Erasing of Master Boot Record Parameters Page hangs

[Xenoamor]

Hi,

Here's the setup I currently have:
nRF52840
SDK 15.2.0
s140 6.1.0 softdevice
Secure Bootloader pca10056_usb

I'm trying to update the mbr_params_page (0xFE000) from my application. However whenever I try to erase it with either nrf_nvmc_page_erase(0xFE000) or sd_flash_page_erase(0xFE000 / 4096) my application hangs. This is strange as the bootloader itself can erase this page fine. The line it hangs on is NRF_NVMC->ERASEPAGE = 0xFE000; (This is with the softdevice disabled)

Deleting the bootloader_settings_page (0xFF000) works as expected.

I have checked the ACL registers and the memory isn't in a protected region. My application linker file also has this section reserved so it shouldn't be using it

What could be the cause for not being able to erase this particular page?

[bjorn-spockeli]

Hi Xenoamar, 

sd_flash_page_erase should return either NRF_SUCCESS or an error code if the erase cannot be performed. Do you have a code snippet that you could share that replicates the issue?

Best regards

Bjørn

[Xenoamor]

Hi Bjørn,

Thanks for getting back to me so quickly. Calling the following causes a program hang:

int main(void)
{
    // Start the softdevice
    nrf_sdh_enable_request();

    printf("Page erase at 0xFE000 returns: %lu\r\n", sd_flash_page_erase(0xFE000 / 4096));

    while (1)
    {}
}

It prints: "Page era"

If I call the following it works:

int main(void)
{
    // Start the softdevice
    nrf_sdh_enable_request();

    printf("Page erase at 0xFF000 returns: %lu\r\n", sd_flash_page_erase(0xFF000 / 4096));

    while (1)
    {}
}

Printing: "Page erase at 0xFF000 returns: 0"

[bjorn-spockeli]

HI Xenoamor, 

I am able to reproduce the behavior that you're seeing when erasing the MBR params page from the application. After calling sd_flash_page_erase, which returns zero, I enter the HardFault handler. According to the SD API documentation this will happen if the page number provided belongs to a protected page. 

So this means that the page must be protected by the SD as I have removed all references to ACL in the bootloader.  The reason for this not faulting in the BL is because this particular bootloader does not enable the the SoftDevice. 

[Xenoamor]

Hi Bjørn,

Thanks for taking the time to look into it. Do you know how the SD is protecting this area of memory?
It appears to continue to protect it even after I have disabled it

For now I can work around it by moving data around in the bootloader before the SD is enabled but it's not very ideal

[bjorn-spockeli]

Hi Xenoamor, 

I found out that the Secure Bootloader calls nrf_bootloader_flash_protect() in both main() and in nrf_bootloader_app_start_final(), which is called when jumping from the bootloader to the application. 

Commenting out the references in nrf_bootloader_app_start_final() in addition to the ones in main() solved the issue, i.e. I can call sd_flash_page_erase(0xFE) from the application without getting the HardFault. 

void nrf_bootloader_app_start_final(uint32_t vector_table_addr)
{
    ret_code_t ret_val;
/*
    // Protect MBR & bootloader code and params pages.
    if (NRF_BOOTLOADER_READ_PROTECT)
    {
        ret_val = nrf_bootloader_flash_protect(0, MBR_SIZE, NRF_BOOTLOADER_READ_PROTECT);
    }

    // Size of the flash area to protect.
    uint32_t area_size;

    area_size = BOOTLOADER_SIZE + NRF_MBR_PARAMS_PAGE_SIZE;

    ret_val = nrf_bootloader_flash_protect(BOOTLOADER_START_ADDR,
                                           area_size,
                                           NRF_BOOTLOADER_READ_PROTECT);

    if (!NRF_BOOTLOADER_READ_PROTECT && (ret_val != NRF_SUCCESS))
    {
        NRF_LOG_ERROR("Could not protect bootloader and settings pages, 0x%x.", ret_val);
    }
*/
    // Run application
    app_start(vector_table_addr);
}

'

So in the end it was an oversight on my part, the SoftDevice does not protect the MBR params page. 

Best regards

Bjørn