This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC2642R: What is the true starting address that the user program stores when the cc2642r1f is doing an OTA upgrade?

Part Number: CC2642R
Other Parts Discussed in Thread: BLE-STACK, SYSCONFIG

Hi team,

Here's an issue from the customer may need your help:

1) Official routine configuration (non-secure mode), address 0x50 for jump-to-user program. However, as shown in the following file, 816 bytes after 0x1000 appear to be also occupied. So what is the starting address for the first packet to write to flash after receiving the bin file data from the mobile app?

Memory Map — SimpleLink CC13XX/CC26XX SDK BLE5-Stack User's Guide 2.02.04.00 documentation

The following table contains the memory map for the CC13xx or CC26xx.

Memory Section Starting Address Size (bytes) Description
Flash 0x00000000 60 Cortex Interrupt Vecs
0x00001000 816 TI RTOS ROM Jump Table
Application / Stack Code
SNV 1-2 pages Simple Non-Volatile Storage
Last Flash Page* 88 Customer Configuration
ROM 0x10000000 ROM_SIZE TI-RTOS, BLE-Stack/BLE5-stack, Crypto, Driverlib, Boot
RAM 0x20000000 RAMVEC_SIZE Interrupt Vector Table in RAM for dynamic Hwi creation
0x20000100 RTOSRAM_SIZE Reserved for pointers for TI-RTOS in ROM
.bss and .data
ICall heap
TI-RTOS kernel system stack (CSTACK)

2) Each page for CC2642 is 8k, meaning that the first page cannot be used to hold the user program?

3) write flash, is it required to write the entire page? Or can write it alone, erase it all?

Could you help check this case? Thanks.

Best Regards,

Cherry

  • Hi Cherry,

    I have assigned this thread to a relevant expert and they will be in touch shortly.

    Best Regards,

    Jan

  • Hey Cherry,

    Are you inquiring about on chip or off chip oad?

    So what is the starting address for the first packet to write to flash after receiving the bin file data from the mobile app?

    I imagine this is application dependent. It may be beneficial to take a look at oad.c where this logic exists. I would take a look at oadImgIdentifyWrite() in particular. Below is a code snippet from this file after the OAD image is validated and the copy process is being prepared for:

    // If image ID is accepted, set variables and pre-erase flash pages
        if(idStatus == OAD_SUCCESS && verifStatus == OAD_SUCCESS)
        {
    
            if(!useExternalFlash)
            {
                imageAddress = 0;
                imagePage = 0;
                metaPage = 0;
            }
            else
            {
                ImageSizeInfo_t extFlInfo[OAD_EFL_MAX_META] = {0};
    
                // Warning: oadFindExtFlMetaPage needs to be called first
                // to populate the imageInfo structure.
                oadFindExtFlMetaPage(&metaPage, extFlInfo);
                // oadFindExtFlImgAddr will find a suitable region
                // based on ext meta
                imageAddress = oadFindExtFlImgAddr(extFlInfo , idPld->len);
                imagePage = EXT_FLASH_PAGE(imageAddress);
            }

    If you connect just the application to the debugger, you can pause the debugger at this point to find the contents of imageAddress, which is what I believe you are inquiring about (from an off-chip OAD perspective).

    2) Each page for CC2642 is 8k, meaning that the first page cannot be used to hold the user program?

    I don't suspect this is the case.

    3) write flash, is it required to write the entire page? Or can write it alone, erase it all?

    I believe the default example allows a write to any space, but the example erases entire pages. I see the function eraseFlashPg inside flash_interface_ext_rtos_NVS.

    I hope this helps as a start. Please let me know if you'd like some additional clarity on this and I will help answer your follow up questions.

  • Hey Ammar,

    Thanks for your help.

    Are you inquiring about on chip or off chip oad?

    They are using on chip OTA. However, they don't use the official OAD routine and the storage start address is found.

    The customer use non-secure mode, so the first page needs to read out the saved interrupt vector before erasing. Read the first 60 bytes with readFlashPg(0,Temp,60); and then print out, unlike the data read with Flash Programr 2.

    Also here're 2 more questions: 

    1.some addresses starting with flash on the first page of CC2642, are cortex interrupt vectors installed, etc., are they readable or not readable?

    2. would these interrupt vectors be wiped off with eraseFlashPg(0)?

    Thanks and regards,

    Cherry

  • Hey Cherry,

    1.some addresses starting with flash on the first page of CC2642, are cortex interrupt vectors installed, etc., are they readable or not readable?

    I believe they should be readable, although I don't think I've ever seen this question before. What's the motivation behind this question? Generally I wouldn't recommend touching the interrupt vector section as that's used by the application to track various states and the stack pointer.

    2. would these interrupt vectors be wiped off with eraseFlashPg(0)?

    Yes, you should not erase the first page.

  • Hey Ammar,

    The flash erasing issue has been resolved, while here's a new condition:

    The customer is cropping and writing OTA programs in official persistent_app engineering. Now they find that flash space is not enough. Is it possible to change the default nvs assignment of 2pages to 1page? This gives an extra 8k of flash to write to the downloader. However, after changing the SIZE and persistent_app start addresses in .syscfg and .cmd, it still report the error "addresses overlap".

    Thanks and regards,

    Cherry

  • Hey Cherry,

    It should be possible to only use 1 nv page. Have you also modified the linker file inside the simple_peripheral_oad_onchip example? You will need to make sure both that project and persistent_app is modified correctly to avoid overlapping segments.

  • Hey Ammar,

    The customer also modified .cmd, .syscfg, and so on in the user program multi_role, but still reported an error.

    Have you also modified the linker file inside the simple_peripheral_oad_onchip example?

    Could you help list the linker file so that they can check one by one and confirm the overlapping?

    Also, after nvs only assigns 1 page=0x2000, does the SNV_ID range: 0x100~0x11F need to be changed?

    Thanks and regards,

    Cherry

  • Hey Cherry,

    Let me try this out on my end and I can follow up with some instructions. I hope to have a reply by Tuesday of next week.

  • Hey Cherry,

    I was not able to reproduce this on the default examples, but I have some steps the customer can try.

    In persistent_app:

    1. Define NVOCMP_NVPAGES=1 inside the project's predefined symbols.
    2. Set the SysConfig NV region to 0x2000 (like you show in your screenshot above).
    3. Open the project's linker file cc13x2_cc26x2_app.cmd (if using CCS, this is located inside C:\ti\simplelink_cc13xx_cc26xx_sdk_6_10_00_21_eng\examples\rtos\CC26X2R1_LAUNCHXL\ble5stack\persistent_app\tirtos\ccs
      1. Edit IMG_A_FLASH_START and set it to 0x00036000.
    4. Open the project's RTOS config file persistent_app.cfg
      1. Modify the m3Hwi.resetVectorAddress to 0x00038090; (if curious, the 0x90 is to account for the security header. The persistent app enables security by default.
      2. 	else
        	{
        	  m3Hwi.resetVectorAddress  = 0x00038090; //change this to 0x00036090; secure persistent app
        	  ROM.constStructAddr = 0x39000; //tables TI rtos uses
        	  ROM.externFuncStructAddr = 0x393C0;
        	}

    In simple_peripheral_oad_on_chip, repeat the above steps, except #4. Note, for item #3, you will need to modify the simple_peripheral_oad_on_chip's linker file separately. Please navigate to that project path to find that linker file. I would also caution on changing the linker files directly (you will lose the original SDK contents). Make sure to back the linker file up or save a copy so that you can revert any change.

    Hope this helps.

  • Hey Ammar,

    Thanks.

    The customer just followed the steps you given except for step 1, and changed 0x00038000 to 0x00034000. And leave nvs allocation 2page=0x4000 unchanged, only compresses user APP space, but it still reports an error.

    The file path for the customer, such as .cmd, is the one in the development engineering that was backed up to the engineering directory, instead of the default path of the installation. Will this be an issue?

    Thanks and regards,

    Cherry

  • Hey Cherry,

    The file path for the customer, such as .cmd, is the one in the development engineering that was backed up to the engineering directory, instead of the default path of the installation. Will this be an issue?

    As long as the customer points to the correct linker file by modifying the project properties, this should be ok.

    The customer just followed the steps you given except for step 1, and changed 0x00038000 to 0x00034000. And leave nvs allocation 2page=0x4000 unchanged, only compresses user APP space, but it still reports an error.

    To use one page NV, I would make sure to define the predefined symbol and set it to 1 as stated. What is the motivation to reduce the start address by 0x4000? The persistent app will save 0x2000, and then you must also make a similar change on the other side (simple_peripheral app) and you can save another 0x2000.

    To help me understand better, does the customer only want to save space in the persistent app?

    I'm a bit confused as the screenshots provided show Region base at 0x30000, why is this?

  • Hey Ammar,

    To help me understand better, does the customer only want to save space in the persistent app?

    The customer actually is wanting to expand the persistent app space, which is not enough to write OTA private protocol program.  And the user app space was redundant. So they want to compress the user's APP flash space for the persistent app project. They move the 16k(=0x4000)flash space for the persistent app. 

    I'm a bit confused as the screenshots provided show Region base at 0x30000, why is this?

    This Region Base at 0x30000: is by a small shift of 0x34000 to 0x4000.

    nv still uses the default 2 page.

    Thanks and regards,

    Cherry

  • Hey Cherry,

    Due to an upcoming holiday, I will not be able to comment on this until Monday 4/18. I appreciate your patience.

    In the meantime, have the customer take a second look at the linker file. It will likely require some extra modification if the regions overlap. One error I see in the logs is that the region is already specified... why is that? Can you detail the modifications made to the project properties with regards to the linker file? As well as any direct modifications made to the linker file?