STM32H743: How to start the system boot loader via software

[Werner Mann]

Posted on July 14, 2018 at 01:29

Hi,

what is the procedure to start the system bootloader in the STM32H743 via software. Even newest AN2606 is not clear on this, since none of the mentioned methods fit the STM32H7 registers etc.

What I mean:

For the F4 the system memory needs to be remapped to 0x00000000, load MSP from value in address 0x00000000 and then a jump to the address stored in address 0x0000004 is done. This works for an F4.

On the F7 (also a Cortex-M7) some option bytes have to be configured correctly and then it is basically MSP from 0x1ff0000 and jump to value of 0x1ff00004.

But what is the procedure on the H7? The system memory is located like on the F7 on 0x1ff00000 but it is not readable, and because of that no loading of MSP and reading the correct jump address. There is no system memory remapping bit in the SYSCFG register which is what AN2606 suggests to use, the only exception mentioned is for the F7. I think there is either no way to achieve this on the STM32H7 or another not yet documented way. In any case, AN2606 is lacking sufficient information, probably forgotten when adding the H7.

Just for reference: When booting with the BOOT pin high, DFU works, no problems here. It is a Rev. Y

Anyone any  idea what works?

Werner

[Tesla DeLorean · Accepted solution]

Posted on July 14, 2018 at 05:17

0x1FF09800

[Tesla DeLorean]

Original Posted on July 14, 2018 at 07:33

Definitely gets into ROM

startup.s (Keil)
 
Reset_Handler   PROC
                EXPORT  Reset_Handler                    [WEAK]
                IMPORT  SystemInit
                IMPORT  __main
 
; STM32H7 Boot-to-ROM sourcer32@gmail.com   13-July-2018
 
                LDR     R0, =0x2001FFFC  ; Safe End-of-RAM location (for demonstration)
                LDR     R1, =0xBEEFBEEF  ; Special Key
                LDR     R2, [R0, #0]
                CMP     R1, R2
                BNE     NotDFuse
 
                STR     R0, [R0, #0]     ; Invalidate Key
                LDR     R1, =0xE000ED00  ; SCB
                LDR     R0, =0x1FF09800  ; ROM BASE
                STR     R0, [R1, #8]     ; VTOR
                LDR     SP,[R0, #0]      ; ROM Stack Pointer
                LDR     R0,[R0, #4]      ; ROM Program Counter
                BX      R0
 
NotDFuse
 
                LDR     R0, =SystemInit
                BLX     R0
 
                LDR     R0, =__main
                BX      R0
 
                ENDP  Reset_Handler
 
main.c
 
void DFUBoot(void)
{
  *((uint32_t *)0x2001FFFC) = 0xBEEFBEEF; // Special Key to End-of-RAM
 
  SCB_CleanDCache();
  NVIC_SystemReset();
}

Formatting broken in forum transition, edited to try and fix that

[Werner Mann]

Posted on July 14, 2018 at 09:17

Thanks Clive,

works like a treat. 

I am using the normal approach just like on the F7, see above, but with 0x1FF09800 instead of 0x1FF00000, and bingo, the DFU device reports itself on USB.

Werner

[Tesla DeLorean]

Posted on July 14, 2018 at 14:14

Yes, ST's 'Normal' method is a bit circuitous and fraught, I've been pushing this type of method for longer as it gets about as close to 'Reset Conditions' as one can realistically get.

I'm perplexed ST didn't provide details of the ROM location, didn't take me long to pin it down, but I've been doing this stuff of ever. I will probably create an annotated disassembly of this later.

All the NUCLEO-H743ZI are Rev Y, need to poke at the STM32H743I-EVAL which I think has engineering silicon (ES)

[Tesla DeLorean]

Posted on July 14, 2018 at 16:54

The EVAL board has a Rev Z

CPUID 411FC271 DEVID 450 REVID 1001

Cortex M7 r1p1

The OTP/ROM area appears to be blank on the ES part

[Khouloud GARSI]

Hello,

In STM32H7, the base address of the system memory is different from the entry point of the bootloader.

Thus, in order to jump to the bootloader, address "0x1FF09800" should be used instead of "0x1FFF0000".

You may have a look on FAQ "Jump to Bootloader from application on STM32H7 devices".

Link:

https://community.st.com/s/article/STM32H7-bootloader-jump-from-application

Khouloud.

[Werner Mann]

Thanks for pointing the FAQ page out to me. While the first answer was already good enough for my purpose, it is good to see some sample code which includes the proper deactivation procedure.

Werner

[Tesla DeLorean]

I suspect JumpToBootloader() will fail from interrupt context, or protected mode RTOS. On CM7 caching or MPU settings might also need to be considered.

[Werner Mann]

Indeed the caches and MPU should be considered. In my bootloader I simply do not activate any of these (for exactly the above reason) but in general you're right. You may be right about the interrupt context and protected mode (at least for the later I hope you are!).