Secure Buttonless DFU Problem on nRF52832 Soft Device 112

[AliMahmood123]

Hello

I am facing problem from many days on buttonless DFU.

Whoever from Nordic approaches kindly give a customized solution rather than other links. I have almost gone through all the links with none exactly matching my issue. I will be really thankful.

I am trying to perform Buttonless DFU on nRF52832 512 kB version on nRF DK. I am using SDK 112 v7 (the latest one) and latest versions of nRF util, etc.. as well. Although I am using SDK 16.

My first act was to convert my application from s132 to S112 on nRF52832 a few months ago as I was using default ble_app_blinky as my base. A kind person from nordic helped me on the issue since the memory mapping on s112 pca10040 example is that of nRF52810

Now for DFU, I am supposed to convert the bootloader s112 example on nRF52810 to nRF52832 by editing the project file for library and memory mapping right?

I used the following links:

1) https://infocenter.nordicsemi.com/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v15.3.0%2Flib_bootloader.html

2) https://devzone.nordicsemi.com/nordic/short-range-guides/b/software-development-kit/posts/getting-started-with-nordics-secure-dfu-bootloader#h61sjziauupw1j397q9s9ldr01q4j6d5

3) https://devzone.nordicsemi.com/f/nordic-q-a/41386/guide-to-allocate-the-amount-of-ram-rom-i-need

and my project application  + BL + setting + SD oombined well using merge hex. It  went into DFU mode on start up and I started OTA 

OTA package is received successfully and after 100% OTA the DK rebooted and nRF log said bootloader not found:

My guess is something is wrong in my conversions as I am trying to convert from s112 nRF52810 examples to nrf 52832 the following projects:

1) Bootloader S112 example

2) I OTA ble_app_blinky s112 example and change it's memory mapping and nrf52832 libraries as we have to keep the same soft device in OTA

Please note from above screenshot that my OTA is fully complete (100%)

I am using the following memory mapping:

1) Bootloader example: nrf52832 s112

linker_section_placement_macros="FLASH_PH_START=0x0;FLASH_PH_SIZE=0x80000;RAM_PH_START=0x20000000;RAM_PH_SIZE=0x10000;FLASH_START=0x78000;FLASH_SIZE=0x6000;RAM_START=0x20005968;RAM_SIZE=0xa698"

linker_section_placements_segments="FLASH RX 0x0 0x80000;RAM RWX 0x20000000 0x10000;uicr_bootloader_start_address RX 0x10001014 0x4;uicr_mbr_params_page RX 0x10001018 0x4;mbr_params_page RX 0x0007E000 0x1000;bootloader_settings_page RX 0x0007F000 0x1000"

2) Base Application FW - nrf52832 s112

linker_section_placement_macros="FLASH_PH_START=0x0;FLASH_PH_SIZE=0x80000;RAM_PH_START=0x20000000;RAM_PH_SIZE=0x10000;FLASH_START=0x26000;FLASH_SIZE=0x5a000;RAM_START=0x200022f0;RAM_SIZE=0xdd10"

linker_section_placements_segments="FLASH RX 0x0 0x80000;RAM RWX 0x20000000 0x10000"

3) The OTA package - S112 nRF52832

linker_section_placement_macros="FLASH_PH_START=0x0;FLASH_PH_SIZE=0x80000;RAM_PH_START=0x20000000;RAM_PH_SIZE=0x10000;FLASH_START=0x26000;FLASH_SIZE=0x5a000;RAM_START=0x20001ae0;RAM_SIZE=0x4520"

linker_section_placements_segments="FLASH RX 0x0 0x80000;RAM RWX 0x20000000 0x10000"

Here are my nrfutil commands -

1) Bootloader settings and hex merges

BOOTLOADER SETTINGS
nrfutil settings generate --family NRF52 --application E_MCB_Project.hex --application-version 1 --bootloader-version 1 --bl-settings-version 2 bootloader_settings.hex

nrfutil settings generate --family NRF52 --application E_MCB_Project.hex --application-version 1 --bootloader-version 1 --bl-settings-version 2 --app-boot-validation VALIDATE_GENERATED_CRC --softdevice s112_sd.hex --sd-boot-validation VALIDATE_GENERATED_CRC bootloader_settings.hex

SETTING AND BOOTLOADER MERGE
mergehex -m secure_bootloader.hex bootloader_settings.hex -o bootloaderAndSettings.hex

PACKAGE HEX FROM ABOVE
mergehex -m bootloaderAndSettings.hex s112_sd.hex -o random.hex

PACKAGE HEX FROM ABOVE 2
mergehex -m random.hex E_MCB_Project.hex -o package_EMCB.hex

Here are commands I used for OTA package

echo "## Creating a FW.zip package that can be used to update the FW on the DK"

nrfutil pkg generate --application blinky_112_2.hex --application-version 61 --application-version-string "1.0.61" --hw-version 52 --sd-req 0xCD --sd-id 0xCD --softdevice s112_sd.hex --key-file private.pem fw81_MCB.zip

echo.

sd_112. hex is default  soft devicce 112 I just renamed it rest is self explanatory.

I have provided complete details and I need help on this. Please provide a customized solution and please dont divert me to other links. Its not a huge issue the OTA happens perfectly  but after reboot it cannot find the bootloader

I am assuming its something withbootloader settings or bootloader memory mapping

Regards

Ali

[AliMahmood123]

Hi Vidar

I like this Idea, I shall try it and update you soon. I hope you read the OP and all the prevailing discussions.

Your idea was great Vidar, but can I get back to Hung with this if this doesnt work? He knows complete history would save you a  lot of trouble?

Ali

[AliMahmood123]

Hi Vidar. I tried your project's hex file.I merged it with my application and ran it. Same result as before.

I really need guidance here. Why would it go to 2E000 address when I set address as 7E000. This issue is being delayed at work as well.

Ali

[Vidar Berg]

Hi Ali,

The bootloader also uses the BOOTLOADER_SETTINGS_ADDRESS and NRF_MBR_PARAMS_PAGE_ADDRESS symbols defined in nrf_dfu_types.h, and the fact that it says the settings page is *backed* up to 0x2E000 indicates that you are still building the project for NRF52810_XXAA.

Attached below is the bootloader project I configured earlier and a version of the ble_app_blinky example thatI have modified to include the buttonless DFU mechanism. Please try DFU with these. Test image is included so you don't have to generate the zip file.

nRF5_SDK16.0.0_examples.zip

[AliMahmood123]

Hi Vidar. It worked! Thank God.

Thanks a lot for your helped Vidar. It means a lot to me that you sent me a custom bootloader application and all your help that helped me get through this. I'm indebted to you. Thanks a lot to Hung as well.

I had some problems in DFU after your steps (invalid object error) because of invalid signature. Turns out I was signing with .pem key. When I created new keys nrfutil generated the private key in .key format. I dont know how this works but DFU used to work with me with .pem format

However, thanks a lot once again. Should I verify this answer?

Also, I have a few questions before we part ways

1) What did you do different with the ble debug application? Perhaps some changes in the SDK because i could notice some changes

2) I did OTA with your blinky application as well as my own. It worked perfectly for both so looks like there was some problem with bootloader application. I have spent more than a month on this. I would like to know what went wrong

Warm Regards

Ali

[Vidar Berg]

Hello Ali,

I'm glad to hear that it finally worked.

AliMahmood123 said:

I had some problems in DFU after your steps (invalid object error) because of invalid signature. Turns out I was signing with .pem key. When I created new keys nrfutil generated the private key in .key format. I dont know how this works but DFU used to work with me with .pem format

 Both formats should work. I used *.pem to generate the test image as you can see from the command I used:

nrfutil pkg generate --debug-mode --application ble_app_blinky_pca10040_s112.hex --key-file private.pem ble_app_blinky.zip

1) I did not modify the SDK itself. And the bootloader 'pca10040_s112_ble_debug' configuration is nearly identical with the original 'pca10040_s132_ble_debug' one. I just made a copy of the original "secure_bootloader_ble_s132_pca10040_debug.emProject" file and used a text editor to replace the occurense of "s132" with "s112".

The blinky app required a bit more work as I had to add the buttonless mechanism. I modified main.c and added the following source files:

    <folder Name="nRF_SVC">
      <file file_name="../../../../../../components/libraries/bootloader/dfu/nrf_dfu_svci.c" />
    </folder>
    <folder Name="nRF_DFU">
      <file file_name="../../../../../../components/ble/ble_services/ble_dfu/ble_dfu.c" />
      <file file_name="../../../../../../components/ble/ble_services/ble_dfu/ble_dfu_bonded.c" />
      <file file_name="../../../../../../components/ble/ble_services/ble_dfu/ble_dfu_unbonded.c" />
    </folder>

Pre-processor definitions:

c_preprocessor_definitions="NRF_DFU_SVCI_ENABLED;BL_SETTINGS_ACCESS_ONLY;NRF_DFU_TRANSPORT_BLE=1"

And include paths:

c_user_include_directories="../../../../../../components/libraries/bootloader;../../../../../../components/libraries/bootloader/ble_dfu;../../../../../../components/libraries/bootloader/dfu"

2) It seemed like you were building to project for nRF52810 instead of nRF52382, so that could be one explanation.