kinetis bootloader测试case

 

Contents
1、Blhost ：...
2

2、BCA..
7

3、BUS.
8

4、CRC.
9

1、Kibble_CRC_01.
10

2、Kibble_CRC_02.
10

5、flash.
11

1、Flash_Security_0001.
11

2、Flash_Fill_Memory_01.
13

3、Flash_Write_Memory_01.
13

4、Flash_Read_01.
14

5、Flash_Read_02.
14

6、FLash Call Command 01.
15

7、flash PFSize 01.
16

6、RAM...
17

1、RAM_Fill_Memory_01.
17

 

 

 

 

 

 

 

 

 

 

 

 

1、Blhost
：

Blhost是PC跟板子进行通信的软件，查看RD提供的文件中是否有blhost  ，路径\Kinetis_Bootloader_2_0_0_d1\bin

Blhost的使用手册路径

Desktop\Kinetis_Bootloader_2_0_0_d1\doc\Kinetis_blhost_User-s_Guide_review

 

1、Get-property命令可以查看板子的属性值，属性值可以在datasheet中找到，查看是否跟datasheet中一样

2、set-property可以配置板子可写的属性值，命令格式如下

Blhost -p COM*/-u -- set-property10/13/22 0/1

3、excute指令立即跳转到app

Demo写到指定 地址

blhost -u -- write-memory 0x8000 app_led_demo.bin

读取写入内容

blhost -u -- read-memory 0x8000 10 

The first word is the address of<stackpointer>, but with Little endian ,The second word  is the address of <addr>

地址单位是字，四个字节。（MCU是32位）

使用excute命令调到app

blhost -u -- execute
sencond_word_address 0 first_word_address

使用错误的地址，看是否跳不到app。如上两个红色参数分别设置错误

PC错误，不可跳到app。Stack错误，能跳到

4、blhost–u – flash-erase-region 0x0  100

5、blhost–u –write-memory 0x0  100

6、blhost–u --  read-memory 0x0  1000000 按住ctrl+c看是否中断读取

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

2、BCA

BCA （bootloaderconfiguration area）是可以配置bootloader的一段区域。它位于应用程序起始地址+0x3C0处。

Bootloader启动的时候会使用默认的配置，当启动完成后。可以在如上的地址处修改bootloader的配置

BCA开始四个字节称为tag，必须设置为‘kcfg’。

详细描述请参考\Kinetis_Bootloader_2_0_0_d1\doc\reference_manual中chapter2

Kcfg  in hex are   6B 6366 67

Flash –resident 中offset为0xa3c0

ROM中offset为0x3c0

如下截图在用户手册中截取，bit位置1表示使能，置0表示禁用

A、在offset处写入tag为kcfg，同时关闭外设（置00），重启。发现UART、I2C等外设都不能使用。

此时要想使外设能够使用，唯一的方法就是用j-link中的unlockkinetis命令擦除

Blhost -u -- write-memory $BCA_OFFSET "{{6B 63 66 67 FFFF FF FF FF FF FF FF FF FF FF FF 00}}"

B、在offset处写入错误的tag(kcxg)，同时关闭外设，重启。发现所有外设还能正常工作

Blhost -u -- write-memory $BCA_OFFSET "{{6B 63 78 67 FFFF FF FF FF FF FF FF FF FF FF FF 00}}"

 

1、测试timeout

下载app后，修改BCA中检测外设的timeout

配置BCA tag timeout设置为10s

Blhost -u -- write-memory 0x83c0 "{{6b63 66 67}}"

Blhost -u -- write-memory 0x83d0 "{{FF FF10 27}}"

2、bootflag设置，让直接进入app

 

Blhost -u -- write-memory 0x83d8 "{{ffff ff ff ff ff 00 ff}}"

 

3、配置BCA tag

Blhost -u -- write-memory 0x83c0  "{{6B 63 66 67 FF FF FF FF FF FF FF FF FFFF FF FF 00}}"

 

 

3、BUS

 

Bus就是总线，是连接各个部件的一组信号线。我们测试的总线有如下几种：UART、I2C、SPI、USB、CAN

1、 测试不同速率下的总线是否能正常工作

UART:

blhost.exe -p com12,9600 -- get-property 1

分别设置如下的速率，看能否正常工作

4800 9600 19200 38400 57600 115200 25600

 

USB:

blhost -u -- get-property 1

 

SPI:

blhost -p COM14 -b spi,5 -- get-property 1

10 20 50 100 200 500 1000 2000

 

I2C:

blhost -p COM14 -b i2c,0x10,5  -- get-property 1

5 50 100 400

2、 向内存写入大量数据，来判断驱动是否正常

blhost -t 100000 -p COM12 -- fill-memory 0x7C0020000 0X10

blhost -t 100000 -p COM12 -- read-memory0x7C00 20000

                其他外设依次设置

       3、配置peripheral高速模式下写入大量数据

blhost -p COMx -- flash-erase-all;

Reset the board

 blhost -p COM12,115200 -- get-property 1

blhost -t 10000 -p COM12,115200 --write-memory 0xa000 0x10000 0x10

blhost -t 10000 -p COM12,115200 --read-memory 0xa000 0x10000

3、 待解决

http://10.192.225.199/jqgrid/jqgrid/newpage/1/container/mainContent/oper/information/db/xt/table/testcase/element/16243/parent/0/ver/77582

 

 

 

 

4、CRC

BCA起始地址0xa000(startaddress of user application)+0x3c0(offset)

1、Kibble_CRC_01

 

blhost -u -- flash-erase-all

blhost -u -- write-memory 0xa3c0 "{{6b63 66 67 00 00 00 00 00 00 00 00 00 00 00 00}}" //BCA中CRC相关值写为0

blhost -u – reset

blhost -u -- get-property 8  //返回值应该为kStatus_AppCrcCheckInactive

 

2、Kibble_CRC_02

 

                A、

blhost -u -- flash-erase-all

blhost -u -- write-memory 0xa3c0 "{{6b63 66 67 00 00 00 00 00 00 00 00 ff ff ff ff}}"

blhost -u -- write-memory 0xa000 "{{ffff ff ff 01 00 00 00}}"// set a PC pointer which is used for thebootloader check process

blhost -u – reset

blhost -u -- get-property 8 //exceptreturn  value shoul be kStatus_AppCrcCheckOutOfRange

 

B、

blhost -u -- flash-erase-all

blhost -u -- write-memory 0xa3c0 "{{6b 63 66 67 ff ff ff ff 00 00 00 02 ff ff ff ff}}"

blhost -u -- write-memory 0xa000 "{{ffff ff ff 01 00 00 00}}"// set a PC pointer which is used for thebootloader check process

blhost -u -- reset

blhost -u -- get-property 8 //exceptreturn  value shoul be kStatus_AppCrcCheckOutOfRange

 

C、

blhost -u --flash-erase-all

blhost -u -- write-memory 0xa3c0 "{{ 6b 63 66 67 00 00 08 00 00 00 0002 ff ff ff ff }}"

blhost -u --write-memory 0xa000 "{{ff ff ff ff 01 00 00 00}}"// set a PC pointerwhich is used for the bootloader check process

blhost -u -- reset

blhost -u -- get-property 8 //exceptreturn  value shoul be kStatus_AppCrcCheckOutOfRange

 

 

5、flash

Flash configuration area 0x400-0x40c

 

1、Flash_Security_0001

这个case设计的目的是为了测试backdoorkey是否能工作。

1. blhost -p COMx -- get-property 17

   Expected  Result:Flash SecurityState=UNSECURE.

2. blhost -p COMx -- flash-erase-all

3. blhost -p COMx -- read-memory 0x400 16  ？？

   Expected Result:For no flash reserved(K80) bootloader, all the bytes are0xff.

                             For has flashreserved(KL25, K22, K64)bootloader, 0x40c is 0xfe, others are all 0xff.

4.blhost -p COMx -- write-memory 0x400"{{ 01 02 03 04 05 06 07 08 ff ff ff ff

   bfff ff ff}}"？？

5. blhost -p COMx -- reset

6. blhost -p COMx -- get-property 17

   Expected Result: Flash Security State=SECURE.

7.blhost -p COMx -- flash-security-disable0102030405060709 (Wrong Key)

   Expected Result:kStatus_FlashAccessError

8.blhost -p COMx -- reset

9.blhost -p COMx -- flash-security-disable0102030405060708 (Right Key)

   Expected Result:Success

10. blhost -p COMx -- get-property 17

   Expected Result: Flash Security State=UNSECURE

11. blhost -p COMx -- flash-erase-all

12. blhost -p COMx -- reset

13. blhost -p COMx -- get-property 17

   Expected Result: Flash Security State=SECURE.

14.blhost -p COMx --flash-erase-all-unsecure

Expected  Result:Flash Security State=UNSECURE.

 

2、Flash_Fill_Memory_01

 

将写的flash区域全部写满，然后读取，查看写入值是否正确

blhost -u -- flash-erase-all

blhost -u -- get-property 4          512KB

blhost -u -- get-property 12       30KB（0x0-0x77ff）

blhost -t 30000-u -- fill-memory 0x7800 493568 0xfe byte

blhost-t 30000 -u  -- read-memory 0x7800 493568

 3、Flash_Write_Memory_01

 

使用fill-memory的方法将flash写满，然后读取到一个txt文档里面。再通过write-memory的方式将flash写满

blhost -u --flash-erase-all

blhost -u --get-property 4          512KB

blhost -u --get-property 12       30KB（0x0-0x77ff）

blhost -t 30000-u -- fill-memory 0x7800 493568 0xfe byte

blhost -t 30000 -u  -- read-memory 0x7800 493568 C:\Users\public.ZCHLABB46681-12\Desktop\Kinetis_Bootloader_2_0_0_d1\bin\Tools\blhost\win\test.txt

blhost -u --flash-erase-all

blhost -t 30000 -u -- write-memory0x7800C:\Users\public.ZCHLABB46681-12\Desktop\Kinetis_Bootloader_2_0_0_d1\bin\Tools\blhost\win\test.txt

blhost -t 10000 -u  --read-memory 0x7800 493568

4、Flash_Read_01

Read once命令对应的读取96bitreserved区域。

读取的内容位于flash哪里？为何跟read-memory读取出来的值不一样？

 

blhost -u -- flash-read-once 0  4 
//read the program once field

blhost -u -- flash-read-resource 0x000000 256 0x00//read theIFR

blhost -u -- flash-read-resource 0x000000 8 0x01  //read the Version ID

 

 

5、Flash_Read_02

 

Test Point

1. Read/Write reserved regions

2. Read/Write address extend thewhole flash

3.Read/Write address more than a sector

4. Read/Write address not aligned,which include not aligned number and not aligned address

 

blhost -u -- read-memory 0x0000 10

blhost -u -- write-memory 0x0000"{{1122}}",// kStatusMemoryRangeInvalid

blhost -u -- get-property 4 //getflash size

blhost -u -- write-memory 0x80000"{{1122}}"// kStatus_FlashAlignmentError

bit位00对齐，100 、1000 1100换成16进制末尾是4、8、0

 

 

 

blhost -u -- get-property 5     //get sector size

blhost -u -- fill-memory 0xa0002052 0x11 byte    //success

 

6、FLash Call Command01

执行call命令

创建IAR工程，生成bin文件的代码如下：

#include "stdint.h"

#define RAM_BASE       (0x20002000ul)

int call_command()

{

  volatile uint32_t*ram_reg = (volatile uint32_t*) RAM_BASE;

  *ram_reg +=1;

  return 0;

}

IAR环境 配置

1 select binary in "Output Converter" .

2 select ” Cortex-M0+” in “GeneralOption->Target->Core”

3 fill "call_command" inLinker->Library->Override default program entry

blhost -p com# -- read-memory 0x20002000 1

blhost -p com# -- write-memory 0x20000000 L5k_call.bin

blhost -p com# -- call 0x20000001 0

blhost -p com# -- read-memory 0x20002000 1

  the value in0x20002000 should plus 1

 

 

 

7、flash PFSize 01

 

 

 

 

6、RAM

 

RAM测试跟flash的测试类似，将ram写满，然后读取，比较读取的内容跟写入的是否一致

1、RAM_Fill_Memory_01

 

blhost -u -- get-property 15     //get ram size

blhost -u -- get-property 14   //get ram start address

blhost -u -- get-property 12   //get ram reserved region

blhost -t 3000 -u -- fill-memory 0x1fff1298126312 0xfe byte  //fill the whole memorywith 0xfe

blhost -t 3000 -u -- read-memory 0x1fff0000131072 
//read the wholememory

 

2、RAM_Write_Memory_01

blhost -u -- get-property 15   //RAM Size = 128 KB

blhost -u -- get-property 14 //RAM Start Address = 0x1FFF0000

blhost -u -- get-property 12 //   RAM: 0x1FFF0000-0x1FFF1297

 blhost -t 30000 -u --fill-memory 0x1fff1298 126312 0xfe byte //fill the whole memory with 0xfe

blhost -t 30000 -u -- read-memory 0x1fff1298131072  C:\Users\public.ZCHLABB46681-12\Desktop\Kinetis_Bootloader_2_0_0_d1\bin\Tools\blhost\win\test.txt   //read memory to test_ram.txt

   blhost -t 10000 -u -- write-memory 0x1fff1298 C:\Users\public.ZCHLABB46681-12\Desktop\Kinetis_Bootloader_2_0_0_d1\bin\Tools\blhost\win\test_ram.txt    //write data to RAM

    blhost-t 10000 -u -- read-memory  0x1fff1298  131072  //read the writed memory