Custom uart bootloader doesn't jump to application

[dbagan]

Hi!

This is what I'm using:

-SoftDevice S113 v7.0.1

-SDK v17.0.0.0

-SES v4.52c

-nRF52840

I've created a custom buttonless uart bootloader based on the "secure_bootloader_uart" for the nRF52480 without any of the security and encryption functions because I just don't need them for my application.

I've debbuged the bootloader and it seems that is working, but I cannot make it to jump to my application once the application is received and flashed.

The flash mapping is:

MBR --> 0x0000 0000 to 0x0000 1000

SoftDevice  --> 0x0000 1000 to 0x0001 C000

Application --> 0x0001 C000 to 0x0008 9000

Bootloader --> 0x000F 8000 to 0x000F E000

Bootloader settings --> 0x000F F000 to 0x0010 0000   (Custom bootloader info)

When the bootloader checks that all code placed in flash, SoftDevide and Application, are valid, then it calls the function "nrf_bootloader_app_start()"

After calling this function it should jump to SoftDevice and then to my application, but the system reboots and executes again the bootloader and it tries to jump again in an endless loop.

I've tested my application with the orignal "secure_bootloader_uart" and it works, so afaik the application is ok. I've also checked that flash addresses on where the application and SoftDevice are placed are the same that the ones used by my Bootloader.

Is there anyone who can help me? Thank you

 

Regards,

David

[Hung Bui]

Hi Dbagan, 

I'm sorry for the late reply. 

I'm  not sure what could be wrong here. Maybe you would need to test without the softdevice. So that the bootloader will just jump to the application located right behind the MBR (the place where the softdevice should be). Make sure you flash the MBR + BL.

If that work then we need to look into why the softdevice didn't jump to the application. 

If you break the code you should be able to find where the PC counter is and based on the location the PC we can check if it's the softdevice or bootloader or application area. 

[dbagan]

Hi Hung Bui,

It's ok, don't worry.
Before testing your proposal I've done another test

Test1:
- Create a hex file with: MBR + S113 + myApp, then flash and execute it.
- The program runs correctly

Test2:
- Create a hex file with: MBR + BL then flash and execute it.
- The BL is exeucted and ready to receive SoftDevice and application code
- I've downloaded the SoftDevice (S113 without the MBR) and the application throught the BL app
- After all code is downloaded the BL executes the new code, but my app doesn't run

I decied to check if flash contents in both tests are the same or if there are any difference between them.
I've used the nrfjprog to read the flash content from Test2 and I've compared it with the Test1 hex file. What I've seen is:

- Both SoftDevice and application partitions have the same data --> good
- Test2 MBR has the jumping addresses placed on 0xFF8 and 0xFFC meanwhile Test1 MBR have 0xFFFFFFFF in both addresses --> The expected, because one has a BL and the other no

Seeing this, I've removed MBR jumping addresses (0xFF8 and 0xFFC) from Test2's hex file and I flash it via nrfjprog to the nRF52. After flashing the modified hex file, my application runs

Conclusion?
If I'm not wrong the MBR, S113 and myApp are correct and well placed on flash and there are no issues with them.

I think that the problem is focused on the BL app. I suppose that there is a missing step in my BL. I don't know, probably I missed to erase or config something into the UICR register or anything else. 

I hope this information will give you some light. Thank you.

Regards,

David

[Hung Bui]

Hi David, 

It seems that the issue is around the bootloader on how it jumped to the softdevice. 

Please check and make sure that all the steps we do in our example bootloader has been done properly in your custom bootloader. 

Please try what I suggested to do DFU update with a blinky (for example) application that start at address 0x1000 (instead of the softdevice) 

Did you initialize the softdevice in the bootloader, for some reason ? 

[dbagan]

Hi Hung,

I'll make a blinky hex file and do what you said.

No. Inside the bootloader I do not initialize the SoftDevice.

I do not use or call any SoftDevice function inside the BL.

Regards,

David

Update:

I've generated a simply blinky program starting at address 0x1000.

I flashed the MBR+BL and downloaded via serie the blinky hex file. The BL doesn't jump to application, so there's something related to BL that I'm not doing correctly 

[Hung Bui]

You may want to break and check where the PC counter jumps to. 

[dbagan]

Hi Hung,

sorry for my late response.

I've been checking the PC in both applications: my BL and the original secure BL. As you might expectected is that both PC are not equal. My BL PC jumps to a wrong address although the address set to the function is correct. Why? I don't know

I debugged the original BL step by step and I did the same with my BL. Both BL applies the same jump destination address, but the original BL jumps correctly and mine no. The only difference between both projects is the optimization level. 

My application is too small, so I don't need to apply any optimization to fit it in the bootloader area, meanwhile the original BL needs to apply a Level 1 optimization in order to fit. I decided to apply the same optimization level into my BL application and guess what happened.... it worked 

I don't know why, but for my it's not normal.

Do you have any explanation for that behaviour?

Regards,

David

[Hung Bui]

Hi David, 
I had a quick test here with the open USB bootloader (debug version) for PCA10059 with optimization level set to 0. I don't see any issue with it jumping to the application. Could you try to test on your side ? Which IDE did you use for compiling? 

What I can suggest is to try simplify the bootloader to very simple one, just have the code to jump to application and nothing else. So when you test it you flash MBR, App, BL (so no DFU feature) just to check the difference between your code and the stock bootloader .