Serial LTE Modem Application (NRF9160) FOTA does not apply new update

[ronald-blackline]

Hi,

I have the SLM application running in a custom board with uses the NRF9160. The SLM is driven an external microprocessor within the same board. Everything seems to work but FOTA will not apply the update.

Basically, we send the following commands after we confirmed successful network registration:

AT#XFOTA=8
AT#XFOTA=1,"">xxxxxx.amazonaws.com/app_update.bin"

This sequence of commands downloaded the FOTA image successfully. Then, we apply the AT#RESET command and this is what we are seeing from RTT

00> *** Booting Zephyr OS build v2.7.0-ncs1 ***
00> I: Starting bootloader
00> I: Primary image: magic=good, swap_type=0x4, copy_done=0x1, image_ok=0x1
00> I: Secondary image: magic=good, swap_type=0x2, copy_done=0x3, image_ok=0x3
00> I: Boot source: none
00> I: Swap type: test
00> D: erasing trailer; fa_id=3
00> D: initializing status; fa_id=3
00> D: writing swap_info; fa_id=3 off=0x6ffd8 (0x7ffd8), swap_type=0x2 image_num=0x0
00> D: writing swap_size; fa_id=3 off=0x6ffd0 (0x7ffd0)
00> D: writing magic; fa_id=3 off=0x6fff0 (0x7fff0)
00> D: erasing trailer; fa_id=7
00> D: writing copy_done; fa_id=3 off=0x6ffe0 (0x7ffe0)
00> I: Bootloader chainload address offset: 0x10000
00> I: Jumping to the first image slot
00> *** Booting Zephyr OS build v2.7.0-ncs1 ***
00> I: Starting bootloader
00> I: Primary image: magic=good, swap_type=0x2, copy_done=0x1, image_ok=0x3
00> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> I: Boot source: none
00> I: Swap type: revert
00> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> D: erasing trailer; fa_id=7
00> D: writing image_ok; fa_id=7 off=0x6ffe8 (0xeffe8)
00> D: writing swap_size; fa_id=7 off=0x6ffd0 (0xeffd0)
00> D: writing magic; fa_id=7 off=0x6fff0 (0xefff0)
00> D: erasing trailer; fa_id=3
00> D: initializing status; fa_id=3
00> D: writing swap_info; fa_id=3 off=0x6ffd8 (0x7ffd8), swap_type=0x4 image_num=0x0
00> D: writing image_ok; fa_id=3 off=0x6ffe8 (0x7ffe8)
00> D: writing swap_size; fa_id=3 off=0x6ffd0 (0x7ffd0)
00> D: writing magic; fa_id=3 off=0x6fff0 (0x7fff0)
00> D: erasing trailer; fa_id=7
00> D: writing copy_done; fa_id=3 off=0x6ffe0 (0x7ffe0)
00> I: Bootloader chainload address offset: 0x10000
00> I: Jumping to the first image slot

After this, the SLM gets run again and we read the following response from the application:

b'\x00Ready\r\n'
b'\r\n'
b'#XFOTA: 5,1,-9\r\n'

This basically indicates failure in the FOTA process. Can someone please help.

[Håkon Alseth]

Hi,

 

Given that it downloads, resets and prints this:

00> I: Swap type: test

It means that mcuboot recognizes this image, but on the very next sequence:

00> I: Jumping to the first image slot
00> *** Booting Zephyr OS build v2.7.0-ncs1 ***
00> I: Starting bootloader
00> I: Primary image: magic=good, swap_type=0x2, copy_done=0x1, image_ok=0x3
00> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> I: Boot source: none
00> I: Swap type: revert

You are essentially trying to boot the new image, and you're reset again, where it reverts to the original image.

 

This can happen if the configuration differs from what mcuboot expects, for instance in the flash layout of the secondary/primary slot.

Could you share details on your original projects "partitions.yml" and/or "pm_static.yml", as well as the "update project"'s partition layout?

It is very important that you follow the partition layout of the original image for all update images.

 

Kind regards,

Håkon

[ronald-blackline]

Thank you for pointing that one. After looking at those files you requested, looks like I need to re-implement the board files since I had it initially implemented using NCS v1.5.0.

I will get back to you regardless if it fixed the issue or not.

[Håkon Alseth]

Let me know if you run into any issues, or have questions!

Kind regards,

Håkon

[ronald-blackline]

Im getting now this error:

00> *** Booting Zephyr OS build v2.7.0-ncs1 ***
00> I: Starting bootloader
00> I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> I: Boot source: none
00> I: Swap type: none
00> I: Bootloader chainload address offset: 0xc000
00> I: Jumping to the first image slot
00> E: Protect mcuboot flash failed, cancel startup.

And here is the content of the pm_static.yml file:

app: {address: 0x18200, size: 0x5ae00}
mcuboot:
  address: 0x0
  placement:
    before: [mcuboot_primary]
  size: 0xc000
mcuboot_pad:
  address: 0xc000
  placement:
    align: {start: 0x1000}
    before: [mcuboot_primary_app]
  size: 0x200
mcuboot_primary:
  address: 0xc000
  size: 0x69000
  span: [spm, mcuboot_pad, app]
mcuboot_primary_app:
  address: 0xc200
  size: 0x68e00
  span: [app, spm]
mcuboot_scratch:
  address: 0xde000
  placement:
    after: [app]
    align: {start: 0x1000}
  size: 0x1e000
mcuboot_secondary:
  address: 0x75000
  placement:
    after: [mcuboot_primary]
    align: {start: 0x1000}
  share_size: [mcuboot_primary]
  size: 0x69000
EMPTY_0:
  address: 0xfc000
  size: 0x2000
settings_storage:
  address: 0xfe000
  placement:
    after: [mcuboot_scratch]
  size: 0x2000
spm:
  address: 0xc200
  inside: [mcuboot_primary_app]
  placement:
    before: [app]
  size: 0xc000

And for "board_partition_conf.dts"

&slot0_partition {
    reg = <0x00010000 0x30000>;
};

&slot0_ns_partition {
    reg = <0x00040000 0x40000>;
};

&slot1_partition {
    reg = <0x00080000 0x30000>;
};

&slot1_ns_partition {
    reg = <0x000b0000 0x40000>;
};

/* Default SRAM planning when building for nRF9160 with
 * ARM TrustZone-M support
 * - Lowest 64 kB SRAM allocated to Secure image (sram0).
 * - 64 kB SRAM reserved for and used by the BSD socket
 *   library.
 * - Upper 128 kB allocated to Non-Secure image (sram0_ns).
 */

&sram0_s {
    reg = <0x20000000 DT_SIZE_K(64)>;
};

&sram0_bsd {
    reg = <0x20010000 DT_SIZE_K(64)>;
};

&sram0_ns {
    reg = <0x20020000 DT_SIZE_K(128)>;
};

[ronald-blackline]

So i fixed the issue "Protect mcuboot flash failed, cancel startup" by defining "CONFIG_FPROTECT=n" in the mcuboot.conf (in "serial_lte_modem/child_image" folder). However, even with the board files ported properly, Im back seeing the original problem:

00> *** Booting Zephyr OS build v2.7.0-ncs1 ***
00> I: Starting bootloader
00> I: Primary image: magic=good, swap_type=0x4, copy_done=0x1, image_ok=0x1
00> I: Secondary image: magic=good, swap_type=0x2, copy_done=0x3, image_ok=0x3
00> I: Boot source: none
00> I: Swap type: test
00> D: erasing trailer; fa_id=2
00> D: initializing status; fa_id=2
00> D: writing swap_info; fa_id=2 off=0x68fd8 (0x74fd8), swap_type=0x2 image_num=0x0
00> D: writing swap_size; fa_id=2 off=0x68fd0 (0x74fd0)
00> D: writing magic; fa_id=2 off=0x68ff0 (0x74ff0)
00> D: erasing trailer; fa_id=6
00> D: writing copy_done; fa_id=2 off=0x68fe0 (0x74fe0)
00> I: Bootloader chainload address offset: 0xc000
00> I: Jumping to the first image slot
00> *** Booting Zephyr OS build v2.7.0-ncs1 ***
00> I: Starting bootloader
00> I: Primary image: magic=good, swap_type=0x2, copy_done=0x1, image_ok=0x3
00> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> I: Boot source: none
00> I: Swap type: revert
00> I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> D: erasing trailer; fa_id=6
00> D: writing image_ok; fa_id=6 off=0x68fe8 (0xddfe8)
00> D: writing swap_size; fa_id=6 off=0x68fd0 (0xddfd0)
00> D: writing magic; fa_id=6 off=0x68ff0 (0xddff0)
00> D: erasing trailer; fa_id=2
00> D: initializing status; fa_id=2
00> D: writing swap_info; fa_id=2 off=0x68fd8 (0x74fd8), swap_type=0x4 image_num=0x0
00> D: writing image_ok; fa_id=2 off=0x68fe8 (0x74fe8)
00> D: writing swap_size; fa_id=2 off=0x68fd0 (0x74fd0)
00> D: writing magic; fa_id=2 off=0x68ff0 (0x74ff0)
00> D: erasing trailer; fa_id=6
00> D: writing copy_done; fa_id=2 off=0x68fe0 (0x74fe0)
00> I: Bootloader chainload address offset: 0xc000
00> I: Jumping to the first image slot

I already attached the file "pm_static.yml" in the previous reply. Below is the generated "partitions.yml" file:

EMPTY_0:
  address: 0xfc000
  end_address: 0xfe000
  region: flash_primary
  size: 0x2000
app:
  address: 0x18200
  end_address: 0x75000
  region: flash_primary
  size: 0x5ce00
mcuboot:
  address: 0x0
  end_address: 0xc000
  placement:
    before:
    - mcuboot_primary
  region: flash_primary
  size: 0xc000
mcuboot_pad:
  address: 0xc000
  end_address: 0xc200
  placement:
    align:
      start: 0x1000
    before:
    - mcuboot_primary_app
  region: flash_primary
  size: 0x200
mcuboot_primary:
  address: 0xc000
  end_address: 0x75000
  region: flash_primary
  size: 0x69000
  span:
  - spm
  - mcuboot_pad
  - app
mcuboot_primary_app:
  address: 0xc200
  end_address: 0x75000
  region: flash_primary
  size: 0x68e00
  span:
  - app
  - spm
mcuboot_scratch:
  address: 0xde000
  end_address: 0xfc000
  placement:
    after:
    - app
    align:
      start: 0x1000
  region: flash_primary
  size: 0x1e000
mcuboot_secondary:
  address: 0x75000
  end_address: 0xde000
  placement:
    after:
    - mcuboot_primary
    align:
      start: 0x1000
  region: flash_primary
  share_size:
  - mcuboot_primary
  size: 0x69000
nrf_modem_lib_ctrl:
  address: 0x20010000
  end_address: 0x200104e8
  inside:
  - sram_nonsecure
  placement:
    after:
    - spm_sram
    - start
  region: sram_primary
  size: 0x4e8
nrf_modem_lib_rx:
  address: 0x200124e8
  end_address: 0x200144e8
  inside:
  - sram_nonsecure
  placement:
    after:
    - nrf_modem_lib_tx
  region: sram_primary
  size: 0x2000
nrf_modem_lib_sram:
  address: 0x20010000
  end_address: 0x200144e8
  orig_span: &id001
  - nrf_modem_lib_ctrl
  - nrf_modem_lib_tx
  - nrf_modem_lib_rx
  region: sram_primary
  size: 0x44e8
  span: *id001
nrf_modem_lib_tx:
  address: 0x200104e8
  end_address: 0x200124e8
  inside:
  - sram_nonsecure
  placement:
    after:
    - nrf_modem_lib_ctrl
  region: sram_primary
  size: 0x2000
otp:
  address: 0xff8108
  end_address: 0xff83fc
  region: otp
  size: 0x2f4
settings_storage:
  address: 0xfe000
  end_address: 0x100000
  placement:
    after:
    - mcuboot_scratch
  region: flash_primary
  size: 0x2000
spm:
  address: 0xc200
  end_address: 0x18200
  inside:
  - mcuboot_primary_app
  placement:
    before:
    - app
  region: flash_primary
  size: 0xc000
spm_sram:
  address: 0x20000000
  end_address: 0x20010000
  inside:
  - sram_secure
  placement:
    after:
    - start
  region: sram_primary
  size: 0x10000
sram_nonsecure:
  address: 0x20010000
  end_address: 0x20040000
  orig_span: &id002
  - sram_primary
  - nrf_modem_lib_ctrl
  - nrf_modem_lib_tx
  - nrf_modem_lib_rx
  region: sram_primary
  size: 0x30000
  span: *id002
sram_primary:
  address: 0x200144e8
  end_address: 0x20040000
  region: sram_primary
  size: 0x2bb18
sram_secure:
  address: 0x20000000
  end_address: 0x20010000
  orig_span: &id003
  - spm_sram
  region: sram_primary
  size: 0x10000
  span: *id003

Let me know if you need more files. Thanks!

[Håkon Alseth]

Hi,

 

It is hard to say what happens here, as there's no application logs between the "test" and the "revert" boot log.

In your new update application, do you call "boot_write_img_confirmed()" after booting?

If this function is not called, then it will revert on the next reset.

 

Does the application reboot itself, or do you manually trigger a reset?

 

Kind regards,

Håkon