This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Custom boot loader for TMS320f2806x

Other Parts Discussed in Thread: CONTROLSUITE, TMS320F28069

Hi,

I am working on a custom CAN bootloader for 28069 MCU,

I have managed to flash the application using the bootloader and have verified that the flash passes CRC check.

I am calling to the application by using the jump instruction which should be stored in sector A (address 0x3F7FF6), which calls c_init00.

The application then loads, but acts strangely (sometimes no CAN comm, or ADC gives inaccurate readings).

When loading the application directly by JTAG, everything is fine.

Is it ok to call c_init00 twice after MCU power-up (once for bootloader and once for application startup)?

Do I need same addresses for stack and RAM for bootloader and application in the command file (i.e different flash sectors, but RAM location = same)?

Any suggestions would be great.

thanks,

Ben.

  • Ben,

    Instead of jumping to c_init00, I recommend having the processor reset itself.  This will give you the same state as a cold-boot.  You can do this easily with the watchdog timer.

    Regards,

    Bill

  • I am not sure a reset will working since the MCU is booting to CAN. The boot mode configuration (GPIO pins) would have to change to Boot to Flash somehow before reset.

    Try returning the Entry Point address of the application from the main of your bootloader without calling c_init00 again.

    You can look at the sci flash kernel example available in controlSUITE for the F2806x. It returns the EntryPoint address from main which was loaded in the application hex file. Returning from main calls _ExitBoot in Exit_Boot.asm. This is included in the project.

    Let me know if this helps.

    Best Regards,
    sal
  • Hi,

    Thank you for your answer,

    1. I couldn't find the sci flash kernel example in controlSuite.

    I have done the following steps:

    1. changed application cmd file do it will store application c_init00 location in special address which bootloader calls to ->

    MEMORY...

    APP_BEGIN   : origin = 0x3E7F6E, length = 0x000030     /* Stores application Start Point */

    SECTIONS...

    appcodestart      : > APP_BEGIN,  PAGE = 0 

    2. changed F2806x_CodeStartBranch.asm do it would jump to _main instead c_int00 ->

    WD_DISABLE .set 1 ;set to 1 to disable WD, else set to 0

    .ref _main
    .global app_code_start

    ***********************************************************************
    * Function: codestart section
    *
    * Description: Branch to code starting point
    ***********************************************************************

    .sect "appcodestart"

    code_start:
    .if WD_DISABLE == 1
    LB wd_disable ;Branch to watchdog disable code
    .else
    LB _main;Branch to start of application
    .endif

    ;end appcodestart section

    ***********************************************************************
    * Function: wd_disable
    *
    * Description: Disables the watchdog timer
    ***********************************************************************
    .if WD_DISABLE == 1

    .text
    wd_disable:
    SETC OBJMODE ;Set OBJMODE for 28x object code
    EALLOW ;Enable EALLOW protected register access
    MOVZ DP, #7029h>>6 ;Set data page for WDCR register
    MOV @7029h, #0068h ;Set WDDIS bit in WDCR to disable WD
    EDIS ;Disable EALLOW protected register access
    LB _main;Branch to start of boot.asm in RTS library

    .endif

    ;end wd_disable

    .end

    ;//===========================================================================
    ;// End of file.
    ;//===========================================================================

    3. bootloader calls the special address.

    The results are worse when tried to run this code.

    can you tell me what i am doing wrong.

    Thanks,

    Ben.

  • Ben, I believe your entry point should be at 0x3F7FF6 for the F28069.  In you cmd file, change origin = 0x3F7FF6 and a length = 0x000002.

    Check Figure 2-8 of http://www.ti.com/lit/ug/spruh18e/spruh18e.pdf

  • The F28069_flash_kernel example is in controlSUITE:
    C:\ti\controlSUITE\device_support\f2806x\v141\F2806x_examples_ccsv5\f28069_flash_kernel

    Please see this example and the previous post regarding returning from main and _ExitBoot.

    Regards,
    sal
  • Ben,

    Fulano is correct.  Please see www.ti.com/lit/spruh18

    Page 206 in the Boot Rom section reads:

    • Jump to branch instruction in flash memory.

    Jump to flash is the default behavior of the Get Mode boot option. Jump to flash is also available as an emulation boot option.

    In this mode, the boot ROM software configures the device for 28x operation and branches directly to location 0x3F 7FF6. This location is just before the 128-bit code security module (CSM) password locations. You are required to have previously programmed a branch instruction at location 0x3F 7FF6 that will redirect code execution to either a custom boot-loader or the application code."

    You have a couple options.  

    • You can return from main which should call _ExitBoot.
    • You directly branch to your application start address at the end of your kernel
    • You can program a branch instruction at 0x3F 7FF6 which branches to the start of your application.  This will cause the C28x to execute your flash application when it boots to Flash as well.  Additionally, you can do this by building and compiling application to run from Flash.  The linker and compiler will write to 0x3F 7FF6 so that the C28x will boot to your application when booting to Flash.

    Hope this helps.

    sal

  • Hi,
    I am also developing a similar kind of bootloader code.

    [Background]
    Project objective:
    On power up, MCU should run bootloader code. Here MCU will check whether any application file is getting received over UART for 15 seconds. If within 15 seconds MCU doesn't receive anything, then application code should get executed.

    To achieve this objective,
    ->I developed test application code that resides on SECTOR D and modified "f28069_flash_kernel " code's linker file to store this bootloader code in SECTOR A of the flash.

    -> I referred code "f28069_flash_kernel " given in path C:\ti\controlSUITE\device_support\f2806x\v151\F2806x_examples_ccsv5\f28069_flash_kernel

    -> I run the "f28069_flash_kernel" bootloader code in release mode and put the break point on statement "return EntryAddr" after CopyData() function. Here, I sent application.txt file separately through PC based utility. Then I found following observation.


    [Observation]
    1. I could not being able to write value received from application.txt for the memory location "0x3F7FF6".
    Here, to move ahead I bypassed the Flash memory write operation for this particular region. I modified CopyData() function by putting following condition.
    if(BlockHeader.DestAddr != 0x003F7FF6)
    {
    status = Flash_Program((Uint16 *) BlockHeader.DestAddr, (Uint16 *)progBuf, BlockHeader.BlockSize, &FlashStatus);
    if(status != STATUS_SUCCESS)
    {
    return ;
    }
    }

    2. After successful flash write operation (apart from location 0x003F7FF6) of application.txt, break point @ return EntryAddr statement got hit. But when I did step debug bootloader code did not pass control to application.[ Here bootloader code got terminated.]

    [Query]
    1. How to jump to application code after CopyData() function execution and return EntryAddr statement execution? Please share sample code if available.

    Best Regards,
    Vishal
  • First, you should make sure you are running the Flash API and flash kernel from RAM when erasing and programming Flash.

    Second, after completing DFU, you could branch to the boot to Flash location (code_start) which will contain a LB opcode to branch to _c_int00 which will then branch to main. You may also be able to simply return(EntryAddr) from the boot loader function.

    sal
  • Hello sal,

    Thank you for your prompt reply.

    I am running flash API and flash kernel (CopyData() function) from RAM. My data is getting written into the Flash memory successfully (except location 0x003F7FF6).

    FYI - Here, I am not using "Exit_Boot.asm" in my program to enter into bootloader mode or to exit from bootloader application. My application is getting invoked from _c_int00 module. (As per entry address given in codestartbrach.asm)

    As suggested, I have already called statement "return EntryAddr;" after CopyData() function execution. But in this case code is not jumping to application's starting address of flash memory. Instead, bootloader's main loop program gets terminated without invoking a application code.

    [Query]

    1) As per datasheet, we have to call exit boot function before entering into application code. So is it okay, if we use LB instruction to branch directly to the application's EntryAddr, without using ExitBoot function? If not, please let me know how to implement ExitBoot function in bootloader's main loop. 

    2) Is it okay, if I do not write the value (read from application hex file) for memory location 0x003F7FF6? (As my boot loader code is also stored in FLASH memory, so I cannot write starting address for both projects - FLASH Bootloader code and Application code)

    Regards,

    Vishal

  • 1) Yes, this is not a problem.

    2) I am not sure what you are asking in this question.

    Regards,
    sal
  • Hello sal,


    Thank you for your confirmation on query [1], that we can directly use LB command.

    Please find below details for Query [2]

    [Background]
    Entry point for TMS320F28069 controller is 0x003F7FF6.

    I have created below two different projects.
    1. Bootloader Project --- Code resides in Flash sector A
    2. Application Project --- Code resides in Flash sector C

    When I build both projects separately, in both the hex files (i.e bootloader.hex & application.hex) I found some values (of 2 words size) for the memory location 0x003F7FF6.

    Here, firstly I am burning bootloader's hex file into 28069 controller's FLASH using JTAG probe and
    then downloading application hex file by running UART - bootloader program.

    Please find below example application's hex data stream, that bootloader firmware receives over UART.
    02 00 3F 00 F6 7F 7E 00 84 8A
    Here,
    02 00 --- Block size -- 2 words
    3F 00 F6 7F --- Load 2 words at memory location 0x003F7FF6
    7E 00 --- Word #1
    84 8A --- Word #2

    While writing the application hex file (received over UART) into the FLASH memory, I could not being able to write data value at memory location 0x003F7FF6. So I skipped flash memory write operation for this particular memory location by putting following condition in bootloder code.
    if(BlockHeader.DestAddr != 0x003F7FF6)
    status = Flash_Program((Uint16 *) BlockHeader.DestAddr, (Uint16 *)progBuf, BlockHeader.BlockSize, &FlashStatus);

    [Query]
    Will my application program work perfectly, if I do not write the value (read from application hex file) for the memory location 0x003F7FF6?


    Regards,
    Vishal
  • 0x3F 7FF6. is the boot to flash memory location. Whatever is programmed into that location will execute on a boot to flash.

    Make sure that the LB (long branch) opcode you desire is programmed into that location.

    sal