Jump to bootloader and Read out protection conflict
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
‎2017-06-22 7:01 PM
Hi everyone!
I'm using STM32F105 MCU , and I'd like to explore built-in DFU feature
When I set BOOT0/BOOT1 pins per datasheet and reboot the MCU, the feature always works ok no matter how read out protection is set in option bits
However, jump from application works only if read out protection is off
The jump code disables all IRQ sources used in my application, clears pending interrupts, sets stack top and jumps to system memory per AN2606
&sharpdefine _DFU_START (0x1FFFB000)
static void (*_p_ldr)(void); NVIC_DisableIRQ(TIM2_IRQn); NVIC_DisableIRQ(TIM3_IRQn); NVIC_DisableIRQ(TIM4_IRQn); NVIC_DisableIRQ(DMA1_Channel1_IRQn); NVIC_ClearPendingIRQ(TIM2_IRQn); NVIC_ClearPendingIRQ(TIM3_IRQn); NVIC_ClearPendingIRQ(TIM4_IRQn); NVIC_ClearPendingIRQ(DMA1_Channel1_IRQn); HAL_RCC_DeInit(); HAL_DeInit(); _p_ldr = ( void(*)(void)) (*((uint32_t *)(_DFU_START+4))); __set_MSP(*(__IO uint32_t*) _DFU_START); _p_ldr();What may cause the problem?
#dfu #bootloader #stm32 #read-out-protection- Labels:
-
Bootloader
-
RDP
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
‎2017-06-22 7:11 PM
I've generally advocated the use of NVIC_SystemReset() and a ma gic number in RAM so ResetHandler can quickly vector to the ROM in near reset conditions.
Check things like SysTick
Try setting SCB->VTOR to _DFU_START
Double check ROM address, not aware of ROP on FLASH precluding the reading or execution of ROM code. Should be able to read things like options bytes and unique serial, etc. The ROM is aware of ROP, and limits subset of feature available, I suppose that could be an issue.
Up vote any posts that you find helpful, it shows what's working..
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
‎2017-06-23 3:41 AM
It is a pity that only F04 and F07 have a 'Jump to Bootloader from application code' entry point!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
‎2017-06-23 5:30 AM
Thank you for your quick reply
Correct me if I'm wrong but the RAM location would contain random value upon normal startup, so there's very small yet finite probability of unintended branching to DFU, isn't ?
ROM address is just start of system memory like described in device datasheet and AN2606
What exactly should I do about SysTick and how can it be related to ROP? (keeping in mind that DFU works ok when activated by boot pins. Even if ROP is on).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
‎2017-06-23 5:50 AM
Despite of that, jumping to start of system memory worked ok for me with STM32F042 devices, without the problem described in the starting post
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
‎2017-06-23 6:40 AM
Either you care to reset many settings, or a bare jump to bootloader will not work reliable in some situations. So caring for the right setup is best done in the bootloader!
