Bypassing ATSAM3X8E (Due) bootloader via Serial Wire Debug (SWD).

Toolchain: ST-LINK/V2 programmer, OpenOCD, ARM GNU Compiler Toolchain.

ARM chips boot into 0x00000. GPNVM bits map one of ROM, flash0, flash1 to 0x00000:

• GPNVM1=0 → ROM (default).
• GPNVM1=1 and GPNVM2=0 → flash0.
• GPNVM1=1 and GPNVM2=1 → flash1.

By default, control jumps to Atmel’s SAM-BA bootloader in ROM. To bypass, set GPNVM1=1 and place vector table at 0x80000 (flash0).

Connect ST-LINK/v2 to Arduino Due’s DEBUG port:

Wiring

Arduino Due

Remap memory:

$ openocd -f openocd-due.cfg
$ telnet localhost 4444
  > halt
  > at91sam3 gpnvm show
  > at91sam3 gpnvm set 1
  > at91sam3 gpnvm show

Full command list is in OpenOCD manual AT91SAM3 (flash driver section).

Compile and upload program:

$ arm-none-eabi-gcc -mcpu=cortex-m3 -mthumb -T script.ld \
    -nostartfiles \
    -nostdlib \
    -o a.elf main.c
$ openocd -f openocd-due.cfg -c "program a.elf verify reset exit"

Commit: 3184969