SpringCore Direct DFU class

The DFU (device firmware upgrade) class is used to load a new firmware into the device.

CLA value

The DFU class uses CLA=5B.

Message format

SpringCore Direct over USB, SpringCore Direct over BLE

The commands and the responses use the same format.

Item Length Description / remark
Header 4 or 6 bytes CLA = 5D, LEN = length of Data + CMD
INS / STA 1 byte Command: opcode of the INStructon
Response: STAtus
Data 0 or more bytes Command data
Response data

Encapsulation in CCID Escape / SCardControl

This kind of encapsulation is not available for this class.

List of INStruction

The INS opcodes are defined below:

INS Name Description Bootloader Firmware
01 DFU_CMD_GET_CONTEXT Retrieve DFU hardware context. yes yes
02 DFU_CMD_MCU_RESET Warm reset mcu (no reply) yes yes
03 DFU_CMD_SET_OPTION rfu
04 DFU_CMD_GET_CONF get register value from constants, templates or registers group no yes (constants require authentication)
05 DFU_CMD_SET_CONF set a new register value to constants, templates or registers group no yes
06 DFU_CMD_AUTH Enable or disable extra features ( const reading ) no yes
07 DFU_CMD_PUSH_TO_STORAGE Send binary (Rx, BGM, ...) to the spi flash. yes yes
08 DFU_DUMP_STORAGE Dump portion of the storage no yes (requires authentication)
09 DFU_CLEAR_STORAGE Erase the whole spi flash content yes yes (requires authentication)
0A DFU_CMD_PUSH_TO_ROM Push data to be written in rom. Erasing is performed by the bootloader. yes no
FF DFU_CMD_PAYLOAD_TEST Simple echo command no yes

List of STAtus

The STA values are defines below:

STA Name Description
00 DFU_OK Success
01 DFU_ERR_UNKNOWN_INSTRUCTION Missing payload
02 DFU_ERR_WRONG_LENGTH Can not handle this payload length
03 DFU_ERR_WRONG_PARAMETER CLA is not present
04 DFU_ERR_EXECUTION_FAILED PCB is not compliant
05 DFU_ERR_FLASH Flash API goes wrong (the following byte is the Flash API response code)
06 DFU_NO_NEED This action has been done previously
07 DFU_WRONG_ID This firmware is not compliant with this device

Commands details

DFU_GET_CONTEXT

Byte Name Description
0 DFU_SUCCESS
1 - 4 Boot loader options Hardware context as found by the boot loader
5 - 12 CPU Name ASCII ("RX65n", "RX111")
13 - 16 First writable rom address This field is defined in the boot loader at build time
17 - 20 Last writable rom address This field is defined in the boot loader at build time
21 - xx SPI flash ID SPI flash Identification string (20 bytes on MT25QL128 but size can differs)

The size of the answer is either 20 bytes long (no SPI Flash detected) or longer (SPI Flash detected). Depending on the presence or not of a SPI Flash, the DFU protocol shall allow to perform a direct dfu/rom rewriting instead of using the spi flash storage.

MT25QL data flash id example:

0x20 ba 18 10 40 00 2e 20 85 00 10 0e 00 2e 00 b6 08 ba a4 aa


Bootloader options:

Bootloader options are warm start persistent.

Dword Bit Name Description
0 24-31 timeout how many seconds we must stay in DFU mode before starting the
firmware (default: 10s, can be changed by the firmware before
a reset, a value of 255 disables this timeout)
16-23 version bootloader version
11-15 rfu
10 has_aes there is a integrated AES hardware module
9 has_network there is a network interface
7 has_battery there is a battery in this product
8 has_usb there is an USB interface
6 in_bootloader we are in the bootloader
5 just_flashed this bit is set by the bootloader after a successful Rx upgrade operation
4 has_antenna there is an i2c antenna in this product
3 has_storage there is a SPI flash in this product
2 force_dfu set this bit and reset the product to force DFU mode
1 cold_reset cold reset (1) or a warm reset (0)
0 is_present we are using a bootloader header
1 31-0 firmware_start_address Firmware Writable Rom start address
2 31-0 firmware_stop_address Firmware Writable Rom end address
3 31-0 rfu

DFU_CMD_MCU_RESET

This command ask for a mcu reset. This is an immediate command, the mcu will reset and winusb will produce an error.

DFU_CMD_SET_OPTION

TBD.

DFU_CMD_AUTH

TBD. Enable or disable special access features (read const, ...).

DFU_CMD_GET_CONF

Short query (will retrieve a register value).

Byte Description
0 register number: 0x00 and 0xFF excluded

Long query (will retrieve a constant, register or a template value).

Byte Description
0 Constant group (0x01) or Register group (0x02) or template group (0x03)
1 register number: 0x00 and 0xFF excluded

Response:

Byte Name
0 DFU_OK or DFU_ERR_EXECUTION_FAILED
1 - xx Register value if DFU_OK

DFU_CMD_SET_CONF

Send a new value to constant, register or a template group.

Byte Description
0 Constant group (0x01) or Register group (0x02) or template group (0x03)
1 register number: 0x00 and 0xFF excluded
2 - x register value to store. if no data value is present, the current register will be deleted

Response:

Byte Name
0 DFU_OK or DFU_ERR_EXECUTION_FAILED

DFU_CMD_PUSH_TO_STORAGE

Send a binary firmware to the SPI flash storage. The first packet contain the firmware header:

Byte Description
0-1 Destination (Rx=0x0000, BGM=0x0001, PN5180=0x0002)
2-5 CRC32 of the binary
6-9 raw binary firmware length

Response:

Byte Name
0 DFU_OK or DFU_ERR_EXECUTION_FAILED

The firmware is then send using raw packets:

Byte Description
0 - x Raw firmware chunk

The bootloader will append another CRC32 at the end of the stored firmware if CRC32 match.

DFU_DUMP_STORAGE

Retrieve data from the SPI flash storage

Byte Description
0-3 32 bit address in flash

The firmware is then send using raw packets:

Byte Description
0 DFU_OK or DFU_ERR_EXECUTION_FAILED
1 - 128 Raw byte from the spi storage (if DFU_OK)

DFU_CLEAR_STORAGE

Clear the whole SPI flash storage

Byte Description
0-7 Secure word: CAFECAFE

The firmware is then send using raw packets:

Byte Description
0 DFU_OK or DFU_ERR_EXECUTION_FAILED