jump to another app explanation

[JCuna.1]

I have this code:

void bootloader_jump_to_app(void){
	pFunction Jump;
	uint32_t JumpAddress;
 
	HAL_RCC_DeInit();
	HAL_DeInit();
 
	JumpAddress = *(__IO uint32_t*)(APP_ADDRESS + 4);
	Jump = (pFunction)JumpAddress;
 
	__set_MSP(*(__IO uint32_t*)APP_ADDRESS);
	Jump();
 
	SCB->VTOR = FLASH_BASE | 0x00008000;
}

For me, does not make sense the last line as in theory this is not called after jump application, however, commenting this line make a hard fault handler after jump function execution.

[JCuna.1]

making more testing, I realized that changing the line SCB->VTOR = FLASH_BASE | 0x00008000; for asm("nop"); still making the code work. So problem is related if there is no last line of code in the function.

Here is the asm code:

419 	HAL_RCC_DeInit();
 bootloader_jump_to_app:
080006a8: push {r3, lr}
080006aa: bl 0x800212c <HAL_RCC_DeInit>
420 	HAL_DeInit();
080006ae: bl 0x8001990 <HAL_DeInit>
422 	JumpAddress = *(__IO uint32_t*)(APP_ADDRESS + 4);
080006b2: ldr r3, [pc, #16] ; (0x80006c4 <bootloader_jump_to_app+28>)
080006b4: ldr r2, [pc, #16] ; (0x80006c8 <bootloader_jump_to_app+32>)
080006b6: ldr r3, [r3, #0]
425 	__set_MSP(*(__IO uint32_t*)APP_ADDRESS);
080006b8: ldr r2, [r2, #0]
 333 __ASM volatile ("MSR msp, %0" : : "r" (topOfMainStack) : );
080006ba: msr MSP, r2
426 	Jump();
080006be: blx r3
428 	asm("nop");
080006c0: nop 
080006c2: pop {r3, pc}
080006c4: strh r4, [r0, #0]
080006c6: lsrs r0, r0, #32
080006c8: strh r0, [r0, #0]
080006ca: lsrs r0, r0, #32

and here the asm code, when there is no instruction after jump();

419 	HAL_RCC_DeInit();
 bootloader_jump_to_app:
080006a8: push {r4, lr}
080006aa: bl 0x800212c <HAL_RCC_DeInit>
420 	HAL_DeInit();
080006ae: bl 0x8001990 <HAL_DeInit>
422 	JumpAddress = *(__IO uint32_t*)(APP_ADDRESS + 4);
080006b2: ldr r3, [pc, #16] ; (0x80006c4 <bootloader_jump_to_app+28>)
080006b4: ldr r2, [pc, #16] ; (0x80006c8 <bootloader_jump_to_app+32>)
080006b6: ldr r3, [r3, #0]
425 	__set_MSP(*(__IO uint32_t*)APP_ADDRESS);
080006b8: ldr r2, [r2, #0]
 333 __ASM volatile ("MSR msp, %0" : : "r" (topOfMainStack) : );
080006ba: msr MSP, r2
426 	Jump();
080006be: ldmia.w sp!, {r4, lr}
080006c2: bx r3
080006c4: strh r4, [r0, #0]
080006c6: lsrs r0, r0, #32
080006c8: strh r0, [r0, #0]
080006ca: lsrs r0, r0, #32

[JCuna.1]

Looks like ldmia.w sp!, {r4, lr} is causing the problem. This is making an increment stack pointer after loading process is stack pointer, and in consequence, changing the recent assignation of main stack pointer before to jump to the app. Optimization process (actually using -oS optimization) is adding this instruction. So adding a nop instruction avoid to make this optimizations.

[Piranha]

When changing the stack pointer, software must use an ISB instruction immediately after the MSR instruction. This ensures that instructions after the ISB instruction execute using the new stack pointer. See ISB

https://developer.arm.com/documentation/dui0552/a/the-cortex-m3-processor/programmers-model/core-registers

If the program updates the value of the VTOR, use a DSB instruction to ensure that the new vector table is used for subsequent exceptions.

https://developer.arm.com/documentation/dui0662/b/The-Cortex-M0--Processor/Memory-model/Software-ordering-of-memory-accesses