AnsweredAssumed Answered

Bootload and jump to MQX 3.8 CW10.2 on K70FX512VMJ120

Question asked by pbanta on Oct 16, 2012
Latest reply on Apr 11, 2013 by Patrik Cizmar

I've been working on a firmware update application for the K70FX.  I have 512KB Pflash and 512KB Dflash (FlexNVM).  I decided to follow some app notes regarding bootloaders and have the following:

 

1. Bootloader in lowest 48KB of Pflash.  This is bare metal code.  I store boot parameters in the last sector of Pflash (0x7F000)  The logic goes like this:

 

  if firmware_update == 1

    bootaddr = 0xc000

  else

    bootaddr = 0x10000000


  New_sp = IMAGE_ADDR(bootaddr)[0];

  New_pc = IMAGE_ADDR(bootaddr)[1];


  asm

  {

    ldr   r4,=New_sp

    ldr   sp, [r4]

    ldr   r4,=New_pc

    ldr   r5, [r4]

    blx   r5

  }

This is essentially the same code that is found in the DFU Bootloader app note (AN4370) and it seems to work.


2. At 0xC000 I have an MQX application that is the "firmware update" application.  It can receive srec files and program them into Dflash.


3. At 0x10000000 I have an MQX application that is the "real" application for the product.


This all works great IF the pieces are loaded with my PEMicro multilink.  I can set the bootloader parameters in the last sector of Pflash, reset the board, and the bootloader jumps to the desired destination.


My problem is when I program the flash from the "firmware update" application.  The application erases the entire Dflash and then parses an srec file and programs the records into Dflash.  I have stopped the code with my debugger right after the erase.  All locations in all sectors are 0xff.  I have stopped the code with my debugger right after the flash programming.  I can see that the correct data from the srecords has been programmed in the correct location in the correct byte order.  At this point I cannot find any difference between data in Dflash programmed by CW10.2/PEMicro or my firmware upgrade app.


The fun begins when I reset the board either by cycling power or like so:

  SCB_AIRCR = SCB_AIRCR_VECTKEY(0x5FA) | SCB_AIRCR_SYSRESETREQ_MASK;


At this point, the bootloader runs but when it branches to the address in r5 it hits an exception immediately.  Before the branch registers look like this:

r0         = 0x0

r1         = 0x1fff04b0

r2         = 0x0

r3         = 0x1fff0418

r4         = 0x1fff0418

r5         = 0x10014e41

r6         = 0x1fff17e0

r7         = 0x410

r8         = 0x2f8

r9         = 0x0

r10        = 0xc

r11        = 0x0

r12        = 0x10014e41

SP         = 0x2000fbfc

LR         = 0x6cf

PC         = 0x4b2

XPSR       = 0x61000000

SP_MAIN    = 0x2000fbfc

SP_PROCESS = 0x0

PRIMASK    = 0x0

FAULTMASK  = 0x0

BASEPRI    = 0x0

CONTROL    = 0x0

 

When the blx r5 is executed, there is an immediate exception:

r0         = 0xffffffff

r1         = 0xffffffff

r2         = 0xffffffff

r3         = 0x7fffffff

r4         = 0x1007fffc

r5         = 0x10014e41

r6         = 0x1fff17e0

r7         = 0x410

r8         = 0x2f8

r9         = 0x0

r10        = 0xc

r11        = 0x0

r12        = 0x0

SP         = 0x2000fbfc

LR         = 0xfffffffd

PC         = 0x44c

XPSR       = 0xa1000003

SP_MAIN    = 0x2000fbfc

SP_PROCESS = 0x2000fbd0

PRIMASK    = 0x0

FAULTMASK  = 0x0

BASEPRI    = 0x0

CONTROL    = 0x0

 

What I have found is that if I write the MQX image to the Dflash with the PEMirco and then disconnect the PEMicro, then I can run my applications and "upgrade" using the S19 file that was generated when I built the software residing in Dflash.  If I make a change to my application and generate a new S19 file and try to load it, the flash programming appears to be successful, but when I reset the board I get the exception again.

 

I don't know how to debug this.  I'm new to Kinetis.  Please help.

 

Thanks in advance.

Outcomes