MBR doesn't copy bootloader when upgrading

[MC]

I have a problem with upgrading bootloader on NRF52832 IC. We are in the middle of porting our own bootloader from SDK 8.1 to SDK 14, because we had to change BLE modules in our products. The application transfers the image into internal flash and signals the bootloader to start the upgrade. We have verified that bootloader image gets transfered and stored succesfully. After transfer the device resets, sets the flags for dfu functions, resets again and then goes into nrf_dfu_bl_continue() function, which compares the BL images and  returns missmatch. So far, so good.

Then the program goes ahead and calls nrf_dfu_mbr_copy_bl() function, which calls sd_mbr_command() with SD_MBR_COMMAND_COPY_BL parameter. After that, device resets again, as it should, but BL doesn't get copied at all. If I manually compare the FWs in BANK_1 and actual installed bootloader, they don't match, so the copy didn't happen. Is there something I am missing?

Also, after an unsuccesfull copying, device starts to behave strange, it sometimes doesn't start, other times it starts but goes back into nrf_dfu_mbr_copy_bl() function, because FWs still don't match. Any hints will be apreciated.

[Einar Thorsrud]

Hi,

Are you using SDK 14.2 with SoftDevice S132 version 5.0.0? What is the return value of the call to sd_mbr_command()? Is UICR.NRFFW[1] set to the start address of an unused flash page?

[MC]

Yes, we are using SDK 14.2, SoftDevice S132 version 5.1.0.

sd_mbr_command() doesn't return anything, it just resets the processor as it should when updating the bootloader. UICR.NRFFW[1] points to the second to last page in flash, 0x7E000. I had problems, when bootloader was too large and has written on that page. Since then, I moved bootloader start address for one page so the MBR settings page is always clear, which I verified through "memmory" tab in Segger embedded studio. I thought this was the problem, but it doesn't seem to be.

The last page 0x7F000 is reserved for bootloader settings.

When I call sd_mbr_command() I could see that something is being written to that page, but then it never gets cleared when MBR resets the processor, nor does the bootloader get swapped.

[Einar Thorsrud]

One more thing: how large is your bootloader (the one you are copying)?

[MC]

Bootloader's size iz 32100 Bytes to be exact.

[Einar Thorsrud]

This puzzles me. Is anything erased or copied, or is the content of the bootloader region is flash identical before and after the call to nrf_dfu_mbr_copy_bl() and subsequent reset? What values do you use for the parameters in the nrf_dfu_mbr_copy_bl() call (particularly the length)?

[MC]

Hi Einar, I just figured it out after several hours of trying.

It turns out, the issue was a bit odd and dificult to track down. We have a system, with a "main" processor and BLE module. I had the module connected to debugger the entire time, which is the key issue here.

After FW transfer and flashing, the main processor resets the device and power cycles the BLE module with it. By doing that, the debugger starts behaving strangly, so it is impossible to see what is going on in real time. When not in debugger mode, the nrf_dfu_mbr_copy_bl() function works as it should and replaces BL without problems. It seems that the power cycle's timing was just right to obscure the BL being copied.

Thank you very much for your time, I will close this question.