AVR32 USB DFU Boot Loader (aka ISP)

warning: none of this information has actually been verified in the real world.
It must, therefore, be helplessly ridden with errors.

"In-System Programming" (ISP) boot loader configuration

The USB DFU boot loader sits in flash memory below address 0x2000, which can only be reprogrammed using JTAG.
So as long as we're using USB to flash it, we're safe and unable to erase the code that lets us flash the device
in the first place.

The internal default config always starts the USB DFU code.
It then decides whether to run the USB DFU device and await a new program to be flashed from a host computer,
or whether to go ahead and launch our program right away.

When the bootloader is running, our program does not -- the chip is only serving an ISP device on the USB.
The bootloader can launch our program with a starting command issued from the host computer over USB,
or it can be asked to launch our program immediately after the device powers on.

The default behavior: when GPIO14 (PA14) is lo, connected to gnd, USB DFU is launched; otherwise, our program is
run -- this only works with an external pull-up resistor on that pin.
(On our usb-avr dongle, that pin is unconnected and floating in radio space. Usually, after power on, the
USB DFU will come up. When powered down very shortly, our program comes up.)

In a productive device, anyone will want the USB DFU bootloader to stay out of the way. For developing, we need to
be able to select freely between USB DFU or our program. So the default behavior is quite ok: have some button on
GPIO14 (PA14), and when the phone is powered on with the button pressed, it's ready for USB reprogramming.

bootloader config

The behavior can be changed by two 32-bit configuration words, written in the final two address locations in the flash (in the area that is reprogrammable via usb).

Word1 at 0x808001FC
word2 at 0x808001F8

  ...| 0x808001F4 | 0x808001F8 | 0x808001FC ] < flash ad-
       .  .  .  . | F8 F9 FA FB| FC FD FE FF] < dress space
                    92 9e 0e 62  E1 1E FF D7    < default value
                      word 2       word 1

When the device is shipped, or when the config words' CRC or KEY fields mismatch, ISP_FORCE is on, and the bootloader will always launch
the USB DFU bootloader and check GPIO14:

word1 = 0xE11EFFD7
word2 = 0x929e0e62

Launching the USB DFU enirely from software running on the device is possible:
set ISP_FORCE to 1 and ISP_IO_COND_EN to 0, and then reset using the watchdog timer.
After reboot, rewrite ISP_IO_COND_EN to 1.

cue: howto for writing to flash from host computer, and from within our program running on the device.

Reference 32166.pdf :

  • 6.2.2 Flash user page
  • 7.2 Activating the ISP

ISP configuration word CRC-8

For example, to select GPIO0:

The fixed key is 0x494f << 17, so becomes 0x929e0000, with the lower 17 bits not yet determined.
Add ISP_IO_COND_LEVEL (a zero) and get 0x929e0000, lower 16 bits not yet determined.
GPIO0 is 0x00 (8 zeros added)
Use [http://www.tty1.net/pycrc/] to calculate the last crc byte:

./pycrc.py --model=crc-8 --check-hexstring "929e00" 

So, to check GPIO0 on bootup and run USB DFU only "when the button is pressed"
(i.e. GPIO0 is pulled to GND), the Configuration Word2 is: 0x929e0048.
A pull-up resistor is then needed on GPIO0, and a button that connects to GND when pushed.