DFU Bootloader's settings can become corrupt after a power-cycle

RE: DFU Bootloader's settings can become corrupt after a power-cycle

Hung Bui — Fri, 01 Sep 2017 13:11:16 GMT

No, it's not implemented and I don't know about the plan or if we going to implement that. As I mentioned, it's important to make sure there will be no unexpected reset when doing DFU. Also, if the DFU bootloader setting is corrupted, worst case will be the update process need to start again.

RE: DFU Bootloader's settings can become corrupt after a power-cycle

Tiago Costa — Thu, 31 Aug 2017 16:08:18 GMT

"I assume the delay added so it take longer than the time the nRF52 can run when the power is cut down ? " That's right! We've measured the delay that it takes to get the voltage to drop low enough so that the nRF52 is completely off when the power is cut. Is that bootloader setting flag already implemented in the SDK or is that an upcoming feature?

RE: DFU Bootloader's settings can become corrupt after a power-cycle

Hung Bui — Thu, 31 Aug 2017 15:33:23 GMT

Good to know Tiago. I didn't know you store your application image on an SD Card. I assume the delay added so it take longer than the time the nRF52 can run when the power is cut down ? I think the bootloader setting flag should help. But we haven't heard any report about that problem yet.

RE: DFU Bootloader's settings can become corrupt after a power-cycle

Tiago Costa — Thu, 31 Aug 2017 11:29:40 GMT

That bootloader setting update flag would be handy actually. Could this help prevent the settings from being reset if they become corrupt?

RE: DFU Bootloader's settings can become corrupt after a power-cycle

Tiago Costa — Thu, 31 Aug 2017 11:16:25 GMT

Hi Hung, your reasoning makes total sense. I would expect the settings to become corrupt if a power-loss occurs during an update. However, frequently, the settings were also lost when our bootloader was calculating a CRC of our firmware files stored in a SD Card, when we forced a reset.

Finally, I believe we have sorted it out:

when we cut power to the board while the bootloader is calculating the CRC, we've noticed that the NRF52 continued to run after the SD Card stopped working (due to low voltage). This caused the read operation to fail, aborting the calculation and triggering a write to the settings (indicating that the image on the SD Card is not valid). After adding a delay before the write operation, we prevented the read errors which can be an indication of a sudden power loss, and the issue could not be reproduced again.

Thanks again for all the assistance on this.

RE: DFU Bootloader's settings can become corrupt after a power-cycle

Hung Bui — Wed, 30 Aug 2017 19:08:53 GMT

I suspect the bootloader has been reset when it's performing a bootloader setting update, meaning it's trying to erase the old bootloader setting and write a new one. Before the new bootloader setting can be written it got reset and the next boot up the bootloader setting appears corrupted.

Do you have the issue if you simply reset the bootloader without doing any DFU update ? From my understanding, the bootloader setting only get updated if there is a DFU update.

Avoiding a system reset when doing DFU is pretty important. That's why most vendors require battery >50% or power supply plugged before doing DFU update.

If needed, we can implement a flag telling if the bootloader setting update is in progress and can continue/retry that on the next booting if there is a reset occurs.

RE: DFU Bootloader's settings can become corrupt after a power-cycle

Tiago Costa — Wed, 30 Aug 2017 08:43:59 GMT

Hi Hung, thanks for your reply. The bootloader fails to enter the application because the bootloader settings are erased by calling nrf_dfu_settings_init() when the bootloader starts, causing nrf_dfu_app_is_valid() to return false. This only occurs if the bootloader is power-cycled multiple times in a row, otherwise works just fine and loads the main app as expected. I have checked the SDK function nrf_dfu_settings_init(), and it seems to only erase the settings whenever they are corrupt. I just don't understand why would they become corrupt when neither the bootloader or the main app are writing to the settings or any other flash region.

The flow of our bootloader on boot is as follows:

calls nrf_dfu_settings_init() to load the bootloader's settings
calls nrf_dfu_continue() in the event there is a pending flash operation - can this cause problems even if there is no pending flash operation?
proceeds to load the main app if nrf_dfu_app_is_valid() returns true and if enter_buttonless_dfu is not set

RE: DFU Bootloader's settings can become corrupt after a power-cycle

Hung Bui — Tue, 29 Aug 2017 15:59:34 GMT

Hi Tiago,

Could you try to modify the bootloader to print out some log to check what cause the bootloader not to enter application ? My suspicion is that the application is modified (because of some flash operation? ) and the CRC is mismatched. If you can reproduce the issue, you can also simply run the bootloader in debug mode and step into the code where it check for application valid.