nRF5340 FOTA upgrade over Bluetooth

[RAlexeev]

I couldn't launch FOTA upgrade over Bluetooth for nRF5340 PDK. I followed this guide developer.nordicsemi.com/.../ug_nrf5340.html to fulfil FOTA upgrade for nRF5340 PDK. I used /home/roman/nordic/ncs/zephyr/samples/subsys/mgmt/mcumgr/smp_svr sample and modified it according to the guide (merely added CONFIG_MCUMGR_SMP_BT=y in prj.conf file). I built this sample and flashed it to nRF5340. A added a minor change to print new line and built it again. I uploaded a file /home/roman/SeggerProjects/smp_svr/build_nrf5340pdk_nrf5340_cpuapp/zephyr/app_update.bin to a mobile phone. After that, I launched an app nRF Connect for Mobile, connected to nRF5340 PDK (Zephyr). See screenshots.

I opened DFU, located uploaded app_update.bin and selected Test and Confirm option.

And after it, I only saw the next screen:

You can see a Log file from nRF Connect for Mobile:

Fullscreen Log_2020-07-07_11_09_02.txt Download

nRF Connect, 2020-07-07
Zephyr (EB:F6:DA:7F:DA:51)
V	11:07:33.807	Connecting to EB:F6:DA:7F:DA:51...
D	11:07:33.807	gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, preferred PHY = LE 1M)
D	11:07:35.281	[Callback] Connection state changed with status: 0 and new state: CONNECTED (2)
I	11:07:35.281	Connected to EB:F6:DA:7F:DA:51
D	11:07:35.285	[Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
D	11:07:35.307	wait(1600ms)
V	11:07:36.910	Discovering services...
D	11:07:36.910	gatt.discoverServices()
D	11:07:36.929	[Callback] Services discovered with status: 0
I	11:07:36.929	Services discovered
V	11:07:36.949	Generic Attribute (0x1801)
- Service Changed [I] (0x2A05)
   Client Characteristic Configuration (0x2902)
- Client Supported Features [R W] (0x2B29)
- Database Hash [R] (0x2B2A)
Generic Access (0x1800)
- Device Name [R] (0x2A00)
- Appearance [R] (0x2A01)
- Peripheral Preferred Connection Parameters [R] (0x2A04)
SMP Service (8d53dc1d-1db7-4cd3-868b-8a527460aa84)
- SMP Characteristic [N WNR] (da2e7828-fbce-4e01-ae9e-261174997c48)
   Client Characteristic Configuration (0x2902)
D	11:07:36.950	gatt.setCharacteristicNotification(00002a05-0000-1000-8000-00805f9b34fb, true)
I	11:07:40.131	Connection parameters updated (interval: 45.0ms, latency: 0, timeout: 420ms)
V	11:08:02.048	[McuMgr] Connecting...
D	11:08:02.051	[McuMgr] gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, LE 1M)
D	11:08:02.117	[McuMgr] [Callback] Connection state changed with status: 0 and new state: 2 (CONNECTED)
I	11:08:02.122	[McuMgr] Connected to EB:F6:DA:7F:DA:51
D	11:08:02.125	[McuMgr] wait(1600)
V	11:08:03.733	[McuMgr] Discovering services...
D	11:08:03.759	[McuMgr] gatt.discoverServices()
I	11:08:03.802	[McuMgr] Services discovered
V	11:08:03.819	[McuMgr] Primary service found
I	11:08:03.826	[McuMgr] Service Changed characteristic found on a bonded device
D	11:08:03.831	[McuMgr] gatt.setCharacteristicNotification(00002a05-0000-1000-8000-00805f9b34fb, true)
V	11:08:03.836	[McuMgr] Enabling indications for 00002a05-0000-1000-8000-00805f9b34fb
D	11:08:03.849	[McuMgr] gatt.writeDescriptor(00002902-0000-1000-8000-00805f9b34fb, value=0x02-00)
I	11:08:03.936	[McuMgr] Data written to descr. 00002902-0000-1000-8000-00805f9b34fb, value: (0x) 02-00
I	11:08:03.961	[McuMgr] Service Changed notifications enabled
V	11:08:03.965	[McuMgr] Requesting new MTU...
D	11:08:03.968	[McuMgr] gatt.requestMtu(515)
I	11:08:04.027	[McuMgr] MTU changed to: 65
D	11:08:04.031	[McuMgr] gatt.setCharacteristicNotification(da2e7828-fbce-4e01-ae9e-261174997c48, true)
V	11:08:04.035	[McuMgr] Enabling notifications for da2e7828-fbce-4e01-ae9e-261174997c48
D	11:08:04.037	[McuMgr] gatt.writeDescriptor(00002902-0000-1000-8000-00805f9b34fb, value=0x01-00)
I	11:08:04.657	Connection parameters updated (interval: 7.5ms, latency: 0, timeout: 5000ms)
I	11:08:04.667	[McuMgr] Connection parameters updated (interval: 7.5ms, latency: 0, timeout: 5000ms)
D	11:08:04.713	[Broadcast] Action received: android.bluetooth.device.action.BOND_STATE_CHANGED, bond state changed to: BOND_BONDING (11)
D	11:08:04.715	[McuMgr] [Broadcast] Action received: android.bluetooth.device.action.BOND_STATE_CHANGED, bond state changed to: BOND_BONDING (11)
D	11:08:05.189	[Broadcast] Action received: android.bluetooth.device.action.BOND_STATE_CHANGED, bond state changed to: BOND_BONDED (12)
I	11:08:05.190	Device bonded
D	11:08:05.206	[McuMgr] [Broadcast] Action received: android.bluetooth.device.action.BOND_STATE_CHANGED, bond state changed to: BOND_BONDED (12)
I	11:08:05.210	[McuMgr] Device bonded
I	11:08:05.557	Connection parameters updated (interval: 45.0ms, latency: 0, timeout: 420ms)
I	11:08:05.558	[McuMgr] Connection parameters updated (interval: 45.0ms, latency: 0, timeout: 420ms)

And a debug output from smp_svr sample to UART:

Fullscreen smp_svr_log.txt Download

*** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***
[00:00:00.006,011] <inf> smp_sample: os_mgmt_register_group()
[00:00:00.006,042] <inf> smp_sample: img_mgmt_register_group()
[00:00:00.006,042] <inf> smp_sample: stat_mgmt_register_group()
[00:00:00.006,042] <inf> smp_sample: start_smp_bluetooth()
[00:00:00.009,429] <inf> smp_bt_sample: smp_bt_register()
[00:00:00.009,460] <inf> smp_sample: build time: Jul  6 2020 23:40:42
[00:00:00.025,054] <inf> smp_bt_sample: Bluetooth initialized
[00:00:00.048,461] <inf> smp_bt_sample: Advertising successfully started
[00:00:12.934,600] <inf> smp_bt_sample: Connected

And nothing happened after it even I was waiting for a long time.

If I use another mobile app - nRF Toolbox, then I have a more meaningful warning to add Init file, which I don't have and about which there's nothing in the guide.

Can you point me what I should do to realise FOTA upgrade? Maybe I didn't find some appropriate guides, because the guide here developer.nordicsemi.com/.../ug_nrf5340.html is so short and general.

[Simon]

Update 10/2/2020: Added strikethrough to an incorrect statement I made

The apps you are trying to use to perform DFU does not support the mcumgr SMP/Bluetooth protocol (read about it here and here), which is used to transfer the DFU image in the smp_svr sample (NCS). The SMP/Bluetooth Protocol consists of the service SMP service and the characteristic SMP Characteristic

These apps are compatible with the Bootloader and the DFU Protocol in the nRF5 SDK. You can see that this DFU Protocol consists of a DFU BLE service with two characterstics; the DFU Control Point characteristic and the DFU Packet characteristic.

I am not aware of any apps that support the SMP/Bluetooth protocol, but I'm sure there exists some. I will look around and get back to you. 

If you have a device with Linux (Raspberry Pi), you can use the mcumgr tool with conntype=ble (mcumgr BLE is not supported on Windows).

Best regards,

Simon

[RAlexeev]

Probably, I didn't copy completely a debug output from smp_svr sample to UART. I tried again and I saw that I didn't include a mcuboot bootloader log. So, the whole log is:

Fullscreen smp_svr_log_full.txt Download

*** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***
[00:00:00.003,112] <inf> mcuboot: Starting bootloader
[00:00:00.009,338] <inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
[00:00:00.019,500] <inf> mcuboot: Boot source: none
[00:00:00.025,024] <inf> mcuboot: Swap type: none
[00:00:00.194,885] <inf> mcuboot: Bootloader chainload address offset: 0x10000
[00:00:00.202,728] <inf> mcuboot: Jumping to the first image slot
*** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***
[00:00:00.006,042] <inf> smp_sample: os_mgmt_register_group()
[00:00:00.006,042] <inf> smp_sample: img_mgmt_register_group()
[00:00:00.006,042] <inf> smp_sample: stat_mgmt_register_group()
[00:00:00.006,042] <inf> smp_sample: start_smp_bluetooth()
[00:00:00.009,429] <inf> smp_bt_sample: smp_bt_register()
[00:00:00.009,460] <inf> smp_bt_sample: Roman Alexeev 1 bluetooth.c
[00:00:00.009,490] <inf> smp_sample: build time: Jul 10 2020 10:25:54
[00:00:00.009,490] <inf> smp_sample: Roman Alexeev 1 main.c
[00:00:00.025,146] <inf> smp_bt_sample: Bluetooth initialized
[00:00:00.061,889] <inf> smp_bt_sample: Advertising successfully started
[00:09:12.476,562] <inf> smp_bt_sample: Connected

Tell me, please, does FOTA upgrade works for nRF5340 PDK or not? And are there a working example and a guide of how to implement it?

[Simon]

I am not aware of any such solutions when using NCS (the nRF5340 only supports NCS, not the nRF5 SDK), but I would be surprised if it wasn't/or is being worked on.

But I will investigate/ask internally and get back to you.

Best regards,

Simon

[RAlexeev]

Thank you, Simon!

Is Nordic Semiconductor going to provide a solution of OTA DFU for nRF5340? I am absolutely sure that it's vitally necessary! We will not release our devices without such functionality. I hope that your colleagues will present the sample soon. Also, thank them for their effort.

I’m eager to receive your response and the OTA DFU example for nRF5340.

[RAlexeev]

Simon said:

I am not aware of any such solutions when using NCS (the nRF5340 only supports NCS, not the nRF5 SDK), but I would be surprised if it wasn't/or is being worked on.

Simon, hello again!

I used nRF Connect SDK when I built and run a provided example and not nRF5 SDK. This is example github.com/.../smp_svr. So, it means that NCS supports OTA DFU properly and a problem is not that nRF5340 supports only NCS and not nRF5 SDK, the problem is that the example doesn't work in the case of specifically nRF5340. It seems that I didn't understand why you mentioned nRF5 SDK.

[Simon]

Okay, I am really sorry for the confusion. My bad. I was not aware that nRF Connect for Mobile supported the mcumgr SMP/Bluetooth Protocol.

I read your previous answer more thoroughly and saw that you were indeed able to perform a DFU with NCS, nRF52840, and the nRF C. app.

I just took a look at the features of the app as well, and it said the following: "Supports McuMgr,profile that lets the user control and update Zephyr-based devices".

So I will now investigate the issue regarding nRF5340, and why it doesn't work with that device specifically. 

Again, sorry for the inconvenience.

Best regards,

Simon

[Simon]

I was not able to upload a sample to neither the nRF52840 nor the nRF5340, and I guess there is something wrong with the nRF Connect mobile app. The developer(s) responsible for that app are currently on vacation, so I'm not sure what's causing this.

However, you said you were able to make it work using the nRF5280 DK, could you provide me in details all the steps for that. Such that I have a reference to look at when investigating the issues with the nRF5340 DK.

Best regards,

Simon

[Lukáš]

Hi Simon, concerning the nRF52 upgrade, this may be relevant for you https://github.com/NordicSemiconductor/Android-nRF-Connect/issues/130

[RAlexeev]

Good evening, Simon!

Basically I followed this guide developer.nordicsemi.com/.../ug_nrf5340.html

Firstly, according to "SMP Server Sample" (developer.nordicsemi.com/.../README.html I connected nRF52840 DK through USB, opened serial terminal "minicom -b 115200 -8 -D /dev/ttyACM0" and built and flashed MCUboot, using the following commands:

Fullscreen build_mcuboot.txt Download

west build -b nrf52840dk_nrf52840 -d build_mcuboot bootloader/mcuboot/boot/zephyr
west flash -d build_mcuboot

UART output after it:

Fullscreen uart_output_1.txt Download

*** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***
[00:00:00.003,143] <inf> mcuboot: Starting bootloader
[00:00:00.009,460] <inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
[00:00:00.019,714] <inf> mcuboot: Boot source: none
[00:00:00.025,238] <wrn> mcuboot: Failed reading image headers; Image=0
[00:00:00.032,775] <err> mcuboot: Unable to find bootable image

Secondly, I located "/ncs/zephyr/samples/subsys/mgmt/mcumgr/smp_svr" example, added the line "CONFIG_MCUMGR_SMP_BT=y" to "prj.conf", open nRF Connect SDK Project from SEGGER Embeded Studio for ARM (see a screenshot below). And finally, I built and run the project: Build -> Build and Run.

UART output after it:

Fullscreen uart_output_2.txt Download

*** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***
[00:00:00.003,143] <inf> mcuboot: Starting bootloader
[00:00:00.009,460] <inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
[00:00:00.019,714] <inf> mcuboot: Boot source: none
[00:00:00.025,238] <wrn> mcuboot: Failed reading image headers; Image=0
[00:00:00.032,775] <err> mcuboot: Unable to find bootable image
*** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***
[00:00:00.003,204] <inf> mcuboot: Starting bootloader
[00:00:00.009,613] <inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
[00:00:00.019,866] <inf> mcuboot: Boot source: none
[00:00:00.025,482] <inf> mcuboot: Swap type: none
[00:00:00.294,433] <inf> mcuboot: Bootloader chainload address offset: 0xc000
[00:00:00.302,276] <inf> mcuboot: Jumping to the first image slot
*** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***


uart:~$ 

Thirdly, I modified the example "SMP Server Sample" and merged a blinky example ("/ncs/zephyr/samples/basic/blinky") to clearly show the difference after upgrading new firmware. I built it and uploaded it to a mobile phone.
And finally, I launched "nRF Connect for Mobile" app (Version 4.24.1) on the mobile phone, scanned, connected to my device with name "Zephyr", taped DFU, located new app_update.bin file and chose "Test and Confirm". After upgrading the firmware I could see a blinking led on the board.
UART output after it:

Fullscreen uart_output_3.txt Download

*** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***                                                                       |  Cannot open /dev/ttyACM0!  |
[00:00:00.003,143] <inf> mcuboot: Starting bootloader                                                                  |                             |
[00:00:00.009,582] <inf> mcuboot: Primary image: magic=good, swap_type=0x2, copy_done=0x1, image_ok=0x1                +-----------------------------+
[00:00:00.019,805] <inf> mcuboot: Boot source: none
[00:00:00.025,421] <inf> mcuboot: Swap type: none
[00:00:00.294,281] <inf> mcuboot: Bootloader chainload address offset: 0xc000
[00:00:00.302,124] <inf> mcuboot: Jumping to the first image slot
*** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***


[00:00:30.927,429] <inf> smp_bt_sample: Connected
[00:00:47.563,385] <inf> mcumgr_flash_mgmt: Erased 0x2d000 bytes of image slot
[00:00:47.739,257] <inf> mcumgr_flash_mgmt: Erased 0x1000 bytes of image slot trailer
uart:~$ *** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***
[00:00:00.003,204] <inf> mcuboot: Starting bootloader
[00:00:00.009,643] <inf> mcuboot: Primary image: magic=good, swap_type=0x2, copy_done=0x1, image_ok=0x1
[00:00:00.019,836] <inf> mcuboot: Boot source: none
[00:00:00.025,451] <inf> mcuboot: Swap type: test
[00:00:17.743,133] <inf> mcuboot: Bootloader chainload address offset: 0xc000
[00:00:17.750,946] <inf> mcuboot: Jumping to the first image slot
*** Booting Zephyr OS build v2.3.0-rc1-ncs1  ***


[00:00:17.692,169] <inf> smp_bt_sample: Connected
[00:03:16.260,620] <wrn> bt_att: Unhandled ATT code 0x1d
[00:03:17.310,913] <inf> smp_bt_sample: Disconnected (reason 0x13)
[00:03:17.311,889] <inf> smp_bt_sample: Advertising successfully started
uart:~$

You can see output of "west status" command:

Fullscreen west_status.txt Download

=== status of manifest (nrf):
HEAD detached at v1.3.0
nothing to commit, working tree clean
=== status of zephyr (zephyr):
HEAD detached at bbd71e23a2
nothing to commit, working tree clean
=== status of mcuboot (bootloader/mcuboot):
HEAD detached at e81a207
nothing to commit, working tree clean
=== status of mcumgr (modules/lib/mcumgr):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of nrfxlib (nrfxlib):
HEAD detached at 3d0d9a5
nothing to commit, working tree clean
=== status of cmock (test/cmock):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of unity (test/cmock/vendor/unity):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of mbedtls-nrf (mbedtls):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of cmsis (modules/hal/cmsis):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of canopennode (modules/lib/canopennode):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of ci-tools (tools/ci-tools):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of civetweb (modules/lib/civetweb):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of fatfs (modules/fs/fatfs):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of hal_nordic (modules/hal/nordic):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of hal_st (modules/hal/st):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of libmetal (modules/hal/libmetal):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of lvgl (modules/lib/gui/lvgl):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of mbedtls (modules/crypto/mbedtls):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of net-tools (tools/net-tools):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of open-amp (modules/lib/open-amp):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of loramac-node (modules/lib/loramac-node):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of openthread (modules/lib/openthread):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of segger (modules/debug/segger):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of tinycbor (modules/lib/tinycbor):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of tinycrypt (modules/crypto/tinycrypt):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of littlefs (modules/fs/littlefs):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of mipi-sys-t (modules/debug/mipi-sys-t):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of nrf_hw_models (modules/bsim_hw_models/nrf_hw_models):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean
=== status of edtt (tools/edtt):
HEAD detached at refs/heads/manifest-rev
nothing to commit, working tree clean

And this is a log from nRF Connect for Mobile of the upgrading process.

Fullscreen Log 2020-07-17 20_30_50.txt Download

nRF Connect, 2020-07-17
Zephyr (D6:C4:F9:A2:02:AD)
V	20:24:24.894	Connecting to D6:C4:F9:A2:02:AD...
D	20:24:24.894	gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, preferred PHY = LE 1M)
D	20:24:25.182	[Callback] Connection state changed with status: 0 and new state: CONNECTED (2)
I	20:24:25.182	Connected to D6:C4:F9:A2:02:AD
D	20:24:25.183	[Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
V	20:24:25.201	Discovering services...
D	20:24:25.201	gatt.discoverServices()
I	20:24:25.577	Connection parameters updated (interval: 7.5ms, latency: 0, timeout: 5000ms)
D	20:24:25.796	[Callback] Services discovered with status: 0
I	20:24:25.796	Services discovered
V	20:24:25.814	Generic Attribute (0x1801)
- Service Changed [I] (0x2A05)
   Client Characteristic Configuration (0x2902)
- Client Supported Features [R W] (0x2B29)
- Database Hash [R] (0x2B2A)
Generic Access (0x1800)
- Device Name [R] (0x2A00)
- Appearance [R] (0x2A01)
- Peripheral Preferred Connection Parameters [R] (0x2A04)
SMP Service (8d53dc1d-1db7-4cd3-868b-8a527460aa84)
- SMP Characteristic [N WNR] (da2e7828-fbce-4e01-ae9e-261174997c48)
   Client Characteristic Configuration (0x2902)
D	20:24:25.815	gatt.setCharacteristicNotification(00002a05-0000-1000-8000-00805f9b34fb, true)
I	20:24:25.898	Connection parameters updated (interval: 50.0ms, latency: 0, timeout: 5000ms)
V	20:24:32.251	[McuMgr] Connecting...
D	20:24:32.256	[McuMgr] gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, LE 1M)
D	20:24:32.342	[McuMgr] [Callback] Connection state changed with status: 0 and new state: 2 (CONNECTED)
I	20:24:32.346	[McuMgr] Connected to D6:C4:F9:A2:02:AD
D	20:24:32.352	[McuMgr] wait(300)
V	20:24:32.659	[McuMgr] Discovering services...
D	20:24:32.670	[McuMgr] gatt.discoverServices()
I	20:24:32.683	[McuMgr] Services discovered
V	20:24:32.688	[McuMgr] Primary service found
V	20:24:32.696	[McuMgr] Requesting new MTU...
D	20:24:32.701	[McuMgr] gatt.requestMtu(515)
I	20:24:32.900	[McuMgr] MTU changed to: 252
D	20:24:32.911	[McuMgr] gatt.setCharacteristicNotification(da2e7828-fbce-4e01-ae9e-261174997c48, true)
V	20:24:32.918	[McuMgr] Enabling notifications for da2e7828-fbce-4e01-ae9e-261174997c48
D	20:24:32.924	[McuMgr] gatt.writeDescriptor(00002902-0000-1000-8000-00805f9b34fb, value=0x01-00)
I	20:24:32.999	[McuMgr] Data written to descr. 00002902-0000-1000-8000-00805f9b34fb, value: (0x) 01-00
I	20:24:33.010	[McuMgr] Notifications enabled
V	20:24:33.016	[McuMgr] Writing characteristic da2e7828-fbce-4e01-ae9e-261174997c48 (WRITE COMMAND)
D	20:24:33.021	[McuMgr] gatt.writeCharacteristic(da2e7828-fbce-4e01-ae9e-261174997c48)
I	20:24:33.029	[McuMgr] Data written to da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 00-00-00-02-00-01-00-00-BF-FF
A	20:24:33.036	[McuMgr] "Operation: READ
Flags: 0
Length: 2
Group Id: 1 (IMAGE)
Sequence Num: 0
Command Id: 0 (STATE)
Message: {}" sent
I	20:24:33.301	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 01-00-00-F4-00-01-00-00-BF-66-69-6D-61-67-65-73-9F-BF-64-73-6C-6F-74-00-67-76-65-72-73-69-6F-6E-65-30-2E-30-2E-30-64-68-61-73-68-58-20-33-35-84-93-1A-03-FC-33-28-E0-77-2F-9C-37-3A-29-FD-CB-FD-14-B0-71-63-67-E8-20-3D-11-6C-BA-DB-F5-68-62-6F-6F-74-61-62-6C-65-F5-67-70-65-6E-64-69-6E-67-F4-69-63-6F-6E-66-69-72-6D-65-64-F5-66-61-63-74-69-76-65-F5-69-70-65-72-6D-61-6E-65-6E-74-F4-FF-BF-64-73-6C-6F-74-01-67-76-65-72-73-69-6F-6E-65-30-2E-30-2E-30-64-68-61-73-68-58-20-33-35-84-93-1A-03-FC-33-28-E0-77-2F-9C-37-3A-29-FD-CB-FD-14-B0-71-63-67-E8-20-3D-11-6C-BA-DB-F5-68-62-6F-6F-74-61-62-6C-65-F5-67-70-65-6E-64-69-6E-67-F4-69-63-6F-6E-66-69-72-6D-65-64-F4-66-61-63-74-69-76-65-F4-69-70-65-72-6D-61-6E-65-6E-74-F4-FF-FF-6B-73-70-6C-69-74-53-74-61-74-75
I	20:24:33.353	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 73-00-FF
A	20:24:33.371	[McuMgr] "{"images":[{"slot":0,"version":"0.0.0","hash":"MzWEkxoD/DMo4HcvnDc6Kf3L/RSwcWNn6CA9EWy62/U=","bootable":true,"pending":false,"confirmed":true,"active":true,"permanent":false},{"slot":1,"version":"0.0.0","hash":"MzWEkxoD/DMo4HcvnDc6Kf3L/RSwcWNn6CA9EWy62/U=","bootable":true,"pending":false,"confirmed":false,"active":false,"permanent":false}],"splitStatus":0}" received
V	20:24:33.382	[McuMgr] Uploading firmware...
V	20:27:41.948	[McuMgr] Writing characteristic da2e7828-fbce-4e01-ae9e-261174997c48 (WRITE COMMAND)
D	20:27:41.951	[McuMgr] gatt.writeCharacteristic(da2e7828-fbce-4e01-ae9e-261174997c48)
I	20:27:41.956	[McuMgr] Data written to da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 02-00-00-32-00-01-00-00-BF-67-63-6F-6E-66-69-72-6D-F4-64-68-61-73-68-58-20-A4-6A-65-82-BA-42-64-1E-DC-61-C2-D3-32-43-B2-58-BA-0C-47-BE-0E-71-96-A8-4B-F5-1F-89-FA-51-28-82-FF
A	20:27:41.961	[McuMgr] "Operation: WRITE
Flags: 0
Length: 50
Group Id: 1 (IMAGE)
Sequence Num: 0
Command Id: 0 (STATE)
Message: {"confirm":false,"hash":"pGplgrpCZB7cYcLTMkOyWLoMR74OcZaoS/UfifpRKII="}" sent
I	20:27:42.250	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 03-00-00-F4-00-01-00-00-BF-66-69-6D-61-67-65-73-9F-BF-64-73-6C-6F-74-00-67-76-65-72-73-69-6F-6E-65-30-2E-30-2E-30-64-68-61-73-68-58-20-33-35-84-93-1A-03-FC-33-28-E0-77-2F-9C-37-3A-29-FD-CB-FD-14-B0-71-63-67-E8-20-3D-11-6C-BA-DB-F5-68-62-6F-6F-74-61-62-6C-65-F5-67-70-65-6E-64-69-6E-67-F4-69-63-6F-6E-66-69-72-6D-65-64-F5-66-61-63-74-69-76-65-F5-69-70-65-72-6D-61-6E-65-6E-74-F4-FF-BF-64-73-6C-6F-74-01-67-76-65-72-73-69-6F-6E-65-30-2E-30-2E-30-64-68-61-73-68-58-20-A4-6A-65-82-BA-42-64-1E-DC-61-C2-D3-32-43-B2-58-BA-0C-47-BE-0E-71-96-A8-4B-F5-1F-89-FA-51-28-82-68-62-6F-6F-74-61-62-6C-65-F5-67-70-65-6E-64-69-6E-67-F5-69-63-6F-6E-66-69-72-6D-65-64-F4-66-61-63-74-69-76-65-F4-69-70-65-72-6D-61-6E-65-6E-74-F4-FF-FF-6B-73-70-6C-69-74-53-74-61-74-75
I	20:27:42.288	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 73-00-FF
A	20:27:42.297	[McuMgr] "{"images":[{"slot":0,"version":"0.0.0","hash":"MzWEkxoD/DMo4HcvnDc6Kf3L/RSwcWNn6CA9EWy62/U=","bootable":true,"pending":false,"confirmed":true,"active":true,"permanent":false},{"slot":1,"version":"0.0.0","hash":"pGplgrpCZB7cYcLTMkOyWLoMR74OcZaoS/UfifpRKII=","bootable":true,"pending":true,"confirmed":false,"active":false,"permanent":false}],"splitStatus":0}" received
V	20:27:42.306	[McuMgr] Writing characteristic da2e7828-fbce-4e01-ae9e-261174997c48 (WRITE COMMAND)
D	20:27:42.310	[McuMgr] gatt.writeCharacteristic(da2e7828-fbce-4e01-ae9e-261174997c48)
I	20:27:42.338	[McuMgr] Data written to da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 02-00-00-02-00-00-00-05-BF-FF
A	20:27:42.343	[McuMgr] "Operation: WRITE
Flags: 0
Length: 2
Group Id: 0 (OS)
Sequence Num: 0
Command Id: 5 (RESET)
Message: {}" sent
I	20:27:42.399	[McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 03-00-00-02-00-00-00-05-BF-FF
A	20:27:42.408	[McuMgr] "{}" received
D	20:27:47.568	[Callback] Connection state changed with status: 8 and new state: DISCONNECTED (0)
E	20:27:47.568	Error 8 (0x8): GATT CONN TIMEOUT
I	20:27:47.568	Disconnected
D	20:27:47.608	[McuMgr] [Callback] Connection state changed with status: 8 and new state: 0 (DISCONNECTED)
W	20:27:47.632	[McuMgr] Error: (0x8): GATT CONN TIMEOUT
I	20:27:47.637	[McuMgr] Disconnected
D	20:27:47.658	[McuMgr] gatt.close()
V	20:27:47.668	[McuMgr] Connecting...
D	20:27:47.672	[McuMgr] gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, LE 1M)
D	20:27:47.684	[Broadcast] Action received: android.bluetooth.device.action.ACL_DISCONNECTED
D	20:28:17.698	[McuMgr] [Callback] Connection state changed with status: 133 and new state: 0 (DISCONNECTED)
W	20:28:17.711	[McuMgr] Error: (0x85): GATT ERROR
W	20:28:17.721	[McuMgr] Connection attempt timed out
D	20:28:17.730	[McuMgr] gatt.close()
D	20:28:17.740	gatt.close()
D	20:28:17.742	wait(200)
V	20:28:17.944	Connecting to D6:C4:F9:A2:02:AD...
D	20:28:17.945	gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, preferred PHY = LE 1M)
D	20:28:18.243	[Callback] Connection state changed with status: 0 and new state: CONNECTED (2)
I	20:28:18.243	Connected to D6:C4:F9:A2:02:AD
D	20:28:18.332	[Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
V	20:28:18.338	Discovering services...
D	20:28:18.338	gatt.discoverServices()
I	20:28:18.640	Connection parameters updated (interval: 7.5ms, latency: 0, timeout: 5000ms)
D	20:28:18.866	[Callback] Services discovered with status: 0
I	20:28:18.866	Services discovered
V	20:28:18.882	Generic Attribute (0x1801)
- Service Changed [I] (0x2A05)
   Client Characteristic Configuration (0x2902)
- Client Supported Features [R W] (0x2B29)
- Database Hash [R] (0x2B2A)
Generic Access (0x1800)
- Device Name [R] (0x2A00)
- Appearance [R] (0x2A01)
- Peripheral Preferred Connection Parameters [R] (0x2A04)
SMP Service (8d53dc1d-1db7-4cd3-868b-8a527460aa84)
- SMP Characteristic [N WNR] (da2e7828-fbce-4e01-ae9e-261174997c48)
   Client Characteristic Configuration (0x2902)
D	20:28:18.883	gatt.setCharacteristicNotification(00002a05-0000-1000-8000-00805f9b34fb, true)
I	20:28:18.969	Connection parameters updated (interval: 50.0ms, latency: 0, timeout: 5000ms)

I archived smp_svr project and modified smp_svr which was merged with blinky example.

smp_svr.zipsmp_svr_modified.zip

I recorded a video to demonstrate the upgrading process to you.

I hope that I didn't skip anything. If you need some extra explanation from my side, just tell me.