Useful info which I found in another post (http://e2e.ti.com/support/dsp/c6000_multi-core_dsps/f/639/t/253724.aspx):
DSP_BOOT_ADDRn will hold the 22 MSBs (bits31-10) of the CorePac boot address. bits9-0 are reserved in this register. The reset value is 22 MSBs of 0x20b00000.
We will add this piece of info in the next release of C66x data manuals. And CorePac will jump to the address specified in DSP_BOOT_ADDRn register automatically after out of reset. It is not software controlled (hardware controlled, not by RBL).