boardloader: check reset flags for production

embed/boardloader/lowlevel.c

@@ -76,7 +76,20 @@ void periph_init(void)
     HAL_PWR_ConfigPVD(&pvd_config);
     HAL_PWR_EnablePVD();
     NVIC_EnableIRQ(PVD_IRQn);
-
-    // Clear the reset flags
-    RCC->CSR |= RCC_CSR_RMVF;
+}
+
+bool reset_flags_init(void)
+{
+#if PRODUCTION
+    // this is effective enough that it makes development painful, so only use it for production.
+    // check the reset flags to assure that we arrive here due to a regular full power-on event,
+    // and not as a result of a lesser reset.
+    if ((RCC->CSR & (RCC_CSR_LPWRRSTF | RCC_CSR_WWDGRSTF | RCC_CSR_IWDGRSTF | RCC_CSR_SFTRSTF | RCC_CSR_PORRSTF | RCC_CSR_PINRSTF | RCC_CSR_BORRSTF)) != (RCC_CSR_PORRSTF | RCC_CSR_PINRSTF | RCC_CSR_BORRSTF)) {
+        return false;
+    }
+#endif
+
+    RCC->CSR |= RCC_CSR_RMVF; // clear the reset flags
+
+    return true;
 }

embed/boardloader/lowlevel.h

@@ -6,5 +6,6 @@
 void flash_set_option_bytes(void);
 bool flash_check_option_bytes(void);
 void periph_init(void);
+bool reset_flags_init(void);
 
 #endif

embed/boardloader/main.c

@@ -151,6 +151,10 @@ int main(void)
 {
     periph_init(); // need the systick timer running before the production flash (and many other HAL) operations
 
+    if (!reset_flags_init()) {
+        return 1;
+    }
+
 #if PRODUCTION
     flash_set_option_bytes();
     if (!flash_check_option_bytes()) {

embed/boardloader/startup.s

@@ -55,7 +55,6 @@ reset_handler:
   // enter the application code
   bl main
 
-  // loop forever if the application code returns
-  b .
+  b shutdown
 
   .end