Hi everyone,
I am doing some stuffs about custom bootloader but I have a problems with it.
I put a LED signalization into BSL_Protect function which is on 0x17F2 memory. In this function I check if BSL sequence was entered.
BSL_Protect
CLR RET_low ;lock (keep JTAGLOCK_KEY state)
BIS #SYSBSLPE+SYSBSLSIZE0+SYSBSLSIZE1 , &SYSBSLC ; protects BSL
BIS.B #BIT3, &P7DIR
BIC.B #BIT3, &P7OUT
BIT #SYSBSLIND,&SYSCTL ;check for BSL start request
JZ BCC2BSL
CLR SYSCTL
BIS.B #BSL_REQ_APP_CALL, RET_low
BIS.B #BIT3, &P7OUT
MOV.W #10000, R11
DELAY_LOOP:
DEC.W R11
JNZ DELAY_LOOP
BIC.B #BIT3, &P7OUT
BCC2BSL: RETA
As you can see the led MUST blink only if the exact bsl sequence was entered. When I burn the BSL code into MSP430F5529 led did not blink. All right. I enter the BSL entry sequence (hold RST, pulse on TEST, hold TEST, release RST, release TEST) and LED diode blinks. All right - I am into BSL code. BUT I press RST button again and the LED blinks AGAIN!
1. Why? I did not enter the BSL sequence! But If I press TEST button, release TEST button and then I press the RST button the blink is not done. Could someone explain it to me? The led blinks if I power off / power on the my board too.
2. Why R12 register? HOW the R12 register invoked the BSL code or an application code? Is something inside into MSP430 which cannot be seen? After reading a lot of documentation the start-up sentence is like this:
a) Hard reset
b) Check if 03CA5h and 0C35Ah is on the proper location: 0x17F4 and 0x17F6
c) After that the PC is set to 0x17F2 where is jump to BSL_Protect function
d) In the BSL_Protect function is a code which decides if BSL sequence was entered. If yes it sets R12 = 0x0002. If not the R12 = 0x0000
e) NOW WHAT? Now is called RETA instruction but WHERE? Could you please explain me HOW and WHERE the code jumps?
3. In this section:
BSL_Entry_JMP
JMP C_Branch
JMP BSL_ACTION0 ;BSL_ACTION0 unused
JMP $ ;BSL_ACTION1 unused
JMP $ ;BSL_ACTION2 unused
JMP $ ;BSL_ACTION3 unused
C_Branch BR #_c_int00
;JMP $ ;BSL_ACTION5 unused
;JMP $ ;BSL_ACTION6 unused
How the BSL code could jump to BSL_ACTION0? Why is the example code like this? Or the action0 is not important?
4. My problem is that I burn app code into MCU. I can run the code but after RST is pressed the code do not work anymore. Problem is that I have wrong jump on the RST vector 0xFFFE and 0xFFFF. I found out with reading of MCU memory byt MSP-FET programmer
THANK YOU VERY MUCH.
Best regards,
Maros
;**************************************************************
; BSL SW low level functions
;**************************************************************
.cdecls C,LIST,"msp430x552x.h"
ARG1 .equ R12
ARG2 .equ R13
ARG3 .equ R14
ARG4 .equ R15
RET_low .equ R12
RET_high .equ r13
.ref _c_int00
;--------------------------------------------------------------
.sect ".ZAREA"
;--------------------------------------------------------------
BSL_Entry_JMP
JMP C_Branch
; JMP BSL_ACTION0 ;BSL_ACTION0 unused
; JMP $ ;BSL_ACTION1 unused
; JMP $ ;BSL_ACTION2 unused
; JMP $ ;BSL_ACTION3 unused
C_Branch BR #_c_int00
;JMP $ ;BSL_ACTION5 unused
;JMP $ ;BSL_ACTION6 unused
.sect ".ZAREA_CODE"
;**************************************************************
; Name :BSL_ACTION0
; Function :BSL Action 0 is a function caller
; Arguments :r15, Function ID
; - 0: Get Software ID
; - 1: Unlock BSL Flash area
; Returns :r14, Low Word
; :r15, High Word
;**************************************************************
BSL_ACTION0
CMP #0xDEAD, ARG2
JNE RETURN_ERROR
CMP #0xBEEF, ARG3
JNE RETURN_ERROR
;CMP #0x01, ARG1
; to do ... comment!
;JEQ BSL_Unprotect ; 1 == unlock BSL flash area
;JEQ JTAG_Lock
;JL BSL_SW_ID ; 0 == return SW ID
;JL RETURN_ERROR ; 0 == return SW ID
JMP RETURN_TO_BSL ; 2 == return to BSL
RETURN_ERROR
CLR RET_low
CLR RET_high
RETA
;**************************************************************
; Name :RETURN_TO_BSL
; Function :Returns to a BSL function after that function has made
; :an external function call
; Arguments none
; Returns :none
;**************************************************************
RETURN_TO_BSL
POP.W RET_low ; remove first word from return addr
POP.W RET_high ; remove second word from return addr
RETA ; should now return to the BSL location
;**************************************************************
; Name :BSL_Protect
; Function :Protects the BSL memory and protects the SYS module
; Arguments :none
; Returns :0 in R12.0 for lock (keep JTAGLOCK_KEY state)
; :1 in R12.0 for unlock (overwrite JTAGLOCK_KEY) : BSL_REQ_JTAG_OPEN
; :0 in R12.1 for no appended call
; :1 in R12.1 for appended call via BSLENTRY : BSL_REQ_APP_CALL
;**************************************************************
BSL_REQ_JTAG_OPEN .equ 0x0001 ;Return Value for BSLUNLOCK Function to open JTAG
BSL_REQ_APP_CALL .equ 0x0002 ;Return Value for BSLUNLOCK Function to Call BSL again
BSL_Protect
CLR RET_low ;lock (keep JTAGLOCK_KEY state)
BIS #SYSBSLPE+SYSBSLSIZE0+SYSBSLSIZE1 , &SYSBSLC ; protects BSL
BIS.B #BIT3, &P7DIR
BIC.B #BIT3, &P7OUT
BIT #SYSBSLIND,&SYSCTL ;check for BSL start request
JZ BCC2BSL
CLR SYSCTL
BIS.B #BSL_REQ_APP_CALL, RET_low
BIS.B #BIT3, &P7OUT
mov.w #10000, R11
DELAY_LOOP: dec.w R11
jnz DELAY_LOOP
BIC.B #BIT3, &P7OUT
BCC2BSL: RETA
.sect ".BSLSIG"
.word 0xFFFF
BslProtectVecLoc .word BSL_Protect ; Do tejto funkcie skoci pri starte programu VZDY.
PBSLSigLoc .word 03CA5h ;1st BSL signature
SBSLSigLoc .word 0C35Ah ;2nd BSL signature
.word 0xFFFF
BslEntryLoc .word BSL_Entry_JMP ;BSL_Entry_JMP
PJTAGLOCK_KEY .word 0xFFFF ; Primary Key Location
SJTAGLOCK_KEY .word 0xFFFF ; Secondary Key Location
; set default unlock JTAG with option to lock with writting
; a value <> 0x0000 or 0xFFFF
.end
