lpc 1768 Secondary Boot Loader error

Question

I am working on lpc 1768 SBL which includes the following code to jump to user application.

#define NVIC_VectTab_FLASH           (0x00000000)
#define USER_FLASH_START             (0x00002000)
void NVIC_SetVectorTable(DWORD NVIC_VectTab, DWORD Offset)
{ 
   NVIC_VECT_TABLE = NVIC_VectTab | (Offset & 0x1FFFFF80);
}
void execute_user_code(void)
{


    void (*user_code_entry)(void);
    /* Change the Vector Table to the USER_FLASH_START 
    in case the user application uses interrupts */
    NVIC_SetVectorTable(NVIC_VectTab_FLASH, USER_FLASH_START);


    user_code_entry = (void (*)(void))((USER_FLASH_START)+1);
    user_code_entry();

}

It was working without any errors. After adding some heap memory to the code, the machine is stuck. I tried out different values for heap. Some of them are working. After some deep debugging ,I could find out that machine was not stuck when there is a value which is divisible by 64 is at first locations of application bin file.

ie,

When I select heap memory as 0x00002E90 ,it generates stack base as 0x10005240 . Then stack base + stack size(0x2900) gives a value = 0x10007B40. I found this is loaded at first locations of application bin file. This value is divisible by 64 and the code is running without stuck.

But ,when I select heap memory as 0x00002E88 ,it generates stack base as 0x10005238 . Then stack base + stack size(0x2900) gives a value = 0x10007B38. This value is not divisible by 64 and the code is stuck.

The disassembly is as follows in this case.

When stepping from address 0x0000 2000 ,it goes to hard fault handler. But in the earlier case it doesn't go to hard fault. It continues and works as well.

I cannot understand the instruction DCW and why it goes to hard fault. Can anyone tell me the reason behind this?

Answer 1

Executing the vector table is what you do on older ARM7/ARM9 parts (or bigger Cortex-A ones) where the vectors are instructions, and the first entry will be a jump to the reset handler, but on Cortex-M, the vector table is pure data - the first entry is your initial stack pointer, and the second entry is the address of the reset handler - so trying to execute it is liable to go horribly wrong..

As it happens, in this case you can actually get away with executing most of that vector table by sheer chance, because the memory layout leads to each halfword of the flash addresses becoming fairly innocuous instructions:

2: 1000    asrs  r0, r0, #32
4: 20d9    movs  r0, #217    ; 0xd9
6: 0000    movs  r0, r0
8: 20f5    movs  r0, #245    ; 0xf5
a: 0000    movs  r0, r0
...

Until you eventually bumble through all the remaining NOPs to 0x20d8 where you pick up the real entry point. However, the killer is that initial stack pointer, because thanks to the RAM being higher up, you get this:

0: 7b38    ldrb  r0, [r7, #12]

The lower byte of 0x7bxx is where the base register is encoded, so by varying the address you have a crapshoot as to which register that is, and furthermore whether whatever junk value is left in there also happens to be a valid address to load from. Do you feel lucky?

Anyway, in summary: Rather than call the address of the vector table directly, you need to load the second word from it, then call whatever address that contains.