Tutorial – Jump to system memory from software on STM32

One of you are already familiar with STM32 feature of embedded bootloader for software download to flash.

This memory is called system memory and is normally accessible with BOOT configuration (either pin hardware or option bytes (later OB) in flash software).

Normally, if you want to jump to system memory, you have to setup pin/OB and reset device. If you have OB setup, this is ok, but since you need at least one BOOT pin in hardware, this can lead to hardware problems.

This tutorial will cover, how to jump to system memory from current program in STM32. This is a way, how to start STM32 internal bootloader for software update.

Tutorial

This tutorial will cover STM32F4 family, but the same principle works for any other family.

In application note for hardware start for STM32F4 (AN4488) you can find a table showing you how to setup boot pins for different configuration.

STM32F4 boot configuration

STM32F4 boot configuration

BOOT0 pin is dedicated on device, while BOOT1 is shared with PB2. When (normally) main flash memory is used, only BOOT0 configuration is required, BOOT1 pin does not care. To make hardware development easier, we can set BOOT0 pin to GND and force device to always jump to main flash memory.

Since we know system memory is available, we also know that it is somewhere in memory on specific memory location. Now, each device has this on different address, but on STM32F429, which I use, it is available on memory location 0x1FFF0000.

Application note (AN2606)describe bootloader in details and also gives you information on where is memory location for specific device [Table 110].

Since now we know where our memory address is, we have to perform jump to that location and if possible, reflect system memory to 0x00000000 address so that MCU sees this at start address.

Steps for jumping to system memory

If you wish to just from main program to system memory at anytime, some important steps needs to be performed first:

  • Find system memory location for specific STM32 in AN2606
  • Set RCC to default values (the same as on startup) [Internal clock, no PLL, etc.)
  • Disable SysTick interrupt and reset it to default
  • Disable all interrupts
  • Map system memory to 0x00000000 location
  • Set jump location to memory location + 4 bytes offset
  • Set main stack pointer to value stored at system memory location address
  • Call virtual function assigned before

To test this code, set boot configuration to main flash memory (default on all STM32 evaluation boards) and run program and call function above when desired.

To test, if jump was successful, open STM32 Flash loader demonstrator software and try to connect via UART with external USB<->UART transceiver.

tilz0R

Owner of this site. Also electronic enthusiasts, web developer, 3D printer fan, handball player and more. Big fan of STM32F4 devices. In anticipation of the new Discovery board for STM32F7 lines.

You may also like...

Read before commenting!

Before you make a new comment, make sure you agree with things listed below:

  • - Read post to make sure if it is already posted what you are asking for,
  • - Make sure you have the latest version of libraries used in your project,
  • - Make a clean and grammatically correct written message,
  • - Report as many details as possible, including what have you done so far,
  • - Do NOT post any code here. Use Pastebin,
  • - Do NOT post any error codes here. Use Pastebin,
  • - Specify STM32Fxxx family and used Discovery/EVAL/Nucleo or custom made board,
  • - Make sure your clock is set correct for PLL,
  • - If you are using my HAL drivers, please check this post how to start.
Comment will be deleted on breaking these rules without notification!
  • Pingback: All STM32F4 tutorials - STM32F4 Discovery()

  • krishh

    Hey which library did you get this from __set_MSP(*(uint32_t *)addr); ?

  • Nelup

    Hello,

    This solution has one big problem which wasn’t mentioned. If anybody erase a complete flash (mass erase), there will be no code to enter the system bootloader. Specially when the code is read protected, there will be reset after mass erase.

    Some CPU as e.g. STM32F042F6 has feature that when flash is empty (mass erased) the system bootloader is run automatically. I think that the STM32F4 doesn’t have this behavior.

    I know 2 better solutions:

    1) Use own bootloder code (IAP), which will manage page erase and flashing and it secures its own flash code from erase. This can be used by user. The system bootloader can be used by production to load the bootloader first or as fatal case.
    You can manage bootloader through any interface (USB VCP, ETH, COM, …) this way. I don’t like USB DFU bootloader much (the CPU check can’t be done) and I prefer USB VCP with the same protocol as through UART.

    2) Use special hardware (small CPU) in function of external watchdog. This watchdog can toggle system bootloader (set BOOT0 + reset) and application code when watchdog is not managed and there is no communication on specified pins.

    nelup

    • This is a good comment. User must be aware of that, for sure. This is out of scope in this tutorial.