Buttonless DFU not flashing new firmware SDK 15.2.0

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

nem22 — Fri, 21 Feb 2020 13:38:41 GMT

Thank you, DFU is working on our custom boards now.

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

bjorn-spockeli — Fri, 21 Feb 2020 13:11:25 GMT

nrf_dfu_settings_write uses the m_dfu_settings_buffer location of the as the address, m_dfu_settings_buffer is defined as

uint8_t m_dfu_settings_buffer[BOOTLOADER_SETTINGS_PAGE_SIZE]
    __attribute__((section(".bootloader_settings_page")))
    __attribute__((used));

in nrf_dfu_settings.c. The .bootloader_settings_page section (and the . mbr_params_page section) is defined in the flash_placement.xml file as

 <MemorySegment name="bootloader_settings_page" start="0x0007F000" size="0x1000">
    <ProgramSection alignment="4" keep="Yes" load="No" name=".bootloader_settings_page" address_symbol="__start_bootloader_settings_page" end_symbol="__stop_bootloader_settings_page" start = "0x0007F000" size="0x1000" />
  </MemorySegment>
  <MemorySegment name="mbr_params_page" start="0x0007E000" size="0x1000">
    <ProgramSection alignment="4" keep="Yes" load="No" name=".mbr_params_page" address_symbol="__start_mbr_params_page" end_symbol="__stop_mbr_params_page" start = "0x0007E000" size="0x1000" />
  </MemorySegment>

Change these to

 <MemorySegment name="bootloader_settings_page" start="0x0003F000" size="0x1000">
    <ProgramSection alignment="4" keep="Yes" load="No" name=".bootloader_settings_page" address_symbol="__start_bootloader_settings_page" end_symbol="__stop_bootloader_settings_page" start = "0x0003F000" size="0x1000" />
  </MemorySegment>
  <MemorySegment name="mbr_params_page" start="0x0003E000" size="0x1000">
    <ProgramSection alignment="4" keep="Yes" load="No" name=".mbr_params_page" address_symbol="__start_mbr_params_page" end_symbol="__stop_mbr_params_page" start = "0x0003E000" size="0x1000" />
  </MemorySegment>

That should solve the issue I think.

Best regards

Bjørn

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

nem22 — Fri, 21 Feb 2020 12:29:32 GMT

Hi, thanks for explaining the size requirements,

After setting NRF_DFU_APP_DATA_AREA_SIZE to 0 I get this from the debug bootloader while sending zip to dfutarg:

<debug> nrf_dfu_validation: Write address set to 0x00026000
<debug> nrf_dfu_settings: Writing settings...
<debug> nrf_dfu_settings: Erasing old settings at: 0x0007F000
<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0007F000, len=1 pages), queue usage: 0
<error> app: Received a fault! id: 0x00004002, pc: 0x00000000, info: 0x2000FF10

I don't understand why it's trying to erase settings at that address when I set BOOTLOADER_SETTINGS_ADDRESS to 0x0003F000

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

bjorn-spockeli — Thu, 20 Feb 2020 19:51:34 GMT

The debug bootloader takes up 0xC000 bytes( 49152 bytes, 48kB) in addition to the two last flash pages for the bootloader settings and the MBR params page which is 8kB in total , the SoftDevie needs 0x26000 bytes, so the total flash usage will be 0x34000, i.e. 208kB, i.e. there is 48 kB left. The bootloader also reserves 3 flash pages(4kB each), i.e. 12kB for the Peer Manager and FDS below the bootloader, this is set by NRF_DFU_APP_DATA_AREA_SIZE in the sdk_config.h file of the bootloader.

From the linker settings and screenshot you posted it seems like the application needs 0xB860 bytes( 46kB). So if you set the NRF_DFU_APP_DATA_AREA_SIZE to 0 then I think the update should go through with the debug bootloader.

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

nem22 — Thu, 20 Feb 2020 15:37:20 GMT

[quote userid="7571" url="~/f/nordic-q-a/57675/buttonless-dfu-not-flashing-new-firmware-sdk-15-2-0/235497"]Ok, and you're not able to perform a application DFU? Or did you want the device to boot to the application and not stay in the bootloader?[/quote]

Indeed, when I flash app+settings, sd and bootloader the app is supposed to load. I am also not able to perform a dfu through dfutarg.

I have tried the debug bootloader(with logs) and normal bootloader and the behavior is different.

Debug bootloader returns this:

<warning> app: Aborting. Cannot fit new firmware on device
<error> nrf_dfu_validation: Can't find room for update
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x4
<warning> nrf_dfu_ble: DFU request 4 failed with error: 0x4

Non-debug bootloader accepts the zip (so it's not error 0x4 because the data is transfered), disconnects and then the board is not advertising anything

I can even reproduce all this on the devkit, presumably something is wrong in my linker section placement macros.

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

bjorn-spockeli — Thu, 20 Feb 2020 14:24:24 GMT

Aha, that explains everything! If you are using the

then you need to modify some defines in the bootloader source code as the QFAB variant is not "officially" supported in the SDK. Here is the diff for the necessary changes:

diff -Nurb nRF5_SDK_15.3.0_59ac345/components/libraries/bootloader/dfu/nrf_dfu_types.h nRF5_SDK_15.3.0_59ac345-mod/components/libraries/bootloader/dfu/nrf_dfu_types.h
--- nRF5_SDK_15.3.0_59ac345/components/libraries/bootloader/dfu/nrf_dfu_types.h	2019-02-14 17:24:58.000000000 +0000
+++ nRF5_SDK_15.3.0_59ac345-mod/components/libraries/bootloader/dfu/nrf_dfu_types.h	2019-04-23 15:54:10.523901768 +0100
@@ -65,7 +65,6 @@
 extern "C" {
 #endif
 
-
 #define INIT_COMMAND_MAX_SIZE      512 /**< Maximum size of the init command stored in dfu_settings. */
 #define INIT_COMMAND_MAX_SIZE_v1   256 /**< Maximum size of the init command in settings version 1. */
 
@@ -99,6 +98,8 @@
     #define BOOTLOADER_SETTINGS_ADDRESS     (0x0002F000UL)
 #elif defined( NRF52832_XXAA )
     #define BOOTLOADER_SETTINGS_ADDRESS     (0x0007F000UL)
+#elif defined( NRF52832_XXAB )
+    #define BOOTLOADER_SETTINGS_ADDRESS     (0x0003F000UL)
 #elif defined(NRF52840_XXAA)
     #define BOOTLOADER_SETTINGS_ADDRESS     (0x000FF000UL)
 #else
@@ -121,6 +122,8 @@
     #define NRF_MBR_PARAMS_PAGE_ADDRESS         (0x000FE000UL)
 #elif defined(NRF52832_XXAA)
     #define NRF_MBR_PARAMS_PAGE_ADDRESS         (0x0007E000UL)
+#elif defined(NRF52832_XXAB)
+    #define NRF_MBR_PARAMS_PAGE_ADDRESS         (0x0003E000UL)
 #elif defined(NRF52810_XXAA)
     #define NRF_MBR_PARAMS_PAGE_ADDRESS         (0x0002E000UL)
 #elif defined(NRF52811_XXAA)

But it seems that you have done these changes already so that seems good.

[quote user="nem22"]Unfortunately now the device is stuck in bootloader advertising as dfutarg.[/quote]

Ok, and you're not able to perform a application DFU? Or did you want the device to boot to the application and not stay in the bootloader?

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

nem22 — Thu, 20 Feb 2020 13:07:20 GMT

Hello, sorry for not pointing this out earlier but I just realized we use the QFAB version of nrf52832 with only 256kb flash. I was using an older version of nrfjprog and it would let me flash the full 512kb. After updating to latest command line tools it printed errors about data outside valid areas.

I updated linker macros in segger to fit everything below 0x40000 address. Below is an image of everything bootloader, app and SD.

Here's a list of things I've done, have I missed something?

bootloader section placement macros:

FLASH_PH_START=0x0
FLASH_PH_SIZE=0x40000
RAM_PH_START=0x20000000
RAM_PH_SIZE=0x10000
FLASH_START=0x32000
FLASH_SIZE=0xc000
RAM_START=0x200057b8
RAM_SIZE=0xa848

bootloader memory segments:

FLASH RX 0x0 0x40000;RAM RWX 0x20000000 0x8000;mbr_params_page RX 0x0003E000 0x1000;bootloader_settings_page RX 0x0003F000 0x1000;uicr_mbr_params_page RX 0x10001018 0x4;uicr_bootloader_start_address RX 0x10001014 0x4

app section placement macros:

FLASH_PH_START=0x0 
FLASH_PH_SIZE=0x40000
RAM_PH_START=0x20000000
RAM_PH_SIZE=0x10000
FLASH_START=0x26000
FLASH_SIZE=0x1a000
RAM_START=0x20003398
RAM_SIZE=0x4c68

changes in nrf_dfu_types.h

#define BOOTLOADER_SETTINGS_ADDRESS     (0x0003F000UL)
#define NRF_MBR_PARAMS_PAGE_ADDRESS         (0x0003E000UL)

I generated settings with --family NRF52QFAB

Unfortunately now the device is stuck in bootloader advertising as dfutarg.

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

bjorn-spockeli — Thu, 20 Feb 2020 08:41:44 GMT

Hmm, I cant really see any reason for the flash operations on the bootloader settings page to fail on custom boards with nRF52832, but not on nRF52 DKs. Its the same compile bootloader binary that is flashed to both boards right?

When you're using fstorage, you're not writing to the two last flash pages right, i.e. pages with start address 0x7E000 or 0x7F000?

Does all the nRF52832s on the custom boards have the same build code? Its unlikely that this is a HW issue, but I'll just run the build code by QA to check if there are any issues with that particular batch.

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

nem22 — Mon, 17 Feb 2020 12:47:03 GMT

Hello

Yes, the issue happens on every custom board we have.

We use fstorage in the application and it is working on custom boards. DFU also does not work if we only flash bootloader+SD on the device and update through the bootloader only (no buttonless).

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

bjorn-spockeli — Fri, 14 Feb 2020 13:57:05 GMT

Ah, my bad. I now see that the log messages does not fit and it makes sense as nrf_fstorage_write/erase will only queue the flash operations which are asynchronous. So the queuing of the flash operations are ok, but the operation it self( which occurs afterwards) fails with NRF_ERROR_INTERNAL.

The question is then why would the erase and write operations fail with NRF_ERROR_INTERNAL.

Do you see this issue on multiple custom boards or just one?

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

nem22 — Fri, 14 Feb 2020 12:09:57 GMT

Hello Bjorn,

I added a breakpoint before nrf_fstorage_erase() in nrf_dfu_flash, using if(page_addr==0x0007F000) to catch the problematic call. The moment nrf_fstorage_erase() returns, rc is set to 0.

nrf_fstorage_erase() and nrf_fstorage_write() both return 0, the error is printed by dfu_fstorage_evt_handler()

ret_code_t nrf_dfu_flash_erase(uint32_t                 page_addr,
                               uint32_t                 num_pages,
                               nrf_dfu_flash_callback_t callback)
{
    ret_code_t rc;

    NRF_LOG_DEBUG("nrf_fstorage_erase(addr=0x%p, len=%d pages), queue usage: %d",
                  page_addr, num_pages, m_flash_operations_pending);

    if(page_addr==0x0007F000)
      NRF_LOG_INFO("0x0007F000");

    //lint -save -e611 (Suspicious cast)
    rc = nrf_fstorage_erase(&m_fs, page_addr, num_pages, (void *)callback);
    //lint -restore
    NRF_LOG_INFO("nrf_fstorage_erase() returned %d in nrf_dfu_flash", rc);


    if ((NRF_LOG_ENABLED) && (rc == NRF_SUCCESS))
    {
        m_flash_operations_pending++;
    }
    else
    {
        NRF_LOG_WARNING("nrf_fstorage_erase() failed with error 0x%x.", rc);
    }

    return rc;
}

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

bjorn-spockeli — Fri, 14 Feb 2020 10:15:45 GMT

Hi nem22,

to me that makes no sense. How can nrf_fstorage_write() and nrf_fstorage_erase() return return code 0x03, which in turn is returned by nrf_dfu_flash_erase() and nrf_dfu_flash_store() as err_code in settings_write()? A non-zero( i.e. not NRF_SUCCESS) should be caught by the if (err_code != NRF_SUCCESS) check. Can you double check that rc in nrf_dfu_flash_store/erase is not modified between the nrf_fstorage_write/erase call and the return rc statment?

ret_code_t nrf_dfu_flash_store(uint32_t                   dest,
                               void               const * p_src,
                               uint32_t                   len,
                               nrf_dfu_flash_callback_t   callback)
{
    ret_code_t rc;

    NRF_LOG_DEBUG("nrf_fstorage_write(addr=%p, src=%p, len=%d bytes), queue usage: %d",
                  dest, p_src, len, m_flash_operations_pending);

    //lint -save -e611 (Suspicious cast)
    rc = nrf_fstorage_write(&m_fs, dest, p_src, len, (void *)callback);
    //lint -restore

    if ((NRF_LOG_ENABLED) && (rc == NRF_SUCCESS))
    {
        m_flash_operations_pending++;
    }
    else
    {
        NRF_LOG_WARNING("nrf_fstorage_write() failed with error 0x%x.", rc);
    }

    return rc;
}

ret_code_t nrf_dfu_flash_erase(uint32_t                 page_addr,
                               uint32_t                 num_pages,
                               nrf_dfu_flash_callback_t callback)
{
    ret_code_t rc;

    NRF_LOG_DEBUG("nrf_fstorage_erase(addr=0x%p, len=%d pages), queue usage: %d",
                  page_addr, num_pages, m_flash_operations_pending);

    //lint -save -e611 (Suspicious cast)
    rc = nrf_fstorage_erase(&m_fs, page_addr, num_pages, (void *)callback);
    //lint -restore

    if ((NRF_LOG_ENABLED) && (rc == NRF_SUCCESS))
    {
        m_flash_operations_pending++;
    }
    else
    {
        NRF_LOG_WARNING("nrf_fstorage_erase() failed with error 0x%x.", rc);
    }

    return rc;
}

static ret_code_t settings_write(void                   * p_dst,
                                 void const             * p_src,
                                 nrf_dfu_flash_callback_t callback,
                                 nrf_dfu_settings_t     * p_dfu_settings_buffer)
{
    ret_code_t err_code;

    if (memcmp(p_dst, p_src, sizeof(nrf_dfu_settings_t)) == 0)
    {
        NRF_LOG_DEBUG("Destination settings are identical to source, write not needed. Skipping.");
        if (callback != NULL)
        {
            callback(NULL);
        }
        return NRF_SUCCESS;
    }

    if (NRF_DFU_SETTINGS_IN_APP && !settings_forbidden_parts_equal_to_backup((uint8_t *)&s_dfu_settings))
    {
        NRF_LOG_WARNING("Settings write aborted since it tries writing to forbidden settings.");
        // Assuming NRF_DFU_SETTINGS_ALLOW_UPDATE_FROM_APP is configured the same as in bootloader.
        return NRF_ERROR_FORBIDDEN;
    }

    NRF_LOG_DEBUG("Writing settings...");
    NRF_LOG_DEBUG("Erasing old settings at: 0x%08x", p_dst);

    // Not setting the callback function because ERASE is required before STORE
    // Only report completion on successful STORE.
    err_code = nrf_dfu_flash_erase((uint32_t)p_dst, 1, NULL);

    if (err_code != NRF_SUCCESS)
    {
        NRF_LOG_ERROR("Could not erase the settings page!");
        return NRF_ERROR_INTERNAL;
    }

    ASSERT(p_dfu_settings_buffer != NULL);
    memcpy(p_dfu_settings_buffer, p_src, sizeof(nrf_dfu_settings_t));

    err_code = nrf_dfu_flash_store((uint32_t)p_dst,
                                   p_dfu_settings_buffer,
                                   sizeof(nrf_dfu_settings_t),
                                   callback);

    if (err_code != NRF_SUCCESS)
    {
        NRF_LOG_ERROR("Could not write the DFU settings page!");
        return NRF_ERROR_INTERNAL;
    }

    return NRF_SUCCESS;
}

[quote user="nem22"]Is there a SB or jumper on the DK I can use to confirm it's not using the crystal?[/quote]

No, the 32kHz crystal is connected directly to the nRF52832 on the nRF52DK. There are no jumpers or solder bridges in between.

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

nem22 — Wed, 12 Feb 2020 15:59:58 GMT

Hello Bjorn,

I have not been able to reproduce the issue on nRF52 DK, dfu works perfectly, no errors when flashing settings page.

I added log_infos after nrf_dfu_flash_erase and nrf_dfu_flash_store and they are both returning 0 - NRF_SUCCESS

<debug> nrf_dfu_settings: Writing settings...
<debug> nrf_dfu_settings: Erasing old settings at: 0x0007F000
<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0007F000, len=1 pages), queue usage: 1
<debug> nrf_dfu_flash: Flash erase failed (0x3): addr=0x0007F000, len=0x1 bytes, pending 0
<info> nrf_dfu_settings: flash erase err code: 0
<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0007F000, src=0x200074D0, len=440 bytes), queue usage: 1
<debug> nrf_dfu_flash: Flash write failed (0x3): addr=0x0007F000, len=0x1B8 bytes, pending 0
<info> nrf_dfu_settings: flash store err code: 0
<info> nrf_dfu_settings: Backing up settings page to address 0x7E000.
<debug> nrf_dfu_settings: Writing settings...
<debug> nrf_dfu_settings: Erasing old settings at: 0x0007E000
<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0007E000, len=1 pages), queue usage: 1
<debug> nrf_dfu_flash: Flash erase failed (0x3): addr=0x0007E000, len=0x1 bytes, pending 0
<info> nrf_dfu_settings: flash erase err code: 0
<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0007E000, src=0x20007688, len=440 bytes), queue usage: 1
<debug> nrf_dfu_flash: Flash write failed (0x3): addr=0x0007E000, len=0x1B8 bytes, pending 0
<debug> nrf_dfu_req_handler: All flash operations have completed. DFU completed.
<debug> app: Shutting down transports (found: 1)

Is there a SB or jumper on the DK I can use to confirm it's not using the crystal?

Thanks

RE: Buttonless DFU not flashing new firmware SDK 15.2.0

bjorn-spockeli — Wed, 12 Feb 2020 10:43:18 GMT

Hi Nem22,

are you able to reproduce this on a nRF52 DK? If so then I would be great if you could share the project + dfu images so that I could debug it.

I am not seeing any "Could not erase the settings page!" or "Could not write the DFU settings page!" statements in the log output, which I would expect when nrf_fstorage_write() and nrf_fstorage_erase() are returning NRF_ERROR_INTERNAL. Could you setup breakpoints in settings_write() in nrf_dfu_settings.c and see why this is not caught?

static ret_code_t settings_write(void                   * p_dst,
                                 void const             * p_src,
                                 nrf_dfu_flash_callback_t callback,
                                 nrf_dfu_settings_t     * p_dfu_settings_buffer)
{
    ret_code_t err_code;

    if (memcmp(p_dst, p_src, sizeof(nrf_dfu_settings_t)) == 0)
    {
        NRF_LOG_DEBUG("Destination settings are identical to source, write not needed. Skipping.");
        if (callback != NULL)
        {
            callback(NULL);
        }
        return NRF_SUCCESS;
    }

    if (NRF_DFU_SETTINGS_IN_APP && !settings_forbidden_parts_equal_to_backup((uint8_t *)&s_dfu_settings))
    {
        NRF_LOG_WARNING("Settings write aborted since it tries writing to forbidden settings.");
        // Assuming NRF_DFU_SETTINGS_ALLOW_UPDATE_FROM_APP is configured the same as in bootloader.
        return NRF_ERROR_FORBIDDEN;
    }

    NRF_LOG_DEBUG("Writing settings...");
    NRF_LOG_DEBUG("Erasing old settings at: 0x%08x", p_dst);

    // Not setting the callback function because ERASE is required before STORE
    // Only report completion on successful STORE.
    err_code = nrf_dfu_flash_erase((uint32_t)p_dst, 1, NULL);

    if (err_code != NRF_SUCCESS)
    {
        NRF_LOG_ERROR("Could not erase the settings page!");
        return NRF_ERROR_INTERNAL;
    }

    ASSERT(p_dfu_settings_buffer != NULL);
    memcpy(p_dfu_settings_buffer, p_src, sizeof(nrf_dfu_settings_t));

    err_code = nrf_dfu_flash_store((uint32_t)p_dst,
                                   p_dfu_settings_buffer,
                                   sizeof(nrf_dfu_settings_t),
                                   callback);

    if (err_code != NRF_SUCCESS)
    {
        NRF_LOG_ERROR("Could not write the DFU settings page!");
        return NRF_ERROR_INTERNAL;
    }

    return NRF_SUCCESS;
}

Best regards

Bjørn