How to jump to application from bootloader after update image in S32K312.

[dnewbe]

I'm using S32K312 MCU that have a large Flash memory.

I created two BIN files operating in locations 0x00400000 and 0x00500000 respectively as Linker Script files after writing Bootloader code.
This bootloader code works with UART port and Erase and Write a BIN file to Flash area.

Two BIN files have the same image and only the Flash address is different.
Images operating on 0x00400000 operate by flashwriting using JTAG.

The image operating at 0x00400000 programs the BIN file to the location of 0x00500000 on FLASH through UART.
Verified that the contents of the BIN file and the contents of FLASH match.
Jump to the next 0x00500000 location.

Left view is on Text editor and right is S32DS debugger.

And last memory is below.

And then jump to application

FunctionPointer functionPtr = (FunctionPointer)(*(uint32 *)0x00500000);
(functionPtr )();

HardFault_Handler will occurr.

How do I jump to 0x00400000 or 0x00500000 position after completing Flash write with Bootloader?

[not_a_duck]

 @Sdeveloper  maybe this helps.

This is the function I use in the bootloader to jump to the app:

void jump_to_app( void )
{
    /* Disable interrupts until the application can copy its interrupt vector table into RAM */
    // __disable_irq();
    __asm__ volatile ("cpsid i" : : : "memory");

    // app start is at 0x00508000
    // 0x00508000 contains address for the stack pointer
    ///// -> 0x20020000
    // 0x00508004 contains address for the reset handler
    ///// -> 0x00500420

    // from the app.map file this is the stackpointer address
    // 20020000 g       .int_vector	00000000 __INT_DTCM_END

    /* Jump to the application reset vector */
    // sets the stack pointer to the application stack
    __asm__ volatile ("msr msp, %0" : : "r" (0x20020000) : );
    // __asm__ volatile ("msr msp, %0" : : "r" (0x20450000) : );
    // need to review this because not sure if this is necessary since reset handler updates this as well. ¯\_(ツ)_/¯

    // sets the program counter to the reset handler and adds 1
    // this is need because these instructions are in the thumb instruction set not arm

    // from the app.map file this is the address of the reset handler.
    // 00500420 g       .pflash	00000000 Reset_Handler
    __asm__ volatile( "bx %0" : : "r"( 0x00500421 ) );
}

[Sdeveloper]

Hi @not_a_duck, 

thanks for your suggestion i tried with the procedure you indicated me but I still can't run the application, the applications gets stuck in HardFault_Handler (image below).

Do you have any further suggestion? Did you perform any specific modification in the application linker file?

Thank you again and BR, 

[not_a_duck]

@Sdeveloper can you please share your linker scripts for the app and bootloader. Can you also share the part of the .map file for the app to see where the "reset_handler" address is and where the interrupt vectors are.

[Sdeveloper]

Hi dnewbe,

I have the same problem you described, one binary file placed at address 0x0400000 ( i named it bootloader) and a second one at 0x0500000 (application). When I perform the Jump from BootLoader to Application as described in NXP support reply post, the jump appears to be correctly executed but then the execution either stops at cpsid instruction, as showed in attached picture, or goes into HardFault_Handler.  

Did you manage to find a working solution?

Thank you in advance, BR

[danielmartynek]

Hello @dnewbe,

There is Unified bootloader Demo you can refer to:

https://community.nxp.com/t5/S32K-Knowledge-Base/Unified-bootloader-Demo/ta-p/1423099

It should work with this code

func = *(UINT32 volatile *)(ADDR_APP + 0xC);
func = *(UINT32 volatile *)(((UINT32)func) + 0x4);   //add this line of code.
func = (((UINT32)func) & 0xFFFFFFFEU);
(* (void (*) (void)) func)();

Core0 start address should be at 0x50000C.

Core0 reset vector at ((uin32_t*)0x50000C) + 0x4)

Please check it in the memory view.

If i'm not mistaken, at 0x50000C, there is 0x441000, as if the core0 reset vector was at 0x441004.

BR, Daniel

[dnewbe]

The value is 0x00050100 at 0050000C.

I want is jump to other image area that is update from 00400000 area image.

[danielmartynek]

Hello @dnewbe,

Why is there address 0x00000000?

Can you check the mamory after it is flashed?

[baseerahmadpiracha]

Hi @dnewbe,

you can use the code below to jump to application by giving the address where you want to jump.

Can you share your code that can Erase and Write a BIN file to Flash area through UART port as I am currently taking files in SREC format.

void JumpToUserApplication( unsigned int userSP,  unsigned int userStartup)

{

/* Check if Entry address is erased and return if erased */

if(userSP == 0xFFFFFFFF){

return;

}

/* Set up stack pointer */

__asm("msr msp, r0");

__asm("msr psp, r0");

/* Relocate vector table */

S32_SCB->VTOR = (uint32_t)APP_START_ADDRESS;

/* Jump to application PC (r1) */

__asm("mov pc, r1");

}

[dnewbe]

My map file is below and what is jump address ?

And code is not mine  it is my company so can't share. Pls refer below
Calculate the number of Sectors required by the size of the BIN file and erase Flash.
Write packets received through UART as much as the size of the BIN file to Flash in order.

.flash 0x00500000 0x113f4
*(.boot_header)
.boot_header 0x00500000 0x2c ./Project_Settings/Startup_Code/startup_cm7.o
0x00501000 . = ALIGN (0x1000)
*fill* 0x0050002c 0xfd4
0x00501000 __text_start = .
0x00501000 __interrupts_rom_start = .
*(.intc_vector)
.intc_vector 0x00501000 0x408 ./Project_Settings/Startup_Code/Vector_Table.o
0x00501000 VTABLE
0x00501408 . = ALIGN (0x4)
0x00501408 __interrupts_rom_end = .
*(.core_loop)
.core_loop 0x00501408 0xc ./Project_Settings/Startup_Code/startup_cm7.o
0x00501408 _core_loop
0x00501414 . = ALIGN (0x4)
*(.startup)
*fill* 0x00501414 0xc
.startup 0x00501420 0x1c8 ./Project_Settings/Startup_Code/startup_cm7.o
0x00501420 Reset_Handler
0x00501420 _start
0x00501572 MCAL_LTB_TRACE_OFF
0x00501574 _end_of_eunit_test
0x005015e8 . = ALIGN (0x4)
*(.systeminit)
0x005015e8 . = ALIGN (0x4)
*(.text.startup)
0x005015e8 . = ALIGN (0x4)
*(.text)