If the bootloader can jump to any flash address? in other words, if the app address must meet some alignment requirements? My test is it only works when app address offset is multiple of 0x8000, is it right?

[Piranha]

http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0646a/Ciheijba.html

Therefore alignment depends on specific MCU, but it definitely isn't as high as 0x8000 bytes.

[XYZ123]

according to link, it seems should work as long as the app address's least 7 bits are 0.

[Tesla DeLorean]

It is usually a function of the vector table size in a given implementation. Take the last vector and round to the next binary multiple​, on most STM32 likely 512 byte boundaries.

[XYZ123]

thank for your reply. for stm32f303, my app scatter file is

LR_IROM1 0x0800C000 0x00032000 {  ; load region size_region

 ER_IROM1 0x0800C000 0x00032000 { ; load address = execution address

  *.o (RESET, +First)

  *(InRoot$$Sections)

  .ANY (+RO)

  .ANY (+XO)

 }

 RW_IRAM1 0x20000000 0x0000C000 { ; RW data

  .ANY (+RW +ZI)

 }

 RW_IRAM2 0x10000000 UNINIT 0x00002000 {

  mode_keys.o (+RW)

  exception_mem.o (+RW)

 }

}

my bootloader jump process is

        typedef void (*pFunction)(void);

pFunction Jump = (pFunction) (*(uint32_t*)(FLASH_ONCHIP_APP + 4));

        SCB->VTOR = FLASH_ONCHIP_APP;

        __set_MSP(*(uint32_t*)FLASH_ONCHIP_APP);

        Jump();

Why it does not work?

[Tesla DeLorean]

>>Why it does not work?

I don't know, use the debugger, step into the code, across the transition and understand what is actually happening.

Is some downstream code changing SCB->VTOR? Are you calling from interrupt/callback context?

Do you turn off other interrupt sources? SysTick, etc

do you have a Hard Fault Handler, or Error Handler that output useful information?

[XYZ123]

fixed. I forgot set VECT_TAB_OFFSET