I've been working on a firmware update application for the K70FX. I have 512KB Pflash and 512KB Dflash (FlexNVM). I decided to follow some app notes regarding bootloaders and have the following:
1. Bootloader in lowest 48KB of Pflash. This is bare metal code. I store boot parameters in the last sector of Pflash (0x7F000) The logic goes like this:
if firmware_update == 1
bootaddr = 0xc000
else
bootaddr = 0x10000000
New_sp = IMAGE_ADDR(bootaddr)[0];
New_pc = IMAGE_ADDR(bootaddr)[1];
asm
{
ldr r4,=New_sp
ldr sp, [r4]
ldr r4,=New_pc
ldr r5, [r4]
blx r5
}
This is essentially the same code that is found in the DFU Bootloader app note (AN4370) and it seems to work.
2. At 0xC000 I have an MQX application that is the "firmware update" application. It can receive srec files and program them into Dflash.
3. At 0x10000000 I have an MQX application that is the "real" application for the product.
This all works great IF the pieces are loaded with my PEMicro multilink. I can set the bootloader parameters in the last sector of Pflash, reset the board, and the bootloader jumps to the desired destination.
My problem is when I program the flash from the "firmware update" application. The application erases the entire Dflash and then parses an srec file and programs the records into Dflash. I have stopped the code with my debugger right after the erase. All locations in all sectors are 0xff. I have stopped the code with my debugger right after the flash programming. I can see that the correct data from the srecords has been programmed in the correct location in the correct byte order. At this point I cannot find any difference between data in Dflash programmed by CW10.2/PEMicro or my firmware upgrade app.
The fun begins when I reset the board either by cycling power or like so:
SCB_AIRCR = SCB_AIRCR_VECTKEY(0x5FA) | SCB_AIRCR_SYSRESETREQ_MASK;
At this point, the bootloader runs but when it branches to the address in r5 it hits an exception immediately. Before the branch registers look like this:
r0 = 0x0
r1 = 0x1fff04b0
r2 = 0x0
r3 = 0x1fff0418
r4 = 0x1fff0418
r5 = 0x10014e41
r6 = 0x1fff17e0
r7 = 0x410
r8 = 0x2f8
r9 = 0x0
r10 = 0xc
r11 = 0x0
r12 = 0x10014e41
SP = 0x2000fbfc
LR = 0x6cf
PC = 0x4b2
XPSR = 0x61000000
SP_MAIN = 0x2000fbfc
SP_PROCESS = 0x0
PRIMASK = 0x0
FAULTMASK = 0x0
BASEPRI = 0x0
CONTROL = 0x0
When the blx r5 is executed, there is an immediate exception:
r0 = 0xffffffff
r1 = 0xffffffff
r2 = 0xffffffff
r3 = 0x7fffffff
r4 = 0x1007fffc
r5 = 0x10014e41
r6 = 0x1fff17e0
r7 = 0x410
r8 = 0x2f8
r9 = 0x0
r10 = 0xc
r11 = 0x0
r12 = 0x0
SP = 0x2000fbfc
LR = 0xfffffffd
PC = 0x44c
XPSR = 0xa1000003
SP_MAIN = 0x2000fbfc
SP_PROCESS = 0x2000fbd0
PRIMASK = 0x0
FAULTMASK = 0x0
BASEPRI = 0x0
CONTROL = 0x0
What I have found is that if I write the MQX image to the Dflash with the PEMirco and then disconnect the PEMicro, then I can run my applications and "upgrade" using the S19 file that was generated when I built the software residing in Dflash. If I make a change to my application and generate a new S19 file and try to load it, the flash programming appears to be successful, but when I reset the board I get the exception again.
I don't know how to debug this. I'm new to Kinetis. Please help.
Thanks in advance.