Shifting Bootloader area using BLE DFU

[Yahya Tawil]

Hello

I have a firmware with Softdevice S132 for NRF52 consists of main application (0x1F000 len:0x56000 ) and Bootloader  (0x75000 len:0x9000). What I'm trying to do is adding more space for the existing App using a page from the Bootloader, So I will do the following shift: main application (0x1F000 len:0x57000 ) and Bootloader  (0x76000 len:0x8000).

When I flash the project using the wires (erasing and flashing firmware + softdevice) It works without any problem, but when I upgrade the bootloader using BLE with the shifted one the device becomes dead. I think this is mentioned clearly in this post Relocating Bootloader by DFU .

According to the explanation, this is because the wired programming erase every thing including the UICR registers (NRFFW[0] which has the start address of bootloader) and flash new firmware while the BLE DFU approach will not do that. However, I made a bridge bootloader that erase the UICR area and update the NRF_UICR->NRFFW[0] to the new Bootloader address after it finishes uploading the new bootloader, but I still get the same thing. I also tried to set the vector table using manually in that step     sd_softdevice_vector_table_base_set(NRF_UICR->NRFFW[0]).

    sd_softdevice_disable();
    if (NRF_UICR->NRFFW[0] != 0x76000)  
    {
        //enable reading 
        NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Ren << NVMC_CONFIG_WEN_Pos;
        while (NRF_NVMC->READY == NVMC_READY_READY_Busy){}
        
        // backup other data in UICR before erasing
        uint32_t * uicr_area_ptr = (uint32_t *)NRF_UICR_BASE ;
        uint32_t uicr_area_buffer[67];
        for (int reg_num=0;reg_num < 67 ; reg_num++)
        {
            uicr_area_buffer[reg_num] = *uicr_area_ptr;
            uicr_area_ptr++;
        }
        
        //erase the UICR
        NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Een << NVMC_CONFIG_WEN_Pos;
        while (NRF_NVMC->READY == NVMC_READY_READY_Busy){}
        NRF_NVMC->ERASEUICR = 1;
        while (NRF_NVMC->READY == NVMC_READY_READY_Busy){}
        
        //enable writing
        NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Wen<< NVMC_CONFIG_WEN_Pos;
        while (NRF_NVMC->READY == NVMC_READY_READY_Busy){}
        
        // restore other data in UICR after erasing
        uicr_area_ptr = (uint32_t *)NRF_UICR_BASE ;
        for (int reg_num=0;reg_num < 67 ; reg_num++)
        {
            *uicr_area_ptr = uicr_area_buffer[reg_num];
            uicr_area_ptr++;
            while (NRF_NVMC->READY == NVMC_READY_READY_Busy){}
        }
        //write the bootloader start address
        NRF_UICR->NRFFW[0] = 0x76000;
        
        //enable reading 
        NRF_NVMC->CONFIG = NVMC_CONFIG_WEN_Ren << NVMC_CONFIG_WEN_Pos;
        while (NRF_NVMC->READY == NVMC_READY_READY_Busy){}
    }

    sd_softdevice_vector_table_base_set(NRF_UICR->NRFFW[0]);

    reset_device();
    }

So am I miss something, for example the MBR in Softdevice uses the old bootloader address, or what? BTW from where the MBR knows the Address the Bootloader ? and is there any detailed documentation/code for MBR ?

Best

[Einar Thorsrud]

Hi,

So am I miss something, for example the MBR in Softdevice uses the old bootloader address, or what? BTW from where the MBR knows the Address the Bootloader ?

Until recently, the MBR found the bootloader address by checking NRF_UICR->NRFFW[0]. If it were set (not all FF), the MBR would jump to the bootloader. However, the MBR shipped with the newest SoftDeices (6.1.1) which was shipped with SDK 15.3 no longer use NRF_UICR->NRFFW[0] but instead places the bootloader start address at the end of the MBR page. This means it is no longer possible to change the bootloader start address by deleting and rewriting a modified UICR page. (this is only half-true, as it is still used if the address is not set within the MBR, for backward compatibility).  Which SDK and SoftDevice version do you upgrade to and from?

and is there any detailed documentation/code for MBR ?

You can find the MBR documentation under Master boot record and bootloader in the SoftDevice specification.

[Yahya Tawil]

Thanks Einar for the interesting note about how new MBR get/store Bootloader address.

I use SDK V13 and SD132 V4.

So as my MBR version should uses NRF_UICR->NRFFW[0] value to jump to bootloader, can you expect what is wrong in my case ? Note: I made sure 100% that erasing and updating the NRFFW[0] is working by doing that and check the values in normal App.

Einar Thorsrud said:

You can find the MBR documentation under Master boot record and bootloader in the SoftDevice specification.

Yes, I saw it, but I was looking for the details you mentioned : ) if I can get them somewhere in the documentation or as a code (it's closed source as I know).

Note: I think this page need to have an update about bootloader address
https://infocenter.nordicsemi.com/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v15.0.0%2Flib_bootloader_dfu_process.html

[Einar Thorsrud]

Hi,

Yahya Tawil said:

can you expect what is wrong in my case ?

The code snippet in the original question seems sensible, but there is probably some detail that I am not spotting. The procedure is proven to work, as shown in detail in this post (though for an older SDK).

Yahya Tawil said:

Yes, I saw it, but I was looking for the details you mentioned : ) if I can get them somewhere in the documentation or as a code (it's closed source as I know).

The MBR is closed source as you write, but I will request that the documentation be expanded.