Flashing the BlackPill (STM32F411CEU6)

I was having a hard time trying to flash the firmware nuttx.bin on BlackPill board. Initially I tried OpenOCD with STLinkV2 as I used to with the BluePill, but it didn’t work. Then I tried a Atmel-ICE SWD programmer with OpenOCD and no luck. So I decided to try using JLink too.

JLink also didn’t work, none of these programmer was communicating with the board, but I knew the board was fine because the blue LED (C13 label) was dimming (fade in and fade out).

I notice that after plugging the USB-C cable on the board the program delays about 1s to start dimming the LED, to I decided to run the “connect” command on JLink prompt at same moment I plug the cable. Great it worked.

Well, partially, I was able to detect the MCU, but erase it not working:

J-Link>con
Device "STM32F411CE" selected.


Connecting to target via SWD
Found SW-DP with ID 0x2BA01477
Found SW-DP with ID 0x2BA01477
Scanning AP map to find all available APs
AP[1]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x24770011)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 0 code (BP) slots and 3 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
ROMTbl[0][1]: E000E000, CID: B105E00D, PID: 0BB00CB1 ???
ROMTbl[0][2]: E0001000, CID: 05E00D0B, PID: 3BB00205 ???
ROMTbl[0][3]: E0002000, CID: 05E00D3B, PID: 2BB00305 ???
ROMTbl[0][4]: E00FF000, CID: 05100D00, PID: 0A041105 ???
ROMTbl[0][5]: E0040000, CID: 05900D0A, PID: 0BB9A105 ???
ROMTbl[0][6]: E0041000, CID: 05900D0B, PID: 0BB92505 ???
Cortex-M4 identified.
J-Link>erase

**************************
WARNING: T-bit of XPSR is 0 but should be 1. Changed to 1.
**************************

Erasing device...

****** Error: Verification of RAMCode failed @ address 0x20000000.
Write: 0xA801BE00 F0009900
Read: 0x0000100A A801BE00
Failed to prepare for programming.
Failed to download RAMCode!
ERROR: Erase returned with error code -1.
J-Link>

Then I found this post at segger website and decided to test the suggested commands: https://forum.segger.com/index.php/Thread/2723-SOLVED-Bricking-STM32F4-after-failed-programming/

J-Link>r
Reset delay: 0 ms
Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
Reset: Halt core after reset via DEMCR.VC_CORERESET.
Reset: Reset device via AIRCR.SYSRESETREQ.
J-Link>h
PC = 080001AC, CycleCnt = 00000000
R0 = 00000000, R1 = 00000000, R2 = 00000000, R3 = 00000000
R4 = 00000000, R5 = 00000000, R6 = 00000000, R7 = 00000000
R8 = 00000000, R9 = 00000000, R10= 00000000, R11= 00000000
R12= 00000000
SP(R13)= 20001AD0, MSP= 20001AD0, PSP= 00000000, R14(LR) = FFFFFFFF
XPSR = 01000000: APSR = nzcvq, EPSR = 01000000, IPSR = 000 (NoException)
CFBP = 00000000, CONTROL = 00, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00

FPS0 = 00000000, FPS1 = 00000000, FPS2 = 00000000, FPS3 = 00000000
FPS4 = 00000000, FPS5 = 00000000, FPS6 = 00000000, FPS7 = 00000000
FPS8 = 00000000, FPS9 = 00000000, FPS10= 00000000, FPS11= 00000000
FPS12= 00000000, FPS13= 00000000, FPS14= 00000000, FPS15= 00000000
FPS16= 00000000, FPS17= 00000000, FPS18= 00000000, FPS19= 00000000
FPS20= 00000000, FPS21= 00000000, FPS22= 00000000, FPS23= 00000000
FPS24= 00000000, FPS25= 00000000, FPS26= 00000000, FPS27= 00000000
FPS28= 00000000, FPS29= 00000000, FPS30= 00000000, FPS31= 00000000
FPSCR= 00000000
J-Link>mem 0x8000000, 0x800
08000000 = D0 1A 00 20 AD 01 00 08 1F 19 00 08 35 17 00 08 
08000010 = 1D 19 00 08 4F 03 00 08 E9 2F 00 08 00 00 00 00 
08000020 = 00 00 00 00 00 00 00 00 00 00 00 00 59 19 00 08 
08000030 = 85 03 00 08 00 00 00 00 2D 19 00 08 5B 19 00 08 
08000040 = C7 01 00 08 C7 01 00 08 C7 01 00 08 C7 01 00 08 
08000050 = C7 01 00 08 C7 01 00 08 C7 01 00 08 C7 01 00 08 
08000060 = C7 01 00 08 C7 01 00 08 C7 01 00 08 C7 01 00 08 
08000070 = C7 01 00 08 C7 01 00 08 C7 01 00 08 C7 01 00 08 
08000080 = C7 01 00 08 C7 01 00 08 C7 01 00 08 00 00 00 00 
08000090 = 00 00 00 00 00 00 00 00 00 00 00 00 C7 01 00 08 
080000A0 = C7 01 00 08 C7 01 00 08 C7 01 00 08 C7 01 00 08 
080000B0 = C7 01 00 08 C7 01 00 08 C7 01 00 08 C7 01 00 08 
080000C0 = C7 01 00 08 C7 01 00 08 C7 01 00 08 C7 01 00 08 
080000D0 = C7 01 00 08 C7 01 00 08 C7 01 00 08 00 00 00 00 
080000E0 = C7 01 00 08 C7 01 00 08 C7 01 00 08 00 00 00 00 
080000F0 = 00 00 00 00 00 00 00 00 00 00 00 00 C7 01 00 08 
08000100 = 00 00 00 00 C7 01 00 08 C7 01 00 08 C7 01 00 08 
08000110 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
08000120 = C7 01 00 08 C7 01 00 08 C7 01 00 08 C7 01 00 08 
08000130 = C7 01 00 08 00 00 00 00 00 00 00 00 00 00 00 00 
08000140 = 00 00 00 00 00 00 00 00 00 00 00 00 21 19 00 08 
08000150 = C7 01 00 08 C7 01 00 08 C7 01 00 08 C7 01 00 08 
08000160 = C7 01 00 08 C7 01 00 08 00 00 00 00 00 00 00 00 
08000170 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
08000180 = 00 00 00 00 C7 01 00 08 00 00 00 00 00 00 00 00 
08000190 = C7 01 00 08 C7 01 00 08 DF F8 0C D0 00 F0 9A F8 
080001A0 = 00 48 00 47 C9 33 00 08 D0 1A 00 20 06 48 80 47 
080001B0 = 06 48 00 47 FE E7 FE E7 FE E7 FE E7 FE E7 FE E7 
080001C0 = FE E7 FE E7 FE E7 FE E7 55 1A 00 08 99 01 00 08 
080001D0 = 2D E9 F0 5F 05 46 00 20 92 46 9B 46 88 46 06 46 
080001E0 = 81 46 40 24 1B E0 28 46 41 46 47 46 22 46 00 F0 
080001F0 = 60 F8 53 46 5A 46 C0 1A 91 41 10 D3 11 46 18 46 
08000200 = 22 46 00 F0 47 F8 2D 1A 67 EB 01 08 4F 46 22 46 
08000210 = 01 20 00 21 00 F0 3E F8 17 EB 00 09 4E 41 20 1E 
08000220 = A4 F1 01 04 DF DC 48 46 31 46 2A 46 43 46 BD E8 
08000230 = F0 9F 40 EA 01 03 9B 07 03 D0 09 E0 08 C9 12 1F 
08000240 = 08 C0 04 2A FA D2 03 E0 11 F8 01 3B 00 F8 01 3B 
08000250 = 52 1E F9 D2 70 47 D2 B2 01 E0 00 F8 01 2B 49 1E 
08000260 = FB D2 70 47 00 22 F6 E7 10 B5 13 46 0A 46 04 46 
08000270 = 19 46 FF F7 F0 FF 20 46 10 BD 30 B5 04 46 00 20 
08000280 = 03 46 00 E0 5B 1C 93 42 03 D2 E0 5C CD 5C 40 1B 
08000290 = F8 D0 30 BD 20 2A 04 DB 20 3A 00 FA 02 F1 00 20 
080002A0 = 70 47 91 40 C2 F1 20 03 20 FA 03 F3 19 43 90 40 
080002B0 = 70 47 20 2A 04 DB 20 3A 21 FA 02 F0 00 21 70 47 
080002C0 = 21 FA 02 F3 D0 40 C2 F1 20 02 91 40 08 43 19 46 
080002D0 = 70 47 00 00 06 4C 07 4D 06 E0 E0 68 40 F0 01 03 
080002E0 = 94 E8 07 00 98 47 10 34 AC 42 F6 D3 FF F7 58 FF 
080002F0 = 38 39 00 08 58 39 00 08 70 B5 8C 18 10 F8 01 5B 
08000300 = 15 F0 07 03 01 D1 10 F8 01 3B 2A 11 06 D1 10 F8 
08000310 = 01 2B 03 E0 10 F8 01 6B 01 F8 01 6B 5B 1E F9 D1 
08000320 = 2B 07 05 D4 00 23 52 1E 0D D4 01 F8 01 3B FA E7 
08000330 = 10 F8 01 3B CB 1A 92 1C 03 E0 13 F8 01 5B 01 F8 
08000340 = 01 5B 52 1E F9 D5 A1 42 D8 D3 00 20 70 BD FE E7 
08000350 = 00 20 70 47 00 20 70 47 07 48 08 4A D0 F8 90 02 
08000360 = 00 21 40 29 03 D0 43 5C 53 54 01 31 F9 E7 04 48 
08000370 = 01 21 01 70 00 20 70 47 00 04 00 20 7C 01 00 20 
08000380 = 78 01 00 20 70 47 70 47 DE 4A 03 29 13 68 23 F4 
08000390 = 40 73 13 60 4F F4 40 73 38 BF 0B 02 11 68 19 43 
080003A0 = 11 60 11 68 21 F0 F8 01 11 60 11 68 41 EA C0 00 
080003B0 = 40 F0 02 00 10 60 10 68 40 F4 80 30 10 60 70 47 
080003C0 = 13 48 01 68 89 05 0F D5 01 68 21 F4 00 71 01 60 
080003D0 = 01 68 41 F4 00 61 01 60 01 68 21 F4 00 61 01 60 
080003E0 = 01 68 41 F4 00 71 01 60 01 68 49 05 0F D5 01 68 
080003F0 = 21 F4 80 61 01 60 01 68 41 F4 80 51 01 60 01 68 
08000400 = 21 F4 80 51 01 60 01 68 41 F4 80 61 01 60 70 47 
08000410 = 00 3C 02 40 BB 49 0A 68 22 F4 40 72 0A 60 0A 68 
08000420 = 42 F0 04 02 0A 60 0A 68 42 EA 00 20 40 F4 80 30 
08000430 = 08 60 70 47 B3 4A 13 68 23 F4 40 73 13 60 13 68 
08000440 = 13 60 13 68 43 F0 01 03 13 60 01 70 70 47 00 BF 
08000450 = 10 B5 AC 49 0C 68 24 F4 40 74 0C 60 0C 68 44 F4 
08000460 = 40 74 0C 60 0C 68 44 F0 01 04 0C 60 02 60 BF F3 
08000470 = 6F 8F 43 60 10 BD 00 BF A2 4A 13 68 23 F4 40 73 
08000480 = 13 60 13 68 43 F4 80 73 13 60 13 68 43 F0 01 03 
08000490 = 13 60 01 80 70 47 00 BF 9A 4A 13 68 23 F4 40 73 
080004A0 = 13 60 13 68 43 F4 00 73 13 60 13 68 43 F0 01 03 
080004B0 = 13 60 01 60 70 47 00 BF 32 48 01 68 C9 06 06 D5 
080004C0 = 8F 49 CA 69 42 F0 10 02 CA 61 10 21 01 60 01 68 
080004D0 = 89 06 06 D5 8A 49 CA 69 42 F0 08 02 CA 61 20 21 
080004E0 = 01 60 01 68 49 06 06 D5 85 49 CA 69 42 F0 04 02 
080004F0 = CA 61 40 21 01 60 01 68 09 06 06 D5 80 49 CA 69 
08000500 = 42 F0 02 02 CA 61 80 21 01 60 01 68 C9 05 07 D5 
08000510 = 7B 49 CA 69 42 F0 01 02 CA 61 4F F4 80 71 01 60 
08000520 = 01 68 89 07 06 D5 76 49 CA 69 42 F0 20 02 CA 61 
08000530 = 02 21 01 60 70 47 00 BF F8 B5 04 46 70 48 00 21 
08000540 = 10 4E C1 61 00 F0 46 FA 05 46 67 1C 30 68 C0 03 
08000550 = 09 D5 00 2F FA D0 24 B1 00 F0 3C FA 40 1B A0 42 
08000560 = F4 D9 03 20 F8 BD 30 68 C0 07 1C BF 01 20 30 60 
08000570 = 30 68 10 F4 F9 7F 03 D0 FF F7 9E FF 01 20 F8 BD 
08000580 = 00 20 F8 BD 0C 3C 02 40 80 B5 09 48 4F F0 FF 31 
08000590 = 00 22 01 61 02 61 41 61 42 61 01 60 02 60 41 60 
080005A0 = 42 60 81 60 82 60 00 F0 5D FA 00 20 80 BD 00 BF 
080005B0 = 10 38 02 40 B0 B5 04 46 00 F0 0C FA 05 46 05 48 
080005C0 = 61 1C 00 78 18 BF 04 44 00 F0 04 FA 40 1B A0 42 
080005D0 = FA D3 B0 BD 18 00 00 20 2D E9 F8 43 DF F8 20 81 
080005E0 = 05 46 98 F8 18 00 01 28 01 D1 02 26 3E E0 01 20 
080005F0 = 88 F8 18 00 4C F2 50 30 89 46 FF F7 9D FF 06 46 
08000600 = 88 BB 4F F0 FF 30 C9 F8 00 00 28 68 3D 4C 01 28 
08000610 = 0C D1 28 7C FF F7 FE FE 4C F2 50 30 FF F7 8C FF 
08000620 = 06 46 20 68 20 F0 04 00 20 60 1A E0 A8 68 07 46 
08000630 = E9 68 08 44 87 42 10 D2 29 7C 38 46 FF F7 A4 FE 
08000640 = 4C F2 50 30 FF F7 78 FF 06 46 20 68 20 F0 FA 00 
08000650 = 20 60 26 B9 A8 68 01 37 EA E7 00 26 01 E0 C9 F8 
08000660 = 00 70 FF F7 AD FE 00 20 88 F8 18 00 30 46 BD E8 
08000670 = F8 83 00 BF 23 48 01 68 41 F0 00 41 01 60 00 20 
08000680 = 70 47 00 BF 2D E9 F0 41 DF F8 74 80 07 46 98 F8 
08000690 = 18 00 01 28 04 BF 02 20 BD E8 F0 81 01 20 88 F8 
080006A0 = 18 00 4C F2 50 30 1E 46 14 46 0D 46 FF F7 44 FF 
080006B0 = 08 BB 02 2F 07 D0 01 2F 0A D0 77 B9 E1 B2 28 46 
080006C0 = FF F7 B8 FE 0E E0 28 46 21 46 FF F7 E5 FE 09 E0 
080006D0 = A1 B2 28 46 FF F7 D0 FE 04 E0 28 46 22 46 33 46 
080006E0 = FF F7 B6 FE 4C F2 50 30 FF F7 26 FF 05 49 0A 68 
080006F0 = 22 F0 01 02 0A 60 00 21 88 F8 18 10 BD E8 F0 81 
08000700 = A4 0A 00 20 10 3C 02 40 06 48 C1 68 B1 F1 FF 3F 
08000710 = C4 BF 00 20 70 47 04 49 01 60 04 49 01 60 C0 68 
08000720 = C0 0F 70 47 04 3C 02 40 23 01 67 45 AB 89 EF CD 
08000730 = 2D E9 F8 4F 94 4A 07 24 90 42 94 4A 08 BF 04 24 
08000740 = 02 44 4F EA B2 23 04 2B 38 BF 4F EA B2 24 90 4A 
08000750 = 00 94 4F F0 00 0A 01 23 0F 24 A2 F5 7E 7B 4F F0 
08000760 = 00 09 00 27 10 2F 08 BF BD E8 F8 8F 03 FA 07 F2 
08000770 = 0A 42 40 D0 0A F0 0C 0C 04 FA 0C F8 BC 08 5B F8 
08000780 = 24 E0 00 9B 0E EA 08 05 03 FA 0C F6 D2 43 B5 42 
08000790 = 13 D1 7F 4B 1D 68 15 40 1D 60 5D 68 15 40 5D 60 
080007A0 = 9D 68 15 40 9D 60 7B 4B 1D 68 15 40 1D 60 5B F8 
080007B0 = 24 50 25 EA 08 05 4B F8 24 50 03 23 05 68 03 FA 
080007C0 = 09 F4 A5 43 05 60 0A F0 1C 05 0F 23 03 FA 05 F5 
080007D0 = 6F F0 03 03 03 EA 57 06 06 44 33 6A AB 43 33 62 
080007E0 = C3 68 A3 43 C3 60 43 68 1A 40 42 60 82 68 01 23 
080007F0 = A2 43 0F 24 82 60 0A F1 04 0A 09 F1 02 09 01 37 
J-Link>mem 0x1fffc000, 8
1FFFC000 = EF AA 10 55 EF AA 10 55 
J-Link>mem 0x1fffc008, 8
1FFFC008 = FF 7F 00 80 FF 7F 00 80 
J-Link>

I found how to unlock the flash of STM32F4 family ( https://wiki.segger.com/images/c/cd/STM32F4_Lock.jlink ) :

J-Link>w4 0x40023C08 0x08192A3B
Writing 08192A3B -> 40023C08
J-Link>w4 0x40023C08 0x4C5D6E7F
Writing 4C5D6E7F -> 40023C08
J-Link>w1 0x40023C15 0xAA
Writing AA -> 40023C15
J-Link>w1 0x40023C14 0x55
Writing 55 -> 40023C14
J-Link>w1 0x40023C14 0xED
Writing ED -> 40023C14
J-Link>

But even after doing it the board is not responding correctly:

J-Link>erase
Erasing device...
Comparing flash   [100%] Done.
Erasing flash     [005%]
****** Error: Failed to erase sectors 0 @ address 0x08000000 (unspecified error)
Failed to erase sectors.

100%] Done.
Verifying flash   [100%] Done.

**************************
WARNING: T-bit of XPSR is 0 but should be 1. Changed to 1.
**************************

J-Link: Flash download: Total time needed: 0.165s (Prepare: 0.098s, Compare: 0.000s, Erase: 0.001s, Program: 0.000s, Verify: 0.000s, Restore: 0.065s)

**************************
WARNING: Core did not halt after single step
**************************

ERROR: Erase returned with error code -5.


J-Link>loadbin nuttx.bin 0
Downloading file [nuttx.bin]...
Comparing flash   [100%] Done.
Erasing flash     [100%] Done.
Programming flash [100%] Done.
Verifying flash   [100%] Done.
Error while programming flash: Programming failed.
J-Link>

At least now the original program that came with the board is not running, the flash was partially formatted I suppose.

Update: after flashing NuttX using DFU I noticed that SWD started to work. So I think the bootloader that guys from WeAct (the company that developed this board) was locking the SWD.

8 thoughts on “Flashing the BlackPill (STM32F411CEU6)

  1. Hi Allan , i use DFU-util to flash STM32F411 BlackPill, i try using micropython and work but i can’t run nuttx in STM32F411 BlackPill

    1. I Welesley, I only saw your message now. Yes, I figure out that STM32F4 has DFU support and used it. But thank you for the suggestion, it could have faced me hours trying SWD.

  2. Thanks Allan for the reply, Please report about some success with Nuttx and STM32F411 BLACK PILL, I have another board that I am trying to use with the Nuttx Devebox STM32H743vit6 .Allan did you add flash memory to the STM32F411? .

  3. Hey Allan, Do you have a RESET PIn connected? I had the same problems, but after using the reset pin all the problems went away.

  4. Hi Mauricio,
    Thank you for suggestion. I didn’t use the reset pin, but after removing the original bootloader from the board now it always works, even without the reset pin. The issue I’m facing now is with DFU mode, it is not entering in DFU mode:

    [26210.876145] usb 1-3: new full-speed USB device number 116 using xhci_hcd
    [26210.876274] usb 1-3: Device not responding to setup address.
    [26211.084285] usb 1-3: Device not responding to setup address.
    [26211.292212] usb 1-3: device not accepting address 116, error -71
    [26211.292325] usb usb1-port3: unable to enumerate USB device

    Welesley also confirmed he see these same issue often.

  5. There is this 2 very useful documents.

    Click to access cd00264379-usb-dfu-protocol-used-in-the-stm32-bootloader-stmicroelectronics.pdf


    Click to access cd00167594-stm32-microcontroller-system-memory-boot-mode-stmicroelectronics.pdf


    As I understood on the MCU side, the DFU mode and bootloader are native. They can’t be changed by the user.
    “The bootloader is stored in the internal boot ROM memory (system memory) of STM32 devices.”, I would guess that you have a driver issue, can you do the same with other boards?
    I would be keen to test your setup here. I have the STM32F411 BlackPill.

    1. Hi Mauricio,
      Yes, the DFU is inside the STM32 internal ROM (not Flash), but the BlackPill comes with a bootloader used by Arduino IDE.
      I thought the issue was on my laptop (I’m using Ubuntu 20.04), but I tested STM32F4Discovery board and it works fine:

      [28225.811424] usb 1-3: new full-speed USB device number 126 using xhci_hcd
      [28225.960660] usb 1-3: New USB device found, idVendor=0483, idProduct=df11, bcdDevice=22.00
      [28225.960665] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
      [28225.960668] usb 1-3: Product: STM32 BOOTLOADER
      [28225.960672] usb 1-3: Manufacturer: STMicroelectronics
      [28225.960674] usb 1-3: SerialNumber: 365439XXXXXX

      So, there are two options: USB Cable issue or Board/STM32F411 issue. I tested with two cables and same issue. After a little bit more searching I found this thread:

      https://github.com/libopencm3/libopencm3/issues/1119

      It appears the STM32F411 USB IP is a little bit different from other STM32 devices. I got the DFU working at least one time on this STM32F411 (as you can see on my recent post), but it is hard to get it working again. We need to inspect the USB communication to discover what is happening.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s