AnsweredAssumed Answered

Factory Flashloader + SB File with Reset Command

Question asked by Albrecht on Sep 5, 2017
Latest reply on Sep 8, 2017 by Albrecht

Hello,

 

I just received some PCBs with KM22F512VLH12 microcontrollers. I'm figuring out how to use the RAM based Flashloader (the bootloader that comes from factory) in order to make our production process easier and I stepped into a possible bug (on the Flashloader or one of the tools I'll describe).

 

I'm currently using Windows 10 64b, so the two tools I'm using (elftosb and blhost) are the binaries that came with the KBOOT package (FSL_Kinetis_Bootloader_2.0.0.zip).

 

Before the boards went to production, I emulated the Flashloader using the flashloader and flashloader_loader provided by the KBOOT package. My objective was:

1. Use the elftosb to create a SB file that would: erase the flash, program my application, reset the microcontroller so my application would start.

2. Use the blhost to "send" the SB file to the Flashloader over an USB-HID connection.

 

The command file sent to build the SB file with my application is quite simple:

sources {
app_file = extern(0);
}

// create a section
section (0) {
erase 0x0000000..0x0080000; //erase the whole memory
load app_file > 0x00000000; // load the application to the beginning of the memory
reset;
}

This is how I create the SB file:

elftosb.exe -o app.sb -c commands.txt app.bin

This is how I send the SB file to the flashloader:

blhost.exe -u 0x15a2,0x0073 receive-sb-file app.sb

This is what the blhost shows me:

Inject command 'receive-sb-file'
Preparing to send 85776 (0x14f10) bytes to the target.
Successful generic response to command 'receive-sb-file'
(1/1)99%usb hid detected receiver data abort
Data phase write aborted by status 0x2712 kStatus_AbortDataPhase
Possible JUMP or RESET command received.
Response status = 10107 (0x277b) kStatusRomLdrUnknownCommand
Wrote 85760 of 85776 bytes.

This means the reset command in the SB file is not recognized by the Flashloader, but the application was written to the memory, thus the microcontroller is still in "Flashloader mode". If I force a reset using the following command, the application starts correctly.

blhost.exe -u 0x15a2,0x0073 reset

 

So I got a new board (also "virgin", as it came from factory) and tried to send a SB file with *just* the RESET command. That means I used the elftosb with the following command file:

sources {
file = extern(0);
}

section(0) {
reset;
}

The following message was printed by the blhost tool (similar command line command was used):

Inject command 'receive-sb-file'
Preparing to send 176 (0xb0) bytes to the target.
Successful generic response to command 'receive-sb-file'
(1/1)90%usb hid detected receiver data abort
Data phase write aborted by status 0x2712 kStatus_AbortDataPhase
Possible JUMP or RESET command received.
Response status = 10107 (0x277b) kStatusRomLdrUnknownCommand
Wrote 160 of 176 bytes.

So I ran the blhost with the debug (-d) flag and got the following messages printed:

Inject command 'receive-sb-file'
Preparing to send 176 (0xb0) bytes to the target.
[01 00 08 00 08 01 00 01 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00]
<03 00 0c 00 a0 00 00 02 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00>
Successful generic response to command 'receive-sb-file'
<>
[02 00 20 00 e9 fa e7 22 fa b2 5f a9 16 e6 89 2b d1 c3 3d 91 5b 62 b7 04 53 54 4d 50 01 02 00 00 0b 00 00 00]
(1/1)18%<>
[02 00 20 00 07 00 00 00 00 00 00 00 00 00 07 00 06 00 01 00 01 00 43 3f 73 67 74 6c 80 f8 ca 3a 70 fb 01 00]
(1/1)36%<>
[02 00 20 00 09 99 00 00 09 99 00 00 09 99 00 00 09 99 00 00 09 99 00 00 09 99 00 00 00 00 fc a4 87 73 4d 54]
(1/1)54%<>
[02 00 20 00 00 00 00 00 08 00 00 00 01 00 00 00 01 00 00 00 5e 01 01 00 00 00 00 00 01 00 00 00 01 00 00 00]
(1/1)72%<>
[02 00 20 00 62 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9a f9 dc 18 57 57 ab b5 1c fe 9e 76 6a ff 06 e1]
(1/1)90%<03 00 00 00 62 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9a f9 dc 18 57 57 ab b5 1c fe 9e 76 6a ff 06 e1>
usb hid detected receiver data abort
Data phase write aborted by status 0x2712 kStatus_AbortDataPhase
Possible JUMP or RESET command received.
<03 00 0c 00 a0 00 00 02 7b 27 00 00 08 00 00 00 00 00 00 00 9a f9 dc 18 57 57 ab b5 1c fe 9e 76 6a ff 06 e1>
- took 0.117 seconds
Response status = 10107 (0x277b) kStatusRomLdrUnknownCommand
Wrote 160 of 176 bytes.

The reset command sent by the blhost directly (without a SB file) prints the following message (with -d flag):

Inject command 'reset'
[01 00 04 00 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00]
<03 00 0c 00 a0 00 00 02 00 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00>
Successful generic response to command 'reset'
- took 0.021 seconds
Response status = 0 (0x0) Success.

 

The same reset SB File works as expected with the flashloader from the KBOOT package, as well as with the FLASH based Bootloader.

 

Summary: reset command from a SB file to the factory flashloader doesn't  work.

 

Any ideas on where is the problem?

Is the elftosb creating a faulty SB file? Then the Flash based bootloader wouldn't work.

Is the blhost sending wrong commands to the microcontroller? The the Flash based bootloader wouldn't work too.

 

I currently believe this is a problem with the factory bootloader.

 

Cheers,

Bruno Albrecht

Outcomes