nrf52840 - DFU via USB - Bootloader seems to work but app will not start.

[marco c.]

Hi there,

I'm developing on an nRF52840 using the nRF52 SDK in version 15.3.0 (15.3.0_59ac345). My project consists of the main application, the softdevice and a bootloader with usb dfu support from the SDK's example section (examples/dfu/secure_bootloader/pca10056_usb).
The main application was ported from another project that is running on an nRF52832. In this project the application is updated via buttonless dfu and that works fine.

In the current project the firmware update is performed via usb. The update process itself seem to work fine. The bootloader works and the firmware package can be downloaded by the nrfutil via usb.
But the main application is not startet by the bootloader.

For initial setup I'm flashing the bootloader, the softevice and the application directly via jtag port to the nRF52840. Here the application will not start either.

To understand the problem you can do the following steps. For simplification I used an example from the SDK 15.3.0 (15.3.0_59ac345). The basic configuration meets the configuration of my application.
By the way I'm developing on an linux distibution. So maybe you need to adapt the following commands.


#1. get the softdevice
cp nRF5_SDK_15.3.0_59ac345/components/softdevice/s140/hex/s140_nrf52_6.1.1_softdevice.hex .

#2. get the bootloader
cp nRF5_SDK_15.3.0_59ac345/examples/dfu/secure_bootloader/pca10056_usb_debug/armgcc/_build/nrf52840_xxaa_debug.hex ./nrf52840_xxaa_bl_debug.hex

#3. get the application
cp nRF5_SDK_15.3.0_59ac345/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/armgcc/_build/nrf52840_xxaa.hex ./nrf52840_xxaa_app.hex

#4. generate the application settings page for bootloader
nrfutil settings generate --family NRF52840 --application ./nrf52840_xxaa_app.hex --application-version 1 --bootloader-version 1 --bl-settings-version 2 settings_nrf52840_xxaa_app.hex

#5. merge the bootloader with application settings file
mergehex -m nrf52840_xxaa_bl_debug.hex settings_nrf52840_xxaa_app.hex -o ./nrf52840_xxaa_bl_w_settings.hex

#6. erase the chip
nrfjprog -f nrf52 --eraseall
nrfjprog -f nrf52 --reset

#7. program the softdevice
nrfjprog -f nrf52 --program s140_nrf52_6.1.1_softdevice.hex -r

#8. program the bootloader
nrfjprog -f nrf52 --program nrf52840_xxaa_bl_w_settings.hex -r

#9. program the application
nrfjprog -f nrf52 --program nrf52840_xxaa_app.hex -r


Now I would expect the application to start after a devie reset. But nothing.

Activating the debug output I get the following issue:

[snip]

SEGGER J-Link V6.46e - Real time terminal output
J-Link EDU Mini V1 compiled May 27 2019 15:50:07 V1.0, SN=801000575
Process: JLinkExe
<info> app: Inside main
<debug> app: In nrf_bootloader_init
<debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...
<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
<debug> nrf_dfu_settings: Using settings page.
<debug> nrf_dfu_settings: Copying forbidden parts from backup page.
<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
<debug> app: Enter nrf_bootloader_fw_activate
<info> app: No firmware to activate.
<debug> app: App is valid
<warning> nrf_dfu_settings: No additional data erased
<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
<debug> app: Running nrf_bootloader_app_start with address: 0x00001000
<debug> app: Disabling interrupts. NVIC->ICER[0]: 0x0

[/snip]

So the bootloader seems to work. But the application won't run.

After reading some posts here in the forum and after testing with a bootloader that provides ble dfu support (examples/dfu/secure_bootloader/pca10056_ble) I'm very sure that there's
something wrong with the applications configuraion. But I can not figure out what's wrong.

So do you have any ideas?
Is there any example code of an application that works with a bootloader that supports usb dfu?



Thank you and best regards, Marco.

[bjorn-spockeli]

Hi marco, 

are you able to attach to the nRF52840 with a debug probe and see if you reach the application code or if you end up in the HardFault handler? You can use Segger Ozone or Segger embedded studio to attach to a running target without reflashing the application. 

Could you also post the linker settings and .map file of the compiled application example? I would like to check that the application vector table is located where it is supposed to be. 

Best regards

Bjørn

[marco c.]

Hi Bjørn,

here is an excerpt from the .map file. Unfortunately I can't post the whole content of the file without

getting an error. Maybe the file has too many lines.

[...]

Memory Configuration

Name             Origin             Length             Attributes
FLASH            0x0000000000026000 0x00000000000ca000 xr
RAM              0x0000000020002220 0x000000000003dde0 xrw
uicr_bootloader_start_address 0x0000000000000ff8 0x0000000000000004 r
*default*        0x0000000000000000 0xffffffffffffffff

Linker script and memory map


.text           0x0000000000026000     0xcaf4
 *(.isr_vector)
 .isr_vector    0x0000000000026000      0x200 _build/nrf52840_xxaa/gcc_startup_nrf52840.S.o
                0x0000000000026000                __isr_vector
 *(.text*)
 .text.__do_global_dtors_aux
                0x0000000000026200       0x24 /usr/lib/gcc/arm-none-eabi/9.1.0/thumb/v7e-m+fp/hard/crtbegin.o
 .text.frame_dummy
                0x0000000000026224       0x1c /usr/lib/gcc/arm-none-eabi/9.1.0/thumb/v7e-m+fp/hard/crtbegin.o
 .text          0x0000000000026240       0x68 /usr/lib/gcc/arm-none-eabi/9.1.0/../../../../arm-none-eabi/lib/thumb/v7e-m+fp/hard/crt0.o
                0x0000000000026240                _mainCRTStartup
                0x0000000000026240                _start
 .text          0x00000000000262a8       0x3c _build/nrf52840_xxaa/gcc_startup_nrf52840.S.o
                0x00000000000262a8                Reset_Handler
                0x00000000000262d0                NMI_Handler
                0x00000000000262d2                HardFault_Handler
                0x00000000000262d4                MemoryManagement_Handler
                0x00000000000262d6                BusFault_Handler
                0x00000000000262d8                UsageFault_Handler
                0x00000000000262da                SVC_Handler
                0x00000000000262dc                DebugMon_Handler
                0x00000000000262de                PendSV_Handler
                0x00000000000262e0                SysTick_Handler
                0x00000000000262e2                TIMER2_IRQHandler
                0x00000000000262e2                RTC0_IRQHandler
                0x00000000000262e2                PWM1_IRQHandler
                0x00000000000262e2                RADIO_IRQHandler
                0x00000000000262e2                PDM_IRQHandler
                0x00000000000262e2                TEMP_IRQHandler
                0x00000000000262e2                QDEC_IRQHandler
                0x00000000000262e2                TIMER3_IRQHandler
                0x00000000000262e2                PWM3_IRQHandler
                0x00000000000262e2                FPU_IRQHandler
                0x00000000000262e2                USBD_IRQHandler
                0x00000000000262e2                SPIM0_SPIS0_TWIM0_TWIS0_SPI0_TWI0_IRQHandler
                0x00000000000262e2                TIMER4_IRQHandler
                0x00000000000262e2                CRYPTOCELL_IRQHandler
                0x00000000000262e2                I2S_IRQHandler
                0x00000000000262e2                SWI4_EGU4_IRQHandler
                0x00000000000262e2                TIMER0_IRQHandler
                0x00000000000262e2                UARTE1_IRQHandler
                0x00000000000262e2                TIMER1_IRQHandler
                0x00000000000262e2                SPIM3_IRQHandler
                0x00000000000262e2                PWM2_IRQHandler
                0x00000000000262e2                ECB_IRQHandler
                0x00000000000262e2                SPIM1_SPIS1_TWIM1_TWIS1_SPI1_TWI1_IRQHandler
                0x00000000000262e2                Default_Handler
                0x00000000000262e2                SAADC_IRQHandler
                0x00000000000262e2                CCM_AAR_IRQHandler
                0x00000000000262e2                WDT_IRQHandler
                0x00000000000262e2                SWI5_EGU5_IRQHandler
                0x00000000000262e2                RNG_IRQHandler
                0x00000000000262e2                RTC2_IRQHandler
                0x00000000000262e2                PWM0_IRQHandler
                0x00000000000262e2                SWI3_EGU3_IRQHandler
                0x00000000000262e2                SWI1_EGU1_IRQHandler
                0x00000000000262e2                SPIM2_SPIS2_SPI2_IRQHandler
                0x00000000000262e2                NFCT_IRQHandler
                0x00000000000262e2                MWU_IRQHandler
                0x00000000000262e2                QSPI_IRQHandler
                0x00000000000262e2                COMP_LPCOMP_IRQHandler
[...]

And here is the content of the linker script.

/* Linker script to configure memory regions. */

SEARCH_DIR(.)
GROUP(-lgcc -lc -lnosys)

MEMORY
{
  FLASH (rx) : ORIGIN = 0x26000, LENGTH = 0xca000
  RAM (rwx) :  ORIGIN = 0x20002220, LENGTH = 0x3dde0
  uicr_bootloader_start_address (r) : ORIGIN = 0x00000FF8, LENGTH = 0x4
}

SECTIONS
{
  . = ALIGN(4);
  .uicr_bootloader_start_address :
  {
    PROVIDE(__start_uicr_bootloader_start_address = .);
    KEEP(*(SORT(.uicr_bootloader_start_address*)))
    PROVIDE(__stop_uicr_bootloader_start_address = .);
  } > uicr_bootloader_start_address
}

SECTIONS
{
  . = ALIGN(4);
  .mem_section_dummy_ram :
  {
  }
  .log_dynamic_data :
  {
    PROVIDE(__start_log_dynamic_data = .);
    KEEP(*(SORT(.log_dynamic_data*)))
    PROVIDE(__stop_log_dynamic_data = .);
  } > RAM
  .log_filter_data :
  {
    PROVIDE(__start_log_filter_data = .);
    KEEP(*(SORT(.log_filter_data*)))
    PROVIDE(__stop_log_filter_data = .);
  } > RAM
  .fs_data :
  {
    PROVIDE(__start_fs_data = .);
    KEEP(*(.fs_data))
    PROVIDE(__stop_fs_data = .);
  } > RAM

} INSERT AFTER .data;

SECTIONS
{
  .mem_section_dummy_rom :
  {
  }
  .sdh_ble_observers :
  {
    PROVIDE(__start_sdh_ble_observers = .);
    KEEP(*(SORT(.sdh_ble_observers*)))
    PROVIDE(__stop_sdh_ble_observers = .);
  } > FLASH
  .sdh_soc_observers :
  {
    PROVIDE(__start_sdh_soc_observers = .);
    KEEP(*(SORT(.sdh_soc_observers*)))
    PROVIDE(__stop_sdh_soc_observers = .);
  } > FLASH
  .pwr_mgmt_data :
  {
    PROVIDE(__start_pwr_mgmt_data = .);
    KEEP(*(SORT(.pwr_mgmt_data*)))
    PROVIDE(__stop_pwr_mgmt_data = .);
  } > FLASH
  .log_const_data :
  {
    PROVIDE(__start_log_const_data = .);
    KEEP(*(SORT(.log_const_data*)))
    PROVIDE(__stop_log_const_data = .);
  } > FLASH
  .sdh_req_observers :
  {
    PROVIDE(__start_sdh_req_observers = .);
    KEEP(*(SORT(.sdh_req_observers*)))
    PROVIDE(__stop_sdh_req_observers = .);
  } > FLASH
  .sdh_state_observers :
  {
    PROVIDE(__start_sdh_state_observers = .);
    KEEP(*(SORT(.sdh_state_observers*)))
    PROVIDE(__stop_sdh_state_observers = .);
  } > FLASH
  .sdh_stack_observers :
  {
    PROVIDE(__start_sdh_stack_observers = .);
    KEEP(*(SORT(.sdh_stack_observers*)))
    PROVIDE(__stop_sdh_stack_observers = .);
  } > FLASH
  .log_backends :
  {
    PROVIDE(__start_log_backends = .);
    KEEP(*(SORT(.log_backends*)))
    PROVIDE(__stop_log_backends = .);
  } > FLASH
    .nrf_balloc :
  {
    PROVIDE(__start_nrf_balloc = .);
    KEEP(*(.nrf_balloc))
    PROVIDE(__stop_nrf_balloc = .);
  } > FLASH

} INSERT AFTER .text


INCLUDE "nrf_common.ld"

The idea with the debug probe sounds good. I'll try this tomorrow.

Best regards

Marco

[bjorn-spockeli]

Hi Marco, the linker settings looks good. 

If you have not modified the bootloader projects linker script, then it should start at 0xf8000, so no issue there. Please try to attach the debug probe to the running program and see where the nRF52840 is executing code after the DFU. 

Best regards

Bjørn

[sne_333]

I am facing the same issue. How do I solve this?