CMSIS Part 16: Bootloaders & Firmware Updates

Application at a Fixed Offset

VTOR Relocation — Linker Script Changes

When the bootloader occupies the first N KB of flash, the application must be linked to start at flash base + N. This requires both a linker script change in the application project and a VTOR relocation at startup. The application's linker script must match the flash origin the bootloader will jump to.

# Application linker script — adjust FLASH origin to skip bootloader
# Bootloader occupies 0x08000000 – 0x0803FFFF (256 KB)
# Application starts at 0x08040000

MEMORY
{
  FLASH (rx)  : ORIGIN = 0x08040000, LENGTH = 1792K   /* 2M - 256K bootloader */
  DTCMRAM (xrw) : ORIGIN = 0x20000000, LENGTH = 128K
  RAM (xrw)     : ORIGIN = 0x24000000, LENGTH = 512K
}

SECTIONS
{
  .isr_vector :
  {
    . = ALIGN(4);
    KEEP(*(.isr_vector))
    . = ALIGN(4);
  } > FLASH
  /* ... rest of sections ... */
}

Application Startup: Relocating VTOR

The application's own startup code (Reset_Handler) must relocate VTOR to match its actual load address. When the bootloader writes SCB->VTOR = APP_BASE, interrupts will vector correctly. But the application's startup code should also confirm this at boot so it can be debugged independently without a bootloader.

/**
 * Application Reset_Handler — called by bootloader jump.
 * Relocate VTOR, initialise data/BSS, then call main().
 * This is normally in startup_stm32h7xx.s — shown here as C pseudocode.
 */
#include "stm32h7xx.h"

extern uint32_t _sidata, _sdata, _edata, _sbss, _ebss;

void Reset_Handler(void)
{
    /* Relocate VTOR to application base (bootloader already did this,
     * but do it here too for standalone debugging without bootloader) */
    SCB->VTOR = 0x08040000u;
    __DSB();

    /* Initialise .data section — copy from Flash to SRAM */
    uint32_t *src = &_sidata;
    for (uint32_t *dst = &_sdata; dst < &_edata; ) {
        *dst++ = *src++;
    }

    /* Zero-fill .bss section */
    for (uint32_t *bss = &_sbss; bss < &_ebss; ) {
        *bss++ = 0u;
    }

    /* Call platform init (SystemInit) then main */
    SystemInit();
    main();

    /* Should never return */
    for (;;) { __NOP(); }
}

Dual-Bank Flash & A/B Update Strategy

Dual-bank flash is the gold standard for fail-safe firmware updates. The MCU's flash is divided into Bank A (currently executing) and Bank B (receives the new image). Programming Bank B never interrupts execution in Bank A. Once Bank B is verified, a hardware bank-swap register setting causes Bank B to appear at address 0 on next reset — becoming the new Bank A.

Dual-Bank Flash Swap — STM32H743

/**
 * Dual-bank flash swap on STM32H743.
 *
 * Flash layout (2 MB):
 *   Bank A: 0x08000000 – 0x080FFFFF (1 MB) — bootloader + current app
 *   Bank B: 0x08100000 – 0x081FFFFF (1 MB) — receives new firmware
 *
 * After programming Bank B and verifying its CRC:
 *   1. Unlock FLASH option bytes
 *   2. Set SWAP_BANK bit in OPTSR_PRG
 *   3. Trigger option byte reload (OPTSTRT)
 *   4. On next reset, Bank B appears at 0x08000000 — becomes new Bank A
 */
#include "stm32h7xx.h"
#include "stm32h7xx_hal_flash.h"
#include "stm32h7xx_hal_flash_ex.h"

#define BANK_B_BASE    0x08100000u   /* Bank B start */
#define BANK_B_SIZE    0x00100000u   /* 1 MB */

/* Write a page of firmware to Bank B */
int32_t write_firmware_page(uint32_t dest_offset, const uint32_t *src,
                             uint32_t word_count)
{
    HAL_FLASH_Unlock();

    for (uint32_t i = 0u; i < word_count; i += 8u) {
        /* STM32H7 flash program unit is 256 bits (8 x 32-bit words) */
        uint32_t dest_addr = BANK_B_BASE + dest_offset + (i * 4u);
        HAL_StatusTypeDef st = HAL_FLASH_Program(
            FLASH_TYPEPROGRAM_FLASHWORD,
            dest_addr,
            (uint32_t)(src + i));
        if (st != HAL_OK) {
            HAL_FLASH_Lock();
            return -1;
        }
    }

    HAL_FLASH_Lock();
    return 0;
}

/* Trigger bank swap after successful verification */
int32_t trigger_bank_swap(void)
{
    FLASH_OBProgramInitTypeDef ob_cfg = {0};

    /* Read current option bytes */
    HAL_FLASHEx_OBGetConfig(&ob_cfg);

    /* Toggle SWAP_BANK */
    ob_cfg.OptionType = OPTIONBYTE_USER;
    ob_cfg.USERType   = OB_USER_SWAP_BANK;

    if (ob_cfg.USERConfig & OB_SWAP_BANK_ENABLE) {
        ob_cfg.USERConfig = OB_SWAP_BANK_DISABLE;
    } else {
        ob_cfg.USERConfig = OB_SWAP_BANK_ENABLE;
    }

    HAL_FLASH_OB_Unlock();
    HAL_StatusTypeDef st = HAL_FLASHEx_OBProgram(&ob_cfg);
    if (st != HAL_OK) {
        HAL_FLASH_OB_Lock();
        return -1;
    }

    /* Launch option byte reload — this triggers a system reset */
    HAL_FLASH_OB_Launch();

    /* Should not reach here — system resets */
    for (;;) {}
}

Rollback on Boot Failure

After a bank swap, the new firmware must "confirm" itself as good within a watchdog timeout. If the application fails to set a "confirmed" flag within N seconds, the watchdog resets the device and the bootloader rolls back to the previous bank.

/* Bootloader: check if new firmware confirmed itself */
#define CONFIRMED_MAGIC  0x600DF00Du
#define BOOT_TRIES_MAX   3u

static void check_and_rollback(void)
{
    uint32_t confirmed = RTC->BKP2R;
    uint32_t tries     = RTC->BKP3R;

    if (confirmed == CONFIRMED_MAGIC) {
        /* Application confirmed — reset try counter */
        RTC->BKP3R = 0u;
        return;  /* proceed to boot application */
    }

    /* Application did not confirm — count failed attempts */
    tries++;
    RTC->BKP3R = tries;

    if (tries >= BOOT_TRIES_MAX) {
        /* Roll back: swap banks back to last known good */
        RTC->BKP3R = 0u;
        trigger_bank_swap();  /* resets system with previous bank */
    }
}

/* Called from application after successful initialisation */
void firmware_confirm(void)
{
    HAL_PWR_EnableBkUpAccess();
    RTC->BKP2R = CONFIRMED_MAGIC;
    RTC->BKP3R = 0u;
}

OTA Transport Protocols

UART XMODEM Receive — Simplified Implementation

XMODEM is the simplest reliable protocol for firmware transfer over UART. It divides the file into 128-byte blocks, each with a simple checksum, and provides basic error recovery. Despite its age (1977), it remains practical for factory programming and debug-port updates.

/**
 * Simplified XMODEM receive — for firmware update over UART.
 * Full XMODEM-CRC (with 16-bit CRC instead of checksum) is recommended
 * for production; this shows the core protocol structure.
 *
 * Protocol:
 *   Receiver: sends 'C' to request CRC mode (or NAK for checksum mode)
 *   Sender:   replies with 128-byte blocks:
 *             SOH | block_num | ~block_num | 128 bytes data | CRC16_hi | CRC16_lo
 *   Receiver: sends ACK after each valid block, NAK for retry, CAN to abort
 */
#include "stm32h7xx.h"
#include "stm32h7xx_hal.h"

#define SOH   0x01u
#define EOT   0x04u
#define ACK   0x06u
#define NAK   0x15u
#define CAN   0x18u
#define XMODEM_BLOCK_SIZE  128u
#define XMODEM_TIMEOUT_MS  3000u

extern UART_HandleTypeDef huart1;

static uint8_t xmodem_buf[XMODEM_BLOCK_SIZE + 5u];  /* SOH+BLK+~BLK+DATA+CRC */

/* CRC16-CCITT */
static uint16_t crc16(const uint8_t *buf, uint32_t len)
{
    uint16_t crc = 0u;
    for (uint32_t i = 0u; i < len; i++) {
        crc ^= (uint16_t)buf[i] << 8u;
        for (uint8_t j = 0u; j < 8u; j++) {
            crc = (crc & 0x8000u) ? ((crc << 1u) ^ 0x1021u) : (crc << 1u);
        }
    }
    return crc;
}

static void uart_send_byte(uint8_t b)
{
    HAL_UART_Transmit(&huart1, &b, 1u, 100u);
}

static int32_t uart_recv_byte(uint8_t *b, uint32_t timeout_ms)
{
    return (HAL_UART_Receive(&huart1, b, 1u, timeout_ms) == HAL_OK) ? 0 : -1;
}

/**
 * xmodem_receive() — receive a firmware image over UART XMODEM-CRC.
 * Writes each verified block to flash at dest_base + (block_num-1)*128.
 * Returns total bytes received, or -1 on error.
 */
int32_t xmodem_receive(uint32_t dest_base)
{
    uint8_t  b       = 0u;
    uint8_t  blk_exp = 1u;
    uint32_t total   = 0u;
    uint32_t retries = 0u;

    /* Request CRC mode */
    uart_send_byte('C');

    for (;;) {
        if (uart_recv_byte(&b, XMODEM_TIMEOUT_MS) != 0) {
            if (++retries > 10u) return -1;
            uart_send_byte('C');
            continue;
        }

        if (b == EOT) {
            uart_send_byte(ACK);
            return (int32_t)total;
        }

        if (b != SOH) {
            uart_send_byte(NAK);
            continue;
        }

        /* Read rest of block: BLK + ~BLK + 128 data bytes + CRC16 (2 bytes) */
        if (HAL_UART_Receive(&huart1, xmodem_buf, 4u + XMODEM_BLOCK_SIZE,
                              XMODEM_TIMEOUT_MS) != HAL_OK) {
            uart_send_byte(NAK);
            continue;
        }

        uint8_t blk  = xmodem_buf[0];
        uint8_t nblk = xmodem_buf[1];

        /* Validate block number */
        if ((uint8_t)(blk + nblk) != 0xFFu || blk != blk_exp) {
            uart_send_byte(NAK);
            continue;
        }

        /* Validate CRC16 */
        uint16_t rx_crc   = ((uint16_t)xmodem_buf[2 + XMODEM_BLOCK_SIZE] << 8u)
                           | xmodem_buf[3 + XMODEM_BLOCK_SIZE];
        uint16_t calc_crc = crc16(xmodem_buf + 2u, XMODEM_BLOCK_SIZE);

        if (rx_crc != calc_crc) {
            uart_send_byte(NAK);
            continue;
        }

        /* Write 128 bytes to flash */
        uint32_t dest = dest_base + ((blk_exp - 1u) * XMODEM_BLOCK_SIZE);
        if (flash_write_block(dest, xmodem_buf + 2u, XMODEM_BLOCK_SIZE) != 0) {
            uart_send_byte(CAN);
            return -1;
        }

        total  += XMODEM_BLOCK_SIZE;
        blk_exp = (blk_exp == 255u) ? 0u : blk_exp + 1u;
        retries = 0u;
        uart_send_byte(ACK);
    }
}

OTA Transport Comparison

CRC32 & Signature Verification

Hardware CRC32 Using CMSIS

CRC32 provides basic integrity verification — detecting accidental corruption but not intentional tampering. STM32 devices include a hardware CRC peripheral that computes CRC32 in hardware, significantly faster than a software implementation. The firmware image is typically padded with its own CRC32 value appended at a known offset (or in a trailer structure).

/**
 * Hardware CRC32 verification using STM32 CRC peripheral.
 * STM32 CRC peripheral uses polynomial 0x04C11DB7 (CRC32/MPEG-2).
 *
 * Image layout:
 *   [Application code and data — N bytes]
 *   [CRC32 value — 4 bytes at APP_BASE + APP_SIZE - 4]
 */
#include "stm32h7xx.h"
#include "stm32h7xx_hal_crc.h"

extern CRC_HandleTypeDef hcrc;

#define APP_BASE  0x08040000u
#define APP_SIZE  0x00040000u   /* 256 KB application area */

int32_t verify_application_crc(void)
{
    /* CRC32 is stored in the last 4 bytes of the application area */
    const uint32_t *app_data   = (const uint32_t *)APP_BASE;
    uint32_t        word_count = (APP_SIZE - 4u) / 4u;
    uint32_t        stored_crc = *(volatile uint32_t *)(APP_BASE + APP_SIZE - 4u);

    /* Reset CRC peripheral */
    __HAL_RCC_CRC_CLK_ENABLE();
    __HAL_CRC_DR_RESET(&hcrc);

    /* Compute CRC32 over the application (excluding the stored CRC word) */
    uint32_t computed_crc = HAL_CRC_Calculate(&hcrc,
                                               (uint32_t *)app_data,
                                               word_count);

    return (computed_crc == stored_crc) ? 0 : -1;
}

ECDSA-P256 Signature Verification with mbedTLS

CRC32 catches accidental corruption but does not protect against malicious firmware. For production products, ECDSA-P256 or Ed25519 signature verification ensures only firmware signed with your private key (kept securely off-device) can run on your hardware.

/**
 * Ed25519 signature verification using mbedTLS (standalone, no PSA).
 * The firmware image is signed offline:
 *   openssl genpkey -algorithm ed25519 -out private.pem
 *   openssl pkey -in private.pem -pubout -out public.pem
 *   python3 sign_image.py firmware.bin private.pem firmware_signed.bin
 *
 * Signed image layout:
 *   [Original firmware — N bytes]
 *   [Ed25519 signature — 64 bytes appended as TLV or at fixed offset]
 */
#include "mbedtls/eddsa.h"
#include "mbedtls/sha512.h"

/* Ed25519 public key — embedded in bootloader at manufacture */
static const uint8_t boot_public_key[32] = {
    /* 32-byte Ed25519 public key — replace with actual key */
    0xAB, 0xCD, 0xEF, 0x01, /* ... 28 more bytes ... */
};

int32_t verify_image_signature(const uint8_t *image, uint32_t image_len,
                                 const uint8_t *sig, uint32_t sig_len)
{
    if (sig_len != 64u) return -1;  /* Ed25519 signature is always 64 bytes */

    mbedtls_eddsa_context ctx;
    mbedtls_eddsa_init(&ctx);

    /* Load the Ed25519 public key */
    int rc = mbedtls_eddsa_read_public(&ctx, boot_public_key,
                                        sizeof(boot_public_key));
    if (rc != 0) {
        mbedtls_eddsa_free(&ctx);
        return -2;
    }

    /* Verify signature over the image (Ed25519 signs the message directly,
     * no pre-hashing required — the hash is internal to Ed25519) */
    rc = mbedtls_eddsa_verify(&ctx, image, image_len, sig);

    mbedtls_eddsa_free(&ctx);
    return (rc == 0) ? 0 : -3;
}

MCUboot Integration

MCUboot (originally from the Mynewt RTOS project, now widely adopted) is an open-source, standards-based secure bootloader. It handles the entire update lifecycle: image verification, slot management, A/B swap, rollback, and encrypted images. Rather than building a bootloader from scratch, professional products should seriously consider MCUboot — it has been audited, is PSA-aligned, and is supported by Zephyr, TF-M, NXP MCUXpresso, and ST's STM32Cube ecosystem.

MCUboot Slot Layout & Image Header

/**
 * MCUboot image header structure (simplified from bootutil/image.h).
 * The imgtool utility (Python) prepends this header and appends TLV metadata
 * when signing a firmware image.
 *
 * Usage:
 *   pip install imgtool
 *   imgtool sign \
 *       --key ed25519.pem \
 *       --header-size 0x200 \
 *       --align 8 \
 *       --version 1.2.0+0 \
 *       --slot-size 0x80000 \
 *       firmware.bin firmware_signed.bin
 */
#include <stdint.h>

#define IMAGE_MAGIC  0x96F3B83Du

typedef struct {
    uint32_t ih_magic;            /* IMAGE_MAGIC */
    uint32_t ih_load_addr;        /* load address (0 = slot-relative) */
    uint16_t ih_hdr_size;         /* size of this header (must be power of 2) */
    uint16_t ih_protect_tlv_size; /* size of protected TLV area */
    uint32_t ih_img_size;         /* image body size in bytes */
    uint32_t ih_flags;            /* IMAGE_F_* flags */
    struct {
        uint8_t iv_major;
        uint8_t iv_minor;
        uint16_t iv_revision;
        uint32_t iv_build_num;
    } ih_ver;                     /* image version */
    uint32_t _pad1;
} image_header_t;

/* MCUboot slot layout — configured in mcuboot/boot/zephyr/mcuboot.conf:
 *
 * Slot layout for STM32H743 (2 MB flash):
 *   0x08000000 – 0x0801FFFF  MCUboot bootloader   (128 KB)
 *   0x08020000 – 0x0809FFFF  Primary slot (Slot 0) (512 KB) — active image
 *   0x080A0000 – 0x0811FFFF  Secondary slot (Slot 1) (512 KB) — update image
 *   0x08120000 – 0x0813FFFF  Scratch area           (128 KB) — swap scratch
 *   0x08140000 – 0x081FFFFF  Application data / KVS (768 KB)
 */

MCUboot Configuration Essentials

# mcuboot/boot/zephyr/prj.conf (Zephyr-based MCUboot configuration)
# Or equivalent KConfig for other platforms

# Enable Ed25519 signature verification
CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y

# Enable encrypted images (optional — adds AES-128 CTR encryption)
# CONFIG_BOOT_ENCRYPT_EC256=y

# Swap mode: overwrite (fast, no rollback) or swap-move (fail-safe rollback)
CONFIG_BOOT_SWAP_USING_MOVE=y

# Anti-rollback protection using security counter in OTP
CONFIG_MCUBOOT_DOWNGRADE_PREVENTION=y
CONFIG_MCUBOOT_HW_ROLLBACK_PROT=y

# Enable serial recovery (UART update port) as fallback
CONFIG_MCUBOOT_SERIAL=y
CONFIG_BOOT_SERIAL_UART=y

# Flash driver configuration
CONFIG_FLASH=y
CONFIG_BOOT_MAX_IMG_SECTORS=256

Exercises

Bootloader Design Planner

Use this tool to document your bootloader architecture — flash bank layout, OTA transport, verification strategy, and fail-safe design. Download as Word, Excel, PDF, or PPTX for design review documentation.

Conclusion & Next Steps

A professional bootloader is one of the most consequential pieces of firmware you will ever write. In this part we covered the complete picture:

• Bootloader fundamentals: the three responsibilities of a bootloader, the update flag pattern using RTC backup registers, and the decision table for single-bank vs dual-bank vs MCUboot strategies.
• Application offset and VTOR: correctly linking the application at its flash offset, the VTOR relocation sequence, and the step-by-step jump procedure (disable interrupts, set MSP, set VTOR, branch).
• Dual-bank flash on STM32H7: programming Bank B while executing from Bank A, the OPTKEY bank-swap procedure, and the boot-try counter rollback mechanism.
• OTA transports: UART XMODEM-CRC implementation with CRC16 validation, and the transport comparison table covering UART, USB DFU, BLE, Wi-Fi, and LoRa.
• Signature verification: hardware CRC32 for integrity checking, and Ed25519 verification using mbedTLS for cryptographic authenticity.
• MCUboot: slot layout, image header structure, imgtool signing, and the key configuration choices (swap-move, anti-rollback, serial recovery).