Factory Flashloader + SB File with Reset Command

brunoalbrecht · ‎09-05-2017

Hello,

I just received some PCBs with KM22F512VLH12 microcontrollers. I'm figuring out how to use the RAM based Flashloader (the bootloader that comes from factory) in order to make our production process easier and I stepped into a possible bug (on the Flashloader or one of the tools I'll describe).

I'm currently using Windows 10 64b, so the two tools I'm using (elftosb and blhost) are the binaries that came with the KBOOT package (FSL_Kinetis_Bootloader_2.0.0.zip).

Before the boards went to production, I emulated the Flashloader using the flashloader and flashloader_loader provided by the KBOOT package. My objective was:

1. Use the elftosb to create a SB file that would: erase the flash, program my application, reset the microcontroller so my application would start.

2. Use the blhost to "send" the SB file to the Flashloader over an USB-HID connection.

The command file sent to build the SB file with my application is quite simple:

sources {
app_file = extern(0);
}
// create a section
section (0) {
erase 0x0000000..0x0080000; //erase the whole memory
load app_file > 0x00000000; // load the application to the beginning of the memory
reset;
}

This is how I create the SB file:

elftosb.exe -o app.sb -c commands.txt app.bin

This is how I send the SB file to the flashloader:

blhost.exe -u 0x15a2,0x0073 receive-sb-file app.sb

This is what the blhost shows me:

Inject command 'receive-sb-file'
Preparing to send 85776 (0x14f10) bytes to the target.
Successful generic response to command 'receive-sb-file'
(1/1)99%usb hid detected receiver data abort
Data phase write aborted by status 0x2712 kStatus_AbortDataPhase
Possible JUMP or RESET command received.
Response status = 10107 (0x277b) kStatusRomLdrUnknownCommand
Wrote 85760 of 85776 bytes.

This means the reset command in the SB file is not recognized by the Flashloader, but the application was written to the memory, thus the microcontroller is still in "Flashloader mode". If I force a reset using the following command, the application starts correctly.

blhost.exe -u 0x15a2,0x0073 reset

So I got a new board (also "virgin", as it came from factory) and tried to send a SB file with *just* the RESET command. That means I used the elftosb with the following command file:

sources {
file = extern(0);
}
section(0) {
reset;
}

The following message was printed by the blhost tool (similar command line command was used):

Inject command 'receive-sb-file'
Preparing to send 176 (0xb0) bytes to the target.
Successful generic response to command 'receive-sb-file'
(1/1)90%usb hid detected receiver data abort
Data phase write aborted by status 0x2712 kStatus_AbortDataPhase
Possible JUMP or RESET command received.
Response status = 10107 (0x277b) kStatusRomLdrUnknownCommand
Wrote 160 of 176 bytes.

So I ran the blhost with the debug (-d) flag and got the following messages printed:

Inject command 'receive-sb-file'
Preparing to send 176 (0xb0) bytes to the target.
[01 00 08 00 08 01 00 01 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00]
<03 00 0c 00 a0 00 00 02 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00>
Successful generic response to command 'receive-sb-file'
<>
[02 00 20 00 e9 fa e7 22 fa b2 5f a9 16 e6 89 2b d1 c3 3d 91 5b 62 b7 04 53 54 4d 50 01 02 00 00 0b 00 00 00]
(1/1)18%<>
[02 00 20 00 07 00 00 00 00 00 00 00 00 00 07 00 06 00 01 00 01 00 43 3f 73 67 74 6c 80 f8 ca 3a 70 fb 01 00]
(1/1)36%<>
[02 00 20 00 09 99 00 00 09 99 00 00 09 99 00 00 09 99 00 00 09 99 00 00 09 99 00 00 00 00 fc a4 87 73 4d 54]
(1/1)54%<>
[02 00 20 00 00 00 00 00 08 00 00 00 01 00 00 00 01 00 00 00 5e 01 01 00 00 00 00 00 01 00 00 00 01 00 00 00]
(1/1)72%<>
[02 00 20 00 62 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9a f9 dc 18 57 57 ab b5 1c fe 9e 76 6a ff 06 e1]
(1/1)90%<03 00 00 00 62 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9a f9 dc 18 57 57 ab b5 1c fe 9e 76 6a ff 06 e1>
usb hid detected receiver data abort
Data phase write aborted by status 0x2712 kStatus_AbortDataPhase
Possible JUMP or RESET command received.
<03 00 0c 00 a0 00 00 02 7b 27 00 00 08 00 00 00 00 00 00 00 9a f9 dc 18 57 57 ab b5 1c fe 9e 76 6a ff 06 e1>
- took 0.117 seconds
Response status = 10107 (0x277b) kStatusRomLdrUnknownCommand
Wrote 160 of 176 bytes.

The reset command sent by the blhost directly (without a SB file) prints the following message (with -d flag):

Inject command 'reset'
[01 00 04 00 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00]
<03 00 0c 00 a0 00 00 02 00 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00>
Successful generic response to command 'reset'
- took 0.021 seconds
Response status = 0 (0x0) Success.

The same reset SB File works as expected with the flashloader from the KBOOT package, as well as with the FLASH based Bootloader.

Summary: reset command from a SB file to the factory flashloader doesn't work.

Any ideas on where is the problem?

Is the elftosb creating a faulty SB file? Then the Flash based bootloader wouldn't work.

Is the blhost sending wrong commands to the microcontroller? The the Flash based bootloader wouldn't work too.

I currently believe this is a problem with the factory bootloader.

Cheers,

Bruno Albrecht

Hui_Ma · ‎09-08-2017

Hi,

First of all, sorry for the later reply.

I do a similar test with TWR-K22F120M board.

1> I use [flashloader_loader.srec] image located at ..\NXP_Kinetis_Bootloader_2_0_0\targets\MK22F51212\iar\binaries folder pre-programmed to MK22FN512VMC12 chip.

2> Then, I select to use the led_demo image file <led_demo_tower_0000.bin>, which located at ..\NXP_Kinetis_Bootloader_2_0_0\apps\led_demo\MK22F51212\iar\binaries as my application file.

I modify the <led_demo_tower_0000.bin> file name to <app.bin>.

3> I use the same command file and named to <commands.txt>

4> After that, using [elftosb.exe] tool to generate the attached <app.sb> file.

5> Using the [blhost.exe] tool to load the <app.sb> file to MK22FN512VMC12 chip.

I checked the MK22FN512VMC12 chip reference manual, the Flashloader doesn't support USB port.

So, I select to use UART port to load the <app.sb>

Please check the result below:

There "Wrote 2144 of 2192 bytes".

I check the TWR-K22F120M board, the boards leds start to blink alternately.

The reset command works as expected.

Thank you for the attention.

Have a great day,
Ma Hui

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

brunoalbrecht · ‎09-08-2017

Thanks Hui_Ma for your answer.

As I said in my post:

-----------------------------------------------------------------------------------------------------------------------
The same reset SB File works as expected with the flashloader from the KBOOT package, as well as with the FLASH based Bootloader.
-----------------------------------------------------------------------------------------------------------------------

I checked the flashloader version that came with the microcontroller from factory and it says 1.5.1. The version from the KBOOT package is 2.0.0.

I guess the older version don't understand the reset command in a SB file.

The workaround is to send a reset command directly with the blhost application, so instead of just one command to send the SB file, I'll have two.