dsPIC33EP512MU810 Bootloader到应用程序跳转

嗨，伙计们，我已经迁移了一个从DSPIC33 EP256MU806 toDSPIC33 EP512MU810的引导加载程序。引导加载程序从外部SPI闪存获得FixWEX HEX文件，并将其安装到Micro的程序Flash。一旦固件被写入Micro的内存中，它就跳转到应用程序。如果Bootloader在Micro的内存写入之后跳转到应用程序，则成功执行跳转。否则，如果引导加载程序没有安装固件（这是普通条件），当它跳转到应用程序时，应用程序运行在开始程序存储器的几个位置，从0x250到0x270（IVT从0x00到0x200分配，程序代码从0x200开始）。因此，我在我的应用程序的反汇编列表中寻找这个位置，它们没有出现。在两个条件下，我比较了程序存储器和数据存储器（SFRS），它们匹配了每个位置。为什么我的应用程序被困在那个循环中？这些地方的代码是什么？这是我用于引导加载程序的链接器脚本：陷阱循环的细节：这些是陷阱位置：地址序列是：0x260-gt；0x266& gt；0x268& gt；0x25c & gt；0x25e & gt；（从0x260重新启动）



      以下为原文

    Hi guys,
I've migrate a bootloader from dsPIC33EP256MU806 to dsPIC33EP512MU810. The bootloader gets the firware hex file from an external SPI Flash memory and installs it to the micro's program flash. Once the firmware is writed in the micro's memory, it jump to the application program.
If the bootloader jumps to application after a micro's memory writing, the jump is performed successfully. Otherwise, if the bootloader doesn't install a firmware (this is the ordinary condition), when it jumps to application, the application program runs in a few location of the beginning program memory, from 0x250 to 0x270 (the ivt is allocateed from 0x004 to 0x200, the program code starts from 0x200), as if it is trapped in a loop.
So, i looked for this location in the disassembly list of my application program, they don't appear.
I compared the program memory and data memory (sfrs) before the jump in both conditions, they match every locations.

Why is my application program trapped in that loop? What is the code in those locations?

PS. this is the linker script i have used for bootloader:
// - BOOTLOADER - SCRIPT

MEMORY
{
  data (a!xr) : ORIGIN = 0x1000, LENGTH = 0xD000
  reset : ORIGIN = 0x7FFFFC, LENGTH = 0x4
  ivt : ORIGIN = 0x7FFFFA, LENGTH = 0x4

  program (xr) : ORIGIN = 0x7FC004, LENGTH = 0x3FFA

  FGS : ORIGIN = 0xF80004, LENGTH = 0x2
  FOSCSEL : ORIGIN = 0xF80006, LENGTH = 0x2
  FOSC : ORIGIN = 0xF80008, LENGTH = 0x2
  FWDT : ORIGIN = 0xF8000A, LENGTH = 0x2
  FPOR : ORIGIN = 0xF8000C, LENGTH = 0x2
  FICD : ORIGIN = 0xF8000E, LENGTH = 0x2
  FAS : ORIGIN = 0xF80010, LENGTH = 0x2
  FUID0 : ORIGIN = 0xF80012, LENGTH = 0x2
}

__FGS = 0xF80004;
__FOSCSEL = 0xF80006;
__FOSC = 0xF80008;
__FWDT = 0xF8000A;
__FPOR = 0xF8000C;
__FICD = 0xF8000E;
__FAS = 0xF80010;
__FUID0 = 0xF80012;

__IVT_BASE = 0x7FFFFA;
__DATA_BASE = 0x1000;
__DATA_LENGTH = 0xD000;
__YDATA_BASE = 0x9000;
__DMA_BASE = 0xD000;
__DMA_END = 0xDFFF;
__CODE_BASE = 0x7FC000;
__CODE_LENGTH = 0x3FFA;

Detail of trap loop:
These are the trap locations:


00025C EB4900 CLR.B [W2]

00025E E80102 INC W2, W2
000260 390002 BRA NC, 0x266
000262 EC2034 INC DSWPAG
000264 A0F002 BSET W2, #15
000266 E90183 DEC W3, W3
000268 3EFFF9 BRA GTU, 0x25C
00026A 370004 BRA 0x274
00026C E12861 CP W5, #1
00026E 320001 BRA Z, 0x272




The address sequence is:
0x260 -> 0x266 -> 0x268 -> 0x25C -> 0x25E -> (restart from 0x260)