RP2350 Bootloader Handoff Issue - Application Never Starts After Boot3

[akhodeir]

I have a fully functional RP2350 bootloader that successfully validates applications and executes the complete ARM Cortex-M33 handoff sequence, but applications never start running after the handoff.

I added the source code here : https://github.com/akhodeir/RP2350-Bootloader/

What Works Correctly :

Bootloader functionality is 100% working:

• USB CDC communication and all commands (INFO, VALIDATE, BOOT, PING, etc.)
• Application validation passes with correct ARM Cortex-M33 vector table analysis
• Handoff sequence executes completely with proper debug output

Debug output shows successful validation:

Boot3: RP2350 Boot Stage 3 v1.0.0
Boot3: Application valid (SP: 0x20080000, Reset: 0x10151EED)
APP_VALID
BOOT_ATTEMPTING
Boot3: ARM handoff to 0x10151EED (SP: 0x20080000)
What Fails :

After the handoff sequence:

• USB disconnects briefly (expected behavior)
• Application never starts executing - no LED patterns, no USB re-enumeration
• Device appears "dead" until reset
• simple test applications fails

Technical Details

Memory Layout:

• Boot Stage 2 (pico-sdk): 0x10000000-0x100000FF (256 bytes)
• Boot Stage 3 (my bootloader): 0x10000100-0x10007FFF (~30KB)
• Application: 0x10008000-0x103FFFFF

ARM Cortex-M33 Handoff Sequence:

  // Clean USB disconnect
  tud_disconnect();
  sleep_ms(50);

  // ARM Cortex-M33 handoff
  __asm volatile ("cpsid i" : : : "memory");              // Disable interrupts
  volatile uint32_t* vtor = (volatile uint32_t*)0xE000ED08;
  *vtor = APPLICATION_START;                               // Set VTOR to 0x10008000
  __asm volatile ("MSR msp, %0" : : "r" (app_stack) : "memory"); // Set stack pointer
  __asm volatile ("dsb" : : : "memory");                  // Memory barriers
  __asm volatile ("isb" : : : "memory");
  void (*reset_handler)(void) = (void (*)(void))(app_entry & ~1U);
  reset_handler();   

Application Details:

• Stack pointer: 0x20080000 (valid RP2350 RAM)
• Reset vector: 0x10151EED (valid application code)
• Built with pico-sdk, proper boot2 stage included
• Works when flashed directly (without bootloader)

The handoff sequence executes (debug shows it reaches the jump), but the application never begins. This suggests there's a critical RP2350-specific initialization or ARM Cortex-M33 requirement that standard bootloader handoff procedures don't cover.

[lurch]

This is well beyond my personal level of knowledge, but in case it helps, the sourcecode for the RP2350 bootrom is at https://github.com/raspberrypi/pico-bootrom-rp2350