How to change the mbr jump address location

RE: How to change the mbr jump address location

Einar Thorsrud — Wed, 02 Mar 2022 09:10:25 GMT

Hi,

Ah, yes. That was it, sd_softdevice_vector_table_base_set() is needed. Good to hear it got resolved. And thanks for letting us know!

RE: How to change the mbr jump address location

R_S — Wed, 02 Mar 2022 07:31:43 GMT

Hi Einar,

The issue got resolved.

I found that under DFU we are also calling ble_stack_init() function. But there is additional data added in that function.

So same thing i am calling in ble code under ble_stack_init() function. And after that its working fine.

actually we need to use these two function calls on both the places once in bootloader before jumping to application and second is inside the application.

Regards

R_S

RE: How to change the mbr jump address location

Einar Thorsrud — Tue, 01 Mar 2022 16:16:14 GMT

Hi,

I did not get a chance to look at this today, but I will test your code on my end tomorrow and get back to you.

RE: How to change the mbr jump address location

R_S — Mon, 28 Feb 2022 15:43:59 GMT

HI,

devzone.nordicsemi.com/.../pca10056_5F00_usb.zip

I have attached the bootloader code here.

In main.c line no 218. i am calling "nrf_bootloader_app_start();" API to jump to the application part.

And inside nrf_bootloader_app_start() function i am given the start address as the application start address(0xED000).

And also calling the function nrf_dfu_mbr_init_sd() & nrf_dfu_mbr_vector_table_set() as you mentioned.

devzone.nordicsemi.com/.../3426.nrf_5F00_bootloader_5F00_app_5F00_start.c

i also attached nrf_bootloader_app_start.c file in which i have added these chnages.

apart from that i dont have any change in the bootloader code. An the code i am using is open bootloader code.

Regards

R_S

RE: How to change the mbr jump address location

Einar Thorsrud — Mon, 28 Feb 2022 14:26:30 GMT

I see... Can you share your bootloader code, where you branch to the application, including configuring the MBR etc? Please include enough context, so include values of constants that may be set elsewhere etc.

RE: How to change the mbr jump address location

R_S — Fri, 25 Feb 2022 14:48:40 GMT

Hi,

I trace it and found the point where i am getting hard fault.

ret_code = sd_softdevice_enable(&clock_lf_cfg, app_error_fault_handler);

The result is same even after using nrf_dfu_mbr_vector_table_set() and not nrf_dfu_mbr_irq_forward_address_set() in the bootloader code.

And the value of registers are mentioned below:

And yes the only chage in my application is in .icf file that is flash start address change.

Previously it was

And Currently i changed it to this

in previous case the application address was 27000 so in that case i directly flashed it without bootloader code.

And in the current scenario as address is 0xED000, so i flashed it with Bootloader code. But not sure what goes wrong in this case? Because i had used open bootloader and secure bootloader together where code control first goes to open bootloader and then from there it jump to the secure bootloader and then it was no issue. But dont know what wrong with this ble_app_uart code.

Regards

R_S

RE: How to change the mbr jump address location

Einar Thorsrud — Fri, 25 Feb 2022 09:40:35 GMT

Hi,

Looking at the screenshot I see you get a hard fault, and not the error I expected form sd_softdevice_enable(), I did not pay attention to that initially. This shows that t PC is 0x0 and LR is 0xffffffe9, where the LR indicates return to thread mode using main stack (and FPU has been used for some reason). But why is PC 0? That should not be the case and indicates that a NULL pointer has been executed. Could it be that you have a bug in ble_stack_init() where that could happen? I suggest you debug there to pinpoint exactly where the issue is. Which function call do you do when you get the hardfault etc? Also, a look at the other CPU registers could be useful (get those for instance with "nrfjprog --readregs").

So there may be another issue here. Please keep this change, though, as running nrf_dfu_mbr_init_sd() () is required in this case, as it runs the SoftDevice reset function that clears a magic word indicating that the SoftDevice has been initialized. Without it, you will see NRF_ERROR_INVALID_STATE returned from sd_softdevice_enable(). That said, you should use nrf_dfu_mbr_vector_table_set() and not nrf_dfu_mbr_irq_forward_address_set(), so please adjust this and let me know what you see then.

Do you still get this with the above suggested change? Is the only change in your application that it is located at a different address, and does the exact same application built to start immediately after the SoftDevice work as expected?

RE: How to change the mbr jump address location

R_S — Fri, 25 Feb 2022 05:56:09 GMT

I did the same way what you mentioned in your initial comment.

nrf_dfu_mbr_init_sd(); and nrf_dfu_mbr_irq_forward_address_set();

and after that jump to the address where my application is there but still same issue i am facing

again it get stuck in that ble_stack_init() function,

Regards

R_S

RE: How to change the mbr jump address location

Einar Thorsrud — Thu, 24 Feb 2022 07:54:30 GMT

[quote user="R_S"]

"nrf_dfu_mbr_irq_forward_address_set()" i already used in my bootloader code example to jump on application having different address. But in this case i am not using any bootloader and i want directly jump to the application code (0xE8000 location) after softdevice. So for that whrere i need to use this function ("nrf_dfu_mbr_irq_forward_address_set()").

because i have only hex file of softdevice code so, that part anyway i cannot edit.

[/quote]

The boot sequence when using MBR and SoftDevice is in essense like this:

MBR runs first (this is located at page 0, and is part of the SoftDevice hex).
- MBR checks if a (bootloader) address is present in either a specific register in UICR (0x10001014) or in the end of the MBR params page (0x00000FF8).
- If either of of these registers has a valid address (are not 0xFFFFFFFF), the MBR will jump there. If not, it will just jump to the bootloader at 0x1000.
SoftDevice runs and passes execution the the application, which follows immediately after the SoftDevice.

So the only way you can boot another location than what is immediately after the SoftDevice is to use the bootloader support in the MBR. However, that does not need to actually be a bootloader. It could also be your application. This would prevent you from using a bootloader though, as the MBR features needed for some types of updates (like bootloader or SoftDevice updates) would not work in this scenario. So If you ever want to add DFU/bootloader support, then you need to do as I described in my initial post.

[quote user="R_S"]I am using bootloader code where i from softdevice code jump to the bootloader code and then in bootloader i am using nrf_dfu_mbr_irq_forward_address_set() and nrf_bootloader_app_start_final() function to jump on the application code. control goes to the 0xE8000 address but it got stuck inside "ble_stack_init()" function and it through an exception error.[/quote]

Yes, that is expected. That is because you are using an approach that does not work. You need to use the approach demonstrated by the bootloader in SDK 14.2, as explained in more detail in my previous reply.

RE: How to change the mbr jump address location

R_S — Thu, 24 Feb 2022 04:54:59 GMT

Hi Einar,

because i have only hex file of softdevice code so, that part anyway i cannot edit.

2nd case:

I am using bootloader code where i from softdevice code jump to the bootloader code and then in bootloader i am using nrf_dfu_mbr_irq_forward_address_set() and nrf_bootloader_app_start_final() function to jump on the application code. control goes to the 0xE8000 address but it got stuck inside "ble_stack_init()" function and it through an exception error.

Regards

R_S

RE: How to change the mbr jump address location

Einar Thorsrud — Wed, 23 Feb 2022 13:19:48 GMT

Hi,

How do you try to jump to 0xE8000?

Without knowing more I suggest you refer to the bootloader in nRF5 SDK 14.2.0 (more recent SDK versions use a different approach). You can refer to the implementation of <nRF5 SDK 14.2>\components\libraries\bootloader\nrf_bootloader_app_start.c you can see that nrf_bootloader_app_start() here takes any application start address and the way it configures the MBR and SoftDevice is different from more recent SoftDevices. You should use this approach, which can also be used with later SDK versions.

To be more specific, In SDK >= 15.0.0, the boot process consists of forwarding interrupts to the SoftDevice using SD_MBR_COMMAND_IRQ_FORWARD_ADDRESS_SET (nrf_dfu_mbr_irq_forward_address_set()), and then always jumping to address 0x1000 (SoftDevice start) instead of the application start address. The old approach is to use the SD_MBR_COMMAND_INIT_SD and SD_MBR_COMMAND_VECTOR_TABLE_BASE_SET command, and start the application at a specific address. This is what you should use when the application is not always immediately after the SoftDevice.

You can compare components\libraries\bootloader\nrf_bootloader_app_start.c in SDK 14.2 and a newer SDK to see both approaches.

Einar