Bootloader CRC (via BCA)

[jan_ymanas]

Hi, 

We're working witch a Kinetis MKE18F with BootRom and want to check if the image was loaded correctly using the BCAs CRC. 

We tried to upload image via CANbus with our own application but we don't have any response about CRC status. After sending the valid or invalid (CRC corrupted) image, the bootloader only sends the GenericResponse with status code kStatus_Success from the WriteMemory command.

These are the CANbus frames received of this response:

Time	CAN ID	Length	Data
0026833197us	0x123	8	5A A4 0C 00 23 72 A0 00
0026833704us	0x123	8	00 02 00 00 00 00 04 00
0026833980us	0x123	2	00 00

We tried it again with the KinetisFlashTool app via UART and the result was the same, wether setting the CRC configuration or not, we receive the same result (no feedback from the bootloader about the CRC application integrity testing)

We don't know how to get it working.

We followed the steps of chapter 23.7, Kinetis KE1xF Sub-Family Reference Manual:

But were should we receive these kStatus? When? After last data frame? Automatically? We don't have a clue.

In BCA we've configured the next CRC values:

.crcStartAddress = 0x000003d0, //!< Disable CRC check
 .crcByteCount = 0x000337fc, //!< Disable CRC check
 .crcExpectedValue = 0xF913CCAD, //!< Disable CRC check‍‍‍

Can you help us? 

Thank you so much!

[jan_ymanas]

Hi all, :smileyhappy:

Thank you all for the replies, ErichS‌ , jayheng‌ and nxf46116. 

Mixing your replies and the reference manuals we got the right way to calculate CRC and apply it. We load the image (.bin) via CANbus and finishes with a reset, then the application start running. So, the process was successful.

But we still don't receiving the CRC kStatus, we don't have any information about CRC via CANbus. The PTA11 pin works and is or isn't asserted, depends if the CRC verification was successful or not.

Best regards,

Jan. 

[jay_heng]

For the image CRC32 calculation, You can use this online tool http://www.sunshine2k.de/coding/javascript/crc/crc_js.html with below configuration

 

In Kinetis device, we need to bypass byte address 0x3cc ~ 0x3cf (bypass length is 4 byte) when calculating image CRC.

[jay_heng]

The CRC32 algo is as below:

x³²+x²⁶+x²³+x²²+x¹⁶+x¹²+x¹¹+x¹⁰+x⁸+x⁷+x⁵+x⁴+x²+x+1

[Alexis_A]

Hello Jan,

For his you will first need to set the MCU to boot from ROM, with this after the reset the BCA configurations should be executed.

For this you need to set the FOPT, BOOTSRC_SEL first.

If you're using MCUXpresso, you can set this field writing in the startup code, in the flash config:

Let me know if this helps you.

Best Regards,

Alexis Andalon

[jan_ymanas]

Hi Alexis, 

thank you for replying. 

We already had this configuration to update via Bootloader:

FOPT-->

BCA-->

Everything goes alright until the host finishes writing the data to the target successfully and then we try to do a reset (5A A4 02 00 66 64 0B 00); after the reset the MCU is still in bootloader and does not exit by timeout.

But were should we receive the CRC kStatus? When? After the last data frame? We still don't have a clue.

Thanks :smileyhappy:

[ErichStyger]

This might be helpful too:

I'm using srec_cat to calculate the CRC, see Tutorial: CRC32 Checksum with the KBOOT Bootloader | MCU on Eclipse 

I hope this helps,

Erich

[Alexis_A]

Hello Jan,

As you mention, I also can't identify where this response is send, I will investigate further about this issue, but meanwhile if you want to identify if the CRC was done correctly the pin PTA 11 is asserted when the CRC check fail after the reset.

Best Regards,

Alexis Andalon

[jan_ymanas]

Thanks Alexis,

We keep trying too.

I think the pin PTA11 is asserted when CRC doesn't correct or Byte count is out of range, that's right? we'll try on a TWR board over the coming days. 

Otherwise, how the ROM Bootloader calculates the CRC? I mean, maybe we don't calculate the CRC correctly.

Thanks! :smileyhappy: Regards,

Jan.

[Alexis_A]

Hello Jan,

I will suggest to check the Kinetis Bootloader  v2.0.0 Reference Manual in the chapter 4.5, you can find the algorithm to calculate the CRC, also if you want to compare I will suggest to use the KinetisFlashTool that you can find in the following link.

You will find it in the next path: NXP_Kinetis_Bootloader_2_0_0\bin\Tools\KinetisFlashTool\win, this tool can help you set the BCA configuration.

Best Regards,

Alexis Andalon

[jan_ymanas]

Hi Alexis,

Thank you for reply!

In the chapter that you mentioned I see the CRC 16 algorithm (XMODEM variant) used for calculate the CRC for bootloader frames , but for CRC 32 algorithm (used by the Bootloader to check API integrity, 0x3CC) what is the variant that its uses? 

We noticed that in the 1.2.0 version of MCU Bootloader Reference Manual doesn't say anything about CRC 32 algorithm calculate but in 2.0.0 or 2.5.0 says CRC 32 uses MPEG2 algorithm variant. 

We have compared our CRC 32, standard and MPEG2, calculated value with the KFT value and doesn't match.

Our CRC 32 calculate:

KFT CRC 32 Calculate:

Best regards,

Jan.