Secure DFU bootloader: application not starting

RE: Secure DFU bootloader: application not starting

Duncan Hurst — Mon, 13 Mar 2017 12:16:30 GMT

Hi,

I have the same problem on:

pca10040 SD132 SDK v12.1.0 NRF52

I have erased the dev board and programmed in the SD s132 v3.0.0 using nRFgo Studio. I built the bootloader_secure example (non-debug version in Keil 5 although I saw the same "error regarding the key" as above but defined NRF_DFU_DEBUG_VERSION in the project options to get the Public Key included)) and flashed it in (I tried nrfjprog and nRFgo Studio). The dev board does not advertise at the end of this sequence. LED 1 is not lit.

I have also tried building the debug version of the example using IAR but with the same result.

If I flash in the pre-built hex file examples\dfu\bootloader_secure\pca10040_debug\hex\secure_dfu_secure_dfu_ble_s132_pca10040_debug.hex then it advertises as DfuTarg as expected.

Why does it not advertise when I follow the instructions and build the example from source?

Thanks, Duncan Hurst

RE: Secure DFU bootloader: application not starting

daniel77 — Thu, 15 Dec 2016 23:31:40 GMT

This is the further guide on IOS nRF Connect and nRF Toolbox to get the buttonless DFU triggered from the app. I got the buttonless DFU working finally.

Thanks Hong Bui! Yes, my phone was cached on previous service and only able to see the DFU service after turning on & off the Bluetooth.

Connect with the device "Nordice_Template" via IOS nRF Connect and discover the "Unknown Service".

Click on the service to discover the "Unknown Characteristics". Click on the right button (3 parallel arrows down button) to enable the service.

The button will turn into a cross out arrow down as below.

Click arrow up button to write 0x01 to the characteristics

The value will change to 0x200101. The device will be disconnected and the nRF51 DK will light up the LED 3.

Find the device advertised as "DfuTarg" in nRF Toolbox and select it as DFU target.

Upload the buttonless DFU app .zip file.

RE: Secure DFU bootloader: application not starting

Hung Bui — Thu, 15 Dec 2016 10:54:10 GMT

@mr91: You would need to add the write property to the characteristic. It's a bug in the buttonless example. Please see here

RE: Secure DFU bootloader: application not starting

mr91 — Thu, 15 Dec 2016 10:28:50 GMT

I got it working now. There was a problem with my hardware abstraction, so there was always a dfu request. the application starts now. However, when I flash the buttonless example (SDK 12.2.0), there is a "Experimental Buttonless DFU Service" with a characteristic "Experimental Buttonless DFU". But there is no control point I can write to to start the bootloader. This control point does not appear when I use "enable services". Whats wrong now? I am so close to my goal :)

RE: Secure DFU bootloader: application not starting

Hung Bui — Thu, 15 Dec 2016 10:20:40 GMT

@daniel: Please make sure you refresh Bluetooth (turn off and on) on the phone and remove pairing if any. As you can find in the source code of the example there is no HRM service declared. Are you using SDK v12 ?

RE: Secure DFU bootloader: application not starting

daniel77 — Thu, 15 Dec 2016 09:26:57 GMT

Hi Hung Bui, I have read that many times. I am using IOS nRF Connect instead of Master Control Panel stated there. I cannot see "Nordic_Buttonless", but only "Nordic_Template". I don't see DFU Service, except battery service, device info, HRM service. There is not Control Point that I can write to.

RE: Secure DFU bootloader: application not starting

Hung Bui — Thu, 15 Dec 2016 08:49:36 GMT

Hi daniel,

Thanks for verifying the process from Mr91.

Regarding your question, you can have a look at this example \examples\ble_peripheral\experimental_ble_app_buttonless_dfu to know how to switch to bootloader. The documentation is here.

Note that it's experimental and we may change that in the furture. But it's simply a demonstration on how to switch to bootloader.

RE: Secure DFU bootloader: application not starting

daniel77 — Wed, 14 Dec 2016 21:53:00 GMT

I followed mr91's steps above and was able to boot into "Nordic_Template" advertised in IOS nRF Connect. I was using nRF51 DK PCA10028 SDK 12.2 secure bootloader and experimental buttonless DFU. However, I am not able to find the DFU Service within "Nordic_Template" services. I wanted to perform a buttonless OTA DFU via the app by using nRF Toolbox again. How to make it happen?

RE: Secure DFU bootloader: application not starting

Hung Bui — Wed, 14 Dec 2016 11:32:52 GMT

Hi Mr91,

All your steps looked fine. I need to see the log when you do DFU. You can find the log by openning nRFLogger.

Also if you have a sniffer trace it would be useful.

You can also turn off optimization in the project option, re-flash the bootloader and enter debug mode, then you can step into the code of the bootloader and check why the application is not started after you do DFU.

RE: Secure DFU bootloader: application not starting

mr91 — Tue, 13 Dec 2016 11:39:39 GMT

Thanks for your reply. In fact it would be great to use DFU to transfer even the first appliation. This is what I did:

1. Erase device
2. Program SD130 using nRFgo Studio
3. Compile the bootloader with my own keyfile (created out of priv.pem)
4. Flashing the bootloader (device is then advertising as "DfuTarg"
5. Compiling my application
6. Copying the generated Hexfile (app.hex) to the nrfutil folder
7. Running nrfutil with: 
nrfutil.exe pkg generate --application app.hex --key-file priv.pem --hw-version 51 --sd-req 0x67,0x80,0x87 --application-version 0x02 output.zip
8. Transfering output.zip to my mobile phone
9. Connecting to "DfuTarg" in nRF Connect app
10. Choosing "DFU" in the upper right corner
11. Choosing the file "output.zip"
12. Progress is displayed as graph
13. After "Disconnecting" is shown in the app, the device is still advertising as "DfuTarg", not running my application

Can you tell me whats wrong?

Edit: Also tried it with nRF Toolbox, same result (progress is completed, still advertising as DfuTarg). Also tried to create a bootloader settings file and merged it with the application, then same process with nrfutil as above. In that case, the bootloader does not accept the file in the first place (no progress is shown in apps, immediate disconnecting after connection is established).

Edit: I performed all above steps with SDK V12.2 (since bootloader was not advertising in 12.1)

RE: Secure DFU bootloader: application not starting

Hung Bui — Tue, 13 Dec 2016 08:32:49 GMT

Hi,

The bootloader was made so that you would need to program the application via DFU bootloader to make it start.

If you don't want to use the DFU bootloader to upload your first application, and prefer to use the programmer instead, you need to alter the bootloader setting in flash to tell the bootloader to start the application. You can generate a bootloader setting hex file then write it to flash to do that. Please have a look here.

RE: Secure DFU bootloader: application not starting

mr91 — Mon, 12 Dec 2016 15:25:53 GMT

Thank you. If i flash the application with Keil (using Segger J-Link) after flashing the bootloader, should the bootloader start this application? Atm it does not leave the bootloader mode (assuming no valid application is found at app start address). Do I have to adapt addresses in the application to get it recognized correctly by the bootloader? Or is it necessary to use the BLE DFU update to get the application running? Thank you.

RE: Secure DFU bootloader: application not starting

Hung Bui — Mon, 12 Dec 2016 12:46:59 GMT

I don't think there was any major modification between SDK v12.2 and SDK v12.0 on the DFU bootloader. Maybe if you test again with a fresh install of SDK v12.0 it may work.

The difference between the debug version and the normal version is that the debug version won't check for version check (application version, bootloader version, hardware version etc). So if use the normal version, please make sure you set the version correctly (update version should not be lower than original version).

To get nRFutil on Windows, you need to install python, install pip and then do "pip install nrfutil" please follow the instruction here.

RE: Secure DFU bootloader: application not starting

mr91 — Mon, 12 Dec 2016 09:43:49 GMT

Hello and thanks for your response. Since I do not know the exact differences between the debug version and the normal one of the secure bootloader, I used the non-debug-version. To get a successful compilation, I changed the dfu_public_key.c to:

//#ifdef NRF_DFU_DEBUG_VERSION 

/** @brief Public key used to verify DFU images */
__ALIGN(4) const uint8_t pk[64] =
{
    0x6e, 0x76, 0x24, 0x50, 0x38, 0xb6, 0xed, 0x60, 0xc3, 0x60, 0x12, 0x50, 0x00, 0xd2, 0x25, 0x0f, 0xee, 0x37, 0xbf, 0x00, 0x02, 0x6b, 0x50, 0x92, 0x80, 0x32, 0x42, 0x2e, 0xd6, 0x68, 0xde, 0xdf, 
    0x3b, 0xcf, 0xa4, 0x6a, 0x3e, 0x45, 0x9b, 0xb3, 0xb1, 0x3c, 0xa3, 0x39, 0xcc, 0x95, 0x58, 0x36, 0xcd, 0x6d, 0x7e, 0x1f, 0xa1, 0xab, 0x79, 0x05, 0x35, 0x2d, 0x2a, 0xda, 0x19, 0xdb, 0x88, 0xce
};

//#else
//#error "Debug public key not valid for production. Please see github.com/.../README.md to generate it"
//#endif

Could this be the reason for the bootloader not to start? I use SDK v12.1.0 on nRF51. I find it hard to debug software which interacts with a SoftDevice since it generates a Hard Fault after hitting the breakpoint.

Thank you very much for your support!

Edit: It's not possible to compile the bootloader with -O0 since the image gets too big. Unfortunately it's also not possible to enable the debug messages (NRF_LOG_INFO).

Edit2: I am not sure if it's of any help since optimization is still active, but in nrf_dfu_transports_init() there is a call

ret_val = trans->init_func();

Regarding to the debugger, this is a zero-pointer (NULL).

Edit3: Tried it with SDK V12.2.0 and it seems to work. Is there a precompiled version of nrfutil available for Windows which supports the pkg command?

RE: Secure DFU bootloader: application not starting

Hung Bui — Fri, 09 Dec 2016 09:57:32 GMT

Hi,

Please provide more information how you "removed the error regarding the key".

Which SDK version are you testing with ?

You can try to set the optimization level to 0 and step into the code and check why it doesn't advertise.