------------------------------------------------------------------------ CHANGELOG TINYSAFEBOOT - FIRMWARE ------------------------------------------------------------------------ tsb_tinymega.asm ------------------------------------------------------------------------ 20140331 Added support for ATtiny441 and ATtiny841: Firmware and installer component required some major adjustments due to that creepy 4-pages erase mode and missing definitions in the 441 and 841. --- My explicit thanks go to Geoff S. for his elaborate help and testing on this solution! --- Added safety-interval for RXD-Low-detection: Former TSB directly jumped into the Application, should RXD not have reached safe logical High- level (which stands for regular idle state in TTL-RS232) while TSB is being initialized. Seems that this feature causes sporadic bootloader lockouts on devices that can only perform power-up-resets and voltages not clearly defined from the instance. Now the delay of some tens up to hundreds of milliseconds (depending on clock frequency) seems to fix this problem and, as a side effect, minimizes risk of being locked-out by a too-shortly defined timeout. 20140302 Revisited internal verifying feature (TSB for ATtinys). 20131023 Fixed Hang-up by Watchdog-Reset: On many ATtinys, a Watchdog-Reset will leave the Watchdog activated (which is a good feature) but restore its Prescaler (amongst other registers), resulting in a rather short timing interval until next Reset is triggered by the Watchdog. Normally this could be easily intercepted within the application's very own Reset-Routine. Since TSB is invoked before the Reset part of the Application, it ends up an infinite loop of Watchdog-re-resetting with virtually no chance to leave because the short-leashed Watchdog remains active anyway. Switching off the Watchdog by TSB is no option, if we consider that some application's Watchdog may be permanently activated by the WDTON fuse. It is better for TSB not to waste any time if Watchdog is enabled, but instantly forward to the Application's Reset-Routine. To regain access to TSB, the Application/Hardware can take the following measures: Deactivate the Watchdog and then allow normal Resets - or - deactivate the Watchdog and directly jump to Address $0000 (TSB-modified Reset-vector on ATtinys). On ATmegas, the Application may directly jump to the starting Address of TSB, whoose absolute Word-address is half of the value indicated as "Appflash" in TSB device info. A switched-off Watchdog may be automatically re-enabled by the Application's Reset-routine when returned from TSB. Additional code is about 6 Bytes only. Modification applicable to all TSB-devices so far. 20130915 Revisited Assembly source for improved compatibility with open source assemblers. Removed some C-stylish preprocessor directives. Unified syntax of sbiw/adiw to common sense, i.e. lowbyte-register notation. No changes in logical structure of the program. 20130902 For ATtinys below 16KB, the rjmp back to application has been simply calculated by adding of one pagesize to the jump distance. This will works fine and will always produce correct rjmps, provided that the rjmp is located exactly one page below FLASHEND. The new method calculates the same rjmp that an assembler would have generated, i.e. it is a backward rjmp not skipping the memory boundary and thus seems the most compatible method with regards to future devices and a different memory location for LASTPAGE. Tested so far with some relevant 2-, 4- and 8-KB ATtinys. 20130625 Some bigger ATmegas seem to have lavish sized 'SECONDBOOTSTART' of 512 WORDS instead of Bytes - with reference to SECONDBOOTSTART the assembler generated TSB code that has left unused flash of 512 on top of memory... changed reference by a definition ((FLASHEND+1)-256) that could not fail. 20130505 Restructured Assembly sourcecode. Optimized ATtiny code to approx. 550 Bytes of code length. Optimized ATmega code to fit into 512-bytes Bootloader Section. 20130414 Modified assembly with respect to further ATtinys with strange I/O-ports assignments. Some properties now recognized in a more universal way, e.g. Pagesize and Flashsize, both requiring adjustments in the code. Minor improvements in coding. Extensive use of 'conditional assembly': One and the same .asm sourcefile should do well for all ATtinys and other devices in question Same sourcecode may be 'switched' by setting one equate at the beginning to make either a customized version of TSB (with own port assignments), a TSB-Installer or a TSB-Template in manual assembly. TO-DOs: Testing with certain ATmegas. 20130216 Improved integrity check for TSB-Installer: Calculates simple 16-bit checksum over all relevant contents of TSB-Installer and TSB-Firmware, which is to be compared with the value that's been packed into the 1st page of the Installer while TSB-Software made the customized TSB-Installer from a template. If equal - upload is supposed to be correct and Installer is safe to continue with deactivation of the old bootloader, copy/verify of the new bootloader's code etc. If NOT equal - program won't change anything and the old bootloader remains in force. 20130210 Change of builddate format in device info block (permanent data): Unlike previous versions of TSB, that actually took three bytes only for the date information, the new format is more efficient but still easy to implement in the assembly source. Chosen format allows to represent all dates from the year 2000 up to the year 2127 with good binary efficiency, thus leaving the third byte free for any other purpose. E.g. these precious 8 bits might contain additional info on project status, authorship or security information. No functional or other relevant changes in TSB-firmware that far. 20130106 - Failsafe startup despite weak pullup on RXD-portline: if RXD is LOW from the beginning, the bootloader will not wait for timeout but directly forward to the Application. - Fixed assembly for ATtiny87. 20121216 Merged TSB_base with an 'Installer' component to build some regular application (starting at $0000 with reset vector) which can be uploaded either by ISP or by way of a bootloader that is already residing on the ATtiny! Normally this application is only 'run-once'. It will automatically change the existing bootloader with the new TSB version brought along, and finally remove itself from memory. Safety precautions have been taken against possible corruption of data or power-outage. Note: Other methods such as external serial downloader components, dual-bootloader arrangements, etc. have been considered and found inapplicable with respect to the limited memory on many ATtinys. The proposed method won't waste any additional memory after the transfer is complete. The result is exactly the same as if the respective TSB-firmware had been uploaded directly to the target address by way of ISP. (Refer to the source code for details.) 20121123 Introduced conditional assembly to re-integrate all supported ATtinys in one assembler source again. 20121116 - Consolidated port handling with respect to one/two-wire operation: In a two-wire configuration (e.g. D0 for RXD and D1 for TXD), the firmware treats TXD as a normal port output, i.e. both logical ones and zeroes are actively driven (sourcing and sinking output). Reasonably this will provide the best compatibility with common levelshifters like MAX232, PL230x, LT280x etc. or interfacing with sensitive HCMOS-inputs. Yet in one-wire configuration, that is alternating TX- and RX- transactions over the same portline, when it comes to data transmission, the firmware will control the port by the proven open-collector method to safely prevent electrical conflicts with an attached CIV-interface. Fortunately and thanks to some code restructuring/optimization, in sum the tsb-firmware code grew only 2 bytes longer :-) 20120902 - 'One-Wire': Applied new method of portline handling to make it possible combining both portlines for serial communications to one wire (aka 'CIV-interface'). The RXD assigned portline is normally configured as an input. The TXD assigned portline is now acting an output with open-collector characteristics. This allows to use the same portbit for RXD and TXD and thus make direct connection to a One-wire serial adaptor with no logical or electronic conflicts arising, since rx/tx is already performed at discrete times (half-duplex) and the high-level is conveniently defined as the stopbit/idle state in TTL-RS232 logic. For one-wire it is therefore recommended to apply one pullup-resistor to ensure sufficient rise times and signal levels (especially when using more simple adaptors that draw all current from the RS232). To make the TSB bootloader for One-wire, you can simply generate the firmware via TSB-software, specifying the same portline for input and output! Of course you may also copy and change the sourcefile 'tsb_base.asm' and assemble 'manually'. This new programming does not interfere with normal two-wired RS232 designs. With level converters like MAX232 or USB-COM-interface, like FT232, you may not even need additional pullup for TXD, since these chips feature internal pullups. Yet, the PL2302 apparently needs one pullup for its serial input line (thanks: OD). - Minor improvements in the code saved some bytes, so we are still around 560 Bytes with full-featured tsb :-) - Security: Former version of Password check was already 'silent', but it turned to start the Application with some delay when the first wrong character was submit. One could try to automatically hack the password by detecting the actual start of the Application, then try a slightly different password string and so on. NOW, the password checking routine will react only after the full and correct password has been submit (or Emergency Erase was requested). Any other approach will start an infinite loop that could only be stopped by hardware RESET on the MCU. From the outside, both states, regularly awaiting further password characters or hangup, look the same. (Yes, with elaborate methods like power analysis or tampering rf-spectral differences, it may be possible to distinguish both states.) - Revisited protocol and timing with no major changes. - Optimized calibration/timing loop - Reformatted assembly source. 20110921 Initially published fully functional version. No 'official' updates yet. ***