4 files changed, 24 insertions, 2 deletions

diff --git a/examples/boot/application/nrf/README.md b/examples/boot/application/nrf/README.md
index 703377a20..a6719b505 100644
--- a/examples/boot/application/nrf/README.md
+++ b/examples/boot/application/nrf/README.md
@@ -32,3 +32,7 @@ cargo objcopy --release --bin b -- -O binary b.bin
 ```
 cargo flash --release --bin a --chip nRF52840_xxAA
 ```
+
+You should then see a solid LED. Pressing button 1 will cause the DFU to be loaded by the bootloader. Upon
+successfully loading, you'll see the LED flash. After 5 seconds, because there is no petting of the watchdog,
+you'll see the LED go solid again. This indicates that the bootloader has reverted the update.
\ No newline at end of file
diff --git a/examples/boot/application/nrf/memory-bl.x b/examples/boot/application/nrf/memory-bl.x
index 8a32b905f..257d65644 100644
--- a/examples/boot/application/nrf/memory-bl.x
+++ b/examples/boot/application/nrf/memory-bl.x
@@ -5,7 +5,7 @@ MEMORY
   BOOTLOADER_STATE                  : ORIGIN = 0x00006000, LENGTH = 4K
   ACTIVE                            : ORIGIN = 0x00007000, LENGTH = 64K
   DFU                               : ORIGIN = 0x00017000, LENGTH = 68K
-  RAM                         (rwx) : ORIGIN = 0x20000008, LENGTH = 32K
+  RAM                         (rwx) : ORIGIN = 0x20000000, LENGTH = 32K
 }
 
 __bootloader_state_start = ORIGIN(BOOTLOADER_STATE);
diff --git a/examples/boot/application/nrf/memory.x b/examples/boot/application/nrf/memory.x
index 3a54ca460..c6926e422 100644
--- a/examples/boot/application/nrf/memory.x
+++ b/examples/boot/application/nrf/memory.x
@@ -5,7 +5,7 @@ MEMORY
   BOOTLOADER_STATE                  : ORIGIN = 0x00006000, LENGTH = 4K
   FLASH                             : ORIGIN = 0x00007000, LENGTH = 64K
   DFU                               : ORIGIN = 0x00017000, LENGTH = 68K
-  RAM                         (rwx) : ORIGIN = 0x20000008, LENGTH = 32K
+  RAM                         (rwx) : ORIGIN = 0x20000000, LENGTH = 32K
 }
 
 __bootloader_state_start = ORIGIN(BOOTLOADER_STATE);
diff --git a/examples/boot/application/nrf/src/bin/a.rs b/examples/boot/application/nrf/src/bin/a.rs
index 7a404a914..83191f388 100644
--- a/examples/boot/application/nrf/src/bin/a.rs
+++ b/examples/boot/application/nrf/src/bin/a.rs
@@ -8,6 +8,7 @@ use embassy_embedded_hal::adapter::BlockingAsync;
 use embassy_executor::Spawner;
 use embassy_nrf::gpio::{Input, Level, Output, OutputDrive, Pull};
 use embassy_nrf::nvmc::Nvmc;
+use embassy_nrf::wdt::{self, Watchdog};
 use panic_reset as _;
 
 static APP_B: &[u8] = include_bytes!("../../b.bin");
@@ -20,6 +21,23 @@ async fn main(_spawner: Spawner) {
     //let mut led = Output::new(p.P1_10, Level::Low, OutputDrive::Standard);
     //let mut button = Input::new(p.P1_02, Pull::Up);
 
+    // The following code block illustrates how to obtain a watchdog that is configured
+    // as per the existing watchdog. Ordinarily, we'd use the handle returned to "pet" the
+    // watchdog periodically. If we don't, and we're not going to for this example, then
+    // the watchdog will cause the device to reset as per its configured timeout in the bootloader.
+    // This helps is avoid a situation where new firmware might be bad and block our executor.
+    // If firmware is bad in this way then the bootloader will revert to any previous version.
+    let wdt_config = wdt::Config::try_new(&p.WDT).unwrap();
+    let (_wdt, [_wdt_handle]) = match Watchdog::try_new(p.WDT, wdt_config) {
+        Ok(x) => x,
+        Err(_) => {
+            // Watchdog already active with the wrong number of handles, waiting for it to timeout...
+            loop {
+                cortex_m::asm::wfe();
+            }
+        }
+    };
+
     let nvmc = Nvmc::new(p.NVMC);
     let mut nvmc = BlockingAsync::new(nvmc);