Can't jump to a custom app location using nrf_bootloader_app_start with SDK V15

Question

With SDK V14.2, I was able to specify internal flash address argument into nrf_bootloader_app_start(uint32_t start_addr) and was able to boot into the address. With SDK V15, the argument option is removed and the jump address is fixed to MBR_SIZE within the nrf_bootloader_app_start(void) function. I tried modifying the start address within nrf_bootloader_app_start but I was not able to boot into the custom app location.

Øyvind Rønningstad · Accepted Answer

Note that h.vig 's solution doesn't work if there is no SoftDevice present. 
 The reason it was removed was that in SDK 15, we also support having no SoftDevice present, so this function would have needed to accomodate that new configuration. Removing the start address argument allowed us to not implement something we didn't need for our own examples. 
 The DFU we provide only allows placing apps 1) at 0x1000 (after the 'MBR'), or 2) after the SoftDevice if there is a SoftDevice present. The start address in both cases can be 0x1000, so we hard-coded it. 
 Implementing this functionality for the general case is surprisingly tedious and has tricky caveats, but if you know what you need for your specific case, it's quite doable. 
 Below is an untested mockup. Use _with_sd if the app needs the SD, and likewise, use _without_sd if the app doesn't need the SD. This might not compile out of the box (because of dependencies), and might not run together with old MBRs. Note that I changed the app_start_impl call to use app_start_final from SDK 15 instead. It should do the same thing, and also give you the memory protection present in 15. Note also that using the _with_sd call in otherwise SD-independent bootloaders (i.e. UART or USB) makes them SD-dependent and brickable by an update that removes the SD. Add the BLE_STACK_SUPPORT_REQD define to prevent this. 
 void start_app_with_sd(cb_uint32 startAddress)
{
 nrf_dfu_mbr_init_sd();

 // Disable and clear interrupts
 NVIC->ICER[0] = 0xFFFFFFFF;
 NVIC->ICPR[0] = 0xFFFFFFFF;
 NVIC->ICER[1] = 0xFFFFFFFF;
 NVIC->ICPR[1] = 0xFFFFFFFF;

 sd_softdevice_vector_table_base_set(startAddress);
 nrf_dfu_mbr_irq_forward_address_set(MBR_SIZE);
 nrf_bootloader_app_start_final(startAddress);
}

void start_app_without_sd(cb_uint32 startAddress)
{
 NVIC->ICER[0] = 0xFFFFFFFF;
 NVIC->ICPR[0] = 0xFFFFFFFF;
 NVIC->ICER[1] = 0xFFFFFFFF;
 NVIC->ICPR[1] = 0xFFFFFFFF;

 nrf_dfu_mbr_irq_forward_address_set(startAddress);
 nrf_bootloader_app_start_final(startAddress);
}

// nrf_dfu_mbr.c:
// Replace this
uint32_t nrf_dfu_mbr_irq_forward_address_set(void)
{
 uint32_t ret_val = NRF_ERROR_INVALID_PARAM;
 uint32_t address = MBR_SIZE;
 ...
 
// With this
uint32_t nrf_dfu_mbr_irq_forward_address_set(uint32_t address)
{
 uint32_t ret_val = NRF_ERROR_INVALID_PARAM;
 ...

h.vig · Answer

i have the exact same question. Can someone from nordic answer on WHY the change was made? 
 
 ------------------------------------------------------------------------------------------------------------------------------------------------ 
 Update: I copied the code from SDK14.1 and I am now able to jump to any RAM and flash address on nrf52840. 
 void start_app(cb_uint32 startAddress) { nrf_dfu_mbr_init_sd(); // Disable and clear interrupts NVIC->ICER[0] = 0xFFFFFFFF; NVIC->ICPR[0] = 0xFFFFFFFF; NVIC->ICER[1] = 0xFFFFFFFF; NVIC->ICPR[1] = 0xFFFFFFFF; sd_softdevice_vector_table_base_set(startAddress); nrf_bootloader_app_start_impl(startAddress); } 
 void __attribute__((noinline)) nrf_bootloader_app_start_impl(uint32_t start_addr) { __ASM volatile( "ldr r0, [%0]	
" // Get App initial MSP for bootloader. "msr msp, r0	
" // Set the main stack pointer to the applications MSP. "ldr r0, [%0, #0x04]	
" // Load Reset handler into R0. "movs r4, #0xFF	
" // Move ones to R4. "sxtb r4, r4	
" // Sign extend R4 to obtain 0xFFFFFFFF instead of 0xFF. "mrs r5, IPSR	
" // Load IPSR to R5 to check for handler or thread mode. "cmp r5, #0x00	
" // Compare, if 0 then we are in thread mode and can continue to reset handler of bootloader. "bne isr_abort	
" // If not zero we need to exit current ISR and jump to reset handler of bootloader. "mrs r1, control	
" // Get CONTROL register value "movs r2, #0x02	
" // load 2 to r2 "bic r1, r2	
" // clear value of CONTROL->SPSEL - > make sure MSP will be used "msr control, r1	
" // set the stack pointer to MSP "mov lr, r4	
" // Clear the link register and set to ones to ensure no return. "bx r0	
" // Branch to reset handler of bootloader. "isr_abort: 	
" "mov r5, r4	
" // Fill with ones before jumping to reset handling. Will be popped as LR when exiting ISR. Ensures no return to application. "mov r6, r0	
" // Move address of reset handler to R6. Will be popped as PC when exiting ISR. Ensures the reset handler will be executed when exist ISR. "movs r7, #0x21	
" // Move MSB reset value of xPSR to R7. Will be popped as xPSR when exiting ISR. xPSR is 0x21000000 thus MSB is 0x21. "rev r7, r7	
" // Reverse byte order to put 0x21 as MSB. "push {r4-r7}	
" // Push everything to new stack to allow interrupt handler to fetch it on exiting the ISR. "movs r4, #0x00	
" // Fill with zeros before jumping to reset handling. We be popped as R0 when exiting ISR (Cleaning up of the registers). "movs r5, #0x00	
" // Fill with zeros before jumping to reset handling. We be popped as R1 when exiting ISR (Cleaning up of the registers). "movs r6, #0x00	
" // Fill with zeros before jumping to reset handling. We be popped as R2 when exiting ISR (Cleaning up of the registers). "movs r7, #0x00	
" // Fill with zeros before jumping to reset handling. We be popped as R3 when exiting ISR (Cleaning up of the registers). "push {r4-r7}	
" // Push zeros (R4-R7) to stack to prepare for exiting the interrupt routine. "movs r0, #0xF9	
" // Move the execution return command into register, 0xFFFFFFF9. "sxtb r0, r0	
" // Sign extend R0 to obtain 0xFFFFFFF9 instead of 0xF9. "bx r0	
" // No return - Handler mode will be exited. Stack will be popped and execution will continue in reset handler initializing other application. ".align	
" :: "r" (start_addr) // Argument list for the gcc assembly. start_addr is %0. : "r0", "r4", "r5", "r6", "r7" // List of register maintained manually. ); }

Can't jump to a custom app location using nrf_bootloader_app_start with SDK V15

Top Replies