CC2538/CC26xx Serial Bootloader Interface (Rev. A)

1 1 SWRA466A February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterfaceApplicati onReportSWRA466A February2015 RevisedMay 2015CC2538/CC26xxSerialBootloaderInterfa ceAasmundBoeABSTRACTT hisapplicationreportprovidesa briefoverviewon the serialbootloaderthat residesin ROMon theCC2538and CC13 documentshowshow the bootloaderprotocolcan be usedtoperformbasicoperationslike erasingand programmingthe flashof the devicebootloaderssupportuniversalasynchr onousreceiver/transmitter(UART)and serialperipheralinterface(SPI)as exampleprojectis createdin VisualStudio , VisualStudioExpress2010and utilizesa librarycalledSerialBootloaderLibraryto demonstratean implementationof the serialbootloaderprotocolon Windows.

2 ThisapplicationreportcoversUARTand is intendedto be usedwith associatedexamplefile, whichcanbe downloadedfromthe followingURL: (SBL).. of Figures1 SimplifiedFlowchartfor EnteringBootloader( cc26xx )..32 SequenceChartfor Sendand ping the to TX and RX Pinson SBL of Tables1 Addressof 8-BitBootloaderConfigurationField( cc2538 variants).. 32-BitBootloaderConfigurationField(CC26x xflashvariants).. February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538 ,Windowsare registeredtrademarksof MicrosoftCorporationin the UnitedStatesand/orothercountries,or othertrademarksare the propertyof parameter:FLASH image valid?Enter ROM Bootloader (Serves commands ifBL enabled)NoCCFG parameter:BL backdoor enabled?

3 YesCCFG == Level?YesEnter FLASH February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterface1 IntroductionThe mainpurposeof the CC2538and cc26xx (1)ROMbootloaderis to supportfunctionalityforprogramminga flashimageinto the deviceflashovereitherSPI or scopeof this documentis to showhow to use the bootloaderto performbasicoperationslike erasingand documentusesUARTas the bootloadertransportationlayer.(1)This documentrefersto the CC13xx/CC26xxdevicefamilyas CC26xxfor built-inbootloaderon the CC2538and CC26xxdevicesstartrunningaftera power-onresetif thereisno validapplicationimagein flash,determinedby an imagevalid field in the customerconfigurationarea(CCA/CCFG).

4 Alternatively,the bootloaderstartif the so-calledbootloaderbackdooris enabledand the associatedpinthat opensthe backdooris set to the the bootloaderis activated,it is readyforcommunicatingwith an externalhost 10 ms CC2538and CC26xxROMbootloaderssupportcommandsthat can readthe flash,it is alsopossibleto disablethe bootloaderentirelyfor bootloaderand backdoorfunctionalityis configuredin the showsas simplifiedflow chartfor the flow is similarfor SimplifiedFlowchartfor EnteringBootloader( cc26xx ) February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538 customerconfigurationareafor CC2538is calledCCAand is placedin the uppermostflashpage,sothe absoluteaddressof the CCAdependson the 8-bitfield in the CCAconfiguresthe bootloaderbackdoorfunctionality(byteoffs et0x7D7).

5 Table1 lists the absoluteaddressof this bytefor Addressof 8-BitBootloaderConfigurationField( cc2538 variants) cc2538 VariantBootloaderConfigurationAddressCx2 538xF53(512KB flash) (256KB flash) (128KB flash) structureof the bootloaderconfigurationbyte is shownin Table2. The pins that can openthebootloaderbackdoorare PA0 - to use by writinga valuefrom0 to 7 in the threeleastsignificantbits of the all disablebackdoorfunction10 Backdoorand bootloaderdisable1 Backdoorand bootloaderenable3 LevelSetsactivelevelfor selectedpin on pad A10 Activelow1 Activehigh2-0 Pin numberThe number(0 - 7) of the pin on pad A that is usedwhenbackdooris (7) February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538 customerconfigurationareafor CC26xxis calledCCFGand is locatedin the uppermostflashpage,so the absoluteaddressof the CCFG dependson the deviceflashsize(1).

6 A 32-bitfield in the CCFG configuresthe bootloaderand backdoorfunctionality(byteoffset0xFD8).T able3 lists the absoluteaddressof this field for differentCC26xxflashversions.(1)The CC26xxCCFGis also memorymappedwith readaccessto Addressof 32-BitBootloaderConfigurationField(CC26x xflashvariants)CC26xxVariantBootloaderCo nfigurationAddress128 structureof the bootloaderconfigurationfield is shownin Table4. The configurationstructureis littleendian,meaningthat the leastsignificantbyte is at the to use by writingthe DIO numberto the secondbyte of the CC26xxBL_BACKDOOR_CONFIGP arameterEncodingBitFieldValueDescription ByteOffsetDefaultValue31-24 EnablebootloaderEnableand disablebootloader0xFDB0xC50xC5 BootloaderenabledAny othervalueBootloaderdisabled23-17 Reserved00xFDA0xFE16 LevelSetsthe activelevelof the numberof the I/O pin that is levelcheckedif the bootloaderbackdooris disablesthe CC2538and CC26xxbootloaderusesthe sameformatfor receivingand actualsignalingon SPI and UART transportationlayersis different.

7 But the packetformatremainsthe shownin Table5 and eachfield is describedin ROMB ootloaderPacketFormatSize(1 Byte)Checksum(1 Byte)Databyte NTable6. PacketFormatFieldDescriptionPacketFieldS ize(bytes)DescriptionSize1 The numberof bytesin the packet,includingthe size checksumof the checksumalgorithmis the sum of the databytestruncatedto ( data)mod256 Data0-253 The first databyte is typicallythe Bootloader s size of packet (1B)Send packet checksum (1B)Send Byte ACK/NACKA wait ACKRead sizeGet checksumGet Packet DataCalculate checksumSend Byte NWait for non-zero dataSignal February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterfacePacketsen dand packetreceivemustadhereto the simpleprotocolshownin Figure2.

8 Boththe hostdeviceand the cc2538 /CC26xxbootloadercan act as senderand host devicebecomesthereceiverwhenit waitsfor a dataresponsefromthe moredetailsaboutthe communicationprotocol,see theCC2538 ROMUser'sGuide(SWRU333) [1]and theCC26xxTechnicalReferenceManual(SWCU11 7) [2].Figure2. SequenceChartfor Sendand receivershouldrespondwith an acknowledgment(ACK)or not-acknowledged(NACK)to indicatewhetherthe commandwas receivedproperlyor not. The ACKand NACK signatureis shownin hardwarepins usedby the ROMbootloaderto communicateoverUARTand SPI are SerialInterfaceConfigurationSignalCC2538 CC26xxEM PinQFN48/7x7 QFN32/5x5 QFN32 February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterfaceThe bootloaderselectsthe first interfaceaccessedby the inactiveinterface(UARTorSPI)will be switchto the otherinterface,the devicemustbe resetusing,for example, UART dataformatis fixedat 8 databits, no parity,and one UART bootloaderutilizesautodetectionof the baudrate describedin ; therefore,any baudrate belowthe maximumcan be used.

9 MaximumUART baudrate for cc2538 :460800baud(1) MaximumUART baudrate for CC26 M baud(1)This datarate numbercan be doubledif an external32 MHzcrystaloscillatoris in use and selectedusingthe re-establishedaftercallingthis command( ). bareminimumneededto establishcommunicationwith the bootloaderoverUARTis showninFigure3, whichincludessendingtwo byteswith the value0x55to let the devicedetectthe baudrate,followedby readingthe deviceresponse,expectingan ACKif the autobaudrate routinewas devicedoesnot respondto the autobaudbytes,it may not be in bootloadermode,or the baudrate isnot connectionhas beenmade,any commandcan be sent to the completelist ofbootloadercommandscan be foundin [1] and [2] for CC2538and cc26xx , SequenceChartfor checkthe statusof the Bootloader ,the CMD_GET_STATUS commandcan be used.

10 This shouldbeusedaftererasingor writingthe flashmemoryto be surethat the eraseand possiblestatuscodesfor the CMD_GET_STATUS commandare shownin PossibleStatusReturnValuesFromBootloader StatusDefinitionValueDescriptionCOMMAND_ RET_SUCCESS0x40 Statusfor successfulcommandCOMMAND_RET_UNKNOWN_CMD 0x41 Statusfor unknowncommandCOMMAND_RET_INVALID_CMD0x4 2 Statusfor invalidcommand(incorrectpacketsize)COMMA ND_RET_INVALID_ADR0x43 Statusfor invalidinputaddressCOMMAND_RET_FLASH_FAI L0x44 Statusfor failedattemptto programor erasethe flashApplicationping()CMD_PINGSBLB ootlloaderSBL_SUCCESSACKS erialBootloaderLibrary(SBL) February2015 RevisedMay 2015 SubmitDocumentationFeedbackCopyright 2015,TexasInstrumentsIncorporatedCC2538/ CC26xxSerialBootloaderInterface3 SerialBootloaderLibrary(SBL)The SBL is a PC libraryfor MicrosoftWindowsthat implementsa host API for communicatingwith theCC2538and SBL libraryprojectis createdin VisualStudioC++ serialbootloaderlibraryusesWindowsAPI to communicatewith the serialCOMport andthereforeis not functionsin SBL are synchronous;meaningthat the functionwill not returnuntil ACKor NACK havebeenreceivedor an errorhas demonstratesa sequencechartof the SBLping() SequenceChartfor pingFunctionCallAll bootloadercommandscan be accessedthroughfunctionswithinSBL.