STM32F10xxx Bootloader Address

[Bernard1]

Posted on November 15, 2016 at 17:30

AN2606 specifies the bootloader address for most of the STM32 devices but not for the STM32F10xxx devices (outside value line parts). See page 22 of AN2606 Rev 28

These parts obviously have a bootloader since the bootloader can be entered by setting Boot0 high during a reset. I am trying to enter the bootloader programmatically.I have checked the content of 0x1FFFF7D6 and it is 0xFFFFFFFF so this is definitely not the right address. #stm32f10xxx-bootloader-address-d

[Tesla DeLorean]

Posted on November 15, 2016 at 17:55

0x1FFFF000 should be the base of the vector table in many of the F103 parts

[DEAD LINK /public/STe2ecommunities/mcu/Lists/cortex_mx_stm32/Flat.aspx?RootFolder=/public/STe2ecommunities/mcu/Lists/cortex_mx_stm32/STM32%20Internal%20Bootloader&FolderCTID=0x01200200770978C69A1141439FE559EB459D7580009C4E14902C3CDE46A77F0FFD06506F5B&currentviews=8405]https://my.st.com/public/STe2ecommunities/mcu/Lists/cortex_mx_stm32/Flat.aspx?RootFolder=%2Fpublic%2FSTe2ecommunities%2Fmcu%2FLists%2Fcortex_mx_stm32%2FSTM32%20Internal%20Bootloader&FolderCTID=0x01200200770978C69A1141439FE559EB459D7580009C4E14902C3CDE46A77F0FFD06506F5B¤tviews=8405

[Bernard1]

Posted on November 15, 2016 at 17:57

Yes but the code at this address is going to check if Boot0 is set and since it it is not, it will execute the flash code. Is that right ?

Edit: no this is not correct. The Boot0 is a H/W feature. Jumping to the system memory should be enough.Why is the table empty only for those devices?To be fair, I did try to run the code pointed by 0x1ffff000 + 4 and it did not execute a reset of my device so may be I am not calling it with everything in the reset state.Edit: this is likely the right way to do it. I will post results when successful.

[Tesla DeLorean]

Posted on November 15, 2016 at 19:26

The BOOTx pins alter the memory mapped/shadowed at the zero address area of the device.

SCB->VTOR is also reset to zero by the core.For the F2/F4, and perhaps others, there are secondary effects, where something inside the built code has an expectation of a zero address basis, perhaps the lack of programming of the SCB->VTORThe Cortex-M0 parts don't have a programmable vector address, and thus rely on the mapping, and the F1 parts don't have the ability to change the mapping in software.