Nrf52832 ble_app_uart DFU No bootloader found(NRF_ERROR_NO_MEM) | SDK 15.3.0 | Soft device S132 6.1.1

[Yogeshwaran]

I am trying to integrate buttonless DFU with FDS in ble_app_uart example from sdk 15.3.0. Merge hex was done properly which includes bootloader_settings.hex+bootloader.hex+softdevice.hex+application.hex and programmed using JLink prior to that i erased the chip using nrfjprog -f nrf52 -e command successfully. Then i resetted the board, application started and reaches ble_dfu_buttonless_async_svci_init() which gives NRF_ERROR_NO_MEM error. I went into debug mode and found uint32_t bootloader address was 0xFFFFFFFF. I checked UICR register value using JLink command -> mem8 0x10001014 4 which results 0xFFFFFFFF. The bootloader i programmed was debug version and i got the below prints.

PRINT_START

00> <info> app: Inside main
00>
00> <debug> app: In nrf_bootloader_init
00>
00> <debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...
00>
00> <debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
00>
00> <debug> nrf_dfu_settings: Using settings page.
00>
00> <debug> nrf_dfu_settings: Copying forbidden parts from backup page.
00>
00> <info> nrf_dfu_settings: Old settings page detected. Upgrading info.
00>
00> <debug> nrf_dfu_settings: Writing settings...
00>
00> <debug> nrf_dfu_settings: Erasing old settings at: 0x0007F000
00>
00> <debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0007F000, len=1 pages), queue usage: 0
00>
00> <debug> nrf_dfu_flash: Flash erase success: addr=0x0007F000, pending 0
00>
00> <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0007F000, src=0x20009188, len=896 bytes), queue usage: 1
00>
00> <debug> nrf_dfu_flash: Flash write success: addr=0x0007F000, pending 0
00>
00> <info> nrf_dfu_settings: Backing up settings page to address 0x7E000.
00>
00> <debug> nrf_dfu_settings: Writing settings...
00>
00> <debug> nrf_dfu_settings: Erasing old settings at: 0x0007E000
00>
00> <debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0007E000, len=1 pages), queue usage: 1
00>
00> <debug> nrf_dfu_flash: Flash erase success: addr=0x0007E000, pending 0
00>
00> <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0007E000, src=0x20009508, len=896 bytes), queue usage: 1
00>
00> <debug> nrf_dfu_flash: Flash write success: addr=0x0007E000, pending 0
00>
00> <debug> app: Enter nrf_bootloader_fw_activate
00>
00> <info> app: No firmware to activate.
00>
00> <debug> nrf_dfu_validation: CRC check of app failed. Return 1
00>
00> <debug> app: App is valid
00>
00> <info> nrf_dfu_settings: Backing up settings page to address 0x7E000.
00>
00> <debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
00>
00> <debug> app: Running nrf_bootloader_app_start with address: 0x00001000
00>
00> <debug> app: Disabling interrupts. NVIC->ICER[0]: 0x0
00>
00> <info> app: Setting vector table to bootloader: 0x00072000
00>
00> <info> app: Setting vector table to main app: 0x00026000
00>

<debug> No bootloader found

00> <error> app: Fatal error
00>

PRINT_ENDS

The application Linker script has 

FLASH_PH_START=0x0

FLASH_PH_SIZE=0x80000

RAM_PH_START=0x20000000

RAM_PH_SIZE=0x10000

FLASH_START=0x26000

FLASH_SIZE=0x53000

RAM_START= 0x200030E0

RAM_SIZE=0xCF20

I don't know why UICR has 0xFFFFFFFF value and i know that because this my application stucks in Fatal error. Why UICR is not programmed properly?

I am attaching nrf52832_xxaa_s132.map(from pca10040_ble_debug\armgcc\build), bootloader_settings.hex, bootloader.hex, application.hex and sd_app_boot.hex for reference.  74862.nrf52832_xxaa_s132.map6567.bootloader_settings.hex1667.nrf52832_xxaa_s132.hex8524.sd_app_boot.hex0513.ble_app_uart_pca10040_s132.hex

[Yogeshwaran]

Actually this issue is happening because i am using segger and it erases the bootloader if going into debug mode. The issue actually comes when buttonless_service initialization happens. Hence i want to modify the NRF_POWER->GPREGRET = BOOTLOADER_DFU_START and restarted the device so i can able to see Dfu_Targ in nrf_connect app. But Now if i upload an app.zip file which i made using nrfutil along with private key i am getting signature failed error in bootloader while uploading app.zip. The bootloader has dfu_public_key.c and i modified the file by using private key. So what could be the issue?

[Einar Thorsrud]

Hi,

Referring to the initial question first, I want to mention that  SDK 15.3 introduced a new location for the bootloader start address. It is no longer in the UICR (though some code still incorrectly refers to "uicr" or "UICR"), but instead it is in the end of the first page, the MBR params page. You can see that MBR_BOOTLOADER_ADDR is set to 0xFF8 in nrf_mbr.h, and this is what is used. So the bootloader start address does not need to be in the UICR.

Yogeshwaran said:

But Now if i upload an app.zip file which i made using nrfutil along with private key i am getting signature failed error in bootloader while uploading app.zip. The bootloader has dfu_public_key.c and i modified the file by using private key. So what could be the issue?

Good question. Based on what you wrote it should work, but perhaps there has been a mixup? Can you double check that you build the bootloader with the correct public key and that this is the bootloader you uploaded to the device? And then verify that you signed the DFU image using the correct corresponding private key?

[Yogeshwaran]

Yeah my bad i messed up with public and private keys. Now i generated both again and placed into the right directory(this was the mistake) to make it work. The new issue happening here is after successful DFU upload the device restarts and i got Fatal error after some serial prints. I programmed again device with nrfjprog -f nrf52 --program --sectorerase then also Fatal error comes at the same place. If erase full flash that means nrfjprog -f nrf52 -e then nrfjprog -f nrf52 --program --sectorerase, it runs the app properly. Again if do DFU it stucks at Fatal error? After this if i upload using JLink without erasing the full flash the app is not running.

[Yogeshwaran]

After Dfu upload i am getting error value 11 at fds_init() function. what does it mean?

[Einar Thorsrud]

Hi,

If an FDS call returns 11 this is FDS_ERR_NO_PAGES, and this is probably because the FDS pages has been corrupted. As this happens after a DFU operation I suspect this is because the flash area was written to during the DFU update. This can happen if the FDS pages are not properly reserved in the bootloader (i.e. the bootloader does not know it cannot use them for temporary storage). How many FDS pages have you configured in your applications sdk_config.h (FDS_VIRTUAL_PAGES)? And how many FDS pages have you reserved in the bootloader's sdk_config.h (NRF_DFU_APP_DATA_AREA_SIZE)?

[Yogeshwaran]

FDS_VIRTUAL_PAGES in application sdk_config.h was 80 and 

NRF_DFU_APP_DATA_AREA_SIZE 12288 in pca10040_ble_debug sdk_config.h

[Einar Thorsrud]

Then there is a clear mismatch. You use 80 FDS pages, but you only reserve 12288 / 0x1000 = 3 pages. So you must increase NRF_DFU_APP_DATA_AREA_SIZE to 0x1000 * 80 = 327680.