Jump to bootloader on an STM32L496

[Andrei Chichak]

Good morning,

I've been fighting with an L496, trying to get it to jump into the bootloader.

I'm using STM32CubeIDE 1.7.0 on a Nucleo-L496ZG.

The code is based on a new project for the Nucleo board, hints from AN2606.

Just to make sure that I wasn't too far off, I pulled out the "FLASH_JumpBootloader" sample program for the F769 and got it running on my F767 Nucleo, then pulled the important bits into a minimal test program. It works well, jumps right into the bootloader and I can attach to the board as a DFU.

So I altered the start address for the L496 and the thing is fighting me. It just reboots the processor. I even tried it on a new L496 Nucleo, but it acts the same.

Here's the code's important bits:

  /* USER CODE BEGIN WHILE */
  while (1)
  {
    /* USER CODE END WHILE */
 
    /* USER CODE BEGIN 3 */
	typedef  void (*pFunction)(void);
	pFunction Jump_To_Application;
	uint32_t JumpAddress;
 
	if (HAL_GPIO_ReadPin(B1_GPIO_Port, B1_Pin) == GPIO_PIN_SET) {
 
		JumpAddress = *(__IO uint32_t*) (0x1FFF0000 + 4);
		Jump_To_Application = (pFunction) JumpAddress;
 
		/* Initialize user application's Stack Pointer */
		__set_MSP(*(__IO uint32_t*) 0x1FFF0000);
 
		Jump_To_Application();
	}
  }
  /* USER CODE END 3 */

Other things that I've tried is to set VTOR, disable all of the interrupts, deinit the clock, shutdown the PLL, set SYSCFG MEMRMP to have the system memory mapped to 0, and do a HAL_DeiInit. No happiness, and just to annoy me, the code above (with the appropriate addresses) works on an F767.

Any ideas?

Thanks,

Andrei (from The Great White North)

[Tesla DeLorean]

It knows the initial boot state, and having checked your entry vectors for validity branches back to your Reset_Handler. Supposed to allow blank devices run the boot loader.

I​ wish they'd discussed this before implementation.

I do have some thoughts about how to defeat this...

[Andrei Chichak]

I don't like it. On my F767 BOOT0 is low, option bytes are configured to read the pins. There's code in FLASH, and it still enters the bootloader.

The L496, same conditions, it detects the code and jumps back to my code. It looks like a poorly documented asymmetry.

[Andrei Chichak · Accepted solution]

Got it. I found an interesting post on https://stm32f4-discovery.net/2017/04/tutorial-jump-system-memory-software-stm32/

I ended up adding back in the stuff that didn't work before and now it works. Computers are vindictive pieces of rock.

if (HAL_GPIO_ReadPin(B1_GPIO_Port, B1_Pin) == GPIO_PIN_SET) {
 
	HAL_RCC_DeInit();
	__disable_irq();
	SysTick->CTRL = 0;
	SysTick->LOAD = 0;
	SysTick->VAL = 0;
	__HAL_SYSCFG_REMAPMEMORY_SYSTEMFLASH();
 
	JumpAddress = *(__IO uint32_t*) (0x1FFF0000 + 4);
	Jump_To_Application = (pFunction) JumpAddress;
 
	/* Initialize user application's Stack Pointer */
	__set_MSP(*(__IO uint32_t*) 0x1FFF0000);
 
	Jump_To_Application();
}

I hope this helps someone in the future.