i.MXRTxxx Boot有三類行為模式：Serial ISP、Serial Boot、Device Boot，後兩種都是跟App啟動執行相關的行為模式，而Serial ISP模式則是相對獨立的Flash下載功能，有了Serial ISP，便可省去專用Flash編程器，今天痞子衡就來詳細聊一聊Se... ...
大家好，我是痞子衡，是正經搞技術的痞子。今天痞子衡給大家介紹的是恩智浦i.MX RTxxx系列MCU的Serial ISP模式。
在上一篇文章 Boot配置(ISP Pin, OTP) 里痞子衡為大家介紹了i.MXRTxxx Boot的行為配置，其中第1.2節里講了Boot有三類行為模式：Serial ISP、Serial Boot、Device Boot，後兩種都是跟App啟動執行相關的行為模式，而Serial ISP模式則是相對獨立的Flash下載功能，有了Serial ISP，便可省去專用Flash編程器，今天痞子衡就來詳細聊一聊Serial ISP模式。
痞子衡在前面已經講過Serial ISP模式是一種串列編程模式，在這種模式下，BootROM通過指定的UART/SPI/I2C/USB-HID口來接收來自Host（恩智浦提供了上位機工具blhost.exe或者MCUBootUtility）的Application數據，並將數據下載進i.MXRTxxx支持的所有外部非易失性存儲器中，為後續從外部存儲器啟動做準備。
一、進入Serial ISP模式
i.MXRTxxx上電永遠是從ROM啟動去執行BootROM程式，最頂層的Boot行為模式由OTP memory里的PRIMARY_BOOT_SRC[3:0]位和晶元外部ISP[2:0]管腳狀態共同決定。假設我們正處於研發階段，PRIMARY_BOOT_SRC[3:0]並未燒寫，那想進入Serial ISP模式最直接的方式便是將ISP[2:0]輸入狀態撥成3'b110，在設計i.MXRTxxx的硬體板時ISP[2:0] pins應設計成可通過撥碼開關選擇輸入電平，下圖是RT600-EVK板（Rev.E）的參考設計：
撥碼開關SW5應撥向SW_DIP-6的6，即設置ISP[2:0]=3'b110，此時便直接進入了Serial ISP模式。
二、blhost的使用
進入了Serial ISP模式，此時便可以用恩智浦提供的host工具與BootROM進行命令交互，host工具在 MCUBootUtility包 里。下載好MCUBootUtility包之後，在\MCUBootUtility\Tools\blhost2_3\win下可以找到用於與BootROM通信的blhost.exe。
2.1 支持的通信外設pinout
BootROM支持四種通信外設，分別是UART/SPI/I2C/USB-HID（其中UART和USB比較常用），pinout如下（Pinout適用RT600）：
2.2 blhost用法
blhost.exe是命令行工具，使用blhost可以通過上述UART/SPI/I2C/USB-HID口與BootROM進行通信與命令交互。
在命令行下打開blhost.exe，輸入-?命令可以看到blhost使用幫助，blhost支持的命令很多：
PS D:\NXP-MCUBootUtility\tools\blhost2_3\win> .\blhost.exe
usage: D:\NXP-MCUBootUtility\tools\blhost2_3\win\blhost.exe
[-?|--help]
[-p|--port <name>[,<speed>]]
[-u|--usb [[[<vid>,]<pid>]]]
[-t|--timeout <ms>]
-- command <args...>
Options:
-?/--help Show this help
-p/--port <name>[,<speed>] Connect to target over UART. Specify COM port
and optionally baud rate
(default=57600)
If -ftbi, then port is BusPal port
--ftdi spi[,<speed>,<polarity>,<phase>,lsb|msb] |
i2c[,<address>,<speed>]
Use SPI or I2C for BusPal<-->Target link
All parameters between square brackets are
optional, but preceding parameters must be
present or marked with a comma.
(ex. -b spi,1000,0,1) (ex. --ftdi spi,1000,,lsb)
spi: speed(KHz),
polarity(0=active_high | 1=active_low),
phase(0=rising_edge | 1=falling_edge),
"lsb" | "msb"
(default=100,1,1,msb)
i2c: address(7-bit hex), speed(KHz)
(default=0x10,100)
-u/--usb [[[<vid>,]<pid>] | [<path>]]
Connect to target over USB HID device denoted by
vid/pid (default=0x15a2,0x0073) or device path
-t/--timeout <ms> Set packet timeout in milliseconds
(default=5000)
Memory ID:
Internal Memory Device internal memory space
0 Internal Memory
(Default selected memory)
16 (0x10) Execute-only region on internal flash
(Only used for flash-erase-all)
Mapped External Memory The memories that are remapped to internal space,
and must be accessed by internal addresses.
(IDs in this group are only used for flash-erase-all and
configure-memory, and ignored by write-memory, read-memory,
flash-erase-region and flash-image(use default 0))
1 QuadSPI Memory
9 FlexSPI NOR Memory
Unmapped External Memory Memories which cannot be remapped to internal space,
and only can be accessed by memories' addresses.
(Must be specified for all commands with <memoryId> argument)
272 (0x110) SPI NOR/EEPROM Memory
288 (0x120) uSDHC SD Memory
289 (0x121) uSDHC MMC Memory
** Note that not all memories are supported on all platforms.
Command:
reset Reset the chip
get-property <tag> [<memoryId> | <index>]
Return bootloader specific property.
<memoryId> and <index> are required by some properties.
<memoryId> = 0, <index> = 0, if not specified.
<memoryId> and <index> are ignored for the other properties.
If <index> is over the range supported by the device, bootloader
will treat as <index> = 0.
1 Bootloader version
2 Available peripherals
3 Start of program flash, <index> is required
4 Size of program flash, <index> is required
5 Size of flash sector, <index> is required
6 Blocks in flash array, <index> is required
7 Available commands
9 Last Error
10 Verify Writes flag
11 Max supported packet size
14 Start of RAM, <index> is required
15 Size of RAM, <index> is required
23 QuadSpi initialization status
24 Target version
25 External memory attrubutes, <memoryId> is required
27 Flash page size, <index> is required
28 Interrupt notifier pin
29 FFR key store update option
set-property <tag> <value>
10 Verify Writes flag
28 Interrupt notifier pin
<value>:
bit[31] for enablement, 0: disable, 1: enable
bit[7:0] for GPIO pin index
bit[15:8] for GPIO port index
29 FFR key store update option
<value>:
0 for Keyprovisioning
1 for write-memory
flash-erase-region <addr> <byte_count> [memory_id]
Erase a region of flash according to [memory_id].
flash-erase-all [memory_id] Erase all flash according to [memory_id],
excluding protected regions.
read-memory <addr> <byte_count> [<file>] [memory_id]
Read memory according to [memory_id] and write to file
or stdout if no file specified
write-memory <addr> [<file>[,byte_count]| {{<hex-data>}}] [memory_id]
Write memory according to [memory_id] from file
or string of hex values,
e.g. data.bin (writes entire file)
e.g. data.bin 8 (writes first 8 bytes from file)
e.g. "{{11 22 33 44}}" (w/quotes)
e.g. {{11223344}} (no spaces)
fill-memory <addr> <byte_count> <pattern> [word | short | byte]
Fill memory with pattern; size is
word (default), short or byte
receive-sb-file <file> Receive SB file
execute <addr> <arg> <stackpointer>
Execute at address with arg and stack pointer
call <addr> <arg> Call address with arg
configure-memory <memory_id> <internal_addr>
Apply configuration block at internal memory address
<internal_addr> to memory with ID <memory_id>
key-provisioning <operation> [arguments...]
<enroll>
Key provisioning enroll. No argument for this operation
<set_user_key> <type> <file>[,<size>]
Send the user key specified by <type> to bootloader. <file> is
the binary file containing user key plaintext. If <size> is not
specified, the entire <file> will be sent. Otherwise, only send
the first <size> bytes
<set_key> <type> <size>
Generate <size> bytes of the key specified by <type>
<write_key_nonvolatile> [memoryID]
Write the key to a nonvolatile memory
<read_key_nonvolatile> [memoryID]
Load the key from a nonvolatile memory to bootloader
<write_key_store> <file>[,<size>]
Send the key store to bootloader. <file> is the binary file
containing key store. If <size> is not specified, the entire
<file> will be sent. Otherwise, only send the first <size> bytes
<read_key_store> <file>
Read the key store from bootloader to host(PC). <file> is the
binary file to store the key store
flash-image <file> [erase] [memory_id]
Write a formated image <file> to memory with ID
<memory_id>. Supported file types: SRecord
(.srec and .s19) and HEX (.hex). Flash is erased
before writing if [erase]=erase. The erase unit
size depends on the target and the minimum erase
unit size is 1K.
list-memory List all on-chip Flash and RAM regions, and off-chip
memories, supported by current device.
Only the configured off-chip memory will be list.
efuse-program-once <addr> <data> [nolock/lock]
Program one word of OCOTP Field
<addr> is ADDR of OTP word, not the shadowed memory address.
<data> is hex digits without prefix '0x'
efuse-read-once <addr>
Read one word of OCOTP Field
<addr> is ADDR of OTP word, not the shadowed memory address.
generate-key-blob <dek_file> <blob_file>
Generate the Blob for given Dek Key
<dek_file> - input, a binary Dek Key (128 Bits) generated by CST tool.
<blob_file> - output, a generated blob (72 Bytes) in binary format.
** Note that not all commands/properties are supported on all platforms.
當使用串口轉USB模塊連接i.MXRTxxx的Flexcomm UART0或者使用USB Cable連接上USB1口後可以看到PC設備管理器會識別出相關設備：
讓我們嘗試一下使用blhost與BootROM通信，先試一下USB通信:
PS D:\NXP-MCUBootUtility\tools\blhost2_3\win> .\blhost.exe -u 0x1fc9,0x0020 -- get-property 1
Inject command 'get-property' Response status = 0 (0x0) Success. Response word 1 = 1258487808 (0x4b030000) Current Version = K3.0.0
再接著試一下UART通信，似乎通信失敗了。需要註意的是，當使用USB通信過一次之後，BootROM已經激活USB外設，不會再去檢測其他外設（包括UART），如果想使用UART通信，需要將板子reset一次，使BootROM重回外設檢測狀態。
PS D:\NXP-MCUBootUtility\tools\blhost2_3\win> .\blhost.exe -p COM25 -- get-property 1
Error: Initial ping failure: No response received for ping command.
三、下載更新Application示例
因為BootROM支持啟動的外部存儲器很多，所以Serial ISP模式下進行Application更新操作要指定具體的外部存儲器類型。在上一節blhost的命令幫助里，我們可以看到Memory ID里已經給各種外部儲存器分配了ID號，在使用blhost命令時使用不同的ID號即可操作相應外部存儲器。
其實BootROM里已經把外部存儲器的下載更新Application操作封裝得很簡單也很統一，我們其實只需要3步操作即可完成Application的下載。以備份啟動的1bit SPI NOR為例（即Flexcomm SPI NOR Memory，Memory ID=0x110）：
// 在SRAM里臨時存儲1bit SPI NOR配置數據
blhost -p COMx -- fill-memory 0x1C000 0x4 0xC0300000 // Flexcomm SPI3, NOR Flash
// 使用1bit SPI NOR配置數據去配置Flexcomm SPI介面
blhost -p COMx -- configure-memory 0x110 0x1C000
// 擦除1bit SPI NOR並將image下載進1bit SPI NOR
blhost -p COMx -- flash-erase-region 0x0 0x20000 0x110
blhost -p COMx -- write-memory 0x0 bt_image.bin 0x110
其中bt_image.bin是填充了Image類型數據的Application鏡像，關於上述命令的具體意義痞子衡會在後續Serial(1-bit SPI) NOR恢復啟動的文章里詳盡解釋，這裡只是給大家一個初步體驗。
至此，恩智浦i.MX RTxxx系列MCU的Serial ISP模式痞子衡便介紹完畢了，掌聲在哪裡~~~
