411 lines
8.1 KiB
ArmAsm
411 lines
8.1 KiB
ArmAsm
; ================================================
|
|
; STM8 RAM Bootloader for SDCC - Optimized Version
|
|
;
|
|
; 命令帧格式:
|
|
; 字节0: 帧头 (0x5A/0xA5)
|
|
; 字节1: 命令类型 (见CMD_*常量)
|
|
; 字节2-3: 目标地址 (高字节在前)
|
|
; 字节4: 数据长度 (0-64)
|
|
; 字节5-68: 数据内容 (最多64字节)
|
|
; 字节69: 校验和 (所有字节XOR)
|
|
; ================================================
|
|
|
|
;; Register address definitions
|
|
UART1_SR = 0x5230 ; Status register
|
|
UART1_DR = 0x5231 ; Data register
|
|
UART1_BRR1 = 0x5232 ; Baud rate register 1
|
|
UART1_BRR2 = 0x5233 ; Baud rate register 2
|
|
UART1_CR2 = 0x5235 ; Control register 2
|
|
|
|
FLASH_DUKR = 0x5064 ; Data EEPROM unprotect
|
|
FLASH_PUKR = 0x5062 ; Flash unprotect
|
|
FLASH_CR2 = 0x505B ; Flash control 2
|
|
FLASH_NCR2 = 0x505C ; Flash control 2 complement
|
|
FLASH_IAPSR = 0x505F ; Flash in-application program status
|
|
|
|
OPT0_ROP = 0x4800 ; Option byte: ROP
|
|
WWDG_CR = 0x50D1 ; WWDG control register
|
|
|
|
;; Const vars
|
|
CMD_READ = 0xF1 ; 读内存命令
|
|
CMD_WRITE = 0xF2 ; 写内存命令
|
|
CMD_GO = 0xF3 ; 跳转执行命令
|
|
CMD_EXEC = 0xF4 ; 直接执行机器码命令
|
|
|
|
CMD_HEADER = 0x5A ; 帧头
|
|
ACK_HEADER = 0xA5 ; 应答帧头
|
|
|
|
SUCCESS_CODE = 0x00 ; 成功响应码
|
|
ERR_CHECKSUM = 0xE1 ; 校验错误
|
|
ERR_INVCMD = 0xE2 ; 非法命令
|
|
ERR_PGDIS = 0xE3 ; 编程受保护的地址
|
|
|
|
MAX_DATA_SIZE = 64 ; 最大数据长度
|
|
|
|
;; Global vars
|
|
;; After an MCU reset the Stack Pointer is set to its upper limit value
|
|
DEFAULT_SP_H = 0x0000 ; Saved with SP value
|
|
DEFAULT_SP_L = 0x0001 ;
|
|
rx_state = 2 ; 接收状态
|
|
rx_length = 3 ; 接收长度
|
|
tx_state = 4 ; 发送状态
|
|
tx_data_length = 5 ; 待发送的数据长度
|
|
calc_checksum = 6 ; 计算的校验和
|
|
temp_var1 = 7 ; 临时变量
|
|
temp_var2 = 8 ; 临时变量
|
|
temp_var3 = 9 ; 临时变量
|
|
tx_buffer = 0x000A ; protocol tx buffer
|
|
rx_buffer = 0x000A ; protocol rx buffer
|
|
|
|
BOOT2_ULA = 0x03CF ; boot2 ram Upper-Limit-Address
|
|
|
|
.area DATA
|
|
.area HOME
|
|
.area RAM_BOOT
|
|
|
|
.db (BOOT2_ULA-(_end-_start)+1)>>8
|
|
.db (BOOT2_ULA-(_end-_start)+1)&0xFF
|
|
|
|
_start:
|
|
; 配置UART1: 128000波特率, 8N1, 启用TX/RX
|
|
mov UART1_BRR1, #1
|
|
;mov UART1_BRR2, #0
|
|
;mov UART1_CR2, #0x0C ; TEN=1, REN=1
|
|
_main_loop:
|
|
; 接收命令帧
|
|
callr receive_frame
|
|
|
|
; 验证校验和
|
|
callr verify_checksum
|
|
jrne _checksum_error
|
|
|
|
; 根据命令类型跳转
|
|
ld A, rx_buffer+1 ; 命令类型
|
|
|
|
cp A, #CMD_READ
|
|
jreq _cmd_read
|
|
|
|
cp A, #CMD_WRITE
|
|
jreq _cmd_write
|
|
|
|
cp A, #CMD_GO
|
|
jreq _cmd_go
|
|
|
|
cp A, #CMD_EXEC
|
|
jreq _cmd_exec
|
|
|
|
_invalid_cmd_error:
|
|
; 未知命令，发送错误响应
|
|
mov tx_state, #ERR_INVCMD
|
|
call send_ack_state_response
|
|
jra _main_loop
|
|
|
|
_checksum_error:
|
|
; 校验和错误响应
|
|
mov tx_state, #ERR_CHECKSUM
|
|
call send_ack_state_response
|
|
jra _main_loop
|
|
|
|
_cmd_read:
|
|
; 读取内存命令
|
|
call read_memory
|
|
jra _main_loop
|
|
|
|
_cmd_write:
|
|
; 写入内存命令
|
|
call write_memory
|
|
jra _main_loop
|
|
|
|
_cmd_go:
|
|
; 跳转执行命令
|
|
ldw X, rx_buffer+2
|
|
jp (X)
|
|
; 注意: jump_to_address 不返回
|
|
|
|
_cmd_exec:
|
|
; 直接执行收到的机器码
|
|
ld A, #0x81 ; ret code
|
|
ld (X), A ; X point to checksum already
|
|
call rx_buffer
|
|
jra _main_loop
|
|
|
|
receive_frame:
|
|
; 初始化接收状态
|
|
clr rx_state
|
|
mov rx_length, #6
|
|
ldw X, #rx_buffer
|
|
|
|
_receive_data:
|
|
; 接收数据部分, 等待RXNE=1
|
|
btjf UART1_SR, #5, _receive_data
|
|
|
|
; 根据状态接收不同部分
|
|
ld A, rx_state
|
|
|
|
cp A, #0
|
|
jreq _receive_header
|
|
|
|
cp A, #4
|
|
jreq _receive_length
|
|
|
|
ld A, UART1_DR
|
|
_save_data:
|
|
ld (X), A
|
|
incw X
|
|
inc rx_state
|
|
|
|
dec rx_length
|
|
jrne _receive_data ; 还有数据，继续接收
|
|
|
|
; 数据接收完成
|
|
mov rx_length, rx_state
|
|
ret
|
|
|
|
_receive_header:
|
|
ld A, UART1_DR
|
|
cp A, #CMD_HEADER
|
|
jrne _receive_data
|
|
jra _save_data
|
|
_receive_length:
|
|
ld A, UART1_DR
|
|
cp A, #MAX_DATA_SIZE
|
|
; length<=MAX_DATA_SIZE
|
|
jrugt receive_frame
|
|
; save length
|
|
ld rx_length, A
|
|
inc rx_length
|
|
inc rx_length
|
|
jra _save_data
|
|
|
|
verify_checksum:
|
|
; 初始化
|
|
clr calc_checksum
|
|
|
|
; 计算需要校验的字节数
|
|
ld A, rx_length
|
|
dec A
|
|
ld temp_var1, A
|
|
|
|
; 设置指针
|
|
ldw X, #rx_buffer
|
|
|
|
_verify_loop:
|
|
ld A, (X)
|
|
xor A, calc_checksum
|
|
ld calc_checksum, A
|
|
incw X
|
|
dec temp_var1
|
|
jrne _verify_loop
|
|
|
|
; 比较校验和
|
|
ld A, calc_checksum
|
|
cp A, (X) ; X现在指向校验和位置
|
|
|
|
ret
|
|
|
|
send_response_pkg:
|
|
clr calc_checksum
|
|
ldw X, #tx_buffer
|
|
ld A, tx_data_length
|
|
add A, #5
|
|
ld temp_var1, A
|
|
; send data
|
|
_send_loop:
|
|
ld A, (X)
|
|
ld UART1_DR, A
|
|
; calc checksum
|
|
xor A, calc_checksum
|
|
ld calc_checksum, A
|
|
_wait_tx1:
|
|
btjf UART1_SR, #7, _wait_tx1
|
|
; move to next
|
|
incw X
|
|
dec temp_var1
|
|
jrne _send_loop
|
|
; send checksum
|
|
ld A, calc_checksum
|
|
ld UART1_DR, A
|
|
_wait_tx2:
|
|
btjf UART1_SR, #7, _wait_tx2
|
|
; finish
|
|
ret
|
|
|
|
; 发送应答状态帧
|
|
send_ack_state_response:
|
|
; set header
|
|
ldw X, #tx_buffer
|
|
ld A, #ACK_HEADER
|
|
ld (X), A
|
|
|
|
; set length
|
|
addw X, #4
|
|
ld A, #1
|
|
ld (X), A
|
|
ld tx_data_length, A
|
|
|
|
; set data
|
|
incw X
|
|
ld A, tx_state
|
|
ld (X), A
|
|
|
|
callr send_response_pkg
|
|
ret
|
|
|
|
; 发送应答数据帧
|
|
send_ack_data_response:
|
|
; set header
|
|
ldw X, #tx_buffer
|
|
ld A, #ACK_HEADER
|
|
ld (X), A
|
|
|
|
; set length
|
|
addw X, #4
|
|
ld A, tx_data_length
|
|
ld (X), A
|
|
|
|
; already set data
|
|
|
|
callr send_response_pkg
|
|
ret
|
|
|
|
read_memory:
|
|
; A = 读取长度
|
|
ldw X, #rx_buffer+5
|
|
ld A, (X)
|
|
ld tx_data_length, A
|
|
ld temp_var1, A
|
|
|
|
; Y = 缓存地址
|
|
ldw Y, X
|
|
|
|
; X = 读取地址
|
|
ldw X, #rx_buffer+2
|
|
ldw X, (X)
|
|
|
|
_read_loop:
|
|
; 读取字节
|
|
ld A, (X)
|
|
ld (Y), A
|
|
|
|
incw X
|
|
incw Y
|
|
dec temp_var1
|
|
jrne _read_loop
|
|
|
|
callr send_ack_data_response
|
|
ret
|
|
|
|
; temp_var1: 待写入长度
|
|
; temp_var2: 单次写长度
|
|
; temp_var3: FLASH_IAPSR
|
|
write_memory:
|
|
; A = 写入长度
|
|
ldw X, #rx_buffer+4
|
|
ld A, (X)
|
|
ld temp_var1, A
|
|
; 检查长度为0直接返回
|
|
tnz A
|
|
jreq _write_success
|
|
|
|
; Y = src
|
|
incw X
|
|
ldw Y, X
|
|
|
|
; X = dst
|
|
ldw X, #rx_buffer+2
|
|
ldw X, (X)
|
|
|
|
; 检查是否为ram地址 (0x0000-0x3FFF)
|
|
ld A, XH
|
|
cp A, #0x40
|
|
jrult _mem_write
|
|
; 检查是否为flash地址 (0x8000-0xFFFF)
|
|
cp A, #0x80
|
|
jruge _flash_write
|
|
; 检查是否为eeprom/opt地址 (0x4000-0x4FFF)
|
|
cp A, #0x50
|
|
jrult _flash_write
|
|
|
|
_mem_write:
|
|
ld A, (Y)
|
|
ld (X), A
|
|
incw X
|
|
incw Y
|
|
dec temp_var1
|
|
jrne _mem_write
|
|
callr send_ack_state_response
|
|
ret
|
|
|
|
_flash_write:
|
|
; unlock FLASH/DATA
|
|
callr unlock_flash
|
|
|
|
; Word Program
|
|
mov FLASH_CR2, #0xC0
|
|
mov FLASH_NCR2, #0x3F
|
|
|
|
_word_write:
|
|
mov temp_var2, #4
|
|
_write_loop:
|
|
; Write a Word
|
|
ld A, (Y)
|
|
ld (X), A
|
|
incw X
|
|
incw Y
|
|
dec temp_var2
|
|
jrne _write_loop
|
|
; Wait write done
|
|
_wait_flash_done:
|
|
mov temp_var3, FLASH_IAPSR
|
|
btjt temp_var3, #0, _write_error
|
|
btjf temp_var3, #2, _wait_flash_done
|
|
|
|
ld A, temp_var1
|
|
cp A, #4
|
|
jrule _write_success
|
|
sub A, #4
|
|
ld temp_var1, A
|
|
jra _word_write
|
|
|
|
_write_error:
|
|
mov tx_state, #ERR_PGDIS
|
|
jra _write_end
|
|
_write_success:
|
|
mov tx_state, #SUCCESS_CODE
|
|
_write_end:
|
|
; Word programming off
|
|
mov FLASH_CR2, #0x00
|
|
mov FLASH_NCR2, #0xFF
|
|
; lock FLASH/DATA
|
|
callr lock_flash
|
|
call send_ack_state_response
|
|
ret
|
|
|
|
unlock_flash:
|
|
; 检查是否为Flash地址 (0x8000-0xFFFF)
|
|
ld A, XH
|
|
cp A, #0x80
|
|
jrult _do_unlock_data
|
|
_do_unlock_flash:
|
|
mov FLASH_PUKR, #0x56 ; KEY1
|
|
mov FLASH_PUKR, #0xAE ; KEY2
|
|
ret
|
|
_do_unlock_data:
|
|
mov FLASH_DUKR, #0xAE ; KEY1
|
|
mov FLASH_DUKR, #0x56 ; KEY2
|
|
ret
|
|
|
|
lock_flash:
|
|
; 检查是否为Flash地址 (0x8000-0xFFFF)
|
|
ld A, XH
|
|
cp A, #0x80
|
|
jrult _do_lock_data
|
|
_do_lock_flash:
|
|
bres FLASH_IAPSR, #1
|
|
ret
|
|
_do_lock_data:
|
|
bres FLASH_IAPSR, #3
|
|
ret
|
|
|
|
_end:
|