Secure Buttonless DFU Problem on nRF52832 Soft Device 112

[AliMahmood123]

Hello

I am facing problem from many days on buttonless DFU.

Whoever from Nordic approaches kindly give a customized solution rather than other links. I have almost gone through all the links with none exactly matching my issue. I will be really thankful.

I am trying to perform Buttonless DFU on nRF52832 512 kB version on nRF DK. I am using SDK 112 v7 (the latest one) and latest versions of nRF util, etc.. as well. Although I am using SDK 16.

My first act was to convert my application from s132 to S112 on nRF52832 a few months ago as I was using default ble_app_blinky as my base. A kind person from nordic helped me on the issue since the memory mapping on s112 pca10040 example is that of nRF52810

Now for DFU, I am supposed to convert the bootloader s112 example on nRF52810 to nRF52832 by editing the project file for library and memory mapping right?

I used the following links:

1) https://infocenter.nordicsemi.com/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v15.3.0%2Flib_bootloader.html

2) https://devzone.nordicsemi.com/nordic/short-range-guides/b/software-development-kit/posts/getting-started-with-nordics-secure-dfu-bootloader#h61sjziauupw1j397q9s9ldr01q4j6d5

3) https://devzone.nordicsemi.com/f/nordic-q-a/41386/guide-to-allocate-the-amount-of-ram-rom-i-need

and my project application  + BL + setting + SD oombined well using merge hex. It  went into DFU mode on start up and I started OTA 

OTA package is received successfully and after 100% OTA the DK rebooted and nRF log said bootloader not found:

My guess is something is wrong in my conversions as I am trying to convert from s112 nRF52810 examples to nrf 52832 the following projects:

1) Bootloader S112 example

2) I OTA ble_app_blinky s112 example and change it's memory mapping and nrf52832 libraries as we have to keep the same soft device in OTA

Please note from above screenshot that my OTA is fully complete (100%)

I am using the following memory mapping:

1) Bootloader example: nrf52832 s112

linker_section_placement_macros="FLASH_PH_START=0x0;FLASH_PH_SIZE=0x80000;RAM_PH_START=0x20000000;RAM_PH_SIZE=0x10000;FLASH_START=0x78000;FLASH_SIZE=0x6000;RAM_START=0x20005968;RAM_SIZE=0xa698"

linker_section_placements_segments="FLASH RX 0x0 0x80000;RAM RWX 0x20000000 0x10000;uicr_bootloader_start_address RX 0x10001014 0x4;uicr_mbr_params_page RX 0x10001018 0x4;mbr_params_page RX 0x0007E000 0x1000;bootloader_settings_page RX 0x0007F000 0x1000"

2) Base Application FW - nrf52832 s112

linker_section_placement_macros="FLASH_PH_START=0x0;FLASH_PH_SIZE=0x80000;RAM_PH_START=0x20000000;RAM_PH_SIZE=0x10000;FLASH_START=0x26000;FLASH_SIZE=0x5a000;RAM_START=0x200022f0;RAM_SIZE=0xdd10"

linker_section_placements_segments="FLASH RX 0x0 0x80000;RAM RWX 0x20000000 0x10000"

3) The OTA package - S112 nRF52832

linker_section_placement_macros="FLASH_PH_START=0x0;FLASH_PH_SIZE=0x80000;RAM_PH_START=0x20000000;RAM_PH_SIZE=0x10000;FLASH_START=0x26000;FLASH_SIZE=0x5a000;RAM_START=0x20001ae0;RAM_SIZE=0x4520"

linker_section_placements_segments="FLASH RX 0x0 0x80000;RAM RWX 0x20000000 0x10000"

Here are my nrfutil commands -

1) Bootloader settings and hex merges

BOOTLOADER SETTINGS
nrfutil settings generate --family NRF52 --application E_MCB_Project.hex --application-version 1 --bootloader-version 1 --bl-settings-version 2 bootloader_settings.hex

nrfutil settings generate --family NRF52 --application E_MCB_Project.hex --application-version 1 --bootloader-version 1 --bl-settings-version 2 --app-boot-validation VALIDATE_GENERATED_CRC --softdevice s112_sd.hex --sd-boot-validation VALIDATE_GENERATED_CRC bootloader_settings.hex

SETTING AND BOOTLOADER MERGE
mergehex -m secure_bootloader.hex bootloader_settings.hex -o bootloaderAndSettings.hex

PACKAGE HEX FROM ABOVE
mergehex -m bootloaderAndSettings.hex s112_sd.hex -o random.hex

PACKAGE HEX FROM ABOVE 2
mergehex -m random.hex E_MCB_Project.hex -o package_EMCB.hex

Here are commands I used for OTA package

echo "## Creating a FW.zip package that can be used to update the FW on the DK"

nrfutil pkg generate --application blinky_112_2.hex --application-version 61 --application-version-string "1.0.61" --hw-version 52 --sd-req 0xCD --sd-id 0xCD --softdevice s112_sd.hex --key-file private.pem fw81_MCB.zip

echo.

sd_112. hex is default  soft devicce 112 I just renamed it rest is self explanatory.

I have provided complete details and I need help on this. Please provide a customized solution and please dont divert me to other links. Its not a huge issue the OTA happens perfectly  but after reboot it cannot find the bootloader

I am assuming its something withbootloader settings or bootloader memory mapping

Regards

Ali

[AliMahmood123]

Hi Hung

Are you sure we have to debug bootloader. That seems trivial task. What are your thoughts on this line though:

"Based on the settings stored in the bootloader settings page, the bootloader determines: whether the application exists, and the location of it. The secure bootloader performs a signature verification of the application before booting into it".

Am I generating the settings in the wrong way if the settings tell where is the BL where is the APP?

[AliMahmood123]

Also for debugging I didnt get it how should I change the addresses exactly. Also how to build without optimization?

Ali

[Hung Bui]

The bootloader is the same as any other application. I assume you have debug normal application and stepped into the code ?
To change the optimization level you go into project setting/option , go to Code Generation and select Optimization level NONE ( if you use Segger embedded Studio)

By stepping into the code you should be able to find if the bootloader settings CRC value doesn't match or if there is something else goes wrong. 

[AliMahmood123]

Yes Hung of course I can debug. By trivial I meant if I am debugging the bootloader as an application separately means I erase the flash and debug it right?

If Im debugging it separately then how can I be sure CRC went wrong when debugger tried to boot application after OTA right?

Kindly answer this question for me.

Meanwhile I will debug and share findings with you

Ali

[AliMahmood123]

Hi Hung

I tried what you said. Took me hours but I could not debug the debug version of secure bootloader. Gave me all sorts of errors on optimization and nrf_log_enabled

However I commented this line in bootloader to create full package via merge hex and it worked fine:

if (s_dfu_settings.bank_0.bank_code != NRF_DFU_BANK_VALID_APP)
{
NRF_LOG_INFO("Boot validation failed. No valid app to boot.");
return false;
}

But after 2 OTAs same problem started happening. I could see dual applications in nRF connect memory map!

I think there is CRC problem based on the line I shared with you.

I tried to generate boootloader settings without validation then it should have worked right?

nrfutil settings generate --family NRF52 --application E_MCB_Project.hex --application-version 1 --bootloader-version 1 --bl-settings-version 2 bootloader_settings.hex

I used above line

Same problem persisted if I left the validation part uncommented in bootloader project.

I think the issue is pinpoint now. Can you please guide me from here please?

I also have 2 questions:

1) What does the validation commands during bootoader settings do. because settings without validation gave me the same error?

2) When is CRC calculated and how? This question is bassically to solve the main problem

Really thanks again for your help Hung. I hope you can help more and we can solve this problem allthe way!

Ali