which contains right bca data (only usb enabled), you can re-program this app via usb interface only .

An demo bca section could be like this:

Best Regards,

Jay

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

bobpaddock — Tue, 06 Jan 2015 19:00:24 GMT

Mark Butcher wrote:
...

This is also what I found with the latest KBOOT (in comparison, the old HIDBootloader.exe from AN4764 will do this in a fraction of a second) - see Re: Re: Does KBOOT support KL25?

A USB loader that only achieves 300 Bytes/s is of course quite rediculous and the problem is obviously in the PC program because it obviously sends a single packet of 36 bytes out every 100ms and the embedded part could easily achieve 50x this performance. I certainly recommend that this issue is resolved because it makes the present solution almost a joke for real work.

I've not been following KBOOT that closely however I will need to get a HID based bootloader into my product soon, and want to be KBOOT compatible.

Is the protocol documented, without having to dig it out of the device end of the source code, or using a bus analyzer?

Why does Freescale refuse to release the source code for the PC end of the utilities (not just KBOOT but all past boot utilities)?

Having to sign an NDA to get it is absurd, which has been a past reply.

To fit into our product flow we usually end up writing our own utilities for the production floor (one big button that says "Program Now" and a Green/Red Pass/Fail indicator. It is a lot easier to convince the boss to use parts from a company when everything is openly supported.

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

mjbcswitzerland — Tue, 06 Jan 2015 20:48:44 GMT

Bob

KBOOT is comprehensively documented and all source code is available. As far as I know, also for the PC, although I didn't try re-building it yet (see KBOOT V1.1.0 Loader - Help - it is just too slow to be useful!!! )

The PC utility is not perfect (yet) for production use. This is however quite typical for such tools where they seem to be balancing use for development and production - there are just too many clicks required for each load and at the moment you really need to close the application and restart it for each target programmed for it to be reliable.

The protocol is quite straight forward. In have integrated it into the uTasker project for UART and USB for operation on most KE, KL and K parts and use it in parallel with Ethernet, USB-MSD and SD card loading. In fact it can be done in a couple of hours from scratch if you have a framework (with UART and USB drivers etc.) to add it to. I needed about 120 lines of C code for compatibility with all families on UART and/or USB.

Personally, if I were preparing a production setup that used KBOOT, I would probably integrate the protocol into a custom program because I often use such an application to program and then control a functional test afterwards.

Regards

Mark

http://www.utasker.com/kinetis.html

Re: Recovery Bootloader Mode on KL27 with BOOT ROM

oliviermartin — Thu, 13 Oct 2016 21:51:20 GMT

Hi ernestoandresrinconcruz ,

I also designed a custom PCB with KL27. I was hoping to use the USB ROM Bootloader but it does not seem to be detected by the PC.
Luckily, I call fallback on the UART Boot ROM.
In your comment you said "The hardware solution is to place PULL-UP resistors in PTA1 and PTA2 pins, especially in PTA1" to make the USB-HID ROM Bootloader more reliable. But I cannot find any other information in the documentation about this fact.
Have you got any explanation for these PULL-UP resistors?

Thanks,

Olivier