KL82 ROM KBOOT - Timeout Exit

[rtoma]

Hi there,

In my application I am getting into KBOOT by holding down pin 33 (NMI_B), while restarting the board. The BCA config area has been configure with the following parameters:

.tag = 0x6766636B, //!< Magic Number
.crcStartAddress = 0xFFFFFFFF, //!< Disable CRC check
.crcByteCount = 0xFFFFFFFF, //!< Disable CRC check
.crcExpectedValue = 0xFFFFFFFF, //!< Disable CRC check
.enabledPeripherals = 0xE1, //!< Enabled Peripheral: UART
.i2cSlaveAddress = 0xFF, //!< Use default I2C address(0x10)
.peripheralDetectionTimeoutMs = 0x03E8, //!< Use user-defined timeout(ms)
.usbVid = 0xFFFF, //!< Use default Vendor ID(0x15A2)
.usbPid = 0xFFFF, //!< Use default Product ID(0x0073)
.usbStringsPointer = 0xFFFFFFFF, //!< Use default USB String
.clockFlags = 0xFE, //!< Enable High speed mode
.clockDivider = 0xFD, //!< Use clock divider(2)
.bootFlags = 0xFF, //!< Enable communication with host
.mmcauConfigPointer = 0xFFFFFFFF, //!< No MMCAU configuration
.keyBlobPointer = 0xFFFFFFFF, //!< No key blob
.canConfig1 = 0xFF, //!< Use default canConfig1
.canConfig2 = 0xFFFF, //!< Use default canConfig2
.canTxId = 0xFFFF, //!< Use default CAN TX ID(0x123)
.canRxId = 0xFFFF, //!< Use default CAN RX ID(0x321)
.qspi_config_block_pointer = 0xFFFFFFFF, //!< No QSPI configuration

I am wondering how one can get the KBOOT to timeout and start the application. At the moment it doesn't as I can use blhost to talk to it. However it doesn't time out at all. I can wait more than 1s in between queries and nothing happens. (I would expect the KBOOT to timeout as there is no communication.)

Is there something I am missing? How can one get the KBOOT to time out after 1s?

Thank you!

[rtoma]

No clues anyone one? 

[jorge_a_vazquez]

Hi Radu Toma

Please refer to Reference Manual Figure 7-2. Kinetis Bootloader Start-up Flowchart, you can find that when you enter to the Booloader with the bootpin assert, the timeout is disable. 

https://www.nxp.com/docs/en/reference-manual/KL82P121M72SF0RM.pdf#page=127 

I think that this was made with the assumption that if you are getting into the bootloader with the pin, you actually want to use the bootloader and then you don't want to get out until you program an application and jump to that application. You could use an jump to application instruction if you want to get of of bootloader.

Hope this could help

Best Regards

Jorge Alcala

[rtoma]

Thanks Jorge, 

Makes sense what you've just described! However I am struggling jumping to application. How can this be achieved? 
I have noticed the blhost execute command, but where can I get the right values for:

• stack pointer
• program counter
• R0

[rtoma]

I seemed to have cracked it. But I have a question (see below). 

In the binary file, the first 4 bytes are the SP and the next 4 bytes are the program counter. Hence an execute command will look like:

blhost -p /dev/ttymxc2,56700 -- execute 0x000004E9 0 0x20012000

(see below the reason for choosing these addresses)

So here is my question: 

in the .map file the start is presented as : 0x000004e8                Reset_Handler

Why is the start address incremented by one in the binary file?

[jorge_a_vazquez · Accepted solution]

Hi Radu Toma

Sorry for the late reply, please look for information about Pointer to function in Thumb state "ARM". For more information please check the following post:

Thumbs up with Assembly on ARM Cortex | MCU on Eclipse 

Hope this could help.
Have a great day,
Jorge Alcala

[rtoma]

Thanks Jorge! Clear and concise explanation.