LwM2M Advanced Firmware Update for external MCU

[harry4951]

Hi,

I want to DFU the nRF52 from nRF91 over UART. And I find this sample: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/samples/cellular/lwm2m_client/fota_external_mcu.html

I believe this part is for putting the nRF52 into serial recovery mode: https://github.com/nrfconnect/sdk-nrf/blob/main/samples/cellular/lwm2m_client/src/fota_external/client.c

I see this is to upload the new nrf52 image to the server and maybe start the update commands: https://github.com/nrfconnect/sdk-nrf/blob/main/samples/cellular/lwm2m_client/scripts/fota.py

I think this is for nrf91 to connect to the server and download the firmware: https://github.com/nrfconnect/sdk-nrf/blob/main/samples/cellular/lwm2m_client/src/main.c#L236

But I couldn't find where the nRF91 transfers the data to the nRF52 while downloading the firmware from the server.

Could you point me to where this happens?

Thanks

/CJ

[Kenneth]

Hello,

On nRF91 side, the nRF52 is presented as one of the target for `dfu_target` library.

So this is implemented as dfu_target_smp.c which forwards the data to the SMP client and that sends data over UART to nRF52 which has the SMP server running.

LwM2M logic is in lwm2m_firmware.c but that should not be that important. All the "magic" should be in dfu_target_smp.c.

Then regarding all the SMP protocol handling and those MCUmgr services, all that code is in the Zephyr side.

Hope that helps,
Kenneth

[harry4951]

Hi, thanks

In order to be able to formward the data, I expect to see some function calls in the code base like "dfu_target_smp_client_init" and "dfu_target_smp_write", but I cant find them.

How dfu_target_smp.c is connected to https://github.com/nrfconnect/sdk-nrf/tree/main/samples/cellular/lwm2m_client

Can you please point me the workflow like from this function -> that function -> dfu_target_smp_write....

Best

/CJ

[Kenneth]

On boot:

1. fota_external_init() is called.
2. It initializes SMP client and sets serial transports.

FOTA start:

1. LwM2M server writes URI to client.
2. engine calls lwm2m_firmware.c:write_dl_uri()
3. it calls lwm2m_start_download_image()
4. it calls init_start_download() and sets type=DFU_TARGET_IMAGE_TYPE_SMP
5. then calls fota_download_util_download_start(<uri>, DFU_TARGET_IMAGE_TYPE_SMP,..)
6. it calls fota_download_util_client_init(, smp_image_type = true) and sets use_smp_dfu_target to true.
7. then rest of the initialization is not relevant, few more calls to initialize Download client and start the download.

Downloading the image

1. Download client progresses independently and start receiving blocks.
2. it calls the callback download_client_callback(evt.id = DOWNLOAD_CLIENT_EVT_FRAGMENT)
3. Now use_smp_dfu_target is true so it calls dfu_target_smp_img_type_check() to verify type.
4. Then calls dfu_target_init(type = DFU_TARGET_IMAGE_TYPE_SMP)
5. it calls dfu_target_smp_init()
6. it calls img_mgmt_client_upload_init() in Zephyr.
7. Now MCUmgr client is initialized and the chain returns to download_client_callback.
8. Now the client writes first block using dfu_target_write()
9. DFU target library calls dfu_target_smp_write()
10. That handles data to IMG mgmt library in Zephyr. img_mgmt_client_upload()