Can not enter application after readback protect?

[Susan_cfx]

Hi ,

I wirte a python script to download FW to nRF52832 custom board, the FW is the merged file with softdevice（s132_nrf52_7.0.1_softdevice.hex）, bootload, bootload settings, and application,  then setting readback protect. 

After setting readback protect, our board just advertising DfuTarg，it seems enter bootload, didn't enter application.

the python script is as follows,

api = LowLevel.API("NRF52")
    sleep(1)
    try:
        api.open()
        api.connect_to_emu_with_snr(jlink_serial, swd_speed)

        # Program the parsed hex into the device's memory.
        test_program = Hex.Hex(hex_file_path)
        print("Writing %s to device..." % hex_file_path)

        for segment in test_program:
            api.write(segment.address, segment.data, True)

        api.sys_reset()
        api.go()
        api.readback_protect(2)   # or api.write_u32(0x10001208, 0x00,True)

        api.pin_reset()
        api.close()

If I comment out api.readback_protect(2)，our board can enter application and works ok .  
In addtion, I download the same FW with nRF connect Programmer, our board can enter application and works ok.
I download another FW, which is merge file with eddystone example，bootload,softdevice, and bootload settings,
it has the same problem，always enter the bootload, attached please find this FW.
1602.ed_sd_bl_set_app.hex

Please help analyze the reason, thank you very much.

[Vidar Berg]

Hi,

It should not make any difference if readback protection is enabled or not. I also did not manage to replicate this with the hex file you uploaded. Your script looks to be correct, but could you try and see if you get the same result if you use nrfjprog as well?

I used the following commands (nrfjprog version 10.10.0 + JlinkARM.dll 6.84a):

$ nrfjprog --program 1185.ed_sd_bl_set_app.hex --chiperase -r
Parsing hex file.
Erasing user available code and UICR flash areas.
Applying system reset.
Checking that the area to write is not protected.
Programming device.
Applying system reset.
Run.

$ nrfjprog --rbp all
Protected the device against read and debug. Only a --recover, --debugreset,
or --pinreset operations will work from now on.

$ nrfjprog --pinreset
Applying pin reset.

[Susan_cfx]

Hi ,

I use nrfjprog and nRFConnect programmer, it is no problem, the beacon can boot into application.

But If I use custom flashing script and Segger JLink, Sometimes, it can boot into application, and sometimes it  cannot boot into application, still advertising DFUtag. 

It looks there are something different between Nordic flashing tool and our flashing tool.

I learned the buttonless DFU module uses an MCU register (NRF_POWER->GPREGRET) to decide whether to boot to bootloader or application.

Does any GPREGRET-flag needs to be set?    How to modify the bootloader firmware ? Thank you very much.

Best regards,

Susan

[Vidar Berg]

Hi Susan,

The GPREGRET is usally only written to by the CPU when doing buttonless DFU, so I don't think that's related to the problem here. But it's interesting that this occurs only intermidently when programed with your flash tool. Maybe the FW was loaded incorrectly in those cases. As a test, please try to generate the settings page with the --app-boot-validation set to NO_VALIDATION and see if you can replicate the problem then.  This will make the bootloader skip the integrity check of the application image on boot.

Best regards,

Vidar

[Susan_cfx]

Hi Vidar,

According to your suggestion, I generate the bootloader settings page with --app-boot-validation set to NO_VALIDATION, and flash the final merged firmware many times, all succeed, no replicate the problem.  If not add this command NO_VALIDATION, most of time failed and advertised DfuTarg.

nrfutil.exe settings generate --no-backup --family NRF52 --application %3 --app-boot-validation NO_VALIDATION --application-version %1 --bootloader-version %2 --bl-settings-version 2 bootloader_settings.hex

 If add the integrity check of the application image, how to solve this problem? 

By the way,  If I set --bl-settings-version 1, prompt error: Invalid value for bl_settings_version: Bootloader settings version 1 does not support boot validation.

I have to modify --bl-settings-version to 2,  why?

Looking forward your reply, thank you very much.

Best regards,

Susan

[Vidar Berg]

Hi Susan,

Thanks for checking. So, the application image appears to be corrupted as the integrity check is failing.

I noticed you are not doing any post validation in your programming script to see if the image was programmed correctly. Can you try to program the hex file as shown in the example script here: https://github.com/NordicSemiconductor/pynrfjprog/blob/master/pynrfjprog/examples/highlevel_program_hex.py and see if it gives the same result?

You may also be impacted by a bug in merghex if you are using the 10.12.x release as reported in this post: https://devzone.nordicsemi.com/f/nordic-q-a/69940/nrf52840---problems-merging-and-flashing-secure_bootloader_uart_mbr_pca10056-and-ble_app_uart_pca10056_s140/286885

Susan_cfx said:

I have to modify --bl-settings-version to 2,  why?

 SDK v15.3.0 and onwards uses the new BL settings format, which must be indicated by setting the --bl-settings-version to '2'.

 Best regards,

Vidar