STM32F4Discovery Bootloader activation without BOOTx Pins

[mhinse]

Posted on December 15, 2014 at 18:46

Hello,

is there a possible way to access the Bootloader-Mode after a System-Reset without the use of the BOOT0 and BOOT1 Pins?

For example, write a value to a backup register and after a reset this backup register is read and the STM32F4Discovery jumps to the Bootloader.

kind regards

#stm32f4 #discovery #stm32f4-bootloader

[Tesla DeLorean]

Posted on December 15, 2014 at 18:52

I've covered this at least a dozen times on the forum, please search/google.

[mhinse]

Posted on December 15, 2014 at 20:02

I am googleing since two weeks but the only way i found was a very bad explained youtube video how to get to the bootloader from the user application.

In this case i must reconfigure the clocks, disable the interrupts and so on.

I am looking for a faster way to access the bootloader via a soft-reset.

Can you give me some links for that theme?

[Tesla DeLorean]

Posted on December 15, 2014 at 21:25

I am googleing since two weeks but... Got to really work on those searching skills then.

https://community.st.com/0D50X00009XkhAzSAJ

https://community.st.com/0D50X00009Xka1fSAB

https://community.st.com/0D50X00009Xkh7wSAB

https://community.st.com/0D50X00009XkhgYSAR

https://community.st.com/0D50X00009XkbZhSAJ

https://community.st.com/0D50X00009XkYIbSAN

Edit:Removed DEADLINKs, original post from 14-Dec-2014

[mhinse]

Posted on December 16, 2014 at 09:54

Hi Clive,

thanks a lot for sharing this links! I am not a real Software Engineer but i have to solve the problem to access the bootloader. Can you tell me how i have to implement this part of assembler code that it works after a reset?

Reboot_Loader PROC
EXPORT Reboot_Loader
LDR R0, =0x40023844 ; RCC_APB2ENR
LDR R1, =0x00004000 ; ENABLE SYSCFG CLOCK
STR R1, [R0, #0]
LDR R0, =0x40013800 ; SYSCFG_MEMRMP
LDR R1, =0x00000001 ; MAP ROM AT ZERO
STR R1, [R0, #0]
LDR R0, =0x1FFF0000 ; ROM BASE
LDR SP,[R0, #0] ; SP @ +0
LDR R0,[R0, #4] ; PC @ +4
BX R0
ENDP ; [e-mail]

Thanks again for your help, you get me out of trouble.

[Tesla DeLorean]

Posted on December 16, 2014 at 16:36

I am not a real Software Engineer...

Me neither, my degree is in Electrical and Electronic Engineering Quick blind mash of the existing example code

; Keil based example - Reset into boot loader - [e-mail]
; From C
; extern void SystemReset(void);
; *((unsigned long *)0x2001FFF0) = 0xDEADBEEF; // Write a scratch location at end of RAM (or wherever)
; SystemReset();
Reset_Handler PROC
EXPORT Reset_Handler
IMPORT __main
;...
LDR R0, =0x2001FFF0 ; Address for RAM signature
LDR R1, =0xDEADBEEF
LDR R2, [R0, #0] ; Read current

STR R0, [R0, #0] ; Invalidate
CMP R2, R1
BEQ Reboot_Loader
; Add other choices
;...
; Normal startup path
LDR R0, =SystemInit
BLX R0
LDR R0, =__main
BX R0
ENDP
;...
; Vector into System Loader
Reboot_Loader PROC
EXPORT Reboot_Loader
LDR R0, =0x40023844 ; RCC_APB2ENR
LDR R1, =0x00004000 ; ENABLE SYSCFG CLOCK
STR R1, [R0, #0]
LDR R0, =0x40013800 ; SYSCFG_MEMRMP
LDR R1, =0x00000001 ; MAP ROM AT ZERO
STR R1, [R0, #0]
LDR R0, =0x1FFF0000 ; ROM BASE
LDR SP,[R0, #0] ; SP @ +0
LDR R0,[R0, #4] ; PC @ +4
BX R0
ENDP ; [e-mail]
SystemReset PROC
EXPORT SystemReset
ldr r1, =0xE000ED0C ; NVIC Application Interrupt and Controller
ldr r0, =0x05FA0004 ; Magic
str r0, [r1, #0] ; Reset
b .
ENDP
;...

[mhinse]

Posted on December 18, 2014 at 09:52

Well, it seems that i can access the Bootloader with the following codes:

in the s file:

Reset_Handler    PROC

                 EXPORT Reset_Handler             [WEAK]

                 IMPORT __main

                 LDR        R0, =0x2001FFF0

                 LDR        R1, =0xDEADBEEF

                 LDR        R2, [R0, #0]

                 STR        R0, [R0, #0] ; Invalidate

                 CMP        R2, R1

                 BEQ        Reboot_Loader

                 LDR        R0, =__main

                 BX         R0

                 ENDP

Reboot_Loader    PROC

                 EXPORT Reboot_Loader

                 LDR        R0, =0x1FFF0000

                 LDR        SP, [R0, #0]

                 LDR        R0, [R0, #4]

                 BX         R0

                 ENDP    

Calling it in the C File:

#include ''misc.h''

void blac(void){

                                    NVIC_InitTypeDef                     NVIC_InitStructure;

                *((unsigned long *)0x2001FFF0) = 0xDEADBEEF; // 128kB STM32F407

  NVIC_SystemReset();

}

When i call it the STM32 BOOTLOADER Device appears in the Devices Manager.

Now i am trying to communicate with the STM32F4Discovery Bootloader via can.

I hope i am on the right way. If not, please leave a comment.

Kind regards and thank you very very much clive1!

[Tesla DeLorean]

Apparently not able to edit my own post to fix the dog's breakfast that the port to the new forum created. Should work for F2 and F4 parts to switch into DFU/USART System Loader ROM

The following C and Assembler provide a means to execute the boot ROM of STM32F2 and F4 parts. It sets a value in RAM and then resets, the reset catches this value and remaps the ROM and jumps into it.

startup.s

; Keil based example - Reset into boot loader - [e-mail]
; From C
; extern void SystemReset(void);
; *((unsigned long *)0x2001FFF0) = 0xDEADBEEF; // Write a scratch location at end of RAM (or wherever)
; SystemReset(); // or NVIC_SystemReset();
 
 
Reset_Handler PROC
 EXPORT Reset_Handler
 IMPORT __main
 
 
 ;...
 
 
 LDR R0, =0x2001FFF0 ; Address for RAM signature
 LDR R1, =0xDEADBEEF
 LDR R2, [R0, #0] ; Read current
 STR R0, [R0, #0] ; Invalidate
 CMP R2, R1
 BEQ Reboot_Loader
 
 ; Add other choices
 
 
 ;...
 
 
 ; Normal startup path
 
 LDR R0, =SystemInit
 BLX R0
 
 LDR R0, =__main
 BX R0
 
 ENDP
 
 ;...
 
 
 ; Vector into System Loader
 
 
Reboot_Loader PROC
 EXPORT Reboot_Loader
 
 LDR R0, =0x40023844 ; RCC_APB2ENR
 LDR R1, =0x00004000 ; ENABLE SYSCFG CLOCK
 STR R1, [R0, #0]
 LDR R0, =0x40013800 ; SYSCFG_MEMRMP
 LDR R1, =0x00000001 ; MAP ROM AT ZERO
 STR R1, [R0, #0]
 LDR R0, =0x1FFF0000 ; ROM BASE
 LDR SP,[R0, #0] ; SP @ +0
 LDR R0,[R0, #4] ; PC @ +4
 BX R0
 
 ENDP ; [e-mail]
 
 
SystemReset PROC
 EXPORT SystemReset
 
 ldr r1, =0xE000ED0C ; NVIC Application Interrupt and Controller
 ldr r0, =0x05FA0004 ; Magic
 str r0, [r1, #0] ; Reset
 
 b .
 
 ENDP
 
 ;...

Now accepting PayPal, Venmo and Amazon Gift Cards..