How to enter bootloader without Boot pins on STM32F72?

[DEyer.1]

hi,

We're using the STM32F7 in our project and would like to flash over USB. In the host application we use USB for data transfer which works well. Unfortunately, I have had no success getting the device into the bootloader as we have no access to the boot pins. I tried this code I found on the internet but the the linux dfu-util -l command says no dfu devices found. I noticed this command takes a long time, same with lsusb when the board is in the bootloader (if it even is). Maybe the USB enumeration ist working properly?

We use a 32 MHz HSE but that doesn't get initialized until after the bootloader is called. Any idea on what could be wrong?

Any help would be greatly appreciated!

best regards,

dominik

void JumpToBootloader(void) {
	void (*SysMemBootJump)(void);
 
 // read out if we want to enter the bootloader from the backup registers
 RTC_HandleTypeDef RtcHandle;
 RtcHandle.Instance = RTC;
 uint32_t callBootloader = HAL_RTCEx_BKUPRead(&RtcHandle, RTC_BKP_DR0);
 HAL_RTCEx_BKUPWrite(&RtcHandle,RTC_BKP_DR0,0x1);
 
 if(!callBootloader)
 {
 return;
 }
 
 
	/**
	 * Step: Set system memory address. 
	 * 
	 * For other families, check AN2606 document table 110 with descriptions of memory addresses 
	 */
	volatile uint32_t addr = 0x1FF00000;
		
	/**
	 * Step: Disable RCC, set it to default (after reset) settings
	 * Internal clock, no PLL, etc.
	 */
	HAL_RCC_DeInit();	
	/**
	 * Step: Disable systick timer and reset it to default values
	 */
	SysTick->CTRL = 0;
	SysTick->LOAD = 0;
	SysTick->VAL = 0;
 
	/**
	 * Step: Disable all interrupts
	 */
	__disable_irq();
	
	/**
	 * Step: Remap system memory to address 0x0000 0000 in address space
	 * For each family registers may be different. 
	 * Check reference manual for each family.
	 *
	 * For STM32F4xx, MEMRMP register in SYSCFG is used (bits[1:0])
	 * For STM32F0xx, CFGR1 register in SYSCFG is used (bits[1:0])
	 * For others, check family reference manual
	 */
	SYSCFG->MEMRMP = 0x01;
 
	/**
	 * Step: Set jump memory location for system memory
	 * Use address with 4 bytes offset which specifies jump location where program starts
	 */
	SysMemBootJump = (void (*)(void)) (*((uint32_t *)(addr + 4)));
 
/**
	 * Step: Set main stack pointer.
	 * This step must be done last otherwise local variables in this function
	 * don't have proper value since stack pointer is located on different position
	 *
	 * Set direct address location which specifies stack pointer in SRAM location
	 */
	__set_MSP(*(uint32_t *)addr);
	/**
	 * Step: Actually call our function to jump to set location
	 * This will start system memory execution
	 */
	SysMemBootJump();
	
	/**
	 * Step: Connect USB<->UART converter to dedicated USART pins and test
	 * and test with bootloader works with STM32 Flash Loader Demonstrator software
	 */
}

[Javier1]

checkout the option bits https://community.st.com/s/article/What-Are-Option-Bytes-In-Stm32-And-How-Do-I-Use-Them

[MM..1]

Your code is for secend test. Primary use pins and read AN2606

 

[DEyer.1]

Thanks for your replies.

This is exactly what I am concerned about. Here in in the AN2606 it says HSE must be less than 26 MHz, we use 32. So does that mean I have no possibility of using the USB bootloader?

Also, I'm not sure what to do with the option bytes. Should I change what happens when the boot0 pin is low so that it runs the bootloader? How will it start my code afterwards?Is this really the recommended way of entering the bootloader from software? It seems rather complicated and not to mention risky as the document said corrupt write can cause device to lock.

cheers

dominik

[Tesla DeLorean]

You can create your own USB DFU loader that supports the hardware you've built. Can deal with whatever pins, clocks or external memories you've used.

There should be examples in CubeF7

When using the ROM's loader you need to account for every pin it might be monitoring for signals and the limitations/constraints of a one-size-fits-all approach.

[DEyer.1]

So there is no means of configuring the ROM's bootloader via some register settings or the like? It always cascades through that full chain of possible flash sources i2c, spi usart etc?

Thanks for the hint, I'll see if I can find that example.

[DEyer.1]

 uint32_t JumpAddress;
 pFunction JumpToApplication;
 /* Jump to user application */
 JumpAddress = *(__IO uint32_t*) (USBD_DFU_APP_DEFAULT_ADD + 4);
 JumpToApplication = (pFunction) JumpAddress;
 /* Initialize user application's Stack Pointer */
 __set_MSP(*(__IO uint32_t*) USBD_DFU_APP_DEFAULT_ADD);
 JumpToApplication();

I've opted for a separate bootloader now as was in the example and this (https://www.youtube.com/watch?v=n_LDXOQHerU&t=570s) video but I can't seem to get it to jump to my application code. Even if I put the above code right after main is called it just seems to hang in TIM1 interrupts (void TIM1_UP_TIM10_IRQHandler(void)). Any idea what could be wrong?

Thanks for any help.