Secret beneath DA14585 second bootloader

Secret beneath DA14585 second bootloader

LR_1 0x07FC0000 0x00008000 {    ; load region size_region
    ER_1 +0 0x00002000 {        ; load address = execution address
        *.o (RESET, +First)
        *(InRoot$$Sections)
        startup_CMSDK_CM0.o
        system_CMSDK.o
    }

    ER_2 0x07FD6000 0x2000 {    ; push it to the end of SysRAM
        .ANY (+RO)
        .ANY (+RW +ZI)
        .ANY (STACK)
    }
}

We can see from the second bootloader’s link file, arch specific object, such as RESET, startup_CMSDK_CM0 and system_CMSDK were scatter loaded at 0x07FC0000 which was the start address of the System RAM. And the left object was scatter loaded at the end of System RAM, this arrangement is important for bootloader.

And below is what DA14585’s second bootloader do:

1. After power up, the first bootloader which stored in ROM will start to execute, this first bootloader will load second bootloader from Flash into SysRam at 0x07FC0000, and because of second bootloader’s link file, second bootloader will be scatter loaded in 2 different region.

2. Now, Cortex M0 will map 0x07FC0000 to 0x00000000, then the second bootloader starts to execute, it will load user image from Flash to SysRam at 0x07FC0000, because of user image’s is small, no overwrite happen, so second bootloader is safe while load user image.

3. After correctly loaded user image, bootloader will config system boot from SysRam, then trigger reboot.