How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

RE: How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

Hieu — Thu, 17 Aug 2023 15:01:34 GMT

If the UART command will only be sent on the master service, then do you think it is secured enough for the UART-triggered DFU to be without bonds?

If you still decide that bonds are require, then you need to setup the Peer Manager in the bootloader, and I guess you will also need to modify the advertising implementation.

RE: How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

jerome.sc — Thu, 17 Aug 2023 08:14:02 GMT

So with my product, I have standard users that operate on a "user service", which is in just works mode (pairing/no bonding). Master users who can access the "master service", need to pair and bond (passkey/mitm protected). There can be up to 10 masters/bonds. Only the masters/bonds can trigger the firmware update, as it should be encrypted.

The button triggering the DFU process is not a physical button, but a UART command from another processor, that only will be sent on the master service, which in turn calls the enter_dfu_mode() function.

RE: How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

mrono — Thu, 17 Aug 2023 06:33:15 GMT

[quote userid="9456" url="~/f/nordic-q-a/102587/how-reliable-is-buttonless-dfu-as-well-as-can-t-go-into-dfu-bootloader-with-button/441723"]This means that if we want the button-triggered DFU operation to have access to the peer data, then we will need to setup the Peer Manager on the bootloader as well.[/quote]

If you have several peers then yes, something like that probably needs to be done. But if there is only one bonded peer, then I think it should be sufficient to simply always forward that data when entering the bootloader.

RE: How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

Hieu — Wed, 16 Aug 2023 22:11:12 GMT

I think mrono is right! From Buttonless Secure DFU Service documentation:

When the Buttonless Secure DFU Service enters the bootloader, the Buttonless Secure DFU Service forwards the current peer data from the Peer Manager data storage to the Secure DFU bootloader. This data is stored in flash, and is activated when the device enters DFU mode.

Thanks a lot, mrono! You stopped me from heading into an incorrect approach.

This means that if we want the button-triggered DFU operation to have access to the peer data, then we will need to setup the Peer Manager on the bootloader as well.

This leads me to rethink about this DFU setup from a different angle.

The point of the bond requirement for performing DFU is to protect against unauthorized update.

With the button-trigger method, the person already has access to the device. For many use cases, this often also means that the person can have the authority to update.

Is that the case with your product, Jerome?

RE: How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

mrono — Tue, 15 Aug 2023 08:34:16 GMT

I don't actually use the bootloader with bonds, but the way I understood it, the buttonless DFU will only forward the peer data of the peer that actually initiated the (buttonless) DFU.

[quote userid="119549" url="~/f/nordic-q-a/102587/how-reliable-is-buttonless-dfu-as-well-as-can-t-go-into-dfu-bootloader-with-button/439929"] I'm thinking if there is a way that I can call one of the underlying DFU service functions that will set the peer data up, before rebooting into the bootloader,[/quote]

I think the function you need is nrf_dfu_set_peer_data(). If you look up in ble_dfu_bonded.c the functions retrieve_peer_data() and enter_bootloader() I think those are the ones you'd need to replicate.

RE: How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

jerome.sc — Tue, 15 Aug 2023 07:53:53 GMT

Ok, great. I'm going to keep testing on my end, but I am running out of reasons why. I've created a new project based on the gls example, and used the nRF52840 DK instead of my custom PCB which has an nRF52833. Even with this, and a fresh install of the SDK I am running into the same problem. Although when I try to debug I can't see debug data from the bootloader code. The normal application runs, and I'm in debug mode. I trigger the DFU process, by pressing a button. It calls the enter_dfu_mode(), I created in the first post. But I can't see where in the DFU process it's failing from the bootloader code. But I assume it's the same issue.

RE: How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

Hieu — Mon, 14 Aug 2023 07:13:50 GMT

Hi Jerome,

I just want to let you know that I am still around. As a next step, I think I will have to try setting up a project myself, and with us being understaffed, it has been a little difficult to schedule a big block of time for that.

I appreciate your patience thus far. I will try to get to it as soon as I can.

Hieu

RE: How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

jerome.sc — Tue, 08 Aug 2023 13:39:59 GMT

Yes, this is enabled in the bootloader code as it's not greyed out.

As well as in the SDK_CONFIG file it's enabled

RE: How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

Hieu — Tue, 08 Aug 2023 12:36:50 GMT

Hi Jerome,

[quote user=""]How reliable is the buttonless DFU?
On the tutorial "nRF5 SDK v17.1.0 Secure DFU Hands-on Tutorial",
it mentions at the bottom "It is important if at all possible, to provide a fail-safe for the DFU process if the buttonless process becomes inoperative, usually via a programming mistake in the application code. A coding mistake that breaks the buttonless process will render the device unable to be updated".
nRF5 SDK v17.1.0 Secure DFU Hands-on Tutorial

The reason for having both a button-based approach and a buttonless approach is based on this statement, which makes sense if the device can't do a DFU then it can be useless. I assume this mainly comes from a lack of testing, before doing a DFU out to all devices in the field. But providing that the tests pass, what are the chances that the service itself stops working?[/quote]

DFU over BLE is quite reliable. We rarely see report of devices being bricked due to a DFU reason. Among the ones I have seen, the situations could have been prevented with enough test cases. But then again, a fallback recovery method would have saved a lot of effort and cost in such cases, so it's always a good idea to have it. But all of this are things you have already thought of.

[quote user=""]How can I keep bonds when going into the bootloader to do a DFU with a button-based approach?[/quote]

As you can see in L1157-L1170 of nrf_dfu_ble.c, the bonds will be loaded if NRF_DFU_BLE_REQUIRES_BONDS.

Have you tried with this configuration enabled?

Hieu

RE: How reliable is buttonless DFU, as well as can't go into dfu bootloader with button?

Hieu — Mon, 07 Aug 2023 11:58:02 GMT

Hi Jerome,

Please know that I will support you with your questions. I am a little occupied at the moment, but I will return questions soon, unless someone from the community already helped you then.

Hieu

RE: How reliable is buttonless DFU, as well as can't going into dfu bootloader with button?

jerome.sc — Fri, 04 Aug 2023 13:04:57 GMT

I've ran the debug version of the bootloader to see what the reason why it's not going into the bootloader, after doing dfu reset from my main application. It seems it can't find the peer data, when going into the bootloader from the GPREGRET method. So it works if I use the DFU services in the main application, but doing with the GPREGRET way from the main application it can't find the peer data. I'm thinking if there is a way that I can call one of the underlying DFU service functions that will set the peer data up, before rebooting into the bootloader, so it can find it if I trigger it by setting the GPREGRET?

My settings config on the bootloader project is below (screenshot). Also on the main application, I've set up these settings:

#define BLE_DFU_ENABLED 1
#define NRF_PWR_MGMT_CONFIG_AUTO_SHUTDOWN_RETRY 1
#define NRF_SDH_BLE_SERVICE_CHANGED 1

#ifndef NRF_DFU_BLE_BUTTONLESS_SUPPORTS_BONDS
#define NRF_DFU_BLE_BUTTONLESS_SUPPORTS_BONDS 1