8720DN OTA erases the wrong image

Technical Discussion Standard SDK
1

Hello, I am developing a project with BW16 module, 4Mb flash integrated. Using latest dev standard SDK.
The problem is, OTA HTTP example is erasing the wrong (currently running) OTA image leading to a crash. The following function:
u32 ota_get_cur_index(void) ;
returns the wrong image index, as the bootloader has not properly set up the MMU regions.

I changed the default memory map, to make use of 4Mb flash, and to have a few space pages. I have my first image at 0x08010000 and second at 0x08210000. Both images run normally when programmed through the serial port and Imagetool app (full erase, with programming only bootloaders and OTA1 or OTA2)

As described in AN0400 I changed

In rtl8721d_bootcfg.c:
u32 OTA_Region[2] = {
0x08010000,
0x08210000,
};

In rtl8721d_ota.h
#define LS_IMG2_OTA1_ADDR 0x08010000
#define LS_IMG2_OTA2_ADDR 0x08210000

rtl8721dhp_intfcfg.c
const u32 ftl_phy_page_start_addr = 0x00202000;

platform_opts.h
#define FAST_RECONNECT_DATA 0x00205000

I fully erased the chip and programmed bootloaders and OTA1 and I am getting the following log:

[update_ota_http_connect_server] Create socket: 0 success!
[http_update_ota] Download new firmware begin, total size : 852000

(following was added by me to see MMU regions)
MMU0 START 0xc000000 END 0xc018fff OFFS 0x3df0000 PHY ADDRESS: 0x8210000
MMU1 START 0xe000000 END 0xe0b6fff OFFS 0x5dd7000 PHY ADDRESS: 0x8229000
OTA ADDRESS: 8210000 MUST BE 8010000 or 8210000

[http_update_ota] OTA1 address space will be upgradedHard Fault Error!!!
R0 = 0x8a210
R1 = 0x4
R2 = 0x80000000
R3 = 0xffffffff
R12 = 0xc005425
LR = 0xffffffbc
PC = 0xc000ff6
xPSR = 0x6100020e
PriMask: 0x0

And it seems the bootloader has set up the MMU to map the invalid OTA image (OTA2). Then it tries to erase OTA1, resulting in a crash. As bootloader is in static library, I cannot trace how it sets up the MMU based on the changes in SDK. Do I have to modify the following MMU config when I change the memory map?

/*

  • @brif MMU Configuration.
  • There are 8 MMU entries totally. Entry 0 & Entry 1 are already used by OTA, Entry 2~7 can be used by Users.
    */
    BOOT_RAM_DATA_SECTION
    MMU_ConfDef Flash_MMU_Config = {
    /VAddrStart, VAddrEnd, PAddrStart, PAddrEnd/
    {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF}, //Entry 2
    {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF}, //Entry 3
    {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF}, //Entry 4
    {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF}, //Entry 5
    {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF}, //Entry 6
    {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF}, //Entry 7
    {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF},
    };

Thanks for the help!

2

Hi @Kruger

After these modifications, I am able to use ATWO to receive an OTA image, and switch between them with no issues.

In rtl8721d_bootcfg.c:
u32 OTA_Region[2] = {
    0x08010000,
    0x08210000,
};

In rtl8721d_ota.h
#define LS_IMG2_OTA1_ADDR 0x08010000
#define LS_IMG2_OTA2_ADDR 0x08210000

platform_opts.h
#define FAST_RECONNECT_DATA 0x00205000

ftl_phy_page_start_addr is only used for BLE, and should not have any effect when only testing OTA.

From the MMU addresses, it looks like it is running from OTA2 instead of OTA1
In rtl8721d_bootcfg.c, edit this line u8 Boot_Log_En = TRUE; and recompile to see what OTA image it is running from. You should see this log on reset:

#[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER ROMSUB:2
[MODULE_BOOT-LEVEL_INFO]:OTA1 USE
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xc016470:8528:0x84000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(8400c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x84000:0xc002805]
[MODULE_BOOT-LEVEL_INFO]:KM0 BOOT_IMG2 BOOT REASON: 0
calibration_ok:[2:19:11]
[MODULE_BOOT-LEVEL_INFO]:IMG1 ENTER MSP:[1007fffc]
[MODULE_BOOT-LEVEL_INFO]:IMG2 DATA[0xe06d8b0:103664:0x10005000]
[MODULE_BOOT-LEVEL_INFO]:IMG2 SIGN[RTKWin(1000500c)]
[MODULE_BOOT-LEVEL_INFO]:IMG2 ENTRY[0x10005000:0xe008641]
[MODULE_BOOT-LEVEL_INFO]:Start NonSecure @ 0xe008640 ...
[MODULE_BOOT-LEVEL_INFO]:KM4 BOOT REASON: 0
#interface 0 is initialized
interface 1 is initialized

Can you provide the settings you used when doing a flash erase and when uploading the images?

Also, my experience with BW16 modules is that by default they use the RTL8720DN chip with a 16Mbit SPI NOR flash, which provides 2MByte of flash memory. Did you change out the flash chip?

1 Like
3

Hello @wyy and thank you very much for the test you made and for the valuable information. Indeed, I am using BW16 and it turns out it has 2Mb flash instead of 4Mb, which is for sure the problem (I opened one BW16 module to make sure).

1 Like