dsPIC33E Bootloader Query
I have implemented a CAN-based bootloader for my dsPIC33E based project (high integrity product). The project uses the approach outlined in the application notes which maps the IVT to a jump table in the main application (bootloader does not use any interrupts). I am happy that this working as expected and avoids hard-coding too many things into the bootloader although I have to live with the slight increase in latency due to the extra jump.
My query relates to the non-maskable interrupt vectors (e.g. stack, DMAC, oscillator etc.). I have handlers defined for these in the main application. However, prior to downloading the application, no handler exists so the exception would cause execution to pass to the jump table which doesn't exist! To mitigate this problem initially I have ensured that the jump table is filled with zeros when the bootloader hex is downloaded, which should result in a device reset for any of the non-maskable interrupts. However, this doesn't protect for partial/failed downloads by the bootloader at some point later (e.g. power failure after page erase gives FFs which translate to NOPs so we may end up executing random data in the remainder of flash).
What is the recommended way to handle the non-maskable interrupts? Ideally, I think I would perform a device reset whilst in bootloader for any of these exceptions, but run the designated handler when in the main application.
Some options I considered:
- locate exception handlers at a fixed address in a common flash page to be loaded with the bootloader but could be reflashed during download (small chance of problems during erase/write)
- locate exception handlers for the non-maskable interrupts in the bootloader, so they are always present. This means they can't be changed in the future