STM32H723 embedded bootloader command GO fail

[BLeon.2]

 I use STM32H723VET6. Bootloader ver 9.2. When I can send command GO at FDCAN (PD1, PD0), I receive ACK(0x79), but after that MCU is fail.

My function:

void BootCanGo(uint8_t* answer)

{

           uint32_t Delayer = 0x8FFFFF;

           uint8_t SendedData[4];

           CanTxHeader.Identifier = BOOT_CAN_COMMAND_GO;

           SendedData[0] = 0x08;

           SendedData[1] = 0x00;

           SendedData[2] = 0x00;

           SendedData[3] = 0x00;

           /* Start the Transmission process */

           CanTxHeader.DataLength = FDCAN_DLC_BYTES_4;

           HAL_FDCAN_AddMessageToTxFifoQ(&hfdcan, &CanTxHeader, SendedData);

           while ((HAL_FDCAN_GetRxFifoFillLevel(&hfdcan, FDCAN_RX_FIFO0) < 1) && --Delayer) {};

           HAL_FDCAN_GetRxMessage(&hfdcan, FDCAN_RX_FIFO0, &CanRxHeader, CanRxData);

           *answer = CanRxData[0];

}

Write memory and Erase memory commands run correct. A program in flash memory mode (BOOT0 pin LOW) run correct. There are no limitations in AN2606:

I tried to run the debugger on the STM32H723 (device side). I stop the program, and after the command GO I start it again in step mode. After of several steps disconnection occurs:

Flash in STM32H723:

What am I doing wrong?

[Imen.D]

Hello @BLeon.2​ ,and welcome to the Community,

Make sure to properly configure the vector table.

Do you use/enable interrupts? Did you try with BOOT0 in high?

Imen

[Tesla DeLorean]

Vector Tables, Watchdog, Stacks, Interrupts, expectations.

Have code very early in Reset_Handler (in assembler) assert/toggle GPIO or tweet/squawk via UART. Confirm it's entering your code, and then check-point from there on out..

Have HardFault_Handler() and Error_Handler() that report actionable data, not die silently.

[BLeon.2]

The address of the entry to the main() does not appear in the PC register. Failure occurs in system memory. I checked the VTOR register through CubeProgrammer (0xE000ED08), turned on disable interrupts in main program, nothing helped.

[Tesla DeLorean]

main() is significant down-stream from the Reset_Handler, SystemInit, and initialization of statics, etc.

Start at the point that transfer of control occurs, figure out who's dying. If the ROM's handed-off to you, it's role is over.

[BLeon.2]

Above in the line of the disambler:

-> 0x1FF1274E F7FFF9B4 BL.W 0x1FF11ABA

there is a write the address of the next instruction to LR: 0x1FF1ABA, which does not exist.

[Tesla DeLorean]

I think you're wrong on the details/interpretation, suggest you save a copy of the Loader ROM, and send/attach that here.

[BLeon.2]

I read System memory (0x1FF00000 - 0x1FF1FFFF) in this .bin file. I couldnt load .bin and added .hex permission.

AN2606, Table 77:

59 Kbyte starting from address 0x1FF00000, contain the bootloader firmware.

[Tesla DeLorean]

1FF11ABA        SUB16   sub_1FF11ABA:                   ; Xref 1FF1274E
1FF11ABA E92D 4FF8              stmdb   sp!, {r3, r4, r5, r6, r7, r8, r9, r10, r11, lr}
1FF11ABE 2000                   movs    r0, #0
1FF11AC0 F8DF 446C              ldr.w   r4, [pc, #1132] ; $1FF11F30=$24002D04
1FF11AC4 9000                   str     r0, [sp, #0]
1FF11AC6 F20F 4874              addw    r8, pc, #1140   ; $474
1FF11ACA F88D 0000              strb.w  r0, [sp]
1FF11ACE F44F 3900              mov.w   r9, #131072     ; $20000
1FF11AD2 F8DF 7460              ldr.w   r7, [pc, #1120] ; $1FF11F34=$24002904
1FF11AD6 F44F 3580              mov.w   r5, #65536      ; $10000
1FF11ADA F8DF 6450              ldr.w   r6, [pc, #1104] ; $1FF11F2C=$24001868
1FF11ADE F8DF A444              ldr.w   r10, [pc, #1092]        ; $1FF11F24=$240035A0
1FF11AE2 E016                   b.n     loc_1FF11B12
1FF11AE4        LOC     loc_1FF11AE4:                   ; Xref 1FF11B50
1FF11AE4 6030                   str     r0, [r6, #0]
1FF11AE6 2079                   movs    r0, #121
1FF11AE8 60F5                   str     r5, [r6, #12]
1FF11AEA 463A                   mov     r2, r7
1FF11AEC 7038                   strb    r0, [r7, #0]
1FF11AEE 4631                   mov     r1, r6
1FF11AF0 4650                   mov     r0, r10
1FF11AF2 F7FF FD2A              bl      sub_1FF1154A
1FF11AF6 60F5                   str     r5, [r6, #12]
1FF11AF8 2010                   movs    r0, #16
1FF11AFA F000 F8C1              bl      sub_1FF11C80
1FF11AFE F8C6 900C              str.w   r9, [r6, #12]
1FF11B02 2000                   movs    r0, #0
1FF11B04 8038                   strh    r0, [r7, #0]
1FF11B06        LOC     loc_1FF11B06:                   ; Xref 1FF11BC2
1FF11B06 F000 F8BC              bl      sub_1FF11C82
1FF11B0A 60F5                   str     r5, [r6, #12]
1FF11B0C 2079                   movs    r0, #121
1FF11B0E        LOC     loc_1FF11B0E:                   ; Xref 1FF11BFA 1FF11C7E
1FF11B0E F000 F8B7              bl      sub_1FF11C80
1FF11B12        LOC     loc_1FF11B12:                   ; Xref 1FF11AE2 1FF11B1C 1FF11B86 1FF11BC8
1FF11B12                                                ;      1FF11BF4 1FF11C00 1FF11C06 1FF11C28
1FF11B12 2140                   movs    r1, #64
1FF11B14 4650                   mov     r0, r10
..

1FF12734        LOC     loc_1FF12734:                   ; Xref 1FF12734 1FF12740 1FF12746 1FF1274C
1FF12734                                                ;      1FF12752
1FF12734 E7FE                   b.n     loc_1FF12734
1FF12736        LOC     loc_1FF12736:                   ; Xref 1FF12724
1FF12736 F8DF 1588              ldr.w   r1, [pc, #1416] ; $1FF12CC0=$240037B8
1FF1273A 6008                   str     r0, [r1, #0]
1FF1273C F7FA FD9D              bl      sub_1FF0D27A
1FF12740 E7F8                   b.n     loc_1FF12734
1FF12742        LOC     loc_1FF12742:                   ; Xref 1FF12728
1FF12742 F7FD FFB4              bl      sub_1FF106AE
1FF12746 E7F5                   b.n     loc_1FF12734
1FF12748        LOC     loc_1FF12748:                   ; Xref 1FF12720
1FF12748 F7FF FF96              bl      sub_1FF12678
1FF1274C E7F2                   b.n     loc_1FF12734
1FF1274E        LOC     loc_1FF1274E:                   ; Xref 1FF1272C
1FF1274E F7FF F9B4              bl      sub_1FF11ABA
1FF12752 E7EF                   b.n     loc_1FF12734
1FF12754        LOC     loc_1FF12754:                   ; Xref 1FF1272E
1FF12754 F3BF 8F4F              dsb     sy
1FF12758 F8DF 1568              ldr.w   r1, [pc, #1384] ; $1FF12CC4=$E000ED0C
1FF1275C F8DF 0568              ldr.w   r0, [pc, #1384] ; $1FF12CC8=$05FA0004
1FF12760 680A                   ldr     r2, [r1, #0]
1FF12762 F402 62E0              and.w   r2, r2, #1792   ; $700
1FF12766 4302                   orrs    r2, r0
1FF12768 600A                   str     r2, [r1, #0]
1FF1276A F3BF 8F4F              dsb     sy
1FF1276E        LOC     loc_1FF1276E:                   ; Xref 1FF12770
1FF1276E BF00                   nop
1FF12770 E7FD                   b.n     loc_1FF1276E
...

[Tesla DeLorean]

1FF11BCA        LOC     loc_1FF11BCA_cmd_21_go:         ; Xref 1FF11B5C
1FF11BCA 6030                   str     r0, [r6, #0]
1FF11BCC F000 F98E              bl      sub_1FF11EEC
1FF11BD0 4683                   mov     r11, r0
1FF11BD2 F1BB 3F55              cmp.w   r11, #1431655765        ; $55555555
1FF11BD6 D00E                   beq.n   loc_1FF11BF6
1FF11BD8 F000 F858              bl      sub_1FF11C8C
1FF11BDC 4658                   mov     r0, r11
1FF11BDE F7FC F849              bl      sub_1FF0DC74
1FF11BE2 2803                   cmp     r0, #3
1FF11BE4 BF18                   it      ne
1FF11BE6 2802                   cmp     r0, #2
1FF11BE8 D105                   bne.n   loc_1FF11BF6
1FF11BEA F000 F84F              bl      sub_1FF11C8C
1FF11BEE 4658                   mov     r0, r11
1FF11BF0 F7FC FA0D              bl      sub_1FF0E00E_GoCode
1FF11BF4 E78D                   b.n     loc_1FF11B12

1FF0E00E        SUB16   sub_1FF0E00E_GoCode:            ; Xref 1FF0D46C 1FF107E2 1FF11BF0 1FF126A4
1FF0E00E                                                ;      1FF13084
1FF0E00E B538                   push    {r3, r4, r5, lr}
1FF0E010 4604                   mov     r4, r0
1FF0E012 F000 F93E              bl      sub_1FF0E292
1FF0E016 F7FF FFF7              bl      sub_1FF0E008_InterruptEnable
1FF0E01A 1D20                   adds    r0, r4, #4
1FF0E01C 6805                   ldr     r5, [r0, #0]
1FF0E01E 6820                   ldr     r0, [r4, #0]
1FF0E020 F7FF FFEA              bl      sub_1FF0DFF8_LoadMSP
1FF0E024 47A8                   blx     r5
1FF0E026 BD31                   pop     {r0, r4, r5, pc}