feat(bootloader): add ST system bootloader entry

Selecting the STM32CubeProgrammer (DFU) upload method gets you a
board that can be flashed over DFU, but nothing puts it into DFU, so
uploading still means reaching for BOOT0. Wire the 1200 bps touch to
the ST system memory bootloader so the upload works on its own.

cdc_1200bps_touchHook() records the request in a .noinit word and
resets. A reset is safe from the USB control transfer callback where
a branch is not, and .noinit holds an arbitrary value after a power
cycle, which is why the request is only trusted after a software
reset. A backup register would not serve, some series have none.

premain() then branches before init() runs HAL_Init(), so the ROM
gets the part close to reset state. systemBootloaderAddress() remaps
system memory to zero rather than carrying a table of per series
addresses, and is WEAK so a board can point it elsewhere.

The ROM clocks USB from the HSE but does not know which crystal is
fitted, so it measures one against the HSI, and per AN2606 it resets
the part when that measurement misses. On a 12 MHz Feather STM32F405
Express a single attempt reached DFU 5 times in 12, so the request
survives the reset and is retried.

Fixes #706

Author: mikeysklar

boards.txt

@@ -6146,6 +6146,7 @@ GenF4.menu.upload_method.dfuMethod=STM32CubeProgrammer (DFU)
 GenF4.menu.upload_method.dfuMethod.upload.protocol=dfu
 GenF4.menu.upload_method.dfuMethod.upload.options=-v {upload.vid} -p {upload.pid} -a {upload.address} -s {upload.start}
 GenF4.menu.upload_method.dfuMethod.upload.tool=stm32CubeProg
+GenF4.menu.upload_method.dfuMethod.build.bootloader_flags=-DBL_SYSTEM
 
 GenF4.menu.upload_method.bmpMethod=BMP (Black Magic Probe)
 GenF4.menu.upload_method.bmpMethod.upload.protocol=gdb_bmp

cores/arduino/main.cpp

@@ -19,11 +19,16 @@
 
 #define ARDUINO_MAIN
 #include "Arduino.h"
+#include "bootloader.h"
 
 // Force init to be called *first*, i.e. before static object allocation.
 // Otherwise, statically allocated objects that need HAL may fail.
 __attribute__((constructor(101))) void premain()
 {
+#if defined(BL_SYSTEM)
+  /* Before any clock or cache setup below, so the ROM gets a quiet part. */
+  jumpToSystemBootloaderIfRequested();
+#endif
 
   // Required by FreeRTOS, see http://www.freertos.org/RTOS-Cortex-M3-M4.html
 #ifdef NVIC_PRIORITYGROUP_4

libraries/SrcWrapper/inc/bootloader.h

@@ -1,6 +1,8 @@
 #ifndef _BOOTLOADER_H_
 #define _BOOTLOADER_H_
 
+#include <stdint.h>
+
 /* Ensure DTR_TOGGLING_SEQ enabled */
 #if defined(BL_LEGACY_LEAF) || defined(BL_HID)
   #ifndef DTR_TOGGLING_SEQ
@@ -12,6 +14,11 @@
 extern "C" {
 #endif /* __cplusplus */
 
+#if defined(BL_SYSTEM)
+uint32_t systemBootloaderAddress(void);
+void jumpToSystemBootloaderIfRequested(void);
+#endif /* BL_SYSTEM */
+
 #ifdef __cplusplus
 }
 #endif /* __cplusplus */

libraries/SrcWrapper/src/stm32/bootloader.c

@@ -1,5 +1,7 @@
 #include "bootloader.h"
 
+#include <stdbool.h>
+
 #include "stm32_def.h"
 #include "backup.h"
 
@@ -37,3 +39,81 @@ void dtr_togglingHook(uint8_t *buf, uint32_t *len)
   }
 }
 #endif /* BL_HID */
+
+#if defined(BL_SYSTEM)
+/* Request to enter the ST system memory bootloader. It lives in .noinit so it
+ * survives the reset that carries it, and holds an arbitrary value after a
+ * power cycle, which is why it is only trusted after a software reset. A
+ * backup register would not do, some series have none. Low half counts
+ * attempts. */
+static uint32_t bootloaderRequest __attribute__((section(".noinit")));
+
+#define BOOTLOADER_REQUEST_MAGIC 0x5A5A0000
+#define BOOTLOADER_REQUEST_MASK  0xFFFF0000
+
+/* The ROM clocks USB from the HSE but does not know which crystal is fitted,
+ * so it measures one against the HSI and resets the part when that measurement
+ * misses, see AN2606 "HSE detected" -> no -> "Generate System reset". On a
+ * 12 MHz STM32F405 a single attempt reached DFU 5 times in 12, so the request
+ * survives the reset and is tried again. */
+#define BOOTLOADER_MAX_ATTEMPTS 16
+
+/* Where the bootloader's vector table lives, a stack pointer to load followed
+ * by an address to jump to. Remapping system memory to 0 keeps this free of
+ * per-series addresses. WEAK so a board can point it elsewhere. */
+WEAK uint32_t systemBootloaderAddress(void)
+{
+#ifdef __HAL_SYSCFG_REMAPMEMORY_SYSTEMFLASH
+  /* Remap system Flash memory at address 0x00000000 */
+  __HAL_SYSCFG_REMAPMEMORY_SYSTEMFLASH();
+  return 0;
+#else
+#error "System memory address unknown for this series"
+#endif
+}
+
+/* Called from premain(), before init() runs HAL_Init(), so the ROM gets the
+ * part close to reset state. It cannot be done from cdc_1200bps_touchHook():
+ * that runs in handler mode and the ROM would never leave the exception. */
+WEAK void jumpToSystemBootloaderIfRequested(void)
+{
+  uint32_t request = bootloaderRequest;
+  uint32_t attempts = request & ~BOOTLOADER_REQUEST_MASK;
+  bool requested = __HAL_RCC_GET_FLAG(RCC_FLAG_SFTRST)
+                   && ((request & BOOTLOADER_REQUEST_MASK) == BOOTLOADER_REQUEST_MAGIC);
+
+  /* Clear it in every other case, so a power cycle always leaves the
+   * bootloader and a completed session does not re-enter it. */
+  bootloaderRequest = 0;
+
+  if (!requested || (attempts >= BOOTLOADER_MAX_ATTEMPTS)) {
+    return;
+  }
+  bootloaderRequest = BOOTLOADER_REQUEST_MAGIC | (attempts + 1);
+  __HAL_RCC_CLEAR_RESET_FLAGS();
+
+  uint32_t sys = systemBootloaderAddress();
+
+  /* Assembly to prevent modifying the stack pointer after loading it, and to
+   * ensure a jump rather than a call. */
+  asm volatile(
+    "ldr r0, [%[sys], #0]   \n\t"  // get address of stack pointer
+    "msr msp, r0            \n\t"  // set stack pointer
+    "ldr r0, [%[sys], #4]   \n\t"  // get address of reset handler
+    "dsb                    \n\t"  // data sync barrier
+    "isb                    \n\t"  // instruction sync barrier
+    "bx r0                  \n\t"  // branch to bootloader
+    : : [sys] "l"(sys) : "r0"
+  );
+
+  __builtin_unreachable();
+}
+
+/* Host closed the CDC port at 1200 bps. Record the request and reset; a reset
+ * is safe from the control transfer callback where a branch is not. */
+void cdc_1200bps_touchHook(void)
+{
+  bootloaderRequest = BOOTLOADER_REQUEST_MAGIC;
+  NVIC_SystemReset();
+}
+#endif /* BL_SYSTEM */