Buttonless DFU with bond not working

RE: Buttonless DFU with bond not working

ssn — Thu, 19 Jul 2018 00:19:09 GMT

>> I think there is something with the debug bootloader which accepts packets that are not signed (or actually signed with a fixed key, for debugging purposes).

Make sense

RE: Buttonless DFU with bond not working

Edvin — Wed, 18 Jul 2018 05:43:23 GMT

I don't know exactly what the difference is. I added all the logging files to the bootloader project (not _debug, I realize I should have used the _debug project instead to save some time). But other than that, I am not sure what the difference between the two are, that would cause any issues.

I think there is something with the debug bootloader which accepts packets that are not signed (or actually signed with a fixed key, for debugging purposes). But why it works without bonding, and not with bonding, I am not sure.

Best regards,

Edvin

RE: Buttonless DFU with bond not working

ssn — Tue, 17 Jul 2018 16:38:11 GMT

Hello,

Tried with SDK you sent me and it works fine without any issues. Next step I started carefully comparing the files and configuration if something is different.

Only difference I spotted is I was working with SDK\examples\dfu\bootloader_secure_ble\pca10040_debug\armgcc. So I switched my SDK\bootloader to use SDK\examples\dfu\bootloader_secure_ble\pca10040\armgcc and it worked as well ;).

So what is causing in pca10040_debug\armgcc? I used this config to see nrf logger messages on Jlink RTT viewer, this be a reason? _debug bootloader does not match with non debug version of app?

Will dig further and let you know.

Appreciate your time and effort in resolving my issues.

Thank you very much.

regards

Suresh

RE: Buttonless DFU with bond not working

Edvin — Mon, 16 Jul 2018 18:12:14 GMT

Hello,

Attached you will find a fresh copy of the SDK, where I only replaced the files you attached in my_dfu.rar and power_strip.rar.

Your app is located in SDK\examples\Suresh\power_strip\power_strip

the bootloader is located in SDK\examples\dfu\bootloader_secure_ble\pca10040\armgcc

There (in the bootloader folder) you will also find a folder called "application". When you run SDK\examples\dfu\bootloader_secure_ble\pca10040\arngcc\flash_everything.bat it will run your prog_uicr.bat code, flash softdevice, bootloader, bootloader_settings, and application, then reset, and then create the dfu_packages inside the "application" folder. Try to connect to it with nRF Connect and then bond, and upload one of the dfu packs, Suresh_app2.zip or Suresh_app3.zip. They have application version 2 and 3, respectively (the application already running has application version 1, so the packets must start at 2).

The only file I didn't replace in the SDK was the makefile.windows, because I had to use my own compiler. Just edit that file, and you should be able to compile your own version of the bootloader, with a new set of keys(as well of your own application). The keys, by the way, are also located in the bootloader folder (armgcc).

Give it a go, and let me know if this one works for you.

devzone.nordicsemi.com/.../SDK14.2.0_5F00_Suresh.zip

Best regards,

Edvin

RE: Buttonless DFU with bond not working

ssn — Mon, 16 Jul 2018 15:02:38 GMT

>> In the project that I sent you I used your project, and the bootloader found in SDK14.2.0\examples\dfu\bootloader_secure_ble\pca10040\arm5_no_packse.
Could you try with "nRF5_SDK_14.2.0_17b948a\examples\dfu\bootloader_secure_ble\pca10040_debug\armgcc" with sdk_dfu_config.h file attached in my_dfu.zip please.

>> It seems like the hw-version, sd-req is correct. I assume that you use the same private.key as you use without bonding, so I assume that it is correct as well.
I generated the private.key, public_key.c, building micro-ecc library file afresh using below commands(all these runs in batch file)

   nrfutil.exe keys generate private.key
   nrfutil keys display --key pk --format code private.key --out_file public_key.c

   cd C:\Data\Project\Device\SDK\nordic\nRF5_SDK_14.2.0_17b948a\external\micro-ecc\nrf52hf_armgcc\armgcc
   rm -r _build
   make

   copy C:\Data\Project\Device\repository\device\nordic\tools\public_key.c C:\Data\Project\Device\SDK\nordic\nRF5_SDK_14.2.0_17b948a\examples\dfu\dfu_req_handling\public_key.c

   cd C:\Data\Project\Device\SDK\nordic\nRF5_SDK_14.2.0_17b948a\examples\dfu\bootloader_secure_ble\pca10040_debug\armgcc
   rm -r _build
   make

>> Do you use the same keyset with your bootloader with and without bonding? If not, are you sure you are not mixing them up?
I usually clean up the old keys to not confuse with stray files. So, it is always fresh set key-pairs.

>> The difference when you require bonding and when you don't require bonding is that you need to store some bootloader settings that accepts the first application,
What bootloader settings I might have missed?

>> I also get the INVALID_OBJECT message. What application-version do you use in your bootloader_settings file?
When sd_bl_app_merged.hex is generated application-version = 1 and when generating dfu package it is 2. You can verify with nrfutil display command for confirmation.

The way sd_bl_app_merged.hex file generated is as below (you can also generate using my app makefile command flash_sd_bl_app)

nrfutil settings generate --family NRF52 --application C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\nrf52832_xxaa.hex --application-version 1 --bootloader-version 1 --bl-settings-version 1 C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\bootloader_setting.hex
Generated Bootloader DFU settings .hex file and stored it in: C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\bootloader_setting.hex

Bootloader DFU Settings:
* File:                 C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\bootloader_setting.hex
* Family:               nRF52
* Start Address:        0x0007F000
* CRC:                  0x539861AA
* Settings Version:     0x00000001 (1)
* App Version:          0x00000001 (1)
* Bootloader Version:   0x00000001 (1)
* Bank Layout:          0x00000000
* Current Bank:         0x00000000
* Application Size:     0x00012D44 (77124 bytes)
* Application CRC:      0xEEC9D449
* Bank0 Bank Code:      0x00000001

mergehex --merge C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\bootloader_setting.hex C:\Data\Project\Device\SDK\nordic\nRF5_SDK_14.2.0_17b948a\examples\dfu\bootloader_secure_ble\pca10040_debug\armgcc\_build\nrf52832_xxaa_s132.hex --output C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\bootloader_merged.hex
Parsing input hex files.
Merging files.
Storing merged file.
mergehex --merge C:\Data\Project\Device\SDK\nordic\nRF5_SDK_14.2.0_17b948a\components\softdevice\s132\hex\s132_nrf52_5.0.0_softdevice.hex C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\bootloader_merged.hex C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\nrf52832_xxaa.hex --output C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\sd_bl_app_merged.hex
Parsing input hex files.
Merging files.
Storing merged file.

DFU package is generated as below

nrfutil pkg generate --hw-version 52 --sd-req 0x9d --application-version 1 --application C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\nrf52832_xxaa.hex --key-file C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\private.key C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\app_dfu_package.zip
Zip created at C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\app_dfu_package.zip

I suggest you try with gcc version and please use my app makefile commands to generate sd_bl_app_merged.hex and app_dfu_package.zip so that we are in sync(ignore this line if you are already doing it)

>> Have you changed anything else in the bootloader, other than what we have discussed?
I have attached all the files which I changed in bootloader but I believe those should not cause this issue.

Regards
Suresh
devzone.nordicsemi.com/.../my_5F00_dfu.zip

RE: Buttonless DFU with bond not working

Edvin — Mon, 16 Jul 2018 11:40:41 GMT

Hello,

I understand.

Yes. 0x9D is the correct sd-req. You can see the list of the different softdevices by typing the command:

"nrfutil pkg generate --help".

In the project that I sent you I used your project, and the bootloader found in SDK14.2.0\examples\dfu\bootloader_secure_ble\pca10040\arm5_no_packse.

The only changes are:

in sdk_config.h: #define NRF_DFU_BLE_REQUIRES_BONDS 1

and the gap_params_init() function, as described above, to change the address when the bootloader starts.

INVALID_OBJECT means that the DFU packet that you are sending is not accepted by the bootloader. The reasons for this is usually that it has used a wrong signing key (private.key), wrong hw-version, wrong sd-req or insufficient application-version.

It seems like the hw-version, sd-req is correct. I assume that you use the same private.key as you use without bonding, so I assume that it is correct as well.

This leaves the application-version.

Do you use the same keyset with your bootloader with and without bonding? If not, are you sure you are not mixing them up?

The difference when you require bonding and when you don't require bonding is that you need to store some bootloader settings that accepts the first application, which is required for bonding with the device that is going to perform the DFU transfer. This is not needed in DFU without bonding, because you can start directly in bootloader mode, without having any bonding information stored.

I tested your files (my_bin.rar) with my bootloader(changed the private.key to the one you included). Then flashed the sd_bl_app_merged.hex file, and the bootloader_settings.hex-file (I also tried without. Didn't know whether it was merged in the other file).

I also get the INVALID_OBJECT message. What application-version do you use in your bootloader_settings file? Have you changed anything else in the bootloader, other than what we have discussed?

BR,

Edvin

RE: Buttonless DFU with bond not working

ssn — Mon, 16 Jul 2018 06:45:52 GMT

Hi Edvin,

The GATT_WRITE issue is resloved but I still see the INVALID_OBJECT. please see the above digest for more details.

Regards

Suresh

RE: Buttonless DFU with bond not working

Edvin — Mon, 16 Jul 2018 06:35:00 GMT

Hello,

Sorry. I was out of office the previous week. I see that you have been working a bit on this. I assume from your last reply that it is working now. Is that correct?

Best regards,

Edvin

RE: Buttonless DFU with bond not working

ssn — Sat, 14 Jul 2018 15:32:30 GMT

The GATT_WRITE issue was because Android_8.0 app doesn't refresh the service discovery when switching to DFU mode and this can be resolved by clicking on refresh item.

RE: Buttonless DFU with bond not working

ssn — Sat, 14 Jul 2018 15:30:19 GMT

After digging into some I see the bootloader returns INVALID_OBJECT at below code in dfu_req_handling.c

dfu_handle_prevalidate()
{
    :
   :
    // calculate the signature
    NRF_LOG_INFO("Verify signature");
    err_code = nrf_crypto_ecdsa_verify_hash(sig_info_p256, &crypto_key_pk, &init_packet_hash, &crypto_sig);
    if (err_code != NRF_SUCCESS)
    {
        NRF_LOG_ERROR("Signature failed");
        nrf_gpio_pin_clear(BSP_LED_3);
        return NRF_DFU_RES_CODE_INVALID_OBJECT;
    }
}

Why and what am I doing wrong?

attached(my_bin.rar) is my generated binaries, could you try with this in your setup and let me know please.

Also, sdk_config.h file of yours is different from SDK 14.2 and I can't build bootloader with your config file. What bootloader are you using?

Could you help me with this please as I'm stuck for months in this issue and this is real thing that needs to be re-solved as it can help many other who haven't tried this configuration of DFU.

devzone.nordicsemi.com/.../my_5F00_bin.rar

RE: Buttonless DFU with bond not working

ssn — Tue, 10 Jul 2018 10:20:51 GMT

Hi,

Appreciate your response to my previous digest.

Thank you

Regards

RE: Buttonless DFU with bond not working

ssn — Sat, 07 Jul 2018 15:08:34 GMT

I tried your application and dfu package in two different version of Android phones as below

Case 1(Moto X4 with Android 8.0, nrfconnect version = 4.19.2):
I get the same issue of GATT WRITE NOT PERMIT error. Further debugging I can see the application custom services listed in dfu mode which should not be the case
as custom services are never known in dfu mode. I suspect the phone does not discover the services afresh in dfu mode instead uses the cached stuff got from application. Using the application handle in dfu mode makes
the device cry and sending GATT WRITE NOT PERMIT error. I did tried with different BD address and I can see the same symptoms.
I have enabled NRF_SDH_BLE_SERVICE_CHANGED in bootloader config file but still does not help. I believe you should do some workaround in nrfconnect for Android 8.0 or I also suspect nrfconnect 4.19.2 version as I remember this not happening in moto X4 before I updated to this version.

Case 2(Nexus 5 with Android 6.0.1 with your files, nrfconnect version = 4.19.0):
I don't see GATT WRITE NOT PERMIT error and dfu works without any issues and completes and device boots up correctly - Hurray!!!. And I don't see the application custom services
listed in dfu mode either which means the phone discovers the service afresh..

Case 3(Nexus 5 with Android 6.0.1 with my setup, nrfconnect version = 4.19.0):
Tried the same stuff with my setup but here I see different issue

V   01:19:26.612   [DFU] Writing to characteristic 8ec90001-f315-4f60-9fb8-838830daea50
D   01:19:26.612   [DFU] gatt.writeCharacteristic(8ec90001-f315-4f60-9fb8-838830daea50)
I   01:19:26.697   [DFU] Data written to 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 04
I   01:19:26.807   [DFU] Notification received from 8ec90001-f315-4f60-9fb8-838830daea50, value (0x): 60-04-05
E   01:19:26.807   [DFU] Remote DFU error: INVALID OBJECT
V   01:19:26.807   [DFU] Disconnecting...

Command I use to generate dfu pkg is

"nrfutil pkg generate --hw-version 52 --sd-req 0x9d --application-version 3 --application C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\nrf52832_xxaa.hex --key-file C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\private.key C:\Data\Project\Device\repository\device\nordic\gcc\power_strip\_build\app_dfu_package.zip"

I'm using s132_nrf52_5.0.0_softdevice.hex so 0x9d is correct, What am I missing? This command works fine without bonding.

Can you use the makefile command to generate the dfu pkg and let me know if it that works please.

Also, I observed with your files the device does not send disconnect packet to phone on entering bootloader but phone waits for time out. This is not the case on SDK 14.2 as it sends disconnect packet to phone before resetting the device. Is your bootloader something different from what I use?

Regards
Suresh

RE: Buttonless DFU with bond not working

Edvin — Fri, 06 Jul 2018 09:05:21 GMT

I didn't change anything but the NRF_DFU_BLE_REQUIRES_BONDS to 1 in sdk_config.h, and in the rest of the Bootloader project, I only changed the address to match the C0:... address.

devzone.nordicsemi.com/.../sdk_5F00_config.h

Can you also try to program the kit with the attached .hex file (it is included the softdevice and bootloader, your application and bootloader settings file). Then try to perform the DFU with the attached DFU packet, custom_app2.zip.

devzone.nordicsemi.com/.../fullfile.hex

devzone.nordicsemi.com/.../custom_5F00_app2.zip

Remember to run your prog_uicr.bat script before programming the fullfile.hex.

Fullfile.hex is the file based on your application, the bootloader generated with bonding required, and the changed address (C0:C0:C0:C0:C0:C0)

I just want to check whether there might be something wrong with the android app, or in some project settings in one of the projects.

Please also delete bonding information from the phone before connecting in nRF Connect. The passkey is still the same as it was in your application.

Let me know if it works.

Best regards,

Edvin

RE: Buttonless DFU with bond not working

ssn — Fri, 06 Jul 2018 03:18:10 GMT

Did you set the STATIC_RANDOM_FLAG in bootloader mode? I have one more suspicion that phone doesn't not re discover the services in bootloader mode since the BD address are same and I believe bootloader has different gatt database making the handles to mismatch.

I did enable the service change request in bootloader mode which should make phone to re discover. Anyway sniffer should give me all details. Let me search for sniffer.

RE: Buttonless DFU with bond not working

ssn — Fri, 06 Jul 2018 01:34:06 GMT

I see the device is connected to Android phone in bootloader mode( Led 2 and 3 are ON). I suspect Android_8.0 phone is not encrypting the link when connecting to device in bootloader mode( will confirm with sniffer). When I try to enable or disable dfu service indication I see GAtt write error and trying to read char configuration of dfu service gives ""expected 16bit but got 128 bit" error message. Do I need to change the bootloader device name "DfuTarg" to match with application device name? Does having different name makes phone to think different device in bootloader mode even though BD address is same?

Could you share your bootloader sdk_config.h file please?

Regards

Suresh

RE: Buttonless DFU with bond not working

Edvin — Thu, 05 Jul 2018 06:50:31 GMT

It looks like you are not bonded. Are you sure that you are?

Could it be that there are other devices in the same area advertising with the same address (C0:C0:C0:C0:C0:C0)?

Try to change the address to something else, something random that no other device in the area is using. Remember to change to that device in the bootloader as well.

When you get the GATT WRITE NOT PERMIT, what LEDs on the DK is on? (LED1 and LED3) or (LED2 and LED3)?

If it is LED1 and LED3, this suggests that you are not connected to the correct device, because it should change to LED2 and LED3 when it is connected.

I just ran the DFU process with your application and with the modified bootloader where the address is changed in nRF Connect for iOS, and it works.

BR,

Edvin

RE: Buttonless DFU with bond not working

ssn — Wed, 04 Jul 2018 13:56:07 GMT

devzone.nordicsemi.com/.../ble_5F00_dfu.rar

Hi,

I did changes as per your suggestion but still I see GATT WRITE ERROR.

V 06:03:45.817 [DFU] Enabling indications for 8ec90004-f315-4f60-9fb8-838830daea50

D 06:03:45.817 [DFU] gatt.setCharacteristicNotification(8ec90004-f315-4f60-9fb8-838830daea50, true)

D 06:03:45.819 [DFU] gatt.writeDescriptor(00002902-0000-1000-8000-00805f9b34fb, value=0x02-00)

E 06:03:45.891 [DFU] Error (0x03): GATT WRITE NOT PERMIT

V 06:03:45.891 [DFU] Disconnecting...

D 06:03:45.913 [DFU] gatt.disconnect()

I 06:03:45.913 [DFU] Disconnected

D 06:03:45.913 [DFU] gatt.close()

My steps(used pca10040_debug of BL):

After building app, bootloader I use "flash_sd_bl_app" command from makefile to flash a fresh chip i.e. SD + BL + APP at one go.

I change the APP_VERSION to 2, re-build app and generate DFU package using "generate_dfu_pkg" command from makefile.

I connect nrfconnect from Android phone to device, pair, click on DFU icon and choose the generted dfu package (from above). I see GATT WRITE ERROR as above(check attached dfu_bond.docx file for more info).

Could you let me the detailed steps using Android phone if you succeed in getting DFU working.

I'm wondering if I'm doing something stupid.

Thank you

RE: Buttonless DFU with bond not working

Edvin — Tue, 03 Jul 2018 14:37:24 GMT

Hello,

Have you changed the address in the bootloader like you did in the application in file ble_app.c on line 545-548?

If you have, can you send the bootloader project as well, so I can replicate the error?

Edit:

I tried to change the address like you did in the bootloader project (hard coded), and now the DFU worked. Not an elegant fix, but you can do this for testing. In the file nrf_ble_dfu.c in the bootloader_secure_ble project, change the gap_params_init() function to the following:

static uint32_t gap_params_init(void)
{
    uint32_t                err_code;
    ble_gap_conn_params_t   gap_conn_params = {0};
    ble_gap_conn_sec_mode_t sec_mode;
    uint8_t const *         device_name;
    uint32_t                name_len;

    BLE_GAP_CONN_SEC_MODE_SET_OPEN(&sec_mode);

#if !defined(NRF_DFU_BLE_REQUIRES_BONDS) || (NRF_DFU_BLE_REQUIRES_BONDS == 0)

    err_code = gap_address_change();
    VERIFY_SUCCESS(err_code);

    if ((m_flags & DFU_BLE_FLAG_USE_ADV_NAME) != 0)
    {
        NRF_LOG_DEBUG("Setting adv name: %s, length: %d", (uint32_t)m_adv_name.name, m_adv_name.len);
        device_name = m_adv_name.name;
        name_len = m_adv_name.len;
    }
    else
#endif
    {
        NRF_LOG_DEBUG("Regular adv name");
        device_name = (uint8_t const *)DEVICE_NAME;
        name_len = strlen(DEVICE_NAME);
    }
    ble_gap_addr_t addr;
    sd_ble_gap_addr_get(&addr);
    for (int i=0; i<6; i++)
    {
        addr.addr[i] = 0xC0;
    }
    err_code = sd_ble_gap_addr_set(&addr);
    VERIFY_SUCCESS(err_code);

    err_code = sd_ble_gap_device_name_set(&sec_mode, device_name, name_len);
    VERIFY_SUCCESS(err_code);

    gap_conn_params.min_conn_interval = MIN_CONN_INTERVAL;
    gap_conn_params.max_conn_interval = MAX_CONN_INTERVAL;
    gap_conn_params.slave_latency     = SLAVE_LATENCY;
    gap_conn_params.conn_sup_timeout  = CONN_SUP_TIMEOUT;

    err_code = sd_ble_gap_ppcp_set(&gap_conn_params);
    return err_code;
}

If that works, read out the address from the register, as you do in the app that you sent me.

The problem for me was that the bootloader didn't use the custom address, and started advertising as DfuTarg with a random address, so the kit that performed the DFU with nRF Connect couldn't find the bootloader board (because it doesn't expect it to change address if bonding is required).

Best Regards,

Edvin

RE: Buttonless DFU with bond not working

ssn — Tue, 03 Jul 2018 01:27:47 GMT

All I did in bootloader and app is changed the BD address to static random instead of default one. If bootloader address is default i can't dfu because application is bonded with static random address.

Mean time will try with default button less app as suggested.

I will wait for your inputs.

Thank you

Regards

Suresh

RE: Buttonless DFU with bond not working

Edvin — Mon, 02 Jul 2018 13:06:49 GMT

I will not have time to look at your application today. We are a bit short staffed these days. What you can do in the meantime is to start with a standard case of buttonless_dfu with bonding, as I described in a previous post, and try to change one thing at the time, and see where it fails. You have a better overview than me what changes you have done. I suspect that there are some issues in the way that the address is changed. Maybe the board performing the DFU doesn't look for the correct address? What happens if you don't change the address?

BR,

Edvin

RE: Buttonless DFU with bond not working

ssn — Fri, 29 Jun 2018 15:12:50 GMT

Hi,

Attached is the APP. U need to run the batch file(part of .rar) to burn UICR before flashing program.

Expecting your reply.

Regards

Suresh

devzone.nordicsemi.com/.../power_5F00_strip.rar

RE: Buttonless DFU with bond not working

Edvin — Fri, 29 Jun 2018 10:38:39 GMT

Hello,

You can send me a PM.

I suspect that there is something wrong in the setup of the Buttonless_DFU service (After you changed the application-version to 1 higher than the currently running application).

BR,

Edvin

RE: Buttonless DFU with bond not working

ssn — Thu, 28 Jun 2018 15:26:54 GMT

Hi Edvin,

The application has IP in it but anyway I will try to remove the IP part and I can share it if you make this thread private please.

In bootloader I have changed to take the static random address and I will share this part as well.

Thank you

Regards

Suresh

RE: Buttonless DFU with bond not working

Edvin — Thu, 28 Jun 2018 14:13:13 GMT

But I don't have your application. Can you please upload the full project, then I may test it. I assume that you haven't changed anything in the bootloader? So I can combine the sdk_config for the bootloader with the bootloader project in the SDK.

But please upload the application that you have modified.

BR,

Edvin

RE: Buttonless DFU with bond not working

ssn — Thu, 28 Jun 2018 12:58:42 GMT

Hi Edvin,

Please see the attached zip files which contains sdk_config.h/makefile for bootloader and application.

Also, I think you have tried with default buttonless_dfu app. Could you try with static random address with MITM enabled please. I given these details in first thread.

It would be great if you follow the steps I'm using in app makefile for flashing SD,BL,APP.

Not sure if I'm missing something.

Regards

Suresh