nrf51 dfu via nrfToolbox or nrfConnect crashes on dfu upload Huawei p30 lite

RE: nrf51 dfu via nrfToolbox or nrfConnect crashes on dfu upload Huawei p30 lite

bjorn-spockeli — Wed, 29 May 2019 15:08:33 GMT

Hmm,

error code 4 is NRF_ERROR_NO_MEM. Digging down in the functions called internally in dfu_data_pkt_handle() it looks like this error code is coming from

dfu_data_pkt_handle()->pstorage_store->cmd_queue_enqueue

due to the queue count reaching the PSTORAGE_CMD_QUEUE_SIZE limit.

static uint32_t cmd_queue_enqueue(uint8_t             opcode,
                                  pstorage_handle_t * p_storage_addr,
                                  uint8_t           * p_data_addr,
                                  pstorage_size_t     size,
                                  pstorage_size_t     offset)
{
    uint32_t retval;

    if (m_cmd_queue.count != PSTORAGE_CMD_QUEUE_SIZE)
    {
        uint8_t write_index = m_cmd_queue.rp + m_cmd_queue.count;

        if (write_index >= PSTORAGE_CMD_QUEUE_SIZE)
        {
            write_index -= PSTORAGE_CMD_QUEUE_SIZE;
        }

        m_cmd_queue.cmd[write_index].op_code      = opcode;
        m_cmd_queue.cmd[write_index].p_data_addr  = p_data_addr;
        m_cmd_queue.cmd[write_index].storage_addr = (*p_storage_addr);
        m_cmd_queue.cmd[write_index].size         = size;
        m_cmd_queue.cmd[write_index].offset       = offset;
        retval                                    = NRF_SUCCESS;
        if (m_cmd_queue.flash_access == false)
        {
            retval = cmd_process();
            if (retval == NRF_ERROR_BUSY)
            {
                // In case of busy error code, it is possible to attempt to access flash.
                retval = NRF_SUCCESS;
            }
        }
        m_cmd_queue.count++;
    }
    else
    {
        retval = NRF_ERROR_NO_MEM;
    }

    return retval;
}

The PSTORAGE_CMD_QUEUE_SIZE is configurable so you could try to increase it. It is defined to 10 by default in pstorage_platform.h

However, it is odd that requesting a larger MTU size appears to resolve the issue. Would you be able to capture a sniffer trace of the on air packets using our nRF Sniffer v2?

https://www.nordicsemi.com/Software-and-Tools/Development-Tools/nRF-Sniffer

Best regards

Bjørn

RE: nrf51 dfu via nrfToolbox or nrfConnect crashes on dfu upload Huawei p30 lite

Robin P — Wed, 29 May 2019 09:34:07 GMT

static void app_data_process(ble_dfu_t * p_dfu, ble_dfu_evt_t * p_evt)

{

    uint32_t err_code;

 

    if ((p_evt->evt.ble_dfu_pkt_write.len & (sizeof(uint32_t) - 1)) != 0)

    {

        // Data length is not a multiple of 4 (word size).

        err_code = ble_dfu_response_send(p_dfu,

                                         BLE_DFU_RECEIVE_APP_PROCEDURE,

                                         BLE_DFU_RESP_VAL_NOT_SUPPORTED);

        APP_ERROR_CHECK(err_code);

        return;

    }

 

    uint32_t length = p_evt->evt.ble_dfu_pkt_write.len;

 

    err_code = hci_mem_pool_rx_produce(length, (void **) &mp_rx_buffer);

    if (err_code != NRF_SUCCESS)

    {

        dfu_error_notify(p_dfu, err_code);

        return;

    }

 

    uint8_t * p_data_packet = p_evt->evt.ble_dfu_pkt_write.p_data;

   

    memcpy(mp_rx_buffer, p_data_packet, length);

 

    err_code = hci_mem_pool_rx_data_size_set(length);

    if (err_code != NRF_SUCCESS)

    {

        dfu_error_notify(p_dfu, err_code);

        return;

    }

 

    err_code = hci_mem_pool_rx_extract(&mp_rx_buffer, &length);

    if (err_code != NRF_SUCCESS)

    {

        dfu_error_notify(p_dfu, err_code);

        return;

    }

 

    dfu_update_packet_t dfu_pkt;

 

    dfu_pkt.packet_type                      = DATA_PACKET;

    dfu_pkt.params.data_packet.packet_length = length / sizeof(uint32_t);

    dfu_pkt.params.data_packet.p_data_packet = (uint32_t *)mp_rx_buffer;

 

    err_code = dfu_data_pkt_handle(&dfu_pkt); // här genereras felet

 

    if (err_code == NRF_SUCCESS)

    {

        m_num_of_firmware_bytes_rcvd += p_evt->evt.ble_dfu_pkt_write.len;

 

        // All the expected firmware data has been received and processed successfully.

        // Response will be sent when flash operation for final packet is completed.

        mp_final_packet = mp_rx_buffer;

    }

    else if (err_code == NRF_ERROR_INVALID_LENGTH)

    {

        // Firmware data packet was handled successfully. And more firmware data is expected.

        m_num_of_firmware_bytes_rcvd += p_evt->evt.ble_dfu_pkt_write.len;

 

        // Check if a packet receipt notification is needed to be sent.

        if (m_pkt_rcpt_notif_enabled)

        {

            // Decrement the counter for the number firmware packets needed for sending the

            // next packet receipt notification.

            m_pkt_notif_target_cnt--;

 

            if (m_pkt_notif_target_cnt == 0)

            {

                err_code = ble_dfu_pkts_rcpt_notify(p_dfu, m_num_of_firmware_bytes_rcvd);

                APP_ERROR_CHECK(err_code);

 

                // Reset the counter for the number of firmware packets.

                m_pkt_notif_target_cnt = m_pkt_notif_target;

            }

       }

    }

    else

    {

        uint32_t hci_error = hci_mem_pool_rx_consume(mp_rx_buffer);

        if (hci_error != NRF_SUCCESS)

        {

            dfu_error_notify(p_dfu, hci_error);

        }

 

        dfu_error_notify(p_dfu, err_code);

    }

}

Fault is generated at: err_code = dfu_data_pkt_handle(&dfu_pkt)

Then in function: nrf_err_code_translate we have error code 4 going in, but there is no handler for error code 4 so it returns default: BLE_DFU_RESP_VAL_OPER_FAILED

Mtu: In Android application -> settings -> connectivity -> Auto request maximum MTU. This enabled makes dfu succeed

RE: nrf51 dfu via nrfToolbox or nrfConnect crashes on dfu upload Huawei p30 lite

bjorn-spockeli — Tue, 28 May 2019 09:29:48 GMT

Which function is returning NO_MEM? Which MTU are you requesting?

RE: nrf51 dfu via nrfToolbox or nrfConnect crashes on dfu upload Huawei p30 lite

Robin P — Tue, 28 May 2019 09:28:44 GMT

We tried debugging the bootloader, And the error we get is error code 4 NO_MEM before it throws the OPERATION_FAILED.

However if I set request MTU in app, the DFU succeeds.

RE: nrf51 dfu via nrfToolbox or nrfConnect crashes on dfu upload Huawei p30 lite

bjorn-spockeli — Tue, 28 May 2019 09:27:06 GMT

Ok, are you using one of the sample firmware images from the SDK, i.e. one of the .zip files in examples\dfu\ble_dfu_send_hex or if you have generated your own image using nrfutil?

RE: nrf51 dfu via nrfToolbox or nrfConnect crashes on dfu upload Huawei p30 lite

Robin P — Tue, 28 May 2019 09:16:15 GMT

0.3.0

RE: nrf51 dfu via nrfToolbox or nrfConnect crashes on dfu upload Huawei p30 lite

bjorn-spockeli — Mon, 27 May 2019 14:40:54 GMT

Which version of nrfutil are you using?

RE: nrf51 dfu via nrfToolbox or nrfConnect crashes on dfu upload Huawei p30 lite

Robin P — Mon, 27 May 2019 13:34:30 GMT

We have used nrfutil to generate image, and sdk version is: 11.

This works on older Android phones.

The Huawei phone is using android 9, with emui 9.0.1.

Some other tests:

Tried with dfuing another product we are working with that uses nrf52 and sdk 15.2.0, This however works to flash from the Huawei phone.

But a strange thing(Maybe not, but I have not seen it before) is that as soon as the fw upload starts, it spawns another connection in nrf connect view to DFU TARG. And at the same time the firmware upload runs in the background in the old connection.

RE: nrf51 dfu via nrfToolbox or nrfConnect crashes on dfu upload Huawei p30 lite

bjorn-spockeli — Mon, 27 May 2019 11:30:03 GMT

Hi Robin,

which SDK version and which SoftDevice version are you using?

Checking the latest SDK that supports the nRF51 Series, which is SDK v12.3.0, I see that the bootloader code will return the NRF_DFU_RES_CODE_OPERATION_FAILED code in the prevalidation of the firmware image, i.e. if the version numbers are correct, if the signature of the firmware image is valid etc. See dfu_handle_prevalidate() in dfu_req_handling.c below.

So I would like to ask if you are using one of the sample firmware images from the SDK, i.e. one of the .zip files in examples\dfu\ble_dfu_send_hex or if you have generated your own image using nrfutil?

static nrf_dfu_res_code_t dfu_handle_prevalidate(dfu_signed_command_t const * p_command, pb_istream_t * p_stream, uint8_t * p_init_cmd, uint32_t init_cmd_len)
{
    dfu_init_command_t const *  p_init = &p_command->command.init;
    uint32_t                    err_code;
    uint32_t                    hw_version = NRF_DFU_HW_VERSION;
    uint32_t                    fw_version = 0;

    // check for init command found during decoding
    if(!p_init_cmd || !init_cmd_len)
    {
        return NRF_DFU_RES_CODE_OPERATION_FAILED;
    }

#ifndef NRF_DFU_DEBUG_VERSION
    if(p_init->has_is_debug && p_init->is_debug == true)
    {
        return NRF_DFU_RES_CODE_OPERATION_FAILED;
    }
#endif

#ifdef NRF_DFU_DEBUG_VERSION
    if (p_init->has_is_debug == false || p_init->is_debug == false)
    {
#endif
        if (p_init->has_hw_version == false)
        {
            return NRF_DFU_RES_CODE_OPERATION_FAILED;
        }

        // Check of init command HW version
        if(p_init->hw_version != hw_version)
        {
            return NRF_DFU_RES_CODE_OPERATION_FAILED;
        }

        // Precheck the SoftDevice version
        bool found_sd_ver = false;
        for(int i = 0; i < p_init->sd_req_count; i++)
        {
            if (p_init->sd_req[i] == SD_FWID_GET(MBR_SIZE))
            {
                found_sd_ver = true;
                break;
            }
        }
        if (!found_sd_ver)
        {
            return NRF_DFU_RES_CODE_OPERATION_FAILED;
        }

        // Get the fw version
        switch (p_init->type)
        {
            case DFU_FW_TYPE_APPLICATION:
                if (p_init->has_fw_version == false)
                {
                    return NRF_DFU_RES_CODE_OPERATION_FAILED;
                }
                // Get the application FW version
                fw_version = s_dfu_settings.app_version;
                break;

            case DFU_FW_TYPE_SOFTDEVICE:
                // not loaded
                break;

            case DFU_FW_TYPE_BOOTLOADER: // fall through
            case DFU_FW_TYPE_SOFTDEVICE_BOOTLOADER:
                if (p_init->has_fw_version == false)
                {
                    return NRF_DFU_RES_CODE_OPERATION_FAILED;
                }
                fw_version = s_dfu_settings.bootloader_version;
                break;

            default:
                NRF_LOG_INFO("Unknown FW update type\r\n");
                return NRF_DFU_RES_CODE_OPERATION_FAILED;
        }

        NRF_LOG_INFO("Req version: %d, Present: %d\r\n", p_init->fw_version, fw_version);

        // Check of init command FW version
        switch (p_init->type)
        {
            case DFU_FW_TYPE_APPLICATION:
                if (p_init->fw_version < fw_version)
                {
                    return NRF_DFU_RES_CODE_OPERATION_FAILED;
                }
                break;

            case DFU_FW_TYPE_BOOTLOADER:            // fall through
            case DFU_FW_TYPE_SOFTDEVICE_BOOTLOADER:
                // updating the bootloader is stricter. There must be an increase in version number
                if (p_init->fw_version <= fw_version)
                {
                    return NRF_DFU_RES_CODE_OPERATION_FAILED;
                }
                break;

            default:
                // do not care about fw_version in the case of a softdevice transfer
                break;
        }

#ifdef NRF_DFU_DEBUG_VERSION
    }
#endif

    // Check the signature
    switch (p_command->signature_type)
    {
        case DFU_SIGNATURE_TYPE_ECDSA_P256_SHA256:
            {
                // prepare the actual hash destination.
                hash_data.p_le_data = &hash[0];
                hash_data.len = sizeof(hash);

                NRF_LOG_INFO("Init command:\r\n");
                NRF_LOG_HEXDUMP_INFO(&s_dfu_settings.init_command[0], s_dfu_settings.progress.command_size);
                NRF_LOG_INFO("\r\n");

                NRF_LOG_INFO("p_Init command:\r\n");
                NRF_LOG_HEXDUMP_INFO(&p_init_cmd[0], init_cmd_len);
                NRF_LOG_INFO("\r\n");

                err_code = nrf_crypto_hash_compute(NRF_CRYPTO_HASH_ALG_SHA256, p_init_cmd, init_cmd_len, &hash_data);
                if (err_code != NRF_SUCCESS)
                {
                    return NRF_DFU_RES_CODE_OPERATION_FAILED;
                }

                // prepare the signature received over the air.
                memcpy(&sig[0], p_command->signature.bytes, p_command->signature.size);

                NRF_LOG_INFO("Signature\r\n");
                NRF_LOG_HEXDUMP_INFO(&p_command->signature.bytes[0], p_command->signature.size);
                NRF_LOG_INFO("\r\n");

                crypto_sig.p_le_data = sig;
                crypto_sig.len = p_command->signature.size;

                NRF_LOG_INFO("signature len: %d\r\n", p_command->signature.size);

                // calculate the signature
                err_code = nrf_crypto_verify(NRF_CRYPTO_CURVE_SECP256R1, &crypto_key_pk, &hash_data, &crypto_sig);
                if (err_code != NRF_SUCCESS)
                {
                    return NRF_DFU_RES_CODE_INVALID_OBJECT;
                }

                NRF_LOG_INFO("Image verified\r\n");
            }
            break;

        default:
            return NRF_DFU_RES_CODE_OPERATION_FAILED;
    }

    // Get the update size
    m_firmware_size_req = 0;

    switch (p_init->type)
    {
        case DFU_FW_TYPE_APPLICATION:
            if (p_init->has_app_size == false)
            {
                return NRF_DFU_RES_CODE_OPERATION_FAILED;
            }
            m_firmware_size_req += p_init->app_size;
            break;

        case DFU_FW_TYPE_BOOTLOADER:
            if (p_init->has_bl_size == false)
            {
                return NRF_DFU_RES_CODE_OPERATION_FAILED;
            }
            m_firmware_size_req += p_init->bl_size;
            // check that the size of the bootloader is not larger than the present one.
#if defined ( NRF51 )
            if (p_init->bl_size > BOOTLOADER_SETTINGS_ADDRESS - BOOTLOADER_START_ADDR)
#elif defined ( NRF52 )
            if (p_init->bl_size > NRF_MBR_PARAMS_PAGE_ADDRESS - BOOTLOADER_START_ADDR)
#endif
            {
                return NRF_DFU_RES_CODE_INSUFFICIENT_RESOURCES;
            }
            break;

        case DFU_FW_TYPE_SOFTDEVICE:
            if (p_init->has_sd_size == false)
            {
                return NRF_DFU_RES_CODE_OPERATION_FAILED;
            }
            m_firmware_size_req += p_init->sd_size;
            break;

        case DFU_FW_TYPE_SOFTDEVICE_BOOTLOADER:
            if (p_init->has_bl_size == false || p_init->has_sd_size == false)
            {
                return NRF_DFU_RES_CODE_OPERATION_FAILED;
            }
            m_firmware_size_req += p_init->sd_size + p_init->bl_size;
            if (p_init->sd_size == 0 || p_init->bl_size == 0)
            {
                return NRF_DFU_RES_CODE_INVALID_PARAMETER;
            }

            // check that the size of the bootloader is not larger than the present one.
#if defined ( NRF51 )
            if (p_init->bl_size > BOOTLOADER_SETTINGS_ADDRESS - BOOTLOADER_START_ADDR)
#elif defined ( NRF52 )
            if (p_init->bl_size > NRF_MBR_PARAMS_PAGE_ADDRESS - BOOTLOADER_START_ADDR)
#endif
            {
                return NRF_DFU_RES_CODE_INSUFFICIENT_RESOURCES;
            }
            break;

        default:
            NRF_LOG_INFO("Unknown FW update type\r\n");
            return NRF_DFU_RES_CODE_OPERATION_FAILED;
    }

    // SHA256 is the only supported hash
    memcpy(&hash[0], &p_init->hash.hash.bytes[0], 32);

    // Instead of checking each type with has-check, check the result of the size_req to
    // Validate its content.
    if (m_firmware_size_req == 0)
    {
        return NRF_DFU_RES_CODE_INVALID_PARAMETER;
    }

    // Find the location to place the DFU updates
    err_code = nrf_dfu_find_cache(m_firmware_size_req, false, &m_firmware_start_addr);
    if (err_code != NRF_SUCCESS)
    {
        return NRF_DFU_RES_CODE_INSUFFICIENT_RESOURCES;
    }

    NRF_LOG_INFO("Write address set to 0x%08x\r\n", m_firmware_start_addr);

    NRF_LOG_INFO("DFU prevalidate SUCCESSFUL!\r\n");

    return NRF_DFU_RES_CODE_SUCCESS;
}