DFU - non secure to secure

[Jenzo]

Hi,
we have an older product based on nRF51822 developed on SDK 9. The nRF51822 is programmed with DFU option but with non-secure.
We want to update with a new secure bootloader and application.

I suppose that is possible, but we cannot find the secure bootloader software for SDK 9. Could you please help.

Best regards

Jens

[Jenzo]

in addtion to the above:

If it is not possible to make convert to a secure bootloader, how do I create a dfu package with the nrfutil tool? We have tried but it forces us to use a private key. 

[Einar Thorsrud]

Hi,

Updating from the legacy bootloader to the secure bootloader via DFU is not supported. It is technically possible on some nRF52 series devices as described in this post, but I am not able to see how you could do it on the nRF51.

Jenzo said:

If it is not possible to make convert to a secure bootloader, how do I create a dfu package with the nrfutil tool? We have tried but it forces us to use a private key. 

You need to use an older version of nrfutil in order to generate packages for the legacy bootloader, specifically nrfutil 0.5.2. This is the latest release with support for the legacy bootloader used in SDK 9.

[Jenzo]

Super. Thanks for an excellent service!

[Jenzo]

One more issue:

When I update the APP on the nRF51822 with zip package then the bootloader does not work anymore / it is overwritten (I guess).

Here is how I created the zip package:

nrfutil dfu genpkg --application-version XXXX --dev-type XXXX --dev-revision XXXX --application app_v21.hex app_v21.zip

How do I preserve the bootloader?

[Einar Thorsrud]

The bootloader should never be overwritten during an application DFU, so I think we need to investigate a bit more to understand what has happened.

1. In what way does the bootloader not work? What have you learned by testing / debugging?
2. Do you have a device with 128 kB or 256 kB lash?
3. Can you share your memory layout (SoftDevice size, application start address and size, bootloader start address and size etc)?
4. Do you use single bank or dual bank application updates?
5. Can you make a flash dump before and after the update so that we can compare and see which regions have change during the DFU procedure? The simplest way to dump the flash is like this (assuming a 256 kB device): nrfjprog --memrd 0 --n 0x40000 > flash_dump.txt

[Jenzo]

Hi Einar,

I found out. My bad.

Thanks for your help.

Regards

Jens