CC2538/CC26xx Serial Bootloader Interface (Rev. …

1 1 SWRA466A February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterfaceApplicati onReportSWRA466A February2015 RevisedMay 2015CC2538/CC26xxSerialBootloaderInterfa ceAasmundBoeABSTRACTT hisapplicationreportprovidesa briefoverviewon the serialbootloaderthat residesin ROMon theCC2538and CC13 documentshowshow the bootloaderprotocolcan be usedtoperformbasicoperationslike erasingand programmingthe flashof the devicebootloaderssupportuniversalasynchr onousreceiver/transmitter(UART)and serialperipheralinterface(SPI)as exampleprojectis createdin VisualStudio , VisualStudioExpress2010and utilizesa librarycalledSerialBootloaderLibraryto demonstratean implementationof the serialbootloaderprotocolon Windows .ThisapplicationreportcoversUARTand is intendedto be usedwith associatedexamplefile, whichcanbe downloadedfromthe followingURL: (SBL).

2 Of Figures1 SimplifiedFlowchartfor EnteringBootloader( cc26xx )..32 SequenceChartfor Sendand ping the to TX and RX Pinson SBL of Tables1 Addressof 8-BitBootloaderConfigurationField( cc2538 variants).. 32-BitBootloaderConfigurationField(CC26x xflashvariants).. February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538 ,Windowsare registeredtrademarksof MicrosoftCorporationin the UnitedStatesand/orothercountries,or othertrademarksare the propertyof parameter:FLASH image valid?Enter ROM Bootloader (Serves commands ifBL enabled)NoCCFG parameter:BL backdoor enabled?YesCCFG == Level?YesEnter FLASH February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterface1 IntroductionThe mainpurposeof the CC2538and cc26xx (1)ROMbootloaderis to supportfunctionalityforprogramminga flashimageinto the deviceflashovereitherSPI or scopeof this documentis to showhow to use the bootloaderto performbasicoperationslike erasingand documentusesUARTas the bootloadertransportationlayer.

3 (1)This documentrefersto the CC13xx/CC26xxdevicefamilyas CC26xxfor built-inbootloaderon the CC2538and CC26xxdevicesstartrunningaftera power-onresetif thereisno validapplicationimagein flash,determinedby an imagevalid field in the customerconfigurationarea(CCA/CCFG).Alte rnatively,the bootloaderstartif the so-calledbootloaderbackdooris enabledand the associatedpinthat opensthe backdooris set to the the bootloaderis activated,it is readyforcommunicatingwith an externalhost 10 ms CC2538and CC26xxROMbootloaderssupportcommandsthat can readthe flash,it is alsopossibleto disablethe bootloaderentirelyfor bootloaderand backdoorfunctionalityis configuredin the showsas simplifiedflow chartfor the flow is similarfor SimplifiedFlowchartfor EnteringBootloader( cc26xx ) February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538 customerconfigurationareafor CC2538is calledCCAand is placedin the uppermostflashpage,sothe absoluteaddressof the CCAdependson the 8-bitfield in the CCAconfiguresthe bootloaderbackdoorfunctionality(byteoffs et0x7D7).

4 Table1 lists the absoluteaddressof this bytefor Addressof 8-BitBootloaderConfigurationField( cc2538 variants) cc2538 VariantBootloaderConfigurationAddressCx2 538xF53(512KB flash) (256KB flash) (128KB flash) structureof the bootloaderconfigurationbyte is shownin Table2. The pins that can openthebootloaderbackdoorare PA0 - to use by writinga valuefrom0 to 7 in the threeleastsignificantbits of the all disablebackdoorfunction10 Backdoorand bootloaderdisable1 Backdoorand bootloaderenable3 LevelSetsactivelevelfor selectedpin on pad A10 Activelow1 Activehigh2-0 Pin numberThe number(0 - 7) of the pin on pad A that is usedwhenbackdooris (7) February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538 customerconfigurationareafor CC26xxis calledCCFGand is locatedin the uppermostflashpage,so the absoluteaddressof the CCFG dependson the deviceflashsize(1).

5 A 32-bitfield in the CCFG configuresthe bootloaderand backdoorfunctionality(byteoffset0xFD8).T able3 lists the absoluteaddressof this field for differentCC26xxflashversions.(1)The CC26xxCCFGis also memorymappedwith readaccessto Addressof 32-BitBootloaderConfigurationField(CC26x xflashvariants)CC26xxVariantBootloaderCo nfigurationAddress128 structureof the bootloaderconfigurationfield is shownin Table4. The configurationstructureis littleendian,meaningthat the leastsignificantbyte is at the to use by writingthe DIO numberto the secondbyte of the CC26xxBL_BACKDOOR_CONFIGP arameterEncodingBitFieldValueDescription ByteOffsetDefaultValue31-24 EnablebootloaderEnableand disablebootloader0xFDB0xC50xC5 BootloaderenabledAny othervalueBootloaderdisabled23-17 Reserved00xFDA0xFE16 LevelSetsthe activelevelof the numberof the I/O pin that is levelcheckedif the bootloaderbackdooris disablesthe CC2538and CC26xxbootloaderusesthe sameformatfor receivingand actualsignalingon SPI and UART transportationlayersis different,but the packetformatremainsthe shownin Table5 and eachfield is describedin ROMB ootloaderPacketFormatSize(1 Byte)Checksum(1 Byte)Databyte NTable6.

6 PacketFormatFieldDescriptionPacketFieldS ize(bytes)DescriptionSize1 The numberof bytesin the packet,includingthe size checksumof the checksumalgorithmis the sum of the databytestruncatedto ( data)mod256 Data0-253 The first databyte is typicallythe Bootloader s size of packet (1B)Send packet checksum (1B)Send Byte ACK/NACKA wait ACKRead sizeGet checksumGet Packet DataCalculate checksumSend Byte NWait for non-zero dataSignal February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterfacePacketsen dand packetreceivemustadhereto the simpleprotocolshownin Figure2. Boththe hostdeviceand the cc2538 /CC26xxbootloadercan act as senderand host devicebecomesthereceiverwhenit waitsfor a dataresponsefromthe moredetailsaboutthe communicationprotocol,see theCC2538 ROMUser'sGuide(SWRU333) [1]and theCC26xxTechnicalReferenceManual(SWCU11 7) [2].

7 Figure2. SequenceChartfor Sendand receivershouldrespondwith an acknowledgment(ACK)or not-acknowledged(NACK)to indicatewhetherthe commandwas receivedproperlyor not. The ACKand NACK signatureis shownin hardwarepins usedby the ROMbootloaderto communicateoverUARTand SPI are SerialInterfaceConfigurationSignalCC2538 CC26xxEM PinQFN48/7x7 QFN32/5x5 QFN32 February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterfaceThe bootloaderselectsthe first interfaceaccessedby the inactiveinterface(UARTorSPI)will be switchto the otherinterface,the devicemustbe resetusing,for example, UART dataformatis fixedat 8 databits, no parity,and one UART bootloaderutilizesautodetectionof the baudrate describedin ; therefore,any baudrate belowthe maximumcan be used.

8 MaximumUART baudrate for cc2538 :460800baud(1) MaximumUART baudrate for CC26 M baud(1)This datarate numbercan be doubledif an external32 MHzcrystaloscillatoris in use and selectedusingthe re-establishedaftercallingthis command( ). bareminimumneededto establishcommunicationwith the bootloaderoverUARTis showninFigure3, whichincludessendingtwo byteswith the value0x55to let the devicedetectthe baudrate,followedby readingthe deviceresponse,expectingan ACKif the autobaudrate routinewas devicedoesnot respondto the autobaudbytes,it may not be in bootloadermode,or the baudrate isnot connectionhas beenmade,any commandcan be sent to the completelist ofbootloadercommandscan be foundin [1] and [2] for CC2538and cc26xx , SequenceChartfor checkthe statusof the Bootloader ,the CMD_GET_STATUS commandcan be used;this shouldbeusedaftererasingor writingthe flashmemoryto be surethat the eraseand possiblestatuscodesfor the CMD_GET_STATUS commandare shownin PossibleStatusReturnValuesFromBootloader StatusDefinitionValueDescriptionCOMMAND_ RET_SUCCESS0x40 Statusfor successfulcommandCOMMAND_RET_UNKNOWN_CMD 0x41 Statusfor unknowncommandCOMMAND_RET_INVALID_CMD0x4 2 Statusfor invalidcommand(incorrectpacketsize)COMMA ND_RET_INVALID_ADR0x43 Statusfor invalidinputaddressCOMMAND_RET_FLASH_FAI L0x44 Statusfor failedattemptto programor erasethe flashApplicationping()CMD_PINGSBLB ootlloaderSBL_SUCCESSACKS erialBootloaderLibrary(SBL) February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterface3 SerialBootloaderLibrary(SBL)

9 The SBL is a PC libraryfor MicrosoftWindowsthat implementsa host API for communicatingwith theCC2538and SBL libraryprojectis createdin VisualStudioC++ serialbootloaderlibraryusesWindowsAPI to communicatewith the serialCOMport andthereforeis not functionsin SBL are synchronous;meaningthat the functionwill not returnuntil ACKor NACK havebeenreceivedor an errorhas demonstratesa sequencechartof the SBLping() SequenceChartfor pingFunctionCallAll bootloadercommandscan be accessedthroughfunctionswithinSBL;whichm akesit easyto executeoperationslike erasingand writingto the a moredetaileddescriptionof the ROMbootloaderand how to use all the serialcommands,see thedevice-specificROMuser s guide[1] [2]. functionwill returnwhetherthe desiredoperationwas successfulor not by list of the possiblereturnvaluesfromSBL functionsand possiblecausesfor themare presentedin SBLF unctionReturnValuesConstantNameValueCaus eSBL_SUCCESS0 Commandsuccessfullyexecutedby bootloaderSBL_ERROR1 Errorduringexecutionof commandSBL_ARGUMENT_ERROR2 SBL functionargumentsinvalidSBL_TIMEOUT_ERRO R3 Bootloaderresponsenot receivedwithina senddatato or receivedatafrombootloaderSBL_ENUM_ERROR5 Failedto enumerateCOMdevicesSBL_UNSUPPORTED_FUNCT ION6 Functionis not supportedfor the (SBL)9 SWRA466A February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538 overviewof the SBL API is shownin Table11.

10 API functionsthat directlymapto a bootloadercommandare markedwith an SBLF unctionsSBLF unctionNameBootloaderCMDD escriptionCC2538CC26xxCreateNANAS taticfunctionfor creatinga SBL ROMbootloaderenumerateNANAS taticfunctionfor enumeratingCOMportson supportedby sectorsin the bit read8 bit deviceCPUfromthe supportedby supportedby devicememoryusingCMD_MEMORY_READand a few commandsin the ROMbootloaderthat differbetweenCC2538and cc26xx ,this meansthat thereare also a few differencesin SBL functionsfor thesedevices;thesedifferencesare SBL functionthat is not supportedfor the chosenhardwarereturnsthe Device-SpecificSBLF unctionsSBLF unctionNameCC2538CC26xxDescriptioneraseF lashBank()Not supportedSupported(COMMAND_BANK_ERASE)Th is erasesall the flashsectorsfor cc26xx ;this can beachievedfor CC2538by usingeraseFlashRangefor supportedSupported(COMMAND_SET_CCFG)Not (CMD_SET_XOSCNot supportedNot (CMD_RUN)Not supportedNot implementedfor February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterface4 ExampleProjectThe exampleapplicationfor SBL is createdfor VisualStudioC++ 2010 Expressand is testedusingthehardwareincludedin the CC2538and a test applicationthat performsthe followingactionsusingthe CC2538or CC26xxROMbootloader.)