- load any program into S12 RAM and execute it,
- erase, read, write EEPROM, set EEPROM protection,
- erase, read, write FLASH,
- secure and unsecure whole MCU.
Using BDM link requires special interface device - so called BDM POD. Supported BDM PODs are:
BOOTLOADER (Freescale's LRAE via serial port)
hcs12mem supports operations on target memory using Freescale's LRAE (Load RAM And Execute) bootloader, using serial port connection (SCI0 on target hardware). Prior to all operations, presence of LRAE bootloader is required in target's FLASH memory. LRAE is available for a wide selection of S12 MCUs. Source code, S-record files and description can be obtained from Freescale as Application Note - AN2546. This bootloader is supposedly loaded into new S12 MCUs as last stage of factory processing, thus some "fresh" parts straight from Freescale should have this bootloader already in FLASH memory.
MONITOR (Freescale's serial monitor - AN2548)
hcs12mem supports operations on target memory using Freescale's serial monitor (AN2548). This monitor uses serial port connection (SCI0 on target hardware). Prior to all operations, presence of serial monitor is required in target's FLASH memory. Monitor is available for a wide selection of S12 MCUs. Source code, S-record files and description can be obtained from Freescale as Application Note - AN2548. Port of the source code to GNU tools is available, see "SEE ALSO" section.
hcs12mem running via BDM supports almost all S12 derivatives (not all are tested, though, especially parts with multiple FLASH blocks are not tested):
<MC9S12> A32, A64, A128, A256, A512, C32, C64, C96, C128, GC16, GC32, GC64, GC96, GC128, D32, D64, D128, D256, D512, E32, E64, E128, E256, H128, H256, UF32, NE64.
hcs12mem using LRAE supports all derivatives that can run LRAE, according to AN2546 (maybe some others too, if LRAE can work on them):
<MC9S12> A32, A64, A128, A256, A512, C32, C128, D32, D64, D128, D256, D512, E128.
hcs12mem using serial monitor supports all derivatives that can run serial monitor. AN2548 has variants of serial monitor for the following targets (compiling dedicated version for other target is easy):
<MC9S12> C32, D32, D64, D128, D256, D512, E128, H256.
My port to GNU tools adds support for A64 and NE64.
Following options can be specified multiple times, any of them, processing is according to occurence order:
Options specific for particular interfaces:
Depending on the interface in use, different options are required:
TBDML - interface type and target type are required, no port specification is required (USB bus is assumed), no target frequency is required (TBDML can auto-detect it), but it can be overriden with -o option, if auto-detection fails and TBDML is unable to connect the target.
BDM12, PODEX - required are: interface type, target type, interface connection port and target frequency.
Two examples of these options for TBDML and PODEX follows: first example - interface is PODEX, serial port for PODEX attachment is /dev/uart0, target is MC9S12A64 MCU operating at 16MHz; second example - interface is TBDML (assumed connection via USB), target is MC9S12A64 MCU, operating frequency is auto-detected. hcs12mem call usually requires some more action commands to do something specific, but such call with these options only is convenient for verifying target communication - it initializes the target, displays all the info and quits:
hcs12mem -i podex -p /dev/uart0 -t mc9s12a64 -o 16MHz
hcs12mem -i tbdml -t mc9s12a64
Unsecure secured microcontroller:
hcs12mem [-ipto] --unsecure
Secure unsecured microcontroller:
hcs12mem [-ipto] --secure
Load some code into target RAM and execute:
hcs12mem [-ipto] --ram-run some_code.s19
Read EEPROM contents:
hcs12mem [-ipto] --eeprom-read eeprom_data.s19
Set EEPROM protection:
hcs12mem [-ipto] --eeprom-protect all
Read data from FLASH memory and write it to S-record file, use Freescale banked linear addresses, write all erased 0xff's to output file (default is to skip them):
hcs12mem [-ipto] -e --flash-address banked-linear --flash-read flash_data.s19
Write data from S-record file to FLASH memory (non-banked flat addressing, option -a non-banked assumed by default):
hcs12mem [-ipto] --flash-write flash_data.s19
Action options can be specified multiple times, they are executed in specified order, for example - erase FLASH, write program into FLASH and reset target, thus immediatelly starting program execution:
hcs12mem [-ipto] --flash-erase --flash-write program.s19 --reset
LRAE BOOTLOADER (AN2546)
Using LRAE serial bootloader, we specify following common options:
hcs12mem -i lrae -p /dev/uart0 -t mc9s12a64 -o 16MHz
Baud rate for serial connection is automatically calculated by hcs12mem, using supplied oscillator frequency as reference. You can override auto-selected baud rate with -b <baud> option, if some other speed is preferred.
Load your program into target RAM, and execute it:
hcs12mem [-ipto] --ram-run program.s19
Write your program into target FLASH, keeping LRAE in FLASH:
hcs12mem [-ipto] --flash-erase --keep-lrae --flash-write program.s19
Bulk erase FLASH memory, load LRAE and your program:
hcs12mem [-ipto] --flash-erase --flash-write lrae.s19 --flash-write program.s19
NOTES: reloading FLASH program using LRAE is tricky, because when your program is loaded into FLASH, LRAE is not running anymore. Thus, if you want to reuse LRAE, your program must have a way to enter LRAE on request, for example push button tested as very first thing in your program or something like that. Also, every hcs12mem call using LRAE requires preceding manual target reset.
Writing program destined to be loaded into FLASH memory in coexistence with LRAE bootloader has special requirements (memory layout, MCU initialization), see Application Note AN2546 for more details.
SERIAL MONITOR (AN2548)
Using serial monitor, we specify following common options (oscillator frequency is not required):
hcs12mem -i sm -p /dev/uart0 -t mc9s12a64
Baud rate for serial connection is 115200bps by default. If you have special version of serial monitor compiled with some other settings, you can override auto-selected baud rate with -b <baud> option.
Using serial monitor, there's no way to erase it, except via BDM, and:
- erasing FLASH erases only parts of memory outside serial monitor (--flash-erase and --flash-erase-unsecure do the same)
- erasing FLASH erases also EEPROM ! (this is how serial monitor implements this)
- securing and unsecuring MCU is not supported
Erase EEPROM, write some initial data and protect upper 256 bytes of EEPROM:
hcs12mem [-ipto] --eeprom-erase --eeprom-write eeprom.s19 --eeprom-protect 256B
Erase FLASH (EEPROM gets erased too), write your program and reset target (thus starting your program):
hcs12mem [-ipt] --flash-erase --flash-write program.s19 --reset
Writing program destined to be loaded into FLASH memory in coexistence with serial monitor has special requirements (memory layout, MCU initialization), see Application Note AN2548 for more details.
FLASH write verify is not implemented yet.
MCUs with more that single FLASH block are barely tested.
http://www.freescale.com - Freescale's web page, all S12 MCU info
http://cml.mfk.net.pl/hcs12mem - hcs12mem web page
http://cml.mfk.net.pl/podex - improved PODEX web page
http://www.duch.cz/podex/ - original PODEX web page
http://www.kevinro.com - Kevin Ross's BDM12 POD web page
http://www.freegeeks.org - Daniel Malik's TBDML
http://cml.mfk.net.pl/an2548 - my port of Freescale's serial monitor (AN2548) to GNU tools
hcs12mem is free software, covered by the GNU General Public License. You are welcome to change it and/or distribute copies of it under the conditions of the GNU General Public License.