DFU with external QSPI memory

[Mohammad]

Hi,

   I am working on project, in which we using nordic nRF52840 chip. We need to flash the app+SD+BL image file in external QSPI memory.

After prevalidation, the DFU controller starts to send flash image package, we need to receive this and need to save in external QSPI memory. Once the postvalidation is successful, then read all the flash image package stored in external QSPI memory and write it to internal flash memory.

For that we use secure bootloader example code as reference file. I need to know where i need to modify the secure bootloader code.

I noticed that after prevalidation, the flash is erased in on_data_obj_create_request() function in nrf_dfu_req_handler.c file, and flash is written in on_data_obj_write_request() under the same c file. Is that right?

Thanks & Regards

Mohammad Gouse

[Mohammad]

Hi Hung Bui,

  I have modified the files nrf_fstorage_nvmc.c, nrf_flash.c, nrf_dfu_flash.c (with their corresponding header file) to have external qspi memory interface.

Once the device enter into DFU mode, it initialize the nrf_dfu_req_handler_init(), so I modified this function by adding nrf_dfu_qspi_init() in it.

  In this project, MX25R6435F used as external QSPI memory. The memory map of this will be same as Nordic system memory map, but without MBR and Bootloader (In our case bootloader in internal flash memory).

Step 1: After pre-validation, I need to copy the image file (SD + APP) to external QSPI. Now I need to know where I need to change the code to proceed to next step.

[Hung Bui]

Hi Mohammad, 

I assume you are familiar with the DFU procedure as described here. 

After you pass the pre-validation (received the init packet and then got the NRF_DFU_OP_OBJECT_WRITE to execute it), you will receive the data objects. 

They will be handled inside nrf_dfu_data_req(). It will start with the NRF_DFU_OP_OBJECT_CREATE and the page will be erased with the call to nrf_dfu_flash_erase() inside on_data_obj_create_request(). You would need to modify that function to erase the QSPI flash page instead. 

Next is NRF_DFU_OP_OBJECT_WRITE , which handled in on_data_obj_write_request(). You need to modify nrf_dfu_flash_store() to store on QSPI. And so on. 

I'm not 100% sure why you would need to make the addressing on QSPI the same as on the internal chip. But it's up to you. You can have a look at our discussion with TomWS above to know about other stuff you need to modify. 

[Mohammad]

Hi Hung,

 Inside on_data_obj_write_request(), i am using ret_code_t ret = nrf_drv_qspi_write( p_req->write.p_data,  p_req->write.len, write_addr) to write into QSPI instead of writing into flash. 

Is that correct?

[Hung Bui]

Hi Mohammad, 

Yes, it's the correct place to replace the nrf_dfu_flash_store() with your qspi function. 

You then need to check if the image copied to the qspi flash correctly after the image is fully transferred. 

[Mohammad]

Hi Hung,

<info> nrf_dfu_serial_usb: USB power detected
<info> nrf_dfu_serial_usb: USB ready
<warning> nrf_dfu_serial_usb: Could not read from CDC. Error: 0x92.
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_RECEIPT_NOTIF_SET
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_MTU_GET
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_SELECT (command)
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (command)
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (command)
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_CRC_GET (command)
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_EXECUTE (command)
<info> nrf_dfu_validation: PB: Init packet data len: 62
<info> nrf_dfu_validation: Signature required. Checking signature.
<info> nrf_dfu_validation: Calculating hash (len: 62)
<info> nrf_dfu_validation: Verify signature
<info> nrf_dfu_validation: Image verified
<info> nrf_dfu_validation: Write address set to 0x00001000
<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
<info> nrf_dfu_req_handler: Writing valid init command to flash.
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_SELECT (data)
<info> nrf_dfu_req_handler: crc = 0x0, offset = 0x0, max_size = 0x1000
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (data)
<info> nrf_dfu_req_handler: Creating object with size: 1708. Offset: 0x00000000, CRC: 0x00000000
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (data)

------------------------------------------QSPI write---------------------------------------
<info> nrf_dfu_req_handler: Wirting to qspi at address 0x1000 with length 0x400
<info> nrf_dfu_req_handler: Data inconsistent at location = 1023, QSPIData[1023] = 0 and Imagedata[1023] = 32
<info> nrf_dfu_req_handler: Data inconsistent, times = 1
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (data)
<info> nrf_dfu_req_handler: Wirting to qspi at address 0x1400 with length 0x2AC
<info> nrf_dfu_req_handler: Data inconsistent at location = 683, QSPIData[683] = 70 and Imagedata[683] = 3
<info> nrf_dfu_req_handler: Data inconsistent, times = 1

------------------------------------------------------------------------------------
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_CRC_GET (data)
<info> nrf_dfu_req_handler: Offset:1708, CRC:0x4009821F
<info> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<info> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_EXECUTE (data)
<info> nrf_dfu_req_handler: Whole firmware image received. Postvalidating.
<info> nrf_dfu_validation: Hash verification. start address: 0x1000, size: 0x6AC
<warning> nrf_dfu_validation: Hash verification failed.
<info> nrf_dfu_validation: Expected FW hash:
<info> nrf_dfu_validation: 97 AF 3F C4 72 7B DD 8B|..?.r{..
<info> nrf_dfu_validation: 21 75 95 95 DF 47 D9 88|!u...G..
<info> nrf_dfu_validation: D1 38 7A C0 32 8C 0C E4|.8z.2...
<info> nrf_dfu_validation: 0A 11 68 6E 78 7A B3 54|..hnxz.T
<info> nrf_dfu_validation: Actual FW hash:
<info> nrf_dfu_validation: 4F 4A FE AE 1A 61 B8 CB|OJ...a..
<info> nrf_dfu_validation: 96 05 85 07 BA 8B 88 60|.......`
<info> nrf_dfu_validation: 9E C0 F7 38 11 1D C3 6A|...8...j
<info> nrf_dfu_validation: BD 04 FC 39 3C 13 BA B6|...9<...
<warning> nrf_dfu_serial: DFU request completed with result: 0xB
<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
<info> nrf_dfu_req_handler: All flash operations have completed. DFU completed.
<info> app: Resetting bootloader.
<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
<info> app: Inside main
<info> app: In nrf_bootloader_init
<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
<info> app: Enter nrf_bootloader_fw_activate
<info> app: No firmware to activate.
<info> app: Boot validation failed. No valid app to boot.
<info> app: DFU mode because app is not valid.
<info> nrf_bootloader_wdt: WDT is not enabled
<info> app: in weak nrf_dfu_init_user
<info> app: Entering DFU mode.
<info> app: Enter main loop
<info> nrf_dfu_serial_usb: USB power detected
<info> nrf_dfu_serial_usb: USB ready

This is the output from NRF_LOG. The last byte written to QSPI is not same as image received.

[Hung Bui]

So you have checked what written in QSPI and the last byte was not the same ? Could you check why that happens ? Note that the size of the last packet is not the same size as other packet. 

[Mohammad]

Hi Hung,
I used blinky_pca10056_mbr.hex found in examples under nordic SDK 15.3 to generate the dfu_app_pkg.zip. I followed the below steps,

1. In the blinky_pca10056_mbr example code, i modified the FLASH_START=0x26000, in order to place code above SD section.

2. Then i generated the settings file,
nrfutil settings generate --family NRF52840 --application blinky_pca10056_mbr.hex --application-version 5 --bootloader-version 2 --bl-settings-version 2 settings.hex

Bootloader DFU Settings:
* File: settings.hex
* Family: NRF52840
* Start Address: 0x000FF000
* CRC: 0x236ED638
* Settings Version: 0x00000002 (2)
* App Version: 0x00000005 (5)
* Bootloader Version: 0x00000002 (2)
* Bank Layout: 0x00000000
* Current Bank: 0x00000000
* Application Size: 0x000006AC (1708 bytes)
* Application CRC: 0x4009821F
* Bank0 Bank Code: 0x00000001
* Softdevice Size: 0x00000000 (0 bytes)
* Boot Validation CRC: 0x1202D358
* SD Boot Validation Type: 0x00000000 (0)
* App Boot Validation Type: 0x00000001 (1)

3. Then I merged the blinky_pca10056_mbr.hex and settings.hex into app_settings.hex

4. Finally the dfu_app_pkg is generated,

nrfutil pkg generate --hw-version 52 --sd-req 0x00 --application-version 5 --application app_settings.hex --key-file Test2.key app_dfu_pkg.zip

5. I am sending the app_dfu_pkg.zip,
nrfutil dfu usb-serial -pkg app_dfu_pkg.zip -p COM5 -b 115200

6. The output,
<info> app: Enter nrf_bootloader_fw_activate
<info> app: No firmware to activate.
<info> app: App is valid
<info> app: DFU mode requested via button.
<info> nrf_bootloader_wdt: WDT is not enabled
<info> app: in weak nrf_dfu_init_user
<info> app: Entering DFU mode.
<info> app: Enter main loop
<info> nrf_dfu_serial_usb: USB power detected
<info> nrf_dfu_serial_usb: USB ready
<warning> nrf_dfu_serial_usb: Could not read from CDC. Error: 0x92.
<info> nrf_dfu_validation: Signature required. Checking signature.
<info> nrf_dfu_validation: Calculating hash (len: 63)
<info> nrf_dfu_validation: Verify signature
<info> nrf_dfu_validation: Image verified
<info> app: Enter nrf_dfu_cache_prepare()
<info> app: required_size: 0xD9324.
<info> app: single_bank: false.
<info> app: keep_app: false.
<info> app: keep_softdevice: false.
<info> app: SD_PRESENT: false.
<info> app: Bank contents:
<info> app: Bank 0 code: 0x01: Size: 0xD9324
<info> app: Bank 1 code: 0x00: Size: 0x0
<info> app: pass: 0.
<info> app: cache_address: 0xDB000.
<info> app: cache_too_small: true.
<info> app: keep_firmware: false.
<info> app: delete_more: true.
<info> app: pass: 1.
<info> app: cache_address: 0x1000.
<info> app: cache_too_small: false.
<info> app: keep_firmware: true.
<info> app: delete_more: false.
<info> nrf_dfu_validation: Write address set to 0x00001000
<info> nrf_dfu_req_handler: Writing valid init command to flash.
<info> nrf_dfu_req_handler: Whole firmware image received. Postvalidating.
<info> nrf_dfu_validation: Convert to hash to big-endian format for use in nrf_crypto
<info> nrf_dfu_validation: Hash verification. start address: 0x1000, size: 0xD9324
--------------------------- Hash verification succeed -----------------------
<info> nrf_dfu_validation: Invalidating old application in bank 0.
<info> nrf_dfu_req_handler: All flash operations have completed. DFU completed.
<info> app: Resetting bootloader.
<info> app: Inside main
<info> app: Enter nrf_bootloader_fw_activate
<info> app: Valid App
<info> app: Enter nrf_dfu_app_continue
<info> app: Setting app as valid
<info> app: Resetting bootloader.
<info> app: Inside main
<info> app: Inside main

--------- But the Led Blink doesn't working --------------

[Hung Bui]

I assume you don't have the softdevice ? 

Where do you put the application to ? 

You can try to do a hex dump (nrfjprog --readcode) to read the flash after you do DFU, and compare it with when you flash only the MBR and the blinky. 

[Mohammad]

Hi Hung,

I assume you don't have the softdevice ?  yes correct

Where do you put the application to ?  In blinky_pca10056_mbr project i have set the FLASH_START = 0x26000

[Mohammad]

Hi Hung,

I compared the blinky_pca10056_mbr.hex with the data written into QSPI, couple of data is mismatch with hex.

In blinky_pca10056_mbr.hex at 4th line before end of hex file as follows

:0E1698000D0E0F10000000000338FDD8704743
:0416A8000090D003DB

Data from end of the QSPI file

d e f 10 0 0 0 0 3 38 fd d8 70 47 ff ff 0 90 d0 3 

If you compare the above two extra two bytes 0xFF and 0xFF is read from QSPI, but remaining all are same. 

I dont know why 0xFF, 0xFF is there after d e f 10 0 0 0 0 3 38 fd d8 70 47. 

Fullscreen QSPI data read.txt Download

0 0 4 20 75 13 0 0 5d 13 0 0 5f 13 0 0 61 13 0 0 63 13 0 0 65 13 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 67 13 0 0 69 13 0 0 0 0 0 0 6b 13 0 0 6d 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 0 0 0 0 0 0 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 6f 13 0 0 0 0 0 0 0 0 0 0 6f 13 0 0 0 0 0 0 6f 13 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 35 49 36 48 a 1a 2 d0 7 22 91 43 8d 46 34 49 34 48 a 1a 6 d0 7 22 91 43 81 f3 9 88 2 22 82 f3 14 88 30 48 31 49 31 4a 0 f0 44 f8 31 48 31 49 32 4a 0 f0 3f f8 31 48 32 49 32 4a 0 f0 3a f8 32 48 32 49 33 4a 0 f0 35 f8 32 48 33 49 33 4a 0 f0 30 f8 33 48 33 49 34 4a 0 f0 2b f8 33 48 34 49 34 4a 0 f0 26 f8 34 48 34 49 0 22 0 f0 2c f8 33 48 34 49 0 22 0 f0 27 f8 33 48 33 49 9 1a 8 29 2 db 0 22 2 60 41 60 31 4a 90 47 1f 48 1f 49 88 42 5 d0 2 68 4 30 3 b4 90 47 3 bc f7 e7 0 20 86 46 ec 46 0 20 0 21 29 4a 90 47 fe e7 88 42 7 d0 52 1a 5 d0 3 78 1 30 b 70 1 31 1 3a f9 d1 70 47 88 42 2 d0 2 70 1 30 fa e7 70 47 0 0 4 20 0 e0 3 20 0 0 4 20 0 0 4 20 a8 16 0 0 8 0 0 20 c 0 0 20 d4 13 0 0 d4 13 0 0 98 16 0 0 a8 16 0 0 8 0 0 20 8 0 0 20 98 16 0 0 98 16 0 0 98 16 0 0 98 16 0 0 98 16 0 0 98 16 0 0 98 16 0 0 98 16 0 0 a6 16 0 0 ac 16 0 0 c 0 0 20 c 0 0 20 c 0 0 20 c 0 0 20 c 0 0 20 c 0 0 20 c 0 0 20 c 20 0 20 9d 13 0 0 91 14 0 0 fe e7 fe e7 fe e7 fe e7 fe e7 fe e7 fe e7 fe e7 fe e7 fe e7 70 47 0 bf 10 48 80 47 10 48 4f f0 7 1 88 43 85 46 f 48 80 47 f 48 1 68 41 f4 70 1 1 60 bf f3 4f 8f bf f3 6f 8f ff f7 32 bf a 48 b 49 b 4a 88 42 7 d0 52 1a 5 d0 3 78 1 30 b 70 1 31 1 3a f9 d1 70 47 71 13 0 0 0 0 4 20 e1 14 0 0 88 ed 0 e0 98 16 0 0 8 0 0 20 8 0 0 20 7 4b 1b 5c 1f 2b 86 bf 3 f0 1f 3 5 49 4f f0 a0 41 1 22 2 fa 3 f3 c1 f8 8 35 70 47 0 bf 98 16 0 0 0 3 0 50 8 b5 0 20 ff f7 e8 ff 1 20 ff f7 e5 ff 2 20 ff f7 e2 ff 3 20 bd e8 8 40 ff f7 dd bf 0 0 a 4b 18 5c 1f 28 8a bf 9 4b 4f f0 a0 43 0 f0 1f 0 d3 f8 4 25 1 21 81 40 21 ea 2 0 a 40 c3 f8 8 5 c3 f8 c 25 70 47 0 bf 98 16 0 0 0 3 0 50 c2 7 10 b5 4 46 c d5 4f f0 a0 43 3 22 c3 f8 34 27 c3 f8 38 27 c3 f8 3c 27 c3 f8 40 27 ff f7 c5 ff a3 7 a d5 4f f0 a0 43 c 22 c3 f8 2c 27 c3 f8 30 27 c3 f8 60 27 c3 f8 64 27 10 bd 0 0 70 b5 1 20 9 4d ff f7 db ff 45 f0 1 5 0 24 20 46 ff f7 bb ff 4f f4 fa 76 4f f4 7a 40 a8 47 1 3e fa d1 1 34 3 2c f2 d1 f0 e7 a0 16 0 0 5 4b 1b 68 8 2b 1 bf 4 4b 18 68 b0 fa 80 f0 40 9 18 bf 0 20 70 47 30 1 0 10 34 1 0 10 8 b5 4f f0 80 43 0 22 c3 f8 c 21 c3 f8 10 21 c3 f8 38 25 4f f0 80 52 3 f5 40 43 d2 f8 4 14 c3 f8 20 15 d2 f8 8 14 c3 f8 24 15 d2 f8 c 14 c3 f8 28 15 d2 f8 10 14 c3 f8 2c 15 d2 f8 14 14 c3 f8 30 15 d2 f8 18 14 c3 f8 34 15 d2 f8 1c 14 c3 f8 40 15 d2 f8 20 14 c3 f8 44 15 d2 f8 24 14 c3 f8 48 15 d2 f8 28 14 c3 f8 4c 15 d2 f8 2c 14 c3 f8 50 15 d2 f8 30 14 c3 f8 54 15 d2 f8 34 14 c3 f8 60 15 d2 f8 38 14 c3 f8 64 15 d2 f8 3c 14 c3 f8 68 15 d2 f8 40 14 c3 f8 6c 15 d2 f8 44 24 c3 f8 70 25 ff f7 9c ff 10 b1 38 4b 38 4a 1a 60 ff f7 96 ff 18 b1 37 4b fb 22 c3 f8 18 25 ff f7 8f ff 48 b1 34 49 35 4b a 68 1b 68 22 f0 f 2 3 f0 f 3 13 43 b 60 ff f7 82 ff 18 b1 30 4b 4f f4 0 72 1a 60 4f f0 80 43 d3 f8 0 24 d2 7 44 bf 6f f0 1 2 c3 f8 0 24 2a 4a d2 f8 88 30 43 f4 70 3 c2 f8 88 30 bf f3 4f 8f bf f3 6f 8f 4f f0 10 23 d3 f8 0 22 0 2a 3 db d3 f8 4 32 0 2b 2f da 20 4b 1 22 c3 f8 4 25 d3 f8 0 24 0 2a fb d0 4f f0 10 22 12 21 c2 f8 0 12 d3 f8 0 24 0 2a fb d0 4f f0 10 23 12 22 c3 f8 4 22 15 4b 1a 46 d3 f8 0 14 0 29 fb d0 0 21 c3 f8 4 15 d2 f8 0 34 0 2b fb d0 bf f3 4f 8f d 49 e 4b ca 68 2 f4 e0 62 13 43 cb 60 bf f3 4f 8f 0 bf fd e7 a 4b b 4a 1a 60 8 bd 8c 56 0 40 48 81 3 0 0 f0 0 40 e4 e 0 40 58 2 0 10 40 96 2 40 0 ed 0 e0 0 e0 1 40 4 0 fa 5 8 0 0 20 0 90 d0 3 d e f 10 0 0 0 0 3 38 fd d8 70 47 ff ff 0 90 d0 3

This makes the hash verification fails.blinky_pca10056_mbr.hex

[Hung Bui]

Hi Mohammad, 

I'm sorry for late response, I was on vacation last week. 

If you don't have the example, the application is supposed to start at address 0x1000. I'm not sure why you set the Flash Start to 0x26000

You may want to check how the last packet is written to QSPI.

But please clarify how you have "  Hash verification succeed " did you remove the hash checking ? 

[TomWS]

@Mohammad, the Hex file line you're referencing is only 14 bytes of data.  Consequently the next two bytes of QSPI flash are not written and hence are 0xff in value.  The hash calculation may be assuming that the extra two bytes are padded with zeroes to make it a full word write (to Flash Memory).

From what I've seen with the BLE data transfers to the DFU code, all data blocks have always been full word multiples so I'm not sure how the raw Hex data would appear on the DFU end of the transfer.