Android 6 Master Control Panel Bonded DFU + Android 6 gets stuck in a loop

[Clem Taylor]

I'm not sure why I didn't notice this sooner.

When trying to do a bonded DFU with a Nexus 6P and Master Control Panel it seems to get stuck in a loop reconnecting.

I connect, bond and trigger a DFU and then MCP disconnects, reconnects, disconnects in a loop. It never attempts to trigger the switch to the bootloader.

However if I manually write the start command to the DFU control point, everything works just fine.

Android 5.1.1 on a Nexus 4 works just fine.

master-control-panel-log.txt or: gist.github.com/.../a51e30a8a41d5f02bb3c

[Aleksander Nowakowski]

Hi, the reason thy it gets in a loop is that the DFU Version is always read as 0.1, which means that that's the application mode, not the bootloader mode. If it works when you manually write the start command, it means that the chip restarts after it disconnects, and does not start the DFU mode at all (or does, but immediately resets afterwards). The question is why..? I'm not quite sure. Nexus 4 sends just 1 packet each connection interval so it's very slow. Maybe it gives more time to the device to set itself up. We don't have the 6P yet, so it's hard to test, but it's a metter of time only.

Did you try the DFU with nRF Toolbox? It has a slightly newer version of the DFU library... There is a small chance it would work.

[Clem Taylor]

This should be the most recent crash:

11-17 17:41:52.737 28845 28862 I BluetoothBondStateMachine: bondStateChangeCallback: Status: 0 Address: E0:4B:75:64:34:DE newState: 2
11-17 17:41:52.737 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=2   
11-17 17:41:52.738 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=2
11-17 17:41:52.738 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=16
11-17 17:41:52.738 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=2
11-17 17:41:52.738 28845 28869 D BluetoothAdapterProperties: Adding bonded device:E0:4B:75:64:34:DE
11-17 17:41:52.738 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=2
11-17 17:41:52.738 28845 28878 I bt_bta_dm: bta_dm_gatt_disc_result service_id_uuid_len=16
11-17 17:41:52.739 28845 28869 I BluetoothBondStateMachine: Bond State Change Intent:E0:4B:75:64:34:DE OldState: 11 NewState: 12
11-17 17:41:52.739 28845 28869 I BluetoothBondStateMachine: StableState(): Entering Off State
11-17 17:41:52.740 24976 29192 E AndroidRuntime: FATAL EXCEPTION: IntentService[DfuBaseService]
11-17 17:41:52.740 24976 29192 E AndroidRuntime: Process: no.nordicsemi.android.nrftoolbox, PID: 24976
11-17 17:41:52.740 24976 29192 E AndroidRuntime: java.lang.NullPointerException: Attempt to get length of null array
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at android.bluetooth.BluetoothGattCharacteristic.getIntValue(BluetoothGattCharacteristic.java:445)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at no.nordicsemi.android.dfu.DfuBaseService.readVersion(DfuBaseService.java:2218)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at no.nordicsemi.android.dfu.DfuBaseService.onHandleIntent(DfuBaseService.java:1370)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at android.app.IntentService$ServiceHandler.handleMessage(IntentService.java:66)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at android.os.Handler.dispatchMessage(Handler.java:102)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at android.os.Looper.loop(Looper.java:148)
11-17 17:41:52.740 24976 29192 E AndroidRuntime:        at android.os.HandlerThread.run(HandlerThread.java:61)
11-17 17:41:52.741  6178  6444 W BluetoothEventManager: CachedBluetoothDevice for device E0:4B:75:64:34:DE not found, calling readPairedDevices().
11-17 17:41:52.743 24220 24220 W BluetoothEventManager: CachedBluetoothDevice for device E0:4B:75:64:34:DE not found, calling readPairedDevices().
11-17 17:41:52.743  4556  6650 W ActivityManager:   Force finishing activity no.nordicsemi.android.nrftoolbox/.dfu.DfuActivity
11-17 17:41:52.774 28845 28862 I bt_btif_gatt: set_read_value unformat.len = 2