STMF429IGT Usb Bootloader AN3990 [SOLVED]

[mogwaifactory]

Posted on August 08, 2015 at 23:44

Hello, I'm trying to run this bootloader on a custom board with a 429IG on it. My target application runs fine, but I need to be able to update on site through usb.

So far, the bootloader writes the image on the chip, but it seems it doesn't jump to the application address. Here are my settings: Bootloader side:

#define APPLICATION_ADDRESS (uint32_t)0x08010000
#define VECT_TAB_OFFSET 0x00

Bootloader linker:

MEMORY
{
FLASH (rx) : ORIGIN = 0x08000000, LENGTH = 0x10000
RAM (xrw) : ORIGIN = 0x20000000, LENGTH = 192K
MEMORY_B1 (rx) : ORIGIN = 0x60000000, LENGTH = 0K
CCMRAM (rw) : ORIGIN = 0x10000000, LENGTH = 64K
}

Application side:

#define FLASH_BASE ((uint32_t)0x08000000)
#define VECT_TAB_OFFSET 0x00010000
....
SCB->VTOR = FLASH_BASE | VECT_TAB_OFFSET;

Application linker:

MEMORY
{
FLASH (rx) : ORIGIN = 0x08010000, LENGTH = 1024K - 0x10000
RAM (xrw) : ORIGIN = 0x20000000, LENGTH = 192K
MEMORY_B1 (rx) : ORIGIN = 0x60000000, LENGTH = 0K
CCMRAM (rw) : ORIGIN = 0x10000000, LENGTH = 64K
}

The bootloader is around 40k so it fits with the first 4 sectors. The jump code in the BL is the following:

if (((*(__IO uint32_t*)APPLICATION_ADDRESS) & 0x2FFE0000 ) == 0x20000000)
{
/* Jump to user application */
JumpAddress = (APPLICATION_ADDRESS + 4);
Jump_To_Application = (pFunction) JumpAddress;
/* Initialize user application's Stack Pointer */
__set_MSP(*(__IO uint32_t*) APPLICATION_ADDRESS);
Jump_To_Application();
}

I have tried to remove the condition and force the jump but nothing happens. I've read countless posts on the forum about that, (thanks Clive1 among others) but I still can't figure it out. Here's the interesting part of the memory view from the ST-LINK Utility after flashing the BL, and writing the target app from the usb key (the chip was fully erased prior to the procedure). If anyone has an idea, I'm all ears 🙂 Thanks, Dan. Edit1: picture didn't upload. Edit2: marked as solved #stm32f #rewrite #bootloader #iap #usb #flash

[Tesla DeLorean]

Posted on August 09, 2015 at 00:55JumpAddress = *(__IO uint32_t*) (APPLICATION_ADDRESS + 4);You want to jump to the address pointed too, not the BASE+4 address of the image itself, as a) it's EVEN and b) it's not code.

[mogwaifactory]

Posted on August 09, 2015 at 09:24

Thanks Clive, that did it!

[gds]

Posted on August 20, 2015 at 15:44

Hi Clive and __Dan_

I also have the sameproblem as __Dan_, I have read many post about this problem ( most ofthem is Clive's post, thank you so much), but I still can fix thisbug, it can not jump to application program ( or application programcan not run). Please give me some advices so solved this bug.

My device: STM32F429DISCOVERY Board

My question: write acustom boot loader to upgrade application program. Run RTX OS to useUSB connection (as a device).

My IDE: Keil ARM v5

I have done: getimage of application program (.bin) and write to flash.

I split Flash to 3part:

- 0x08000000 –0x08040000 : contain boot loader ( 256KB, used 80KB)

- 0x08040000 –0x081C0000 : contain application program( used 11KB for blink ledapplication)

- 0x081C0000 –0x081E0000 : contain configuration and data share between boot loaderand application program.

In boot loader:

- Start at :0x08000000 – size 0x40000

- #defineVECT_TAB_OFFSET 0x00

;*************************************************************

;*** Scatter-Loading Description File generated by uVision ***

;*************************************************************

LR_IROM10x08000000 0x00040000 { ; load region size_region

ER_IROM1 0x080000000x00040000 { ; load address = execution address

*.o (RESET, +First)

*(InRoot$$Sections)

.ANY (+RO)

}

RW_IRAM1 0x200000000x00030000 { ; RW data

.ANY (+RW +ZI)

}

}

In applicationprogram

- Start at :0x08040000 – size 0x1C0000

- #defineVECT_TAB_OFFSET 0x40000

;*************************************************************

;*** Scatter-Loading Description File generated by uVision ***

;*************************************************************

LR_IROM10x08040000 0x001C0000 { ; load region size_region

ER_IROM1 0x080400000x001C0000 { ; load address = execution address

*.o (RESET, +First)

*(InRoot$$Sections)

.ANY (+RO)

}

RW_IRAM1 0x200000000x00030000 { ; RW data

.ANY (+RW +ZI)

}

}

My jump code: in thefirst of main boot loader, it check a value store in 0x081E0000 offlash, if value = 0 will jump to application else continue to runboot loader program (Init System and ...).

                              if ( boot_select ==0x00) // check boot flag

{ // APPLICATION_ADDRESS =0x08040000 LED_Initialize();

LED_On(0);

if ((((*(__IOuint32_t*)APPLICATION_ADDRESS) & 0xFF000000 ) == 0x20000000) || \

(((*(__IOuint32_t*)APPLICATION_ADDRESS) & 0xFF000000 ) == 0x10000000))

{

JumpAddress = *(__IOuint32_t*) (APPLICATION_ADDRESS + 4 );

Jump_To_Application =(pFunction) JumpAddress;

__set_MSP(*(__IOuint32_t*) APPLICATION_ADDRESS);

Jump_To_Application();

}

}

Ihave test this jump command, if I replace APPLICATION_ADDRESS =0x08000000 ( boot loader

 address) it can jump (as reset) but ifAPPLICATION_ADDRESS = 0x08040000, nothing happen . I have run debugin Keil, I saw it got Hard Fault.Thank for your help!

[Tesla DeLorean]

Posted on August 20, 2015 at 20:36

Can you step slowly into the app code and identify where it's faulting, and what the faulting state is as reported by the processor? Joseph Yiu has some good examples of a Hard Fault Handler that isn't a useless while(1) loop.

When handing over control make sure you don't have a whole mess of interrupts running, and these won't transition well to code that hasn't even initialized yet. Watch out for whatever you've enabled especially SysTick or USB interrupts.Ask yourself if the RTOS hands over control in a USER or SYSTEM state, and whether that's going to cause faults, or limit instruction execution options.I generally prefer to drop control from the boot loader to an app in the least molested way as possible. If the loader can just check the app is valid and transfer to it, all the better. If your loader has to bring the whole circus to town, consider if having a quick reset entry path that gets to the app quickly can avoid bring the whole set of loader features up, and then tearing them down properly before transferring control of a stable system.

[gds]

Posted on August 21, 2015 at 13:24

Thanks Clive! 

My jump code work fine, the problem is the application program can not run because my boot loader write wrong data to flash. Thanks for your advice!