Design of AT91SAM7Sxx MCU Boot-Loader

The AT91SAM7xx series are 32-bit MCUs based on the ARM7 core introduced by Atmel. User code is compiled in Thumb mode to obtain 16-bit instruction width, thereby saving internal program space. At present, the internal Flash space of this series of chips ranges from 32KB to 256KB, and the RAM space ranges from 8KB to 6?KB. Except SAM7S32, the chips of this series are embedded with USB2.0 full-speed communication module. This article introduces the user program upgrade tool based on the USB interface.

We know that Atmel provides a SAM-BA download tool for this series of chips. The application of this tool in the product stage has certain limitations. In order to start the SAM-BA program inside the chip, the user needs to short-circuit the TST pin of the chip to the power terminal, then power on for 10 seconds, and then power on again. The Boot-loader program introduced in this article resides in the internal Flash space of the chip. The startup method is to press and hold a specific button of the product and then power on. This greatly simplifies the upgrade process of product firmware.

1 The position of Boot-loader in Flash

In order to use the same Boot-Loader program in the entire SAM7Sxx series, we locate it at the low end of the Flash with an offset of 0x800 to 0x15ff, occupying a total of 3584 bytes of space. The corresponding user program should avoid using this address when linking. The author uses the IAR compilation environment and needs to modify the link target positioning control file to achieve the purpose of positioning the target file.Take S256 as an example, need to modify the at91SAM7S256_NoRemap.xcl file

 The items that need to be modified in the link control file of the Boot-loader are:

-DROMSTART1=00 Start position of interrupt vector table

-DROMEND1=3F interrupt vector table end position

-DROMSTART2=800 the starting position of the target program

-DROMEND2=15FF target program end position

The positioning of CODE and ICODE CONST also needs to be modified accordingly.

 The Boot-loader startup file is provided by Atmel (Cstartup.s79), but it needs to be modified:

RSEG ICODE:CODE:ROOT(2) is changed to RSEG INTVEC:CODE:ROOT(2) to locate the exception vector table from 0x00 to 0x3f.

Add the statement RSEG ICODE:CODE:ROOT(2) at the end of the exception vector table to locate the startup code in the CODE section.

 The user application project needs to be modified in the at91SAM7S256_NoRemap.xcl file

-DROMSTART1=00 interrupt vector table and start code start position

-DROMEND1=7FF interrupt vector table and start code end position

-DROMSTART2=1600 the starting position of the target program

-DROMEND2=3FFFF target program end position

The positioning of CODE and ICODE CONST also needs to be modified accordingly. To avoid overlap with Boot-Loader address.

2 Implementation of Boot-Loader

2.1 Start of Boot-Loader

After power-on reset, the PC pointer first points to the Boot-Loader, and the Boot-Loader first initializes the IO port, and then judges whether the user has pressed the button to start the Boot-Loader. If the key is not pressed and there is user code in Flash, then jump to the user program entry. The following code is to compile the user entrance subroutine with the assembly.

PUBLIC EnterUser



ldr r1, = 0x15fc; 0x15fc saves the user entry address

ldr r0, [r1,#0]

bx r0

If the user presses this key when powering on, the main loop of Boot-Loader will run.

2.2 USB drive

USB driver adopts HID class to save the need of developing driver. The HID report uses the following structure:

const char LoaderDescriptor[] = {

0x06, 0xA0, 0xFF, // manufacturer-defined purpose

0x09, 0x01, // manufacturer-defined purpose

0xA1, 0x01, // report collection: application

// The Input report

0x09, 0x03, // report ID defined by the manufacturer

0x15, 0x00, // logical minimum (0)

0x26, 0xFF, 0x00, // logical maximum (255)

0x75, 0x08, // report bit width (8 bits)

0x95, 0x03, // report length (3)

0x81, 0x02, // input report

// The Output report

0x09, 0x04, // report ID defined by the manufacturer

0x15, 0x00, // logical minimum (0)

0x26, 0xFF, 0x00, // logical maximum (255)

0x75, 0x08, // report bit width

0x96, 0x04, 0x01, // report length (260 bytes)

0x91, 0x02, // output report

0xC0}; // End of collection

In this way, the size of the datagram downloaded by the PC is 260B. The first byte is the write command, and the second and third bytes are the page address of the user firmware (the user firmware needs to be compiled into a binary file *.bin). Next is the 256 bytes of firmware data.

2.3 Flash Operation of

Define all functions for operating Flash in RAM space, for example:

__ramfunc int CFlash::Erase_All(void)

Because the Flash of the SAM7Sxx series adopts a single-layer structure, it is not allowed to rewrite the content of the Flash while the program is running on the Flash, so the program that operates the Flash must be run in the RAM.

2.4 Processing of data packets

The first data packet contains user startup code and exception vector table. Boot-Loader needs to modify the reset vector and save the user entry address (pseudo code as follows)

if (Page == 0) {

Get User Entrance Address

Replace User Entrance Address with Boot-Loader Entrance Address

Program first page into Flash

Set flag to indicate an unfinished task

Calculate checksum and return to PC


After receiving the end instruction, the completion flag needs to be set (pseudo code is as follows):

if (Command == END_OF_TASK) {

Write last page into Flash

Reset unfinished flag

Calculate checksum and return to PC


If the page address overlaps with the boot-loader, no write operation is performed, and only the success flag is returned to the PC:

if ((Page >= BL_START_PAGE) && (Page <= BL_END_PAGE)) {

ret = true;



3 Introduction to the realization of downloading software on PC

The following is the standard PC terminal operation process:

– Get USB HID Class GUID

-Get all HID device structure array

– Obtain device information according to VID PID

-Open the device handle

– Communicate with Boot-Loader

The above steps are common in Windows, MacOS, and Linux. Readers can find specific methods for PC-side program implementation in Reference 3.

Figure Boot-loader position in Flash (take SAM7S256 as an example)

4 Conclusion

The implementation method introduced in this article simplifies the upgrade process of AT91SAM7Sxx series user program. The HID USB interface increases the flexibility of product cross-platform applications. The author tested and downloaded 25K code for about 2 seconds, which has certain practical value.


[1] at91sam7s_full.pdf. Http://

[2] HID1_11.pdf. Http://

[3] Stuart Allman Using the HID class eases the job of writing USB device drivers. Http://

Li Longqing

Hill Si Instrument (Shenzhen) Co., Ltd.

The Links:   ME701203 FZ200R65KF2