STM32F4Discovery Bootloader activation without BOOTx Pins

[mhinse]

Posted on December 15, 2014 at 18:46

Hello,

is there a possible way to access the Bootloader-Mode after a System-Reset without the use of the BOOT0 and BOOT1 Pins? For example, write a value to a backup register and after a reset this backup register is read and the STM32F4Discovery jumps to the Bootloader. kind regards #stm32f4 #discovery #stm32f4-bootloader

[Tesla DeLorean]

Posted on December 15, 2014 at 18:52

I've covered this at least a dozen times on the forum, please search/google.

[mhinse]

Posted on December 15, 2014 at 20:02

I am googleing since two weeks but the only way i found was a very bad explained youtube video how to get to the bootloader from the user application.

In this case i must reconfigure the clocks, disable the interrupts and so on. I am looking for a faster way to access the bootloader via a soft-reset. Can you give me some links for that theme?

[Tesla DeLorean]

Posted on December 15, 2014 at 21:25

I am googleing since two weeks but... Got to really work on those searching skills then.

https://community.st.com/0D50X00009XkhAzSAJ

https://community.st.com/0D50X00009Xka1fSAB

https://community.st.com/0D50X00009Xkh7wSAB

https://community.st.com/0D50X00009XkhgYSAR

https://community.st.com/0D50X00009XkbZhSAJ

https://community.st.com/0D50X00009XkYIbSAN

Edit:Removed DEADLINKs, original post from 14-Dec-2014

[mhinse]

Posted on December 16, 2014 at 09:54

Hi Clive,

thanks a lot for sharing this links! I am not a real Software Engineer but i have to solve the problem to access the bootloader. Can you tell me how i have to implement this part of assembler code that it works after a reset?

Reboot_Loader PROC
EXPORT Reboot_Loader
LDR R0, =0x40023844 ; RCC_APB2ENR
LDR R1, =0x00004000 ; ENABLE SYSCFG CLOCK
STR R1, [R0, #0]
LDR R0, =0x40013800 ; SYSCFG_MEMRMP
LDR R1, =0x00000001 ; MAP ROM AT ZERO
STR R1, [R0, #0]
LDR R0, =0x1FFF0000 ; ROM BASE
LDR SP,[R0, #0] ; SP @ +0
LDR R0,[R0, #4] ; PC @ +4
BX R0
ENDP ; sourcer32@gmail.com

Thanks again for your help, you get me out of trouble.

[Tesla DeLorean]

Posted on December 16, 2014 at 16:36

I am not a real Software Engineer...

Me neither, my degree is in Electrical and Electronic Engineering Quick blind mash of the existing example code

; Keil based example - Reset into boot loader - sourcer32@gmail.com
; From C
; extern void SystemReset(void);
; *((unsigned long *)0x2001FFF0) = 0xDEADBEEF; // Write a scratch location at end of RAM (or wherever)
; SystemReset();
Reset_Handler PROC
EXPORT Reset_Handler
IMPORT __main
;...
LDR R0, =0x2001FFF0 ; Address for RAM signature
LDR R1, =0xDEADBEEF
LDR R2, [R0, #0] ; Read current

STR R0, [R0, #0] ; Invalidate
CMP R2, R1
BEQ Reboot_Loader
; Add other choices
;...
; Normal startup path
LDR R0, =SystemInit
BLX R0
LDR R0, =__main
BX R0
ENDP
;...
; Vector into System Loader
Reboot_Loader PROC
EXPORT Reboot_Loader
LDR R0, =0x40023844 ; RCC_APB2ENR
LDR R1, =0x00004000 ; ENABLE SYSCFG CLOCK
STR R1, [R0, #0]
LDR R0, =0x40013800 ; SYSCFG_MEMRMP
LDR R1, =0x00000001 ; MAP ROM AT ZERO
STR R1, [R0, #0]
LDR R0, =0x1FFF0000 ; ROM BASE
LDR SP,[R0, #0] ; SP @ +0
LDR R0,[R0, #4] ; PC @ +4
BX R0
ENDP ; sourcer32@gmail.com
SystemReset PROC
EXPORT SystemReset
ldr r1, =0xE000ED0C ; NVIC Application Interrupt and Controller
ldr r0, =0x05FA0004 ; Magic
str r0, [r1, #0] ; Reset
b .
ENDP
;...

[mhinse]

Posted on December 18, 2014 at 09:52

Well, it seems that i can access the Bootloader with the following codes:

in the s file: Reset_Handler    PROC                  EXPORT Reset_Handler             [WEAK]                  IMPORT __main                  LDR        R0, =0x2001FFF0                  LDR        R1, =0xDEADBEEF                  LDR        R2, [R0, #0]                  STR        R0, [R0, #0] ; Invalidate                  CMP        R2, R1                  BEQ        Reboot_Loader                  LDR        R0, =__main                  BX         R0                  ENDP Reboot_Loader    PROC                  EXPORT Reboot_Loader                  LDR        R0, =0x1FFF0000                  LDR        SP, [R0, #0]                  LDR        R0, [R0, #4]                  BX         R0                  ENDP     Calling it in the C File: #include ''misc.h'' void blac(void){                                     NVIC_InitTypeDef                     NVIC_InitStructure;                 *((unsigned long *)0x2001FFF0) = 0xDEADBEEF; // 128kB STM32F407   NVIC_SystemReset(); } When i call it the STM32 BOOTLOADER Device appears in the Devices Manager. Now i am trying to communicate with the STM32F4Discovery Bootloader via can. I hope i am on the right way. If not, please leave a comment. Kind regards and thank you very very much clive1!

[Tesla DeLorean]

Apparently not able to edit my own post to fix the dog's breakfast that the port to the new forum created. Should work for F2 and F4 parts to switch into DFU/USART System Loader ROM

The following C and Assembler provide a means to execute the boot ROM of STM32F2 and F4 parts. It sets a value in RAM and then resets, the reset catches this value and remaps the ROM and jumps into it.

startup.s

; Keil based example - Reset into boot loader - sourcer32@gmail.com
; From C
;  extern void SystemReset(void);
;  *((unsigned long *)0x2001FFF0) = 0xDEADBEEF; // Write a scratch location at end of RAM (or wherever)
;  SystemReset(); // or NVIC_SystemReset();
 
 
Reset_Handler   PROC
    EXPORT  Reset_Handler
    IMPORT  __main
 
 
    ;...
 
 
    LDR     R0, =0x2001FFF0 ; Address for RAM signature
    LDR     R1, =0xDEADBEEF
    LDR     R2, [R0, #0] ; Read current
    STR     R0, [R0, #0] ; Invalidate
    CMP     R2, R1
    BEQ     Reboot_Loader
 
    ; Add other choices
 
 
    ;...
 
 
    ; Normal startup path
 
    LDR     R0, =SystemInit
    BLX     R0
 
    LDR     R0, =__main
    BX      R0
 
    ENDP
 
    ;...
 
 
    ; Vector into System Loader
 
 
Reboot_Loader   PROC
    EXPORT  Reboot_Loader
 
    LDR     R0, =0x40023844 ; RCC_APB2ENR
    LDR     R1, =0x00004000 ; ENABLE SYSCFG CLOCK
    STR     R1, [R0, #0]
    LDR     R0, =0x40013800 ; SYSCFG_MEMRMP
    LDR     R1, =0x00000001 ; MAP ROM AT ZERO
    STR     R1, [R0, #0]
    LDR     R0, =0x1FFF0000 ; ROM BASE
    LDR     SP,[R0, #0]     ; SP @ +0
    LDR     R0,[R0, #4]     ; PC @ +4
    BX      R0
 
    ENDP ; sourcer32@gmail.com
 
 
SystemReset     PROC
    EXPORT  SystemReset
 
    ldr     r1, =0xE000ED0C ; NVIC Application Interrupt and Controller
    ldr     r0, =0x05FA0004 ; Magic
    str     r0, [r1, #0]    ; Reset
 
    b       .
 
    ENDP
 
    ;...

Now accepting PayPal, Venmo and Amazon Gift Cards..