Extending application of SDK 12.3 for legacy buttonless DFU

[Tim]

Hello,

I need to develop an application for nRF51822 that uses SoftDevice 110 v8.0.0 using SDK 12.3 and extend it to use buttonless DFU for the legacy DFU bootloader of SDK 10/11. I've successfully added S110 v8.0.0 to SDK 12.3 and have its ble_app_uart example building and working well using Segger Embedded Studio 4.18 on macOS (on nRF51 DK).

The DFU bootloader of 12.3 is the newer secure bootloader, so instructions/examples for extending an application for buttonless DFU are for this newer secure bootloader. A couple tickets (here and here) state that it is possible to port the legacy DFU service and related libraries from SDK 10/11 to SDK 12.3.

The guide for extending an app for buttonless DFU in SDK 11 state that the application must use Device Manager. I understand that Device Manager was removed in SDK 12.x and replaced with Peer Manager. I'm a bit lost on how to go about this. Adding buttonless legacy DFU support to an application in SDK 10/11 relies on:

bootloader_util_arm.c in nRF51SDK1000dc26b5e/examples/dfu/experimental_ant_bootloader/
dfu_app_handler.c in nRF51SDK1000dc26b5e/components/libraries/bootloader_dfu
ble_dfu.c in nRF51SDK1000dc26b5e/components/ble/ble_services/ble_dfu

Adding buttonless DFU (secure) support to an application in SDK 12.3 relies on:

ble_dfu.c in
nrf_dfu_settings.c

I've tried approaching this a number of different ways, all unsuccessful so far. Before providing details, thought I would ask for some initial guidance. General steps for extending the ble_app_uart application of SDK 12.3 with S110 v8.0.0 for buttonless legacy DFU.

Many thanks,

Tim

[bjorn-spockeli]

Hi Tim, 

as far as I remember, the Device Manager is only used to fetch the Peer Data. So I think that you only have to modify the dfu_app_peer_data_set() function 

/**@brief Function for providing peer information to DFU for re-establishing a bonded connection in
 *        DFU mode.
 *
 * @param[in] conn_handle   Connection handle for the connection requesting DFU mode.
 */
static void dfu_app_peer_data_set(uint16_t conn_handle)
{
    uint32_t                 err_code;
    dm_sec_keyset_t          key_set;
    uint32_t                 app_context_data = 0;
    dm_application_context_t app_context;


/** [DFU bond sharing] */
    err_code = dm_handle_get(conn_handle, &m_dm_handle);
    if (err_code == NRF_SUCCESS)
    {
        err_code = dm_distributed_keys_get(&m_dm_handle, &key_set);
        if (err_code == NRF_SUCCESS)
        {
            APP_ERROR_CHECK(err_code);

            m_peer_data.addr              = key_set.keys_central.p_id_key->id_addr_info;
            m_peer_data.irk               = key_set.keys_central.p_id_key->id_info;
            m_peer_data.enc_key.enc_info  = key_set.keys_periph.enc_key.p_enc_key->enc_info;
            m_peer_data.enc_key.master_id = key_set.keys_periph.enc_key.p_enc_key->master_id;

            err_code = dfu_ble_svc_peer_data_set(&m_peer_data);
            APP_ERROR_CHECK(err_code);

            app_context_data   = (DFU_APP_ATT_TABLE_CHANGED << DFU_APP_ATT_TABLE_POS);
            app_context.len    = sizeof(app_context_data);
            app_context.p_data = (uint8_t *)&app_context_data;
            app_context.flags  = 0;

            err_code = dm_application_context_set(&m_dm_handle, &app_context);
            APP_ERROR_CHECK(err_code);
        }
        else
        {
            // Keys were not available, thus we have a non-encrypted connection.
            err_code = dm_peer_addr_get(&m_dm_handle, &m_peer_data.addr);
            APP_ERROR_CHECK(err_code);

            err_code = dfu_ble_svc_peer_data_set(&m_peer_data);
            APP_ERROR_CHECK(err_code);
        }
    }
/** [DFU bond sharing] */
}

Now to replace the DM code with the equivalent Peer Manager APIs I suggest that you take a look at the retrieve_peer_data() function in ble_dfu_bonded.c in SDK v14.1.0. SDK v12.x and v13.x  did not have any bond sharing feature implementend, hence its better to look at v14.x.

static uint32_t retrieve_peer_data(void)
{
    ret_code_t              ret_code;
    pm_peer_data_bonding_t  bonding_data;
    pm_peer_id_t            peer_id;

    ret_code = pm_peer_id_get(mp_dfu->conn_handle, &peer_id);
    VERIFY_SUCCESS(ret_code);

    if (peer_id == PM_PEER_ID_INVALID)
    {
        return NRF_ERROR_FORBIDDEN;
    }

    ret_code = pm_peer_data_bonding_load(peer_id, &bonding_data);
    VERIFY_SUCCESS(ret_code);

    memcpy(&m_peer_data.ble_id, &bonding_data.peer_ble_id, sizeof(ble_gap_id_key_t));
    memcpy(&m_peer_data.enc_key, &bonding_data.own_ltk, sizeof(ble_gap_enc_key_t));

    uint16_t len = SYSTEM_SERVICE_ATT_SIZE;
    ret_code = sd_ble_gatts_sys_attr_get(mp_dfu->conn_handle,
                                         m_peer_data.sys_serv_attr,
                                         &len,
                                         BLE_GATTS_SYS_ATTR_FLAG_SYS_SRVCS);

    NRF_LOG_INFO("---------------system attribute table: %d--------------", len);

    VERIFY_SUCCESS(ret_code);

    return NRF_SUCCESS;
}

So dm_handle_get() and dm_distributed_keys_get() can be replaced with pm_peer_id_get() and pm_peer_data_bonding_load(). Once you have the bonding data ( pm_peer_data_bonding_t) you just need to copy the correct content into a dfu_ble_peer_data_t struct and then pass that to dfu_ble_svc_peer_data_set. 

typedef struct
{
    uint8_t           own_role;    /**< @brief The BLE role of the local device during bonding. See @ref BLE_GAP_ROLES. */
    ble_gap_id_key_t  peer_ble_id; /**< @brief The peer's Bluetooth address and identity resolution key (IRK). */
    ble_gap_enc_key_t peer_ltk;    /**< @brief The peer's long-term encryption key (LTK) and master ID. */
    ble_gap_enc_key_t own_ltk;     /**< @brief Locally generated long-term encryption key (LTK) and master ID, distributed to the peer. */
} pm_peer_data_bonding_t;

typedef struct
{
    ble_gap_addr_t      addr;                                   /**< BLE GAP address of the device that initiated the DFU process. */
    ble_gap_irk_t       irk;                                    /**< IRK of the device that initiated the DFU process if this device uses Private Resolvable Addresses. */
    ble_gap_enc_key_t   enc_key;                                /**< Encryption key structure containing encrypted diversifier and LTK for re-establishing the bond. */
    uint8_t             sys_serv_attr[SYSTEM_SERVICE_ATT_SIZE]; /**< System service attributes for restoring of Service Changed Indication setting in DFU mode. */
} dfu_ble_peer_data_t;

On the bootloader side you should not have to do any changes. 

Best regards

Bjørn

[Tim]

Hello ...

I've been testing DFU on Simblee and have discovered some odd behaviour, similar to this thread (see last reply, no resolution provided). Simblee is proprietary and normally programmed using Arduino IDE and the Simblee library. It is readback protected so I cannot read its flash contents. I do know it uses S110 v8.0.0 and I do have its dual bank bootloader hex file. I also know that Simblee apps are placed at 0x1F000 in flash instead of 0x18000, the standard location for S110 v8.0.0 applications.

I built a simple Simblee application that advertises "simblee" and programmed a Simblee using the Arduino IDE. I also built the Nordic ble_app_hrs example of SDK 10.0 for s110_and_dfu (pca10028) using GCC. I modified the linker script to place the application at 0x1F000.

I used nrfutil version 0.52 to generate zip image files of simpleSimblee.ino.hex and ble_app_hrs_s110.hex with a command like:

nrfutil dfu genpkg ble_app_hrs_s110.zip --application ble_app_hrs_s110.hex --application-version 0xffff --dev-revision 0xffff --dev-type 0xffff -sd-req 0x64

I transferred the zip files to iPad with nRF Connect installed then I connect to the Simblee and perform DFU using the simpleSimblee.ino.zip and ble_app_hrs_s110.zip images.

If the application on the Simblee is a legacy buttonless DFU enabled application built using the Arduino IDE and Simblee library (simpleSimblee), DFU is successful. Here's the DFU log from nRF Connect for DFU of ble_app_hrs_s110.zip:

File Name: ble_app_hrs_s110.zip
Parts: 1
Size: 31 KB
Soft Device Size: Zero KB
Bootloader Size: Zero KB
[Callback] Central Manager did update state to: Powered ON
Connecting to simblee...
centralManager.connect(peripheral, options: nil)
[Callback] Central Manager did connect peripheral
Connected to simblee
Discovering services...
peripheral.discoverServices(nil)
Services discovered
Starting Legacy DFU...
Connected to simblee
Services discovered
Legacy DFU Service found
Discovering characteristics in DFU Service...
peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
DFU characteristics discovered
Reading DFU Version number...
peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0100
Version number read: 0.1
Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
DFU Control Point notifications enabled
Application with buttonless update found
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Jump to bootloader (Op Code = 1, Upload Mode = 4) request sent
[Callback] Central Manager did disconnect peripheral
Disconnected by the remote device
Connecting to simblee...
centralManager.connect(peripheral, options: nil)
[Callback] Central Manager did connect peripheral
Connected to simblee
Discovering services...
peripheral.discoverServices([00001530-1212-EFDE-1523-785FEABCD123])
Services discovered
Legacy DFU Service found
Discovering characteristics in DFU Service...
peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
DFU characteristics discovered
Reading DFU Version number...
peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0600
Version number read: 0.6
Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
DFU Control Point notifications enabled
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Writing image sizes (0b, 0b, 30892b) to characteristic 00001532-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x0000000000000000ac780000, for: 00001532-1212-EFDE-1523-785FEABCD123, type: .withoutResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Start DFU (Op Code = 1, Upload Mode = 4) request sent
Notification received from 00001531-1212-EFDE-1523-785FEABCD123, value (0x): 100101
Response (Op Code = 1, Status = 1) received
Writing Initialize DFU Parameters...
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x0200, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Writing to characteristic 00001532-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0xffffffffffff00000100640013d8, for: 00001532-1212-EFDE-1523-785FEABCD123, type: .withoutResponse)
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x0201, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Notification received from 00001531-1212-EFDE-1523-785FEABCD123, value (0x): 100201
Response (Op Code = 2, Status = 1) received
Initialize DFU Parameters completed
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x080c00, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Packet Receipt Notif Req (Op Code = 8, Value = 12) request sent
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x03, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Uploading firmware...
Sending firmware to DFU Packet characteristic...
Notification received from 00001531-1212-EFDE-1523-785FEABCD123, value (0x): 100301
Response (Op Code = 3, Status = 1) received
Upload completed in 14.52 seconds
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x04, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Validate Firmware (Op Code = 4) request sent
Notification received from 00001531-1212-EFDE-1523-785FEABCD123, value (0x): 100401
Response (Op Code = 4, Status = 1) received
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x05, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Activate and Reset (Op Code = 5) request sent
[Callback] Central Manager did disconnect peripheral
Disconnected by the remote device

After successful DFU, Simblee advertises Nordic_HRM, I can connect, etc.

If the application on the Simblee is the ble_app_hrs_s110 application, it seems there is an issue connecting to the device after jumping to the bootloader because there's a pause (timeout?) after "centralManager.connect(peripheral, options: nil)" and then later, the DFU version number read is again 0.1 which I understand means it's the application with buttonless DFU running, not the bootloader. So the DFU controller (nRF Connect) tries to again jump to the bootloader and this repeats without end.

File Name: simpleSimblee.ino.zip
Parts: 1
Size: 26 KB
Soft Device Size: Zero KB
Bootloader Size: Zero KB
[Callback] Central Manager did update state to: Powered ON
Connecting to Nordic_HRM...
centralManager.connect(peripheral, options: nil)
[Callback] Central Manager did connect peripheral
Connected to Nordic_HRM
Discovering services...
peripheral.discoverServices(nil)
Services discovered
Starting Legacy DFU...
Connected to Nordic_HRM
Services discovered
Legacy DFU Service found
Discovering characteristics in DFU Service...
peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
DFU characteristics discovered
Reading DFU Version number...
peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0100
Version number read: 0.1
Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
DFU Control Point notifications enabled
Application with buttonless update found
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Jump to bootloader (Op Code = 1, Upload Mode = 4) request sent
[Callback] Central Manager did disconnect peripheral
Disconnected by the remote device
Connecting to Nordic_HRM...
centralManager.connect(peripheral, options: nil)
[Callback] Central Manager did connect peripheral
Connected to Nordic_HRM
Discovering services...
peripheral.discoverServices([00001530-1212-EFDE-1523-785FEABCD123])
Services discovered
Legacy DFU Service found
Discovering characteristics in DFU Service...
peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
DFU characteristics discovered
Reading DFU Version number...
peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0100
Version number read: 0.1
Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
DFU Control Point notifications enabled
Application with buttonless update found
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Jump to bootloader (Op Code = 1, Upload Mode = 4) request sent
[Callback] Central Manager did disconnect peripheral
Disconnected by the remote device
Connecting to Nordic_HRM...
centralManager.connect(peripheral, options: nil)
[Callback] Central Manager did connect peripheral
Connected to Nordic_HRM
Discovering services...
peripheral.discoverServices([00001530-1212-EFDE-1523-785FEABCD123])
Services discovered
Legacy DFU Service found
Discovering characteristics in DFU Service...
peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
DFU characteristics discovered
Reading DFU Version number...
peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0100
Version number read: 0.1
Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
DFU Control Point notifications enabled
Application with buttonless update found
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Jump to bootloader (Op Code = 1, Upload Mode = 4) request sent
[Callback] Central Manager did disconnect peripheral
Disconnected by the remote device
Connecting to Nordic_HRM...
centralManager.connect(peripheral, options: nil)
[Callback] Central Manager did connect peripheral
Connected to Nordic_HRM
Discovering services...
peripheral.discoverServices([00001530-1212-EFDE-1523-785FEABCD123])
Services discovered
Legacy DFU Service found
Discovering characteristics in DFU Service...
peripheral.discoverCharacteristics(nil, for: 00001530-1212-EFDE-1523-785FEABCD123)
DFU characteristics discovered
Reading DFU Version number...
peripheral.readValue(00001534-1212-EFDE-1523-785FEABCD123)
Read Response received from 00001534-1212-EFDE-1523-785FEABCD123, value (0x): 0100
Version number read: 0.1
Enabling notifications for 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.setNotifyValue(true, for: 00001531-1212-EFDE-1523-785FEABCD123)
Notifications enabled for 00001531-1212-EFDE-1523-785FEABCD123
DFU Control Point notifications enabled
Application with buttonless update found
Writing to characteristic 00001531-1212-EFDE-1523-785FEABCD123...
peripheral.writeValue(0x0104, for: 00001531-1212-EFDE-1523-785FEABCD123, type: .withResponse)
Data written to 00001531-1212-EFDE-1523-785FEABCD123
Jump to bootloader (Op Code = 1, Upload Mode = 4) request sent
[Callback] Central Manager did disconnect peripheral
Disconnected by the remote device
Connecting to Nordic_HRM...
centralManager.connect(peripheral, options: nil)
.
.
.

There is something different about legacy buttonless DFU between a Simblee-built application and a Nordic SDK application. I need to resolve this before I continue working on adding legacy buttonless DFU to the ble_app_uart_s110 application I'm using to develop our Simblee/nRF51 application.

Oddly, when I repeat these tests using an nRF51 DK, all images DFU successfully, even it the application on the DK is a Nordic SDK application with legacy buttonless DFU support.

I'm puzzled and appreciate any help.

Many thanks,

Tim

[Tim]

Hello ...

Unfortunately I'm still stuck here. As per my previous post, for some reason when Simblee has an app that was built using Nordic SDK 10.0 with legacy buttonless DFU support, DFU of a new application fails because it appears that when attempting to jump to bootloader, the device resets and runs the application again rather than entering DFU mode. When Simblee has an app that was built using the Simblee library, DFU of new application succeeds.

I'm trying to figure out what may be different legacy buttonless DFU support in a Simblee library-built app and a Nordic SDK-built app.

Are there other ways to force DFU mode from the application? I'm testing with the ble_app_hrs example for s110_and_dfu. My application will be based on ble_app_uart of SDK 12.3, re-worked to work with S110 v8.0.0 and legacy buttonless DFU of SDK 10.0.

I've seen some tickets where the power management module is used:

nrf_pwr_mgmt_shutdown(NRF_PWR_MGMT_SHUTDOWN_GOTO_DFU)

Possible that this would work? Could my app write something to flash to basically make the bootloader see that there's no application and, therefore, enter DFU?

I find it odd that applications built with Simblee library are placed at 0x1F000 in flash instead of 0x18000, the standard location for s110 v8.0.0 applications.

I tried in bootloader_start() of dfu_app_handler.c:

NRF_POWER->GPREGRET = BOOTLOADER_DFU_START;
NVIC_SystemReset();

Didn't work. I read that when doing this, you have to remove the init_softdevice check in ble_stack_init() in the bootloader and unfortunately I don't have access to the source of or control over the Simblee bootloader.

How about using DFU to first update the bootloader to the bootloader of SDK 10.0? Then perhaps DFU of new application, initiated from application build with Nordic SDK 12.3, would work?

Thank you for any suggested next steps to resolve.

Tim

[Tim]

While I did not get the above working, I've found a solution. I can DFU the bootloader of SDK10.0 with S110 v8.0.0 to Simblee, then I can DFU a new application that uses:

#define BOOTLOADER_DFU_START 0xB1

ret_code_t err_code;
err_code = sd_power_gpregret_set(BOOTLOADER_DFU_START);
APP_ERROR_CHECK(err_code);
sd_nvic_SystemReset();   

to reset into DFU mode. As per this ticket, I had to modify bootloader source to remove the init_softdevice check from ble_stack_init():

//if (init_softdevice)

//{
    err_code = sd_mbr_command(&com);

    APP_ERROR_CHECK(err_code);
//}

So the first update of Simblees in the field is two-step. First, DFU bootloader and S110. Unfortunately the chip hangs after this, but hard reset (power off/on) causes it to start in DFU mode. Then DFU new application.

Future updates of the application require that our iOS application connect to the peripheral, send a message so the application then executes the above code. Device enters DFU mode, then iOS app proceeds with DFU of new application.

The good thing is that we end up with a bootloader on Simblees that we control.

Thanks for help along the way. Very much appreciated.

Tim