ADUCM331开发笔记（五）内核说明

7 KERNEL

The ADuCM330/ADuCM331 feature a protected, on-chip, kernel resident in the top 2 kB of the Flash/EE code space. After a reset event,the hardware calculates its own kernel checksum and compares it to the checksum programmed during production test to ensure that the kernel does not contain any errors. If an error occurs, the kernel cannot continue and stops execution.
If the checksum is correct, the kernel copies the factory calibrated data from the manufacturing data space into the various on-chip peripherals. The following peripherals are calibrated by the kernel:
• Precision oscillator
• Low power oscillator
• 33VDD, DVDD18, AVDD18
• Voltage reference
• Current ADC (offset and gain)
• Voltage/temperature ADC (offset and gain)
The following processor registers and user registers are modified by the kernel and differ from their POR default values:
• R0 to R15
• GP0CON
• FEEADR/FEEDATL/FEEDATH/FEECON0/FEECON1/FEESIGN
• HVDAT/HVCON
• HVDCFG0
The ADuCM330/ADuCM331 also feature an on-chip LIN downloader. Note that kernel entry and downloader exit can only occur via a reset. SWD-JTAG access is disabled during kernel execution. Before exiting to user code, the kernel checks if the SWD lock location of the uppermost page in flash contains the key value, 0x160320 (see Figure 9). If this key is present, SWD-JTAG access is not granted after kernel exit. If any other value is present, SWD-JTAG access is enabled. This process provides additional security to ensure that SWD access is not possible between kernel exit and user code SWD disabling.
ADuCM330/ADuCM331具有受保护的片内内核，位于闪存/EE代码空间的前2 kB。重置事件后，硬件计算自己的内核校验和，并将其与生产测试期间编程的校验和进行比较，以确保内核不包含任何错误。如果发生错误，内核将无法继续并停止执行。
如果校验和正确，内核会将工厂校准的数据从制造数据空间复制到各种片上外设中。以下外设由内核校准：
• 精密振荡器
• 低功耗振荡器
• 33VDD， DVDD18， AVDD18
• 电压基准
• 电流 ADC（失调和增益）
• 电压/温度ADC（失调和增益）
以下处理器寄存器和用户寄存器由内核修改，并且不同于其 POR 默认值：
• R0 至 R15
• GP0CON
• FEEADR/FEEDATL/FEEDATH/FEECON0/FEECON1/FEESIGN
• HVDAT/HVCON
• HVDCFG0
ADuCM330/ADuCM331还具有片内LIN下载器。请注意，内核进入和下载器退出只能通过重置发生。SWD-JTAG 访问在内核执行期间被禁用。在退出用户代码之前，内核会检查闪存中最上层页面的 SWD 锁定位置是否包含密钥值 0x160320（请参阅图 9）。如果存在此密钥，则在内核退出后不会授予 SWD-JTAG 访问权限。如果存在任何其他值，则启用 SWD-JTAG 访问。此过程提供了额外的安全性，以确保在内核退出和用户代码 SWD 禁用之间无法访问 SWD。

KERNEL IMPLEMENTATION
The main sequences that the kernel follows are described in the following sections and shown in Figure 4.
内核实现
内核遵循的主序列在以下各节中描述，如图 4 所示。

7.1 Debug Mode调试模式

After a reset, the kernel initializes the device and tests the state of the GPIO5 pin. If this pin is low, the kernel branches to user space using Address 0x00000000. This mode is intended for code development only.
重置后，内核初始化设备并测试 GPIO5 引脚的状态。如果此引脚较低，则内核将使用地址0x00000000分支到用户空间。此模式仅用于代码开发。

7.2 Normal Application Mode正常应用模式

If after a reset event, the kernel finds the GPIO5 pin high, the kernel checks for a valid first page of user flash. A valid page is one that has a valid CRC at Address 0x7FC. If the kernel determines that the first page is valid, it branches to the beginning of that page. For robustness,it is recommended that the first page contain code that validates the rest of the application code before exiting the first page.
Instead of a CRC at Address 0x7FC, a key value of 0x16400000 can also be used. However, this does not ensure that the first page is not corrupted.
Note that if the 0x7FC location has already been programmed and user code is required to modify it, either Page 0 must be erased or the 0x7FC location be rewritten with all zeros. Overwriting the 0x7FC location with any other value is not recommended, because an invalid ECC can result.
如果在重置事件后，内核发现 GPIO5 引脚为高电平，则内核将检查用户闪存的第一页是否有效。有效页面是指在地址 0x7FC 处具有有效 CRC 的页面。如果内核确定第一页有效，它将分支到该页的开头。为了健壮性，建议在退出第一页之前，第一页包含验证应用程序其余代码的代码。
除了地址 0x7FC 处的 CRC，还可以使用 0x16400000 键值。但是，这并不能确保第一页未损坏。
请注意，如果0x7FC位置已被编程，并且需要用户代码来修改它，则必须擦除第 0 页或用全零重写0x7FC位置。不建议使用任何其他值覆盖0x7FC位置，因为可能会导致无效的 ECC。

7.3 Boot Loading Mode引导加载模式

If after a reset, the kernel finds the GPIO5 pin to be high and Page 0 not to have a valid CRC or key, the kernel checks for a valid user boot loader. The boot loader structure is as follows. The boot loader can be of any size up to 30 kB but must be located at the top of the user flash.
• Address (Flash Size − 0x4) must contain the CRC of the boot loader.
• Address (Flash Size − 0x1C) must contain the lowest address of the boot loader block.
• Address (Flash Size − 0x20) must contain the entry point of the boot loader code.
• All three addresses must contain valid information to enter the boot loader correctly.
An extra consideration for the entry point is that, due to the Cortex-M3 addressing architecture, any address branched to must be a half word boundary + 1.
For example:
• If the lowest address of the boot loader on a 96 kb device (ADuCM330) is 0x10800, the entry point must be 0x10801.
• If the lowest address of the boot loader on a 128 kb device (ADuCM331) is 0x18800, the entry point must be 0x18801.
如果在重置后，内核发现 GPIO5 引脚为高电平，而第 0 页没有有效的 CRC 或密钥，则内核将检查是否有有效的用户引导加载程序。引导加载程序结构如下。引导加载程序可以是最大 30 kB 的任何大小，但必须位于用户闪存的顶部。
• 地址（闪存大小 − 0x4）必须包含引导加载程序的 CRC。
• 地址（闪存大小 − 0x1C）必须包含引导加载程序块的最低地址。
• 地址（闪存大小 − 0x20）必须包含引导加载程序代码的入口点。
• 所有三个地址都必须包含有效信息才能正确进入引导加载程序。
入口点的另一个考虑因素是，由于 Cortex-M3 寻址架构，任何分支到的地址都必须是半字边界 + 1。
例如：
• 如果 96 kb 器件 （ADuCM330） 上引导加载程序的最低地址0x10800，则必须0x10801入口点。
• 如果 128 kb 器件 （ADuCM331） 上引导加载程序的最低地址0x18800，则必须0x18801入口点。
The flash size is used to designate the size of user flash. For the ADuCM330 (96 kB), the size of user flash is 0x18000. For the ADuCM331 (128 kB), the size of user flash is 0x20000.
The kernel uses the values at these addresses, shown in the previous bullet list, to determine if the boot loader is valid.
If the boot loader feature is not used, a value of 0xFFFF FFFF must be placed at (Flash Size − 0x20).
The normal application can receive commands via the LIN to change to the boot loader that is located at the top of the user flash. The boot loader can use an appropriate protocol to update the application code. As the first step of reflashing, the boot loader must ensure that the value at Address 0x007FC is not the Page 0 CRC or the 0x16400000 key. The last step of reflashing must rewrite Address 0x007FC to ensure that recovery after partial reflashing is possible.
Note that if the boot loader locations have already been programmed and user code is required to modify them, the user must either erase that page or overwrite the location with all zeros. Overwriting the boot loader locations with any other value is not recommended because an invalid ECC can result.
闪存大小用于指定用户闪存的大小。对于ADuCM330 （96 kB），用户闪存的大小0x18000。对于ADuCM331 （128 kB），用户闪存的大小为0x20000。
内核使用这些地址的值（如上一个项目符号列表中所示）来确定引导加载程序是否有效。
如果未使用引导加载程序功能，则必须将 0xFFFF FFFF 的值设置为 （闪存大小 − 0x20）。
普通应用程序可以通过 LIN 接收命令，以更改为位于用户闪存顶部的引导加载程序。引导加载程序可以使用适当的协议来更新应用程序代码。作为重新烧录的第一步，引导加载程序必须确保地址 0x007FC 处的值不是第 0 页 CRC 或 0x16400000 键。重新烧录的最后一步必须重写地址0x007FC，以确保可以在部分重新烧录后恢复。
请注意，如果引导加载程序位置已经编程，并且需要用户代码来修改它们，则用户必须擦除该页面或用全零覆盖该位置。不建议使用任何其他值覆盖引导加载程序位置，因为可能会导致无效的 ECC。

7.4 Interrupted Boot Loading启动加载中断

If reflashing the application is, for any reason, interrupted before it is complete, reflashing can be restarted as follows.
Upon a reset after a partial reflash, the kernel detects that the application is corrupted (value at 0x007FC is incorrect). The kernel checks the boot loader, and if the boot loader is found to be valid, the kernel passes control to the boot loader, and the reflashing can be repeated by the boot loader until complete.
如果重新烧录应用程序由于任何原因在完成之前中断，则可以按如下方式重新启动重新刷写。
在部分重新刷新后重置时，内核会检测到应用程序已损坏（0x007FC 处的值不正确）。内核检查引导加载程序，如果发现引导加载程序有效，内核将控制权传递给引导加载程序，引导加载程序可以重复重新刷新，直到完成。

7.5 Downloader下载器

If the kernel finds that the boot loader is also not valid, the kernel enters the downloader of the kernel, and it is possible to reflash the user code as described in the Application Note AN-946, Flash/EE Memory Programming via LIN—Protocol 6. When in this state, if no valid LIN frames are received for nominally one hour, the device goes into power down.
Additionally, download mode offers a fast LIN download option so that the user can program the device more quickly, at speeds of up to 100 kbaud, if capable programming hardware is available. Note that download mode cannot be entered from any of the other modes except via a reset. Also note that this mode cannot be exited except via a reset.
如果内核发现引导加载程序也无效，内核将进入内核的下载程序，并可以按照应用笔记AN-946《通过LIN进行闪存/EE存储器编程—协议6》中所述重新刷新用户代码。处于此状态时，如果标称值为一小时未收到有效的LIN帧，则器件将进入断电状态。
此外，下载模式提供快速LIN下载选项，以便用户可以更快地对设备进行编程，速度高达100 kbaud（如果支持编程硬件可用）。请注意，除非通过重置，否则无法从任何其他模式进入下载模式。另请注意，除非通过重置，否则无法退出此模式。

7.6 Interrupted Downloader中断的下载程序

If downloading to the user space is, for any reason, interrupted before it is complete, downloading can be restarted as follows. As long as 0x007FC does not contain the Page 0 CRC or key and the boot loader is not valid, the downloader can be restarted at any time by resetting the device (for example, POR). For this reason, the downloader must only update 0x007FC after the full application has been downloaded and verified. In addition, if the boot loader feature is used, the values at (Flash Size − 0x4) and (Flash Size − 0x1C) must only be updated after the entire boot loader has been downloaded and verified.
如果下载到用户空间由于任何原因在完成之前中断，则可以按如下方式重新启动下载。只要0x007FC不包含第 0 页 CRC 或密钥，并且引导加载程序无效，就可以随时通过重置设备（例如 POR）重新启动下载程序。因此，下载程序只能在下载并验证完整应用程序后更新0x007FC。此外，如果使用引导加载程序功能，则只有在下载并验证整个引导加载程序后，才能更新 （Flash Size − 0x4） 和 （Flash Size − 0x1C） 的值。

7.7 Boot Updater启动更新程序

The boot loader can be updated as follows. Using the method described previously, code can be downloaded as application code with the following capabilities:
• The code must look like a valid application to the system.
• The code must consist mainly of a copy of the new boot loader.
• The code must contain code that autonomously erases the old boot loader and replaces it with the new boot loader.
When this process is complete, the system can use the new boot loader to reflash the application space with a battery monitoring application.
可以按如下方式更新引导加载程序。使用前面介绍的方法，可以将代码下载为具有以下功能的应用程序代码：
• 代码必须看起来像系统的有效应用程序。
• 代码必须主要由新引导加载程序的副本组成。
• 代码必须包含自主擦除旧引导加载程序并将其替换为新引导加载程序的代码。
此过程完成后，系统可以使用新的引导加载程序通过电池监控应用程序重新刷新应用程序空间。

7.8 Interrupted Boot Updater中断的启动更新程序

If reflashing the boot loader is, for any reason, interrupted before it is complete, reflashing can be repeated by resetting the device (for example, POR) because the boot updater application is still valid.
如果重新烧录引导加载程序出于任何原因在完成之前中断，则可以通过重置设备（例如 POR）来重复重新烧录，因为引导更新程序应用程序仍然有效。

7.9 Direct LIN Interface (Ext Mode)直接LIN接口（外部LIN模式）

Single battery monitoring can be achieved using the LIN pin for communications. If the kernel detects that a download is required, it drives the GPIO3 pin high, which can be used to enable an external LIN interface. The kernel then monitors both the LIN pin and the Rx pin. If a frame start is detected on the LIN pin, the kernel assumes that the application is in single battery monitoring mode. If a frame start is first detected on the LIN_RX pin (GPIO4), the kernel switches over to use the LIN_RX/LIN_TX pins (GPIO4/GPIO1) instead.
This allows use of an external LIN transceiver. For the kernel, the only difference between these modes is this switching from the LIN pin to the Rx/Tx pins. The kernel only performs this switching when it reaches download mode. If the kernel exits to user or boot loader mode, the user code must switch to the Rx/Tx pins and drive the GPIO3 pin to control the transceiver.
使用LIN引脚进行通信可以实现单电池监控。如果内核检测到需要下载，它会将 GPIO3 引脚驱动到高电平，该引脚可用于启用外部 LIN 接口。然后，内核监视 LIN 引脚和 Rx 引脚。如果在LIN引脚上检测到帧启动，内核假定应用处于单电池监视模式。如果首次在LIN_RX引脚 （GPIO4） 上检测到帧启动，内核将切换到改用 LIN_RX/LIN_TX 引脚 （GPIO4/GPIO1）。
这允许使用外部LIN收发器。对于内核，这些模式之间的唯一区别是从LIN引脚切换到Rx/Tx引脚。内核仅在达到下载模式时执行此切换。如果内核退出用户或引导加载程序模式，则用户代码必须切换到 Rx/Tx 引脚并驱动 GPIO3 引脚以控制收发器。