0x0BF97000 (system bootloader base per AN2606): the jump appears to succeed (In Debug reaches the bootloader region), but execution then breaks at an address inside the bootloader ROM with no further progress and no USB enumeration. The hardware boot path works correctly. The problem is purely on the software-jump path.
I created an empty project in sample you can download and test it. I also attached my option bytes (i think everything is default).
MCU: STM32H573 (also tested h523)
I created an empty project in sample you can download and test it. I also attached my option bytes (i think everything is default).
MCU: STM32H573 (also tested h523)
/**
******************************************************************************
* @file dfu_jump.c
* @author Uğur Tümer
* @brief See dfu_jump.h. Implements the magic-word + soft-reset path into
* the STM32H523 system bootloader (USB DFU on PA11/PA12).
******************************************************************************
*/
#include "dfu_jump.h"
/** Magic word stored in TAMP_BKP0R between the request and the next boot. */
#define DFU_JUMP_MAGIC 0xDEADB007UL
#define BOOTLOADER_BASE_ADDR 0x0BF97000
static void enable_backup_access(void)
{
__HAL_RCC_RTC_CLK_ENABLE();
HAL_PWR_EnableBkUpAccess();
}
void dfu_jump_request(void)
{
enable_backup_access();
TAMP->BKP0R = DFU_JUMP_MAGIC;
__DSB();
__ISB();
NVIC_SystemReset();
}
void dfu_jump_check_and_run(void)
{
enable_backup_access();
if (TAMP->BKP0R != DFU_JUMP_MAGIC)
{
return;
}
TAMP->BKP0R = 0U;
__disable_irq();
for (uint16_t i = 0; i < sizeof(NVIC->ICER) / sizeof(NVIC->ICER[0]); ++i)
{
NVIC->ICER[i] = 0xFFFFFFFF;
NVIC->ICPR[i] = 0xFFFFFFFF;
}
__DSB();
__ISB();
SysTick->CTRL = 0U;
SysTick->LOAD = 0U;
SysTick->VAL = 0U;
__enable_irq();
(void)HAL_RCC_DeInit();
(void)HAL_DeInit();
SCB->VTOR = BOOTLOADER_BASE_ADDR;
uint32_t bootloader_msp = *(volatile uint32_t *)(BOOTLOADER_BASE_ADDR);
uint32_t bootloader_entry = *(volatile uint32_t *)(BOOTLOADER_BASE_ADDR + 4U);
__set_MSP(bootloader_msp);
void (*const sys_boot)(void) = (void (*)(void))bootloader_entry;
sys_boot();
while (1)
{
__NOP();
}
}int main(void)
{
/* USER CODE BEGIN 1 */
/* USER CODE END 1 */
/* MCU Configuration--------------------------------------------------------*/
/* MPU Configuration--------------------------------------------------------*/
MPU_Config();
/* Reset of all peripherals, Initializes the Flash interface and the Systick. */
HAL_Init();
/* USER CODE BEGIN Init */
dfu_jump_check_and_run();
dfu_jump_request();
/* USER CODE END Init */
/* Configure the system clock */
SystemClock_Config();
/* USER CODE BEGIN SysInit */
/* USER CODE END SysInit */
/* Initialize all configured peripherals */
MX_ICACHE_Init();
/* USER CODE BEGIN 2 */
/* USER CODE END 2 */
/* Infinite loop */
/* USER CODE BEGIN WHILE */
while (1)
{
/* USER CODE END WHILE */
/* USER CODE BEGIN 3 */
}
/* USER CODE END 3 */
}
Hi @mƎALLEm, thank you for your reply.
I already checked and tested this code, it didn't work in STM32H573I-DK. same error with my code
'Break at address "0xbf9ede0" with no debug information available, or outside of program code.'
/* USER CODE BEGIN Header */
/**
******************************************************************************
* @file : main.c
* @brief : Main program body
******************************************************************************
* @attention
*
* Copyright (c) 2026 STMicroelectronics.
* All rights reserved.
*
* This software is licensed under terms that can be found in the LICENSE file
* in the root directory of this software component.
* If no LICENSE file comes with this software, it is provided AS-IS.
*
******************************************************************************
*/
/* USER CODE END Header */
/* Includes ------------------------------------------------------------------*/
#include "main.h"
/* Private includes ----------------------------------------------------------*/
/* USER CODE BEGIN Includes */
/* USER CODE END Includes */
/* Private typedef -----------------------------------------------------------*/
/* USER CODE BEGIN PTD */
/* USER CODE END PTD */
/* Private define ------------------------------------------------------------*/
/* USER CODE BEGIN PD */
enum{C0, F030x8, F030xC, F03xx, F05, F07, F09, F10xx, F105, F107, F10XL, F2, F3, F4, F7, G0, G4, H503, H563, H573, H7x, H7A, H7B, L0, L1, L4, L5, WBA, WBX, WL, U5};
#define MCU H573 //Define here the MCU being used
/* USER CODE END PD */
/* Private macro -------------------------------------------------------------*/
/* USER CODE BEGIN PM */
/* USER CODE END PM */
/* Private variables ---------------------------------------------------------*/
/* USER CODE BEGIN PV */
/* USER CODE END PV */
/* Private function prototypes -----------------------------------------------*/
void SystemClock_Config(void);
static void MPU_Config(void);
static void MX_ICACHE_Init(void);
/* USER CODE BEGIN PFP */
void JumpToBootloader(void);
/* USER CODE END PFP */
/* Private user code ---------------------------------------------------------*/
/* USER CODE BEGIN 0 */
/* USER CODE END 0 */
/**
* @brief The application entry point.
* @retval int
*/
int main(void)
{
/* USER CODE BEGIN 1 */
/* USER CODE END 1 */
/* MCU Configuration--------------------------------------------------------*/
/* MPU Configuration--------------------------------------------------------*/
MPU_Config();
/* Reset of all peripherals, Initializes the Flash interface and the Systick. */
HAL_Init();
/* USER CODE BEGIN Init */
/* USER CODE END Init */
/* Configure the system clock */
SystemClock_Config();
/* USER CODE BEGIN SysInit */
/* USER CODE END SysInit */
/* Initialize all configured peripherals */
MX_ICACHE_Init();
/* USER CODE BEGIN 2 */
/* USER CODE END 2 */
/* Infinite loop */
/* USER CODE BEGIN WHILE */
while (1)
{
/* USER CODE END WHILE */
/* USER CODE BEGIN 3 */
HAL_Delay(1000);
JumpToBootloader();
}
/* USER CODE END 3 */
}
/**
* @brief System Clock Configuration
* @retval None
*/
void SystemClock_Config(void)
{
RCC_OscInitTypeDef RCC_OscInitStruct = {0};
RCC_ClkInitTypeDef RCC_ClkInitStruct = {0};
/** Configure the main internal regulator output voltage
*/
__HAL_PWR_VOLTAGESCALING_CONFIG(PWR_REGULATOR_VOLTAGE_SCALE3);
while(!__HAL_PWR_GET_FLAG(PWR_FLAG_VOSRDY)) {}
/** Initializes the RCC Oscillators according to the specified parameters
* in the RCC_OscInitTypeDef structure.
*/
RCC_OscInitStruct.OscillatorType = RCC_OSCILLATORTYPE_HSI;
RCC_OscInitStruct.HSIState = RCC_HSI_ON;
RCC_OscInitStruct.HSIDiv = RCC_HSI_DIV2;
RCC_OscInitStruct.HSICalibrationValue = RCC_HSICALIBRATION_DEFAULT;
RCC_OscInitStruct.PLL.PLLState = RCC_PLL_NONE;
if (HAL_RCC_OscConfig(&RCC_OscInitStruct) != HAL_OK)
{
Error_Handler();
}
/** Initializes the CPU, AHB and APB buses clocks
*/
RCC_ClkInitStruct.ClockType = RCC_CLOCKTYPE_HCLK|RCC_CLOCKTYPE_SYSCLK
|RCC_CLOCKTYPE_PCLK1|RCC_CLOCKTYPE_PCLK2
|RCC_CLOCKTYPE_PCLK3;
RCC_ClkInitStruct.SYSCLKSource = RCC_SYSCLKSOURCE_HSI;
RCC_ClkInitStruct.AHBCLKDivider = RCC_SYSCLK_DIV1;
RCC_ClkInitStruct.APB1CLKDivider = RCC_HCLK_DIV1;
RCC_ClkInitStruct.APB2CLKDivider = RCC_HCLK_DIV1;
RCC_ClkInitStruct.APB3CLKDivider = RCC_HCLK_DIV1;
if (HAL_RCC_ClockConfig(&RCC_ClkInitStruct, FLASH_LATENCY_1) != HAL_OK)
{
Error_Handler();
}
/** Configure the programming delay
*/
__HAL_FLASH_SET_PROGRAM_DELAY(FLASH_PROGRAMMING_DELAY_0);
}
/**
* @brief ICACHE Initialization Function
* @PAram None
* @retval None
*/
static void MX_ICACHE_Init(void)
{
/* USER CODE BEGIN ICACHE_Init 0 */
/* USER CODE END ICACHE_Init 0 */
/* USER CODE BEGIN ICACHE_Init 1 */
/* USER CODE END ICACHE_Init 1 */
/** Enable instruction cache in 1-way (direct mapped cache)
*/
if (HAL_ICACHE_ConfigAssociativityMode(ICACHE_1WAY) != HAL_OK)
{
Error_Handler();
}
if (HAL_ICACHE_Enable() != HAL_OK)
{
Error_Handler();
}
/* USER CODE BEGIN ICACHE_Init 2 */
/* USER CODE END ICACHE_Init 2 */
}
/* USER CODE BEGIN 4 */
void JumpToBootloader (void)
{
uint32_t i=0;
void (*SysMemBootJump)(void);
/* Set a vector addressed with STM32 Microcontrollers names */
/* Each vector position contains an address to the boot loader entry point */
volatile uint32_t BootAddr[33];
BootAddr[C0] = 0x1FFF0000;
BootAddr[F030x8] = 0x1FFFEC00;
BootAddr[F030xC] = 0x1FFFD800;
BootAddr[F03xx] = 0x1FFFEC00;
BootAddr[F05] = 0x1FFFEC00;
BootAddr[F07] = 0x1FFFC800;
BootAddr[F09] = 0x1FFFD800;
BootAddr[F10xx] = 0x1FFFF000;
BootAddr[F105] = 0x1FFFB000;
BootAddr[F107] = 0x1FFFB000;
BootAddr[F10XL] = 0x1FFFE000;
BootAddr[F2] = 0x1FFF0000;
BootAddr[F3] = 0x1FFFD800;
BootAddr[F4] = 0x1FFF0000;
BootAddr[F7] = 0x1FF00000;
BootAddr[G0] = 0x1FFF0000;
BootAddr[G4] = 0x1FFF0000;
BootAddr[H503] = 0x0BF87000;
BootAddr[H563] = 0x0BF97000;
BootAddr[H573] = 0x0BF97000;
BootAddr[H7x] = 0x1FF09800;
BootAddr[H7A] = 0x1FF0A800;
BootAddr[H7B] = 0x1FF0A000;
BootAddr[L0] = 0x1FF00000;
BootAddr[L1] = 0x1FF00000;
BootAddr[L4] = 0x1FFF0000;
BootAddr[L5] = 0x0BF90000;
BootAddr[WBA] = 0x0BF88000;
BootAddr[WBX] = 0x1FFF0000;
BootAddr[WL] = 0x1FFF0000;
BootAddr[U5] = 0x0BF90000;
/* Disable all interrupts */
__disable_irq();
/* Disable Systick timer */
SysTick->CTRL = 0;
/* Set the clock to the default state */
HAL_RCC_DeInit();
/* Clear Interrupt Enable Register & Interrupt Pending Register */
for (i=0;i<5;i++)
{
NVIC->ICER[i]=0xFFFFFFFF;
NVIC->ICPR[i]=0xFFFFFFFF;
}
/* Re-enable all interrupts */
__enable_irq();
/* Set up the jump to boot loader address + 4 */
SysMemBootJump = (void (*)(void)) (*((uint32_t *) ((BootAddr[MCU] + 4))));
/* Set the main stack pointer to the boot loader stack */
__set_MSP(*(uint32_t *)BootAddr[MCU]);
/* Call the function to jump to boot loader location */
SysMemBootJump();
/* Jump is done successfully */
while (1)
{
/* Code should never reach this loop */
}
}
/* USER CODE END 4 */
/* MPU Configuration */
void MPU_Config(void)
{
MPU_Region_InitTypeDef MPU_InitStruct = {0};
MPU_Attributes_InitTypeDef MPU_AttributesInit = {0};
/* Disables the MPU */
HAL_MPU_Disable();
/** Initializes and configures the Region 0 and the memory to be protected
*/
MPU_InitStruct.Enable = MPU_REGION_ENABLE;
MPU_InitStruct.Number = MPU_REGION_NUMBER0;
MPU_InitStruct.BaseAddress = 0x08FFF000;
MPU_InitStruct.LimitAddress = 0x08FFFFFF;
MPU_InitStruct.AttributesIndex = MPU_ATTRIBUTES_NUMBER0;
MPU_InitStruct.AccessPermission = MPU_REGION_ALL_RO;
MPU_InitStruct.DisableExec = MPU_INSTRUCTION_ACCESS_DISABLE;
MPU_InitStruct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
HAL_MPU_ConfigRegion(&MPU_InitStruct);
/** Initializes and configures the Attribute 0 and the memory to be protected
*/
MPU_AttributesInit.Number = MPU_ATTRIBUTES_NUMBER0;
MPU_AttributesInit.Attributes = INNER_OUTER(MPU_NOT_CACHEABLE);
HAL_MPU_ConfigMemoryAttributes(&MPU_AttributesInit);
/* Enables the MPU */
HAL_MPU_Enable(MPU_PRIVILEGED_DEFAULT);
}
/**
* @brief This function is executed in case of error occurrence.
* @retval None
*/
void Error_Handler(void)
{
/* USER CODE BEGIN Error_Handler_Debug */
/* User can add his own implementation to report the HAL error return state */
__disable_irq();
while (1)
{
}
/* USER CODE END Error_Handler_Debug */
}
#ifdef USE_FULL_ASSERT
/**
* @brief Reports the name of the source file and the source line number
* where the assert_param error has occurred.
* @PAram file: pointer to the source file name
* @PAram line: assert_param error line source number
* @retval None
*/
void assert_failed(uint8_t *file, uint32_t line)
{
/* USER CODE BEGIN 6 */
/* User can add his own implementation to report the file name and line number,
ex: printf("Wrong parameters value: file %s on line %d\r\n", file, line) */
/* USER CODE END 6 */
}
#endif /* USE_FULL_ASSERT */
