痞子衡嵌入式：恩智浦i.MX RTxxx系列MCU啓動那些事（3）- Serial ISP模式(blhost)

---

　　你們好，我是痞子衡，是正經搞技術的痞子。今天痞子衡給你們介紹的是恩智浦i.MX RTxxx系列MCU的Serial ISP模式。

　　在上一篇文章 Boot配置(ISP Pin, OTP) 裏痞子衡爲你們介紹了i.MXRTxxx Boot的行爲配置，其中第1.2節裏講了Boot有三類行爲模式：Serial ISP、Serial Boot、Device Boot，後兩種都是跟App啓動執行相關的行爲模式，而Serial ISP模式則是相對獨立的Flash下載功能，有了Serial ISP，即可省去專用Flash編程器，今天痞子衡就來詳細聊一聊Serial ISP模式。

　　痞子衡在前面已經講過Serial ISP模式是一種串行編程模式，在這種模式下，BootROM經過指定的UART/SPI/I2C/USB-HID口來接收來自Host（恩智浦提供了上位機工具blhost.exe或者MCUBootUtility）的Application數據，並將數據下載進i.MXRTxxx支持的全部外部非易失性存儲器中，爲後續從外部存儲器啓動作準備。

1、進入Serial ISP模式

　　i.MXRTxxx上電永遠是從ROM啓動去執行BootROM程序，最頂層的Boot行爲模式由OTP memory裏的PRIMARY_BOOT_SRC[3:0]位和芯片外部ISP[2:0]管腳狀態共同決定。假設咱們正處於研發階段，PRIMARY_BOOT_SRC[3:0]並未燒寫，那想進入Serial ISP模式最直接的方式即是將ISP[2:0]輸入狀態撥成3'b110，在設計i.MXRTxxx的硬件板時ISP[2:0] pins應設計成可經過撥碼開關選擇輸入電平，下圖是RT600-EVK板（Rev.E）的參考設計：

　　撥碼開關SW5應撥向SW_DIP-6的6，即設置ISP[2:0]=3'b110，此時便直接進入了Serial ISP模式。

2、blhost的使用

　　進入了Serial ISP模式，此時即可以用恩智浦提供的host工具與BootROM進行命令交互，host工具在 MCUBootUtility包 裏。下載好MCUBootUtility包以後，在\MCUBootUtility\Tools\blhost2_3\win下能夠找到用於與BootROM通訊的blhost.exe。

2.1 支持的通訊外設pinout

　　BootROM支持四種通訊外設，分別是UART/SPI/I2C/USB-HID（其中UART和USB比較經常使用），pinout以下（Pinout適用RT600）：

2.2 blhost用法

　　blhost.exe是命令行工具，使用blhost能夠經過上述UART/SPI/I2C/USB-HID口與BootROM進行通訊與命令交互。
　　在命令行下打開blhost.exe，輸入-?命令能夠看到blhost使用幫助，blhost支持的命令不少：

PS D:\NXP-MCUBootUtility\tools\blhost2_3\win> .\blhost.exe
usage: D:\NXP-MCUBootUtility\tools\blhost2_3\win\blhost.exe
                                                                      [-?|--help]
                                                                      [-p|--port <name>[,<speed>]]
                                                                      [-u|--usb [[[<vid>,]<pid>]]]
                                                                      [-t|--timeout <ms>]
                                                                      -- command <args...>

Options:
  -?/--help                    Show this help
  -p/--port <name>[,<speed>]   Connect to target over UART. Specify COM port
                               and optionally baud rate
                                 (default=57600)
                                 If -ftbi, then port is BusPal port
  --ftdi spi[,<speed>,<polarity>,<phase>,lsb|msb] |
              i2c[,<address>,<speed>]
                               Use SPI or I2C for BusPal<-->Target link
                               All parameters between square brackets are
                               optional, but preceding parameters must be
                               present or marked with a comma.
                               (ex. -b spi,1000,0,1) (ex. --ftdi spi,1000,,lsb)
                                 spi:  speed(KHz),
                                       polarity(0=active_high | 1=active_low),
                                       phase(0=rising_edge | 1=falling_edge),
                                       "lsb" | "msb"
                                       (default=100,1,1,msb)
                                 i2c:  address(7-bit hex), speed(KHz)
                                       (default=0x10,100)
  -u/--usb [[[<vid>,]<pid>] | [<path>]]
                               Connect to target over USB HID device denoted by
                               vid/pid (default=0x15a2,0x0073) or device path
  -t/--timeout <ms>            Set packet timeout in milliseconds
                                 (default=5000)

Memory ID:
  Internal Memory              Device internal memory space
    0                            Internal Memory
                                 (Default selected memory)
    16 (0x10)                    Execute-only region on internal flash
                                 (Only used for flash-erase-all)
  Mapped External Memory       The memories that are remapped to internal space,
                               and must be accessed by internal addresses.
                               (IDs in this group are only used for flash-erase-all and
                               configure-memory, and ignored by write-memory, read-memory,
                               flash-erase-region and flash-image(use default 0))
    1                            QuadSPI Memory
    9                            FlexSPI NOR Memory
  Unmapped External Memory     Memories which cannot be remapped to internal space,
                               and only can be accessed by memories' addresses.
                               (Must be specified for all commands with <memoryId> argument)
    272 (0x110)                  SPI NOR/EEPROM Memory
    288 (0x120)                  uSDHC SD Memory
    289 (0x121)                  uSDHC MMC Memory

** Note that not all memories are supported on all platforms.

Command:
  reset                        Reset the chip
  get-property <tag> [<memoryId> | <index>]
                               Return bootloader specific property.
                               <memoryId> and <index> are required by some properties.
                               <memoryId> = 0, <index> = 0, if not specified.
                               <memoryId> and <index> are ignored for the other properties.
                               If <index> is over the range supported by the device, bootloader
                               will treat as <index> = 0.

    1                          Bootloader version
    2                          Available peripherals
    3                          Start of program flash, <index> is required
    4                          Size of program flash, <index> is required
    5                          Size of flash sector, <index> is required
    6                          Blocks in flash array, <index> is required
    7                          Available commands
    9                          Last Error
    10                         Verify Writes flag
    11                         Max supported packet size
    14                         Start of RAM, <index> is required
    15                         Size of RAM, <index> is required
    23                         QuadSpi initialization status
    24                         Target version
    25                         External memory attrubutes, <memoryId> is required
    27                         Flash page size, <index> is required
    28                         Interrupt notifier pin
    29                         FFR key store update option
  set-property <tag> <value>
    10                         Verify Writes flag
    28                         Interrupt notifier pin
                               <value>:
                                   bit[31] for enablement, 0: disable, 1: enable
                                   bit[7:0] for GPIO pin index
                                   bit[15:8] for GPIO port index
    29                         FFR key store update option
                               <value>:
                                   0 for Keyprovisioning
                                   1 for write-memory
  flash-erase-region <addr> <byte_count> [memory_id]
                               Erase a region of flash according to [memory_id].
  flash-erase-all [memory_id]  Erase all flash according to [memory_id],
                               excluding protected regions.
  read-memory <addr> <byte_count> [<file>] [memory_id]
                               Read memory according to [memory_id] and write to file
                               or stdout if no file specified
  write-memory <addr> [<file>[,byte_count]| {{<hex-data>}}] [memory_id]
                               Write memory according to [memory_id] from file
                               or string of hex values,
                               e.g. data.bin (writes entire file)
                               e.g. data.bin 8 (writes first 8 bytes from file)
                               e.g. "{{11 22 33 44}}" (w/quotes)
                               e.g. {{11223344}} (no spaces)
  fill-memory <addr> <byte_count> <pattern> [word | short | byte]
                               Fill memory with pattern; size is
                               word (default), short or byte
  receive-sb-file <file>       Receive SB file
  execute <addr> <arg> <stackpointer>
                               Execute at address with arg and stack pointer
  call <addr> <arg>            Call address with arg
  configure-memory <memory_id> <internal_addr>
                               Apply configuration block at internal memory address
                               <internal_addr> to memory with ID <memory_id>
  key-provisioning <operation> [arguments...]
                               <enroll>
                                   Key provisioning enroll. No argument for this operation
                               <set_user_key> <type> <file>[,<size>]
                                   Send the user key specified by <type> to bootloader. <file> is
                                   the binary file containing user key plaintext. If <size> is not
                                   specified, the entire <file> will be sent. Otherwise, only send
                                   the first <size> bytes
                               <set_key> <type> <size>
                                   Generate <size> bytes of the key specified by <type>
                               <write_key_nonvolatile> [memoryID]
                                   Write the key to a nonvolatile memory
                               <read_key_nonvolatile> [memoryID]
                                   Load the key from a nonvolatile memory to bootloader
                               <write_key_store> <file>[,<size>]
                                   Send the key store to bootloader. <file> is the binary file
                                   containing key store. If <size> is not specified, the entire
                                   <file> will be sent. Otherwise, only send the first <size> bytes
                               <read_key_store> <file>
                                   Read the key store from bootloader to host(PC). <file> is the
                                   binary file to store the key store
  flash-image <file> [erase] [memory_id]
                               Write a formated image <file> to memory with ID
                               <memory_id>. Supported file types: SRecord
                               (.srec and .s19) and HEX (.hex). Flash is erased
                               before writing if [erase]=erase. The erase unit
                               size depends on the target and the minimum erase
                               unit size is 1K.
  list-memory                  List all on-chip Flash and RAM regions, and off-chip
                               memories, supported by current device.
                               Only the configured off-chip memory will be list.
  efuse-program-once <addr> <data> [nolock/lock]
                               Program one word of OCOTP Field
                               <addr> is ADDR of OTP word, not the shadowed memory address.
                               <data> is hex digits without prefix '0x'
  efuse-read-once <addr>
                               Read one word of OCOTP Field
                               <addr> is ADDR of OTP word, not the shadowed memory address.
  generate-key-blob <dek_file> <blob_file>
                               Generate the Blob for given Dek Key
                               <dek_file> - input, a binary Dek Key (128 Bits) generated by CST tool.
                               <blob_file> - output, a generated blob (72 Bytes) in binary format.

** Note that not all commands/properties are supported on all platforms.

　　當使用串口轉USB模塊鏈接i.MXRTxxx的Flexcomm UART0或者使用USB Cable鏈接上USB1口後能夠看到PC設備管理器會識別出相關設備：

　　讓咱們嘗試一下使用blhost與BootROM通訊，先試一下USB通訊:

PS D:\NXP-MCUBootUtility\tools\blhost2_3\win> .\blhost.exe -u 0x1fc9,0x0020 -- get-property 1

Inject command 'get-property'
Response status = 0 (0x0) Success.
Response word 1 = 1258487808 (0x4b030000)
Current Version = K3.0.0

　　再接着試一下UART通訊，彷佛通訊失敗了。須要注意的是，當使用USB通訊過一次以後，BootROM已經激活USB外設，不會再去檢測其餘外設（包括UART），若是想使用UART通訊，須要將板子reset一次，使BootROM重回外設檢測狀態。

PS D:\NXP-MCUBootUtility\tools\blhost2_3\win> .\blhost.exe -p COM25 -- get-property 1

Error: Initial ping failure: No response received for ping command.

3、下載更新Application示例

　　由於BootROM支持啓動的外部存儲器不少，因此Serial ISP模式下進行Application更新操做要指定具體的外部存儲器類型。在上一節blhost的命令幫助裏，咱們能夠看到Memory ID裏已經給各類外部儲存器分配了ID號，在使用blhost命令時使用不一樣的ID號便可操做相應外部存儲器。
　　其實BootROM裏已經把外部存儲器的下載更新Application操做封裝得很簡單也很統一，咱們其實只須要3步操做便可完成Application的下載。以備份啓動的1bit SPI NOR爲例（即Flexcomm SPI NOR Memory，Memory ID=0x110）：

// 在SRAM裏臨時存儲1bit SPI NOR配置數據
blhost -p COMx -- fill-memory 0x1C000 0x4 0xC0300000 // Flexcomm SPI3, NOR Flash

// 使用1bit SPI NOR配置數據去配置Flexcomm SPI接口
blhost -p COMx -- configure-memory 0x110 0x1C000

// 擦除1bit SPI NOR並將image下載進1bit SPI NOR
blhost -p COMx -- flash-erase-region 0x0 0x20000 0x110
blhost -p COMx -- write-memory 0x1000 bt_image.bin 0x110

　　其中bt_image.bin是填充了Image類型數據的Application鏡像，關於上述命令的具體意義痞子衡會在後續Serial(1-bit SPI) NOR恢復啓動的文章裏詳盡解釋，這裏只是給你們一個初步體驗。

　　至此，恩智浦i.MX RTxxx系列MCU的Serial ISP模式痞子衡便介紹完畢了，掌聲在哪裏~~~