Need bootloader for QE128(flexis)

[HenryJ]

I am porting an application from HCS08 to QE128 processor and have not found bootloader for QE128(flexis) processor.

The QE128 does not seem to support interrup vector redirection, although the interrupt vectors appear to be write protected whenever any Flash memory is protected.

Work-arounds appear to be:

1) Unprotect bootloader code (not desirable) 

2) Create dummy ISRs that do re-direction to actual ISR

Has anyone done a bootloader for the QE128?

[sivanov]

Henry,

Can you send me your bootloader code to sivanov@sensidyne.com ? Also, were you able to program the entire memory range?

Stan

[tonyp]

Here's my own boot loader (a cut-down public version) http://aspisys.com/code/hc08/tboot.html.

It reads plain S19 files directly from a terminal.  No need for special app on PC side.  Just connect with an RS-232 terminal at the given baud rate (adjustable, usually 38400 bps).

It can program the full QE128 memory.  The paged memory uses S2 records with the extra byte denoting the page.

You write your application as if stand-alone but simply avoid the boot loader ROM space.  Vectors should go to their natural location as the boot loader will relocate them for you.

I've been using it for years without problems.

To assemble you will also need my ASM8 assembler -- the latest version -- which can found here: ASM8 HC08/9S08 Assembler

(Click on the title to download.)  Inside the archive you should find all needed include files (qe128.inc, common.inc, macros.inc).

Let me know if you have problems.

Hope this helps.

[sivanov]

Thank you, Tony!

[hek]

Hi Henry,

I am abit curious about your progress, I will face the exact same problem in a week or two when I'll have to port a avr bootloader to the world of S08...
Did you find any good solution?

Best Regards
Henrik

[kef]

1) unprotecting the bootloader code is somewhat dangerous.

2) dummy ISRs should be OK. But can you justify something like this to redirect single interrupt?:

redir_intx:

     lda   app_intx_vector+1

     psha

     lda   app_intx_vector

     psha

     rts

H register has to be preserved before application ISR saves it. So ldx  followed by jmp ,x won't work

What about jump table in applications code? Bootloader could have almost all his vectors pointing to applications jump table entries.

    jmp rtcISR

    jmp sci2txISR

...

  etc

[JimDon]

It's true you can not re-direct the vectors on QE128.

Just so it is clear, what do you need to bootloader for?

(not trying to say you don't need it, just trying to understand your purpose)

[ok2ucx]

Dears,

I've recently ported AN2295 bootloader for QE family and it's been briefly tested only. Attached you can find this alpha version which soon becomes a part of an official AN2295 update.

Note that due to changes in addressing modes and vector relocation, the newer version of command line hc08sprg.exe is required, also attached (with free GUI).

Any positive/negative feedback is more than welcome.

Pavel, an2295 bootloader developer, Freescale CZ

Message Edited by ok2ucx on 2008-02-04 02:13 PM

hc08sprg-s08qe-alpha-1.exe.zip

AN2295-Bootloader-Control-beta-1.exe.zip

Message Edited by t.dowe on 2009-09-03 04:53 PM

[HenryJ]

We are using the bootloader to do field upgrades of the application code.

(I have actually modified the bootloader to run on RS-485 instead of RS-232.)

Is it true that write-protecting Flash memory also write-protects the interrupt vectors?

[HenryJ]

I would like to thank all of you that replied to this request. I have completed the bootloader and publish the following tips on the changes required. Please contact me if you would like help or a copy of the final code.

Differences in QE128 and HCs08 bootloaders

1. Illegal instruction (ILOP) on HCS09 ($8D) is now a legal QE128 instruction.
   Changed value from byte to work ($9e1f). This increased code size.

2. Protection block size increased from 512 to 1024 bytes, so saved relocation
vector address REL_VECT changed from $FDC0 to $FBC0. Since the nterrupt vectors ar no longer
redirected, only the relocated reset vector at address $FBFE is used to vector to the
start of the application.

3. Also, since the interrupt vectors ar no longer redirected, the original vector table
must point to code used to go to the real vecots. This required coordination with the
application program. The bootloader and application progam must coordinate in this redirection.
e.g. Vector at location $FFCE is My_Timer2_Interrupt and
     My_Timer2_Interrupt  has instruction JMP, (int) Timer2_Interrupt pointing to usual ISR.

4. Protection bit in NVPROT.FPOPEN changed from 0 to 1 to protect bootloader flash.

5. Removed test of SRS for false (short) reset pulse.

6. Added data block corresponding to SIZE = 128 for QE128 flash size and locations.

7. Modifications will also be needed to handle loading memory in pages for addresses above 64K.

[russellsher]

Hi Henry

If you could please send me a copy of your bootloader, that would be great. (russell@et.co.za)

thank-you very much

Russell

[RichardL]

Hi Henry,

Your comment is very helpful.

I would like to copy your final code on bootloader for QE128.

If you are okay, please send it richard.lee@future.ca

Thanks a lot.

[ok2ucx]

Some more QE family AN2295 bootloader updates for the testing available here:

http://forums.freescale.com/freescale/board/message?board.id=8BITCOMM&message.id=14668#M14668

Regards, Pavel

Message Edited by ok2ucx on 2009-08-04 04:58 PM

[robert_t]

I'm working on a wireless bootloader, with a propietary wireless protocol. I'm trying to emulate rs232 over wireless, to use bootloader from an2295 and gui/master from the same an.

I'm working on source of an2295 for qe64. I can't understand these lines:

main:

    IFDEF IRQOPTION
        BIH     PVEC0                   ; if IRQ high, jump directly to real app.
    ENDIF
        LDA     SRS                     ; fetch RESET status reg.
        TSTA                            ; check if zero (this happens if RESET pulse is too short)
        BEQ     slfprg                  ; if so, jump to self programming               
        AND     #%11000000              ; mask only POR and PIN RESET source     
        BNE     slfprg                  ; any of these sources, go to self programming
PVEC0:  JMP     VEC0              ; jump to relocated application! 

VEC0, relocated application jump to main but main is also main of the bootloader, how can it goes to main of my new software?

If I use more space for my personal bootloader (I've to put the code for the transceiver) i.e. 2 KB where I have to put the new REL_VECT? thank you.

[ok2ucx]

Hallo,

this is perfectly OK. paged AC and QE devices (with Flash 64kB up) do not have vector relocation feature implemented, thus these must be redirected the same way as on older HC08s (see AN2295, protocol version 1 for details). AC128 and QE128 are using protocol version 0x0A.

The initial values of redirected tables are stored in 

APL_VECT_ROM:    SECTION

in 0xFBA0 - 0xFBFF memory area.

This area is not protected and is (during bootloading) reprogrammed with new vectors (actually JMP vector - 3 bytes sequence for each redirected vector) pointing to the user application. VEC0 points to the reset vector of the application and that's why it is also used during startup when bootloader decides to run the user application. Initial values (before any bootloading) are going to bootloader reset, so such blank device (with bootloader only) restarts bootloader again and again.

---

You can move REL_VECT in erase page multiples, actually you need to touch:

ASM file:

- REL_VECT value define: (REL_VECT    EQU     $FBA0)

- protection boundary: (MY_NVPROT      DC.B    %11111101)

PRM file:

  APLVECTROM = READ_ONLY 0xFBA0 TO 0xFBFF;

Hope it's clear.

Pavel