Android 6 Master Control Panel Bonded DFU + Android 6 gets stuck in a loop

[Clem Taylor]

I'm not sure why I didn't notice this sooner.

When trying to do a bonded DFU with a Nexus 6P and Master Control Panel it seems to get stuck in a loop reconnecting.

I connect, bond and trigger a DFU and then MCP disconnects, reconnects, disconnects in a loop. It never attempts to trigger the switch to the bootloader.

However if I manually write the start command to the DFU control point, everything works just fine.

Android 5.1.1 on a Nexus 4 works just fine.

master-control-panel-log.txt or: gist.github.com/.../a51e30a8a41d5f02bb3c

[Aleksander Nowakowski]

Hi, the reason thy it gets in a loop is that the DFU Version is always read as 0.1, which means that that's the application mode, not the bootloader mode. If it works when you manually write the start command, it means that the chip restarts after it disconnects, and does not start the DFU mode at all (or does, but immediately resets afterwards). The question is why..? I'm not quite sure. Nexus 4 sends just 1 packet each connection interval so it's very slow. Maybe it gives more time to the device to set itself up. We don't have the 6P yet, so it's hard to test, but it's a metter of time only.

Did you try the DFU with nRF Toolbox? It has a slightly newer version of the DFU library... There is a small chance it would work.

[Clem Taylor]

MCP is never attempting to issue the start command, it is just disconnecting and reconnecting. The device side is happily accepting connections. When I manually do the write to DFU control point it is properly switching to bootloader mode (passing bond data and cleanly disconnecting). I'm not sure what you mean by giving more time to the device to setup, it can't reconnect until the device starts advertising and it doesn't start advertising until is is ready to go.

The 6p just happens to be the only device I have with Android 6, I'd imagine that the same issue would happen with other devices with Android 6. The BLE hardware on the Nexus 6P is fairly standard for current android devices. Has Nordic tested MCP DFU with Android 6 on any recent device?

I did manage to get the nRF toolbox to work, but it really likes to die with 'Unfortunately, nRF Toolbox has stopped'. nRF toolbox does not start out connected, it connects, does the CCCD write and then writes the 'start' DFU command. The device switches to bootloader mode, starts advertising, and the toolbox reconnects. From sending the 'start command' to reconnecting is ~1.5s.

The nRF toolbox crash seems to be related to having to bond to trigger the switch to DFU mode. It likes to die after I enter the pin. If I try a second time, Android remembers the bond and it the DFU upload works.

[Aleksander Nowakowski]

Hi, yes, we've tested it with Nexus 9 and 6, both with Android 6. Could you report the crash using the Unfortunately, ... dialog box? I'll have a look at it tomorrow.

[Clem Taylor]

This should be the most recent crash:

11-17 17:41:52.737 28845 28862 I BluetoothBondStateMachine: bondStateChangeCallback: Status: 0 Address: E0:4B:75:64:34:DE newState: 2
11-17 17:41:52.737 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=2   
11-17 17:41:52.738 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=2
11-17 17:41:52.738 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=16
11-17 17:41:52.738 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=2
11-17 17:41:52.738 28845 28869 D BluetoothAdapterProperties: Adding bonded device:E0:4B:75:64:34:DE
11-17 17:41:52.738 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=2
11-17 17:41:52.738 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=16
11-17 17:41:52.739 28845 28869 I BluetoothBondStateMachine: Bond State Change Intent:E0:4B:75:64:34:DE OldState: 11 NewState: 12
11-17 17:41:52.739 28845 28869 I BluetoothBondStateMachine: StableState(): Entering Off State
11-17 17:41:52.740 24976 29192 E AndroidRuntime: FATAL EXCEPTION: IntentService[DfuBaseService]
11-17 17:41:52.740 24976 29192 E AndroidRuntime: Process: no.nordicsemi.android.nrftoolbox, PID: 24976
11-17 17:41:52.740 24976 29192 E AndroidRuntime: java.lang.NullPointerException: Attempt to get length of null array
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at android.bluetooth.BluetoothGattCharacteristic.getIntValue(BluetoothGattCharacteristic.java:445)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at no.nordicsemi.android.dfu.DfuBaseService.readVersion(DfuBaseService.java:2218)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at no.nordicsemi.android.dfu.DfuBaseService.onHandleIntent(DfuBaseService.java:1370)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at android.app.IntentService$ServiceHandler.handleMessage(IntentService.java:66)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at android.os.Handler.dispatchMessage(Handler.java:102)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at android.os.Looper.loop(Looper.java:148)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at android.os.HandlerThread.run(HandlerThread.java:61)
11-17 17:41:52.741  6178  6444 W BluetoothEventManager: CachedBluetoothDevice for device E0:4B:75:64:34:DE not found, calling readPairedDevices().
11-17 17:41:52.743 24220 24220 W BluetoothEventManager: CachedBluetoothDevice for device E0:4B:75:64:34:DE not found, calling readPairedDevices().
11-17 17:41:52.743  4556  6650 W ActivityManager:   Force finishing activity no.nordicsemi.android.nrftoolbox/.dfu.DfuActivity
11-17 17:41:52.774 28845 28862 I bt_btif_gatt: set_read_value unformat.len = 2

[Clem Taylor]

FYI, the dialog box just say "Ok", there is no option to report the bug. The above was pulled from an Android bug report.