nRF51 OTA BLE DFU | flash space erased before init packet validation.

RE: nRF51 OTA BLE DFU | flash space erased before init packet validation.

drmd — Wed, 13 Jun 2018 21:33:01 GMT

So I managed to make the change that Hung suggested. And it works the way I want it to: if the init packet validation fails, the device can restart and run the original application without problem.

All I needed to modify is dfu_single_bank.c and dfu_transport_ble.c (attached).

devzone.nordicsemi.com/.../single_5F00_bank_5F00_new_5F00_states.zip

RE: nRF51 OTA BLE DFU | flash space erased before init packet validation.

drmd — Wed, 13 Jun 2018 13:27:18 GMT

Thanks for the reply! I'll give it a try.

RE: nRF51 OTA BLE DFU | flash space erased before init packet validation.

Hung Bui — Wed, 13 Jun 2018 08:35:17 GMT

Hi drmd,

My mistake, I was thinking of the start packet not the init packet.

You are right that when erasing the old application, the bootloader need to wait for the erasing to be finished (max 90ms/page ). There is a call back called dfu_cb_handler() in dfu_transport_ble.c that you can use. Currently it's used to send the notification for the START packet after the erasing is done .

What you can do is to modify it, so that the notification about the INIT packet complete ( ble_dfu_response_send(p_dfu, BLE_DFU_INIT_PROCEDURE, resp_val);) to be delayed instead of the START packet, until the flash erasing is finished.

What you planing to do is also fine, I assume what you do is to verify the DFU master before allowing the bootloader to process the Start packet.

Note that, this trick can easily be recorded and replayed. So this approach is not really safe from attacker. It might be used to avoid accidental DFU update.

RE: nRF51 OTA BLE DFU | flash space erased before init packet validation.

drmd — Tue, 12 Jun 2018 16:35:31 GMT

Hi Hung,

I tried to put the dfu_prepare_func_app_erase() call after dfu_init_prevalidate() in dfu_init_pkt_complete(). I also changed the states correspondingly. My guess is that the clear can take arbitrary amount of time and the state could be messed up between DFU_STATE_RDY ( changed by pstorage_callback_handler() ) and DFU_STATE_RX_DATA_PKT.

However, I found a way to only enable communication with DFU service when a certain value has been written to a characteristic and therefore effectively disable DFU functionality to public. So I'll leave the dfu_single_bank.c as it is.

RE: nRF51 OTA BLE DFU | flash space erased before init packet validation.

Hung Bui — Tue, 12 Jun 2018 16:18:20 GMT

Hi ,

Could you let me know what exactly you modified ?

As far as I understand, the flash erasing of the original application only happens after the start packet is received and application version and image size verified. The function dfu_prepare_func_app_erase () is called inside "case DFU_STATE_IDLE: " in dfu_start_pkt_handle() in dfu_single_bank.c