Firmware not starting after DFU

[koldybin]

Hello, I have the following question. I'm trying to program my firmware via DFU Bootloader and nRF Connect (smartphone). That works perfectly with the test board SparkFun nRF52832 Breakout. But if I do the same with my own hardware, the firmware won't start. The upload goes perfectly, but DFU will start again in two seconds. If the firmware is flashed without a DFU, it works without a problem. It looks like the problem is with the hardware. But I compared everything and found no mistake. What could be causing the error in the hardware that does not allow the flashed firmware to start?

SDK_17.0.0_9d13099, nRF52832

Schematic board SparkFun

Thanks in advance

[Edvin]

Hello,

I don't know what sort of bootloader you are using, but please check out the equvialent _debug project, such as:

SDK\examples\dfu\secure_bootloader\pca10040_uart_debug

And monitor the RTT log. What does it say? When the DFU is finished, but it restarts in DFU mode, does the RTT log say anything about why the DFU mode was re-entered?

What changes did you do to the bootloader project? Have you tested a bootloader from an unmodified SDK?

Best regards,

Edvin

[koldybin]

Sorry Edvin,

This is the last part of log when I use DFU with debug function:

.......

00> <debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0002C000, len=1 pages), queue usage: 1
00> 
00> <debug> nrf_dfu_req_handler: Creating object with size: 1324. Offset: 0x00006000, CRC: 0x12CFD00B
00> 
00> <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
00> 
00> <debug> nrf_dfu_flash: Flash erase success: addr=0x0002C000, pending 1
00> 
00> <debug> nrf_dfu_ble: Buffer 0x200082AC acquired, len 244 (244)
00> 
00> <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (data)
00> 
00> <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0002C000, src=0x200082AC, len=244 bytes), queue usage: 1
00> 
00> <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
00> 
00> <debug> nrf_dfu_flash: Flash write success: addr=0x0002C000, pending 1
00> 
00> <debug> nrf_dfu_ble: Freeing buffer 0x200082AC
00> 
00> <debug> nrf_dfu_ble: Buffer 0x200082AC acquired, len 244 (244)
00> 
00> <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (data)
00> 
00> <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0002C0F4, src=0x200082AC, len=244 bytes), queue usage: 1
00> 
00> <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
00> 
00> <debug> nrf_dfu_flash: Flash write success: addr=0x0002C0F4, pending 1
00> 
00> <debug> nrf_dfu_ble: Freeing buffer 0x200082AC
00> 
00> <debug> nrf_dfu_ble: Buffer 0x200082AC acquired, len 244 (244)
00> 
00> <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (data)
00> 
00> <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0002C1E8, src=0x200082AC, len=244 bytes), queue usage: 1
00> 
00> <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
00> 
00> <debug> nrf_dfu_flash: Flash write success: addr=0x0002C1E8, pending 1
00> 
00> <debug> nrf_dfu_ble: Freeing buffer 0x200082AC
00> 
00> <debug> nrf_dfu_ble: Buffer 0x200082AC acquired, len 244 (244)
00> 
00> <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (data)
00> 
00> <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0002C2DC, src=0x200082AC, len=244 bytes), queue usage: 1
00> 
00> <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
00> 
00> <debug> nrf_dfu_flash: Flash write success: addr=0x0002C2DC, pending 1
00> 
00> <debug> nrf_dfu_ble: Freeing buffer 0x200082AC
00> 
00> <debug> nrf_dfu_ble: Buffer 0x200082AC acquired, len 244 (244)
00> 
00> <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (data)
00> 
00> <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0002C3D0, src=0x200082AC, len=244 bytes), queue usage: 1
00> 
00> <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
00> 
00> <debug> nrf_dfu_flash: Flash write success: addr=0x0002C3D0, pending 1
00> 
00> <debug> nrf_dfu_ble: Freeing buffer 0x200082AC
00> 
00> <debug> nrf_dfu_ble: Buffer 0x200082AC acquired, len 104 (244)
00> 
00> <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (data)
00> 
00> <debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0002C4C4, src=0x200082AC, len=104 bytes), queue usage: 1
00> 
00> <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
00> 
00> <debug> nrf_dfu_flash: Flash write success: addr=0x0002C4C4, pending 1
00> 
00> <debug> nrf_dfu_ble: Freeing buffer 0x200082AC
00> 
00> <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_CRC_GET (data)
00> 
00> <debug> nrf_dfu_req_handler: Offset:25900, CRC:0x2A9E2C99
00> 
00> <debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
00> 
00> <debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_EXECUTE (data)
00> 
00> <debug> nrf_dfu_req_handler: Whole firmware image received. Postvalidating.
00> 
00> <debug> nrf_dfu_validation: Hash verification. start address: 0x26000, size: 0x652C
00> 
00> <debug> nrf_dfu_validation: Invalidating old application in bank 0.
00> 
00> <debug> nrf_dfu_settings: Writing settings...
00> 
00> <debug> nrf_dfu_settings: Erasing old settings at: 0x0007F000
00> 
00> <debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0007F000, len=1 pages), queue usage: 1<info> app: Inside main
00> 
00> <debug> app: In nrf_bootloader_init
00> 
00> <debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...
00> 
00> <debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
00> 
00> <debug> nrf_dfu_settings: Using settings page.
00> 
00> <debug> nrf_dfu_settings: Copying forbidden parts from backup page.
00> 
00> <debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
00> 
00> <info> nrf_dfu_settings: Backing up settings page to address 0x7E000.
00> 
00> <debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
00> 
00> <debug> app: Enter nrf_bootloader_fw_activate
00> 
00> <info> app: No firmware to activate.
00> 
00> <info> app: Boot validation failed. No valid app to boot.
00> 
00> <debug> app: DFU mode because app is not valid.
00> 
00> <info> nrf_bootloader_wdt: WDT is not enabled
00> 
00> <debug> app: in weak nrf_dfu_init_user
00> 
00> <debug> app: timer_stop (0x20005984)
00> 
00> <debug> app: timer_activate (0x20005984)
00> 
00> <info> app: Entering DFU mode.
00> 
00> <debug> app: Initializing transports (found: 1)
00> 
00> <debug> nrf_dfu_ble: Initializing BLE DFU transport
00> 
00> <debug> nrf_dfu_ble: Setting up vector table: 0x00071000
00> 
00> <debug> nrf_dfu_ble: Enabling SoftDevice.
00> 
00> <debug> nrf_dfu_ble: Configuring BLE stack.
00> 
00> <debug> nrf_dfu_ble: Enabling the BLE stack.
00> 
00> <debug> nrf_dfu_ble: No advertising name found
00> 
00> <debug> nrf_dfu_ble: Using default advertising name
00> 
00> <debug> nrf_dfu_ble: Advertising...
00> 
00> <debug> nrf_dfu_ble: BLE DFU transport initialized.
00> 
00> <debug> nrf_dfu_flash: Initializing nrf_fstorage_sd backend.
00> 
00> <debug> app: Enter main loop
00> 
00> <debug> nrf_dfu_ble: Connected
00> 
00> <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
00> 
00> <debug> nrf_dfu_ble: max_conn_interval: 12
00> 
00> <debug> nrf_dfu_ble: min_conn_interval: 12
00> 
00> <debug> nrf_dfu_ble: slave_latency: 0
00> 
00> <debug> nrf_dfu_ble: conn_sup_timeout: 600
00> 
00> <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
00> 
00> <debug> nrf_dfu_ble: max_conn_interval: 6
00> 
00> <debug> nrf_dfu_ble: min_conn_interval: 6
00> 
00> <debug> nrf_dfu_ble: slave_latency: 0
00> 
00> <debug> nrf_dfu_ble: conn_sup_timeout: 500
00> 
00> <debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
00> 
00> <debug> nrf_dfu_ble: max_conn_interval: 12
00> 
00> <debug> nrf_dfu_ble: min_conn_interval: 12
00> 
00> <debug> nrf_dfu_ble: slave_latency: 0
00> 
00> <debug> nrf_dfu_ble: conn_sup_timeout: 600
00> 
00> <debug> nrf_dfu_ble: Advertising...
00> 
00> <debug> nrf_dfu_settings: Using settings page.
00> 
00> <debug> nrf_dfu_settings: Copying forbidden parts from backup page.

[koldybin]

So the log above says that app is invalid: <debug> app: DFU mode because app is not valid. What can be the error when app works without DFU. And with other SparkFun hardware, the app also works with DFU? What else can I look for?

Thanks

[Edvin]

Hello,

On the SparkFun hardware, did you program the bootloader yourself, or was it pre-programmed?

How did you program the bootloader and application on your custom hardware? Did you generate and program the bootloader settings? If you compiled the bootloader yourself, did you do any changes to the bootloader project? If so, which ones?

Do you see the bootloader advertisements? have you tried to update the firmware via DFU? If so, how did you generate the DFU image?

Best regards,

Edvin

[koldybin]

Hi Edvin,

Edvin said:

On the SparkFun hardware, did you program the bootloader yourself, or was it pre-programmed?

I programmed both hardware (SparkFun and my own hardware) with SES. First Target -> Erase All and then Target -> Download secure_bootloader_ble_s132_pca10040.

Edvin said:

How did you program the bootloader and application on your custom hardware? Did you generate and program the bootloader settings?

I did not generate bootloader settings. Probably here is my mistake?

Edvin said:

If you compiled the bootloader yourself, did you do any changes to the bootloader project? If so, which ones?

I only removed LED functions (bsp_board_led_on(BSP_BOARD_LED_0)…) and #include "boards.h" from example nRF5_SDK_17.0.0_9d13099 \ examples \ dfu \ secure_bootloader \ pca10040_s132_ble.

Edvin said:

Do you see the bootloader advertisements? have you tried to update the firmware via DFU? If so, how did you generate the DFU image?

Yes, I see DFU advertisements in nRF Connect Android app. I can also flash FW. I generated the FW image with nrfutill. The image is successfully flashed via Android app and works with SparkFun hardware. The image is flashed in the same way with own hardware but does not start. The RTT log says that app is invalid: <debug> app: DFU mode because app is not valid.

Maybe it is missing bootloader settings in own hardware?

Thanks

[koldybin]

Hello Edvin,

I believe i have found possible cause. The SparkFun hardware has nRF52832-QFAA 64kB. In my own hardware I have nRF52832-QFAB 32kB. I only now understood that I ordered the wrong nRF. I have read out memories from both nRFs with nRF Connect (please see screenshot). With nRF AB (32 kB) bootloader is not displayed, why? Although DFU works and the screenshots are already with the app that I flashed via DFU (please see address 0x00026000 - 0x0002C52B). App is only 25,900 bytes and should also work with nRF AB. The app does not start with nRF52832-QFAB 32kB. What do I have to adjust in order to start the app with nRF AB (32 kB)?

[Edvin]

I see.

Did it not throw any errors when you programmed the bootloader? If not, what happens if you try to read out e.g. the flash address:

"nrfjprog --memrd 0x00078000 --n 1024"

?

What is the bootloader's flash start address?

Basically what you need to do is to change the flash addresses. If your application uses FDS (Used if you use the peer manager or any other parts that uses FDS), then make sure that it fetches the correct address.

Depening on what IDE you are using, it is probably possible to change the compiler to set the QFAB instead of QFAA as the target.

Best regards,

Edvin

[koldybin]

Hi Edvin,

Edvin said:

Did it not throw any errors when you programmed the bootloader?

No, there were no errors

Edvin said:

If not, what happens if you try to read out e.g. the flash address:

"nrfjprog --memrd 0x00078000 --n 1024"

QFAA and QFAB memories are absolutely the same:

C:\Program Files (x86)\Nordic Semiconductor\nrf-command-line-tools\bin>nrfjprog --memrd 0x00078000 --n 1024
0x00078000: 20010000 0007835D 00078345 00078347   |... ]...E...G...|
0x00078010: 00078349 0007834B 0007834D 00000000   |I...K...M.......|
0x00078020: 00000000 00000000 00000000 0007D0C1   |................|
0x00078030: 00078351 00000000 00078353 00078355   |Q.......S...U...|
0x00078040: 00078357 00078357 00078357 00078357   |W...W...W...W...|
0x00078050: 00078357 00078357 00078357 00078357   |W...W...W...W...|
0x00078060: 00078357 00078357 00078357 00078357   |W...W...W...W...|
0x00078070: 00078357 00078357 00078357 00078357   |W...W...W...W...|
0x00078080: 0007B3AD 00078357 00078357 00078357   |....W...W...W...|
0x00078090: 00078357 00078357 0007D2C9 00078357   |W...W.......W...|
0x000780A0: 00078357 00078357 00078357 00078357   |W...W...W...W...|
0x000780B0: 00078357 00078357 00000000 00000000   |W...W...........|
0x000780C0: 00078357 00078357 00078357 00078357   |W...W...W...W...|
0x000780D0: 0007B061 00078357 00078357 00000000   |a...W...W.......|
0x000780E0: 00000000 00000000 00000000 00000000   |................|
0x000780F0: 00000000 00000000 00000000 00000000   |................|
0x00078100: 00000000 00000000 00000000 00000000   |................|
0x00078110: 00000000 00000000 00000000 00000000   |................|
0x00078120: 00000000 00000000 00000000 00000000   |................|
0x00078130: 00000000 00000000 00000000 00000000   |................|
0x00078140: 00000000 00000000 00000000 00000000   |................|
0x00078150: 00000000 00000000 00000000 00000000   |................|
0x00078160: 00000000 00000000 00000000 00000000   |................|
0x00078170: 00000000 00000000 00000000 00000000   |................|
0x00078180: 00000000 00000000 00000000 00000000   |................|
0x00078190: 00000000 00000000 00000000 00000000   |................|
0x000781A0: 00000000 00000000 00000000 00000000   |................|
0x000781B0: 00000000 00000000 00000000 00000000   |................|
0x000781C0: 00000000 00000000 00000000 00000000   |................|
0x000781D0: 00000000 00000000 00000000 00000000   |................|
0x000781E0: 00000000 00000000 00000000 00000000   |................|
0x000781F0: 00000000 00000000 00000000 00000000   |................|
0x00078200: 48324931 D0021A0A 43912207 4930468D   |1I2H.....".C.F0I|
0x00078210: 1A0A4830 2207D006 F3814391 22028809   |0H.....".C....."|
0x00078220: 8814F382 492D482C F0004A2D 482DF83C   |....,H-I-J..<.-H|
0x00078230: 4A2E492D F837F000 492E482D F0004A2E   |-I.J..7.-H.I.J..|
0x00078240: 482EF832 4A2F492E F82DF000 492F482E   |2..H.I/J..-..H/I|
0x00078250: F0004A2F 482FF828 4A30492F F823F000   |/J..(./H/I0J..#.|
0x00078260: 4930482F F0004A30 4830F81E 22004930   |/H0I0J....0H0I."|
0x00078270: F824F000 4930482F F0002200 4A2FF81F   |..$./H0I."..../J|
0x00078280: 481F4790 4288491F 6802D005 B4033004   |.G.H.I.B...h.0..|
0x00078290: BC034790 2000E7F7 46EC4686 21002000   |.G..... .F.F. .!|
0x000782A0: 47904A27 4288E7FE 1A52D007 7803D005   |'J.G...B..R....x|
0x000782B0: 700B3001 3A013101 4770D1F9 D0024288   |.0.p.1.:..pG.B..|
0x000782C0: 30017002 4770E7FA 20010000 2000F800   |.p.0..pG... ... |
0x000782D0: 20010000 20010000 0007DB40 2000597C   |... ... @...|Y. |
0x000782E0: 200059B4 000783B8 000783B8 0007D5FE   |.Y. ............|
0x000782F0: 0007DB40 2000597C 2000597C 0007D66C   |@...|Y. |Y. l...|
0x00078300: 0007D66C 0007D66C 0007D66C 0007D66C   |l...l...l...l...|
0x00078310: 0007D66C 0007D66C 0007D66C 0007DB40   |l...l...l...@...|
0x00078320: 0007DB78 200059B4 200059B4 200059B4   |x....Y. .Y. .Y. |
0x00078330: 20007F64 20007F64 20007F64 00078385   |d.. d.. d.. ....|
0x00078340: 00079C71 E7FEE7FE E7FEE7FE E7FEE7FE   |q...............|
0x00078350: E7FEE7FE E7FEE7FE B802F000 BFFCF7FF   |................|
0x00078360: F04F480F 43880107 480E4685 480E4780   |.HO....C.F.H.G.H|
0x00078370: F4416801 60010170 8F4FF3BF 8F6FF3BF   |.hA.p..`..O...o.|
0x00078380: BF3EF7FF 490A4809 42884A0A 1A52D007   |..>..H.I.J.B..R.|
0x00078390: 7803D005 700B3001 3A013101 4770D1F9   |...x.0.p.1.:..pG|
0x000783A0: 20010000 0007B489 E000ED88 0007D658   |... ........X...|
0x000783B0: 20005968 2000597C B5301C4B 460400DB   |hY. |Y. K.0....F|
0x000783C0: 0003F012 D10DB29B 602A4D07 4B07441A   |.........M*`.D.K|
0x000783D0: 4B07601A 4B077018 4B077018 4B07801C   |.`.K.p.K.p.K...K|
0x000783E0: BD308019 E7FC2007 200059BC 200059B8   |..0.. ...Y. .Y. |
0x000783F0: 200059B4 200059C4 200059C0 200059C2   |.Y. .Y. .Y. .Y. |

Edvin said:

What is the bootloader's flash start address?

In QFAA 0x00078000. How can I determine that in QFAB?

Edvin said:

Basically what you need to do is to change the flash addresses.

In SES I have "flash_placement.xml" and settings in Project -> Options -> Linker -> Memory Segments and Section Placement Macros. Do I have to adjust both? Can you tell me which parameters do I need to change?

Memory Segments

FLASH RX 0x0 0x80000;RAM RWX 0x20000000 0x10000;mbr_params_page RX 0x0007E000 0x1000;bootloader_settings_page RX 0x0007F000 0x1000;uicr_bootloader_start_address RX 0x10001014 0x4;uicr_mbr_params_page RX 0x10001018 0x4

Section Placement Macros

FLASH_PH_START=0x0
FLASH_PH_SIZE=0x80000
RAM_PH_START=0x20000000
RAM_PH_SIZE=0x10000
FLASH_START=0x78000
FLASH_SIZE=0x6000
RAM_START=0x20005968
RAM_SIZE=0xa698

Edvin said:

Depening on what IDE you are using, it is probably possible to change the compiler to set the QFAB instead of QFAA as the target.

Unfortunately I did not find this in SES.

Many thanks for the help!