F446RE System Memory Boot Mode UART1 PA9 Problem

Zt Liu · ‎2017-10-24

Posted on October 24, 2017 at 10:38

Hi, everyone.

I got a strange, also interesting, problem, while I am using System Memory Boot Mode with STM32F446RE.

=================================================================================

Hardware Description

STM32F446, Nucleo-64 Board (PID:0x0421, BID:0x90, Bootloader Version:0x31)

STM32F410 Nucleo-64 Board for comparison

=================================================================================

Host Test Utilities:

ST Flash Loader Demonstrator,

AccessPort (just a PC com port test software)

Prolific PL2302 USB to Serial Module (self made)

=================================================================================

Configuration:

1 BOOT0 pin: 1 (pull high to 3.3V)

2 BOOT1/PB2 pin: 0(pull down to Gnd)

3 This makes System Memory selected as Boot area.

4 UART1 PA9/PA10 and UART3 PC10/PC11 with pullup 100K Ohm Resistor.

5 UARTx TX/RX connected to RX/TX pins of PL2302

=================================================================================

TRY1:

Use STM32F446

UART1 PA9/PA10 => Flash Loader Demonstrator Failed (''Unrecognised device....Please, restart your device and try again'' )

TRY2:

Use STM32F446

UART3 PC10/PC11 => OK, Flash Loader Demonstrator works!

TRY3:

Switch to STM32F410 UART1 PA9/PA10 => OK, Flash Loader Demonstrator works!

TRY4:

Back to STM32F446 and PA9/PA10 pins, with still the above setup. Oscilloscope shows the following image:

=================================================================================

Problem:

Due to unknown reason, STM32F446RE PA9 UART1 TX pin is somehow driven low with system memory boot mode pin setup after a reset. This strange phenomena cannot be seen in UART3 PC10 pin, and STM32F410 UART1 PA9 pin.

I've tried that if Boot0 grounded, as normal flash operation, this PA9 driven-low phenomena also cannot not be observed, as the 100K resistor is easily pulled it VCC. I believe this is somehow related to the code in the system boot memory, perhaps not properly configured.

=================================================================================

Work-Around:

1. Set PA9 TX pin with pull-up resistor down to few kOhm(1K ~ 4.99K Ohm) does the job, with the cost of power consumption.

2. If I use Com Port Test Software, like AccessPort, This PA9 driven-low after reset causes the host to receive a 0x00 byte equivalently, hence Flash Loader Demonstrator fails to recognize the device. If this 0x00 byte is omitted, we can still send 0x7F to make UART1 enter boot mode, as I can read chip information using 0x00FF and 0x01FE. Hence a custom flash loader application is still possible.

=================================================================================

Does any have similar experience? Or I just got a damaged F446??

Thanks for reading this post!

.Zt

#system-bootloader #stm32f446 #uart1 #flash-loader-demo #f446

waclawek.jan · ‎2017-10-24

Posted on October 24, 2017 at 18:11

STM32F407:

1fff1304: f44f 1104 mov.w r1, #2162688 ; 0x210000

1fff1308: 6381 str r1, [r0, #56] ; 0x38 OTG_FS_GCCFG = 0x210000 -- set NOVBUSSENS and PWRDWN (the former makes the PHY working without need for VBUS signal (PA9); the latter switches on the PHY (contrary to its name, as it's 'disable powerdown'... :| )

STM32F446:

1fff36b2: f44f 1144 mov.w r1, #3211264 ; 0x310000

1fff36b6: 6381 str r1, [r0, #56] ; 0x38 // OTG_FS_GCCFG = 0x310000 WTF?

JW

View solution in original post

waclawek.jan · ‎2017-10-24

Posted on October 24, 2017 at 11:01

In the 'F446, probably OTG_FS_GCCFG.VBUSBSEN is switched on, that involves a

https://community.st.com/0D50X00009XkaC1SAJ

.

As you've said, not a showstopper, as it can be worked around by an external pullup - and AN2606 does call for pullups on Tx/Rx for bootloading albeit for 100kOhm which would be insufficient for this case.

I believe this ought to be properly documented in AN2606 for all STM32 models which use the same OTG module and DFU bootloader with enabled VBUSBSEN potentially conflicting with the USART bootloader.

JW

Zt Liu · ‎2017-10-24

Posted on October 24, 2017 at 12:36

Thanks for this quick reply!!!

:)

I just check that my F410RE has no this corresponding USB functionality,

it's very likely that, as you said, PA9 as VBUS pin is somehow strongly pull-down.

However, as your post has pointed out, this amazingly strong pull-down character is also not observed as spec stated.

(Otherwise, my external pull-up 1K would not work!)

(F446 spec belowed.)

I really hope that this could be properly documented.....

Guess you're right about that in system boot mode, both UART1 and USB OTG FS are both enabled which cause PA9 to strongly pull-down in the beginning after reset.

Thanks again!

.Zt

waclawek.jan · ‎2017-10-24

Posted on October 24, 2017 at 18:11

STM32F407:

1fff1304: f44f 1104 mov.w r1, #2162688 ; 0x210000

1fff1308: 6381 str r1, [r0, #56] ; 0x38 OTG_FS_GCCFG = 0x210000 -- set NOVBUSSENS and PWRDWN (the former makes the PHY working without need for VBUS signal (PA9); the latter switches on the PHY (contrary to its name, as it's 'disable powerdown'... :| )

STM32F446:

1fff36b2: f44f 1144 mov.w r1, #3211264 ; 0x310000

1fff36b6: 6381 str r1, [r0, #56] ; 0x38 // OTG_FS_GCCFG = 0x310000 WTF?

JW

Zt Liu · ‎2017-10-24

Posted on October 25, 2017 at 03:51

WOW! What are these codes?

Are they from system boot memory?!?!

:(

If so, how did you get it?

And address offset 0x38 is indeed OTG_GCCFG register in F446,

but there are only VBDEN [bit 21] and PWRDWN [bit16]!

What is this mysterious Bit 20??

[F446 OTG_GCCFG, address offset:0x038]

Thanks, JW!!!

Zt

Tesla DeLorean · ‎2017-10-24

172759CGIL3

Tips, Buy me a coffee, or three.. PayPal Venmo
Up vote any posts that you find helpful, it shows what's working..

Zt Liu · ‎2017-10-24

Posted on October 25, 2017 at 05:51

I was so embarrassed to ask this...

I just didn't know that even system memory can be read.

(I supposed that only main flash memory can be read <= wrong!)

Even ST-Link can do the job, just type in the start address of System Memory 0x1FFF0000,

I get

Great lesson for today!!

By the way, may i ask.....

Is there any recommended tool for disassembling, or you guys just do this by yourselves?

While I was using Microchip's MCU, their IDE MPLAB can directly do this.

Not sure about this with Keil or some other tool chain?

,Zt

chaitanya chippada · ‎2017-10-24

Posted on October 25, 2017 at 08:29

Hi,

I'm using LIS3DSH accelerometer with Evaluation board STEVAL-MKI134V1 (LIS3DSH) ,with the configuration of

1600 Hz sampling frequency, 800 Hz analog filter,full scale +/- 2g,in stream mode,I'm using this sensor for collecting vibration data in my project,I'm getting 1 g in x-axis according sensor placement,but getting some offset in Y axis,like

i attached plot of vibration, I'm getting offset in Y axis below 100 Hz,Please can you tell what is the problem.

Thanks & regards,

Ch. Sai Chaitanya.

Zt Liu · ‎2017-10-25

Posted on October 25, 2017 at 08:48

Does your problem have anything to do with STM32F446 System memory boot mode?

You should go to MEMS/Motion Sensor Forum, there are some great guys and ST employees.

waclawek.jan · ‎2017-10-25

Posted on October 25, 2017 at 09:45

Since the inception of IDE, every one contains a disassembler - how else would you single-step machine code in any useful way? Arduinoids would be the exception, except they are just chains no tools. There are of course disassemblers and disassemblers and at times, there are reasons to write your own (or augment an existing one).

Didn't you ever occur that our profession is highly recursive? The tools for programming are mainly made by programming...

JW