NRF52840 OTA over BLE

RE: NRF52840 OTA over BLE

Hung Bui — Tue, 04 Aug 2020 11:28:11 GMT

Hi Sowmiya,

Have you tried to compare with what the phone or the DFU tool on PC send when doing the same DFU ?
Please use the sniffer to capture a proper DFU from the phone or DFU tool on PC so that you can pin point what make it didn't work.

In addition you need to get the bootloader to run in debug mode and you would be able to debug when there is anything goes wrong on the bootloader side.

RE: NRF52840 OTA over BLE

sowmiya — Fri, 24 Jul 2020 12:11:19 GMT

<info> app: Inside main
<debug> app: In nrf_bootloader_init
<debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...
<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
<debug> nrf_dfu_settings: Settings OK
<debug> app: Enter nrf_bootloader_fw_activate
<info> app: No firmware to activate.
<debug> app: Enter nrf_dfu_app_is_valid
<debug> app: No valid app to boot.
<debug> app: DFU mode because app is not valid.
<info> nrf_bootloader_wdt: WDT is not enabled
<debug> app: in weak nrf_dfu_init_user
<debug> app: timer_stop (0x20000024)
<debug> app: timer_activate (0x20000024)
<info> app: Entering DFU mode.
<debug> app: Initializing transports (found: 1)
<debug> nrf_dfu_serial_uart: serial_dfu_transport_init()
<debug> nrf_dfu_serial_uart: serial_dfu_transport_init() completed
<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
<debug> app: Enter main loop
<debug> app: Shutting down transports (found: 1)
<debug> nrf_dfu_serial: Received ping 1
<info> nrf_dfu_serial_uart: Allocated buffer 2000378C
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_PING
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_serial: Sending Response: [0x9, 0x1]
<debug> app: Shutting down transports (found: 1)
<debug> nrf_dfu_serial: Set receipt notif target: 0
<info> nrf_dfu_serial_uart: Allocated buffer 2000378C


<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_RECEIPT_NOTIF_SET
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_serial: Sending Response: [0x2, 0x1]
<debug> app: Shutting down transports (found: 1)
<debug> nrf_dfu_serial: Received serial mtu
<info> nrf_dfu_serial_uart: Allocated buffer 2000378C


<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_MTU_GET
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_serial: Sending Response: [0x7, 0x1]
<debug> app: Shutting down transports (found: 1)
<info> nrf_dfu_serial_uart: Allocated buffer 2000378C


<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_SELECT (command)
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_serial: Sending Response: [0x6, 0x1]
<debug> app: Shutting down transports (found: 1)
<info> nrf_dfu_serial_uart: Allocated buffer 2000378C


<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (command)
<debug> app: timer_stop (0x20000024)
<debug> app: timer_activate (0x20000024)
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_serial: Sending Response: [0x1, 0x1]
<debug> app: Shutting down transports (found: 1)
<info> nrf_dfu_serial_uart: Allocated buffer 20003810

waiting for your reply,

devzone.nordicsemi.com/.../test1_5F00_app.zip

here is my bin and dat file ,

same file is working by using application through BLE

but when used in uart not getting any response .i have debug the code .

uint8_t create_obj[] = { 0x01, 0x01, 0x91, 0x00, 0x00, 0x00 };

	uint32_t create_obj_len = 6;
	uint8_t init_packet2[] = { 8, 4, 8, 1, 18, 0 };
	uint32_t init_packet2_len = 6;


uint8_t init_packet1[] = { 0x12, 0x8A, 0x01, 0x0A, 0x44, 0x08, 0x01, 0x12, 0x40, 0x08, 0x01, 0x10, 0x34, 0x1A, 0x02, 0xAE,
			0x01, 0x20, 0x00, 0x28, 0x00, 0x30, 0x00, 0x38, 0xF4, 0xE0, 0x02, 0x42, 0x24, 0x08, 0x03, 0x12,
			0x20, 0x9D, 0x45, 0x56, 0x3B, 0xF7, 0x9D, 0x44, 0x66, 0x5E, 0x69, 0x45, 0xB7, 0x9F, 0xAB, 0x2C,
			0x32, 0xB0, 0x9F, 0x10, 0x31, 0x69, 0x5C, 0x64, 0x6D, 0xA1, 0x8F, 0xD9, 0xE2, 0x53, 0x12, 0x4A,
			0x81, 0x48, 0x00, 0x52, 0x04, 0x08, 0x01, 0x12, 0x00, 0x10, 0x00, 0x1A, 0x40, 0x51, 0x1F, 0xE2,
			0xD4, 0x31, 0xD3, 0x3C, 0x12, 0xCE, 0xF7, 0x98, 0x85, 0x59, 0xBB, 0x40, 0x92, 0x6B, 0x61, 0x70,
			0x29, 0x8A, 0x13, 0x4B, 0xD5, 0x45, 0xA1, 0xEA, 0x05, 0xBA, 0x59, 0xB7, 0x21, 0x4E, 0xAE, 0x78,
			0x43, 0x97, 0xE3, 0xD2, 0xE8, 0x82, 0x0F, 0x40, 0x39, 0xBC, 0x51, 0x2A, 0xA6, 0x18, 0x98, 0x6E,
			0xD8, 0x40, 0xF1, 0x7E, 0x5A, 0x0B, 0xFF, 0x4E, 0x70, 0x88, 0x2E, 0xAA, 0xC2 };
			uint32_t init_packet1_len = 141;
			
			memset(enc_data, 0, sizeof(enc_data));
	//INIT PACKET 1
encode_slip(enc_data,&enc_data_len,init_packet1,init_packet1_len);
uart_flush(UART_NUM_1);
uart_write_bytes(UART_NUM_1,(char*) enc_data, enc_data_len);
uart_wait_tx_done(UART_NUM_1, 5);
ESP_LOG_BUFFER_HEX_LEVEL( "INIT PACKET 1 -->", enc_data, enc_data_len, ESP_LOG_INFO );

vTaskDelay(10);
	memset(enc_data, 0, sizeof(enc_data));
	//INIT PACKET 2
	encode_slip(enc_data, &enc_data_len, init_packet2, init_packet2_len);
	uart_flush(UART_NUM_1);
	uart_write_bytes(UART_NUM_1, (char*) enc_data, enc_data_len);
	uart_wait_tx_done(UART_NUM_1, 5);
	ESP_LOG_BUFFER_HEX_LEVEL("INIT PACKET 2 -->", enc_data, enc_data_len,
			ESP_LOG_INFO);

	memset(enc_data, 0, sizeof(enc_data));
	//REQUEST CHECKSUM
	encode_slip(enc_data, &enc_data_len, CRC, CRC_len);
	uart_flush(UART_NUM_1);
	uart_write_bytes(UART_NUM_1, (char*) enc_data, enc_data_len);
	uart_wait_tx_done(UART_NUM_1, 5);
	ESP_LOG_BUFFER_HEX_LEVEL("CHECKSUM -->", enc_data, enc_data_len,
			ESP_LOG_INFO);

	vTaskDelay(20);
	ESP_ERROR_CHECK(uart_get_buffered_data_len(UART_NUM_1, &read_len));
	readBytes = uart_read_bytes(UART_NUM_1, RespData, (uint32_t) read_len, 0);
	ESP_LOG_BUFFER_HEX_LEVEL("CHECKSUM Response <--", RespData, readBytes,
			ESP_LOG_INFO);

	memset(enc_data, 0, sizeof(enc_data));
	//EXECUTE
	encode_slip(enc_data, &enc_data_len, execute, exe_len);
	uart_flush(UART_NUM_1);
	uart_write_bytes(UART_NUM_1, (char*) enc_data, enc_data_len);
	uart_wait_tx_done(UART_NUM_1, 5);
	ESP_LOG_BUFFER_HEX_LEVEL("EXECUTE -->", enc_data, enc_data_len,
			ESP_LOG_INFO);

	vTaskDelay(10);
	ESP_ERROR_CHECK(uart_get_buffered_data_len(UART_NUM_1, &read_len));
	readBytes = uart_read_bytes(UART_NUM_1, RespData, (uint32_t) read_len, 0);
	ESP_LOG_BUFFER_HEX_LEVEL("EXECUTE Response <--", RespData, readBytes,
			ESP_LOG_INFO);
	printf("RespData:%s", (char*) RespData);

here is my code..

whats the mistake here ?? could you explain ??

regards,

sowmiya

RE: NRF52840 OTA over BLE

sowmiya — Fri, 24 Jul 2020 10:51:27 GMT

hello,

i to started with serial from esp to nrf

in that i can able to send upto create object and getting responses but when i tried send a init packet but not getting response ,juts i converted my .dat file to hex in online convertor and hardcoded the value in code.

how to send the init packet??

RE: NRF52840 OTA over BLE

Hung Bui — Thu, 23 Jul 2020 12:57:34 GMT

My example code is for updating a nRF52 from a nRF52 not from ESP. From that example you can have an overview of the DFU process.

I would suggest you to record sniffer trace, not just the log.

Please step into the bootloader and debug inside that , check why it doesn't receive CRC calculate request. You may need to change the optimization level to be able to step into the bootloader's code.

RE: NRF52840 OTA over BLE

sowmiya — Wed, 22 Jul 2020 16:23:34 GMT

yes , i go with your example but how to start ? and where to start in esp side with uart ?

now i am trying ESP32 to nrf over BLE. as you said i did the same , traced the log from nrf connect app and implemented logics for esp to nrf ,but i dont know whats missing in that, until the init packet i am getting as per the log taken from nrf connect app.

could you explain on sending the firmware file procedure??

regards,

sowmiya

RE: NRF52840 OTA over BLE

Hung Bui — Wed, 22 Jul 2020 13:23:52 GMT

I don't see the bootloader responding to CRC calculate request. Please try to debug the bootloader and have a look inside nrf_dfu_command_req() function.

Have you looked at my example ?

If you don't plan to try the UART DFU, another advice for you is to do DFU of the same file using our tool for example the app on the phone or NRF Connect app on PC. Then record a sniffer trace of that process. Doing that you can replicate the same procedure on the ESP and can find why it didn't work for you.

RE: NRF52840 OTA over BLE

sowmiya — Wed, 22 Jul 2020 12:00:06 GMT

hai ,

i tried OTA over ble from esp32 to nrf52840

here i have attached the log got from nrf52.

STEP 1 : extract zip file in cloud . as per the DFU protocol send a initial commamd and got proper response

STEP 2 : send a .dat file which is downloaded and stored in a file system of esp32 to nrf52 and calculation of crc was correct and signature verified successfully.

STEP 3: downloaded a bin file in esp32 by http and stored in file system and spllited the .bin file as 12 objects

each object as 4096 bytes , send as 144 bytes in a loop when completion of first object (4096)

0x03 send for crc but i didnt get any data from nrf side.

<info> app: Inside main
<debug> app: In nrf_bootloader_init
<debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...
<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
<debug> nrf_dfu_settings: Settings OK
<debug> app: Enter nrf_bootloader_fw_activate
<info> app: No firmware to activate.
<debug> app: Enter nrf_dfu_app_is_valid
<debug> app: No valid app to boot.
<debug> app: DFU mode because app is not valid.
<info> nrf_bootloader_wdt: WDT is not enabled
<debug> app: in weak nrf_dfu_init_user
<debug> app: timer_stop (0x200057D4)
<debug> app: timer_activate (0x200057D4)
<info> app: Entering DFU mode.
<debug> app: Initializing transports (found: 1)
<debug> nrf_dfu_ble: Initializing BLE DFU transport
<debug> nrf_dfu_ble: Setting up vector table: 0x000F1000
<debug> nrf_dfu_ble: Enabling SoftDevice.
<debug> nrf_dfu_ble: Configuring BLE stack.
<debug> nrf_dfu_ble: Enabling the BLE stack.
<debug> nrf_dfu_ble: No advertising name found
<debug> nrf_dfu_ble: Using default advertising name
<debug> nrf_dfu_ble: Advertising...
<debug> nrf_dfu_ble: BLE DFU transport initialized.
<debug> nrf_dfu_flash: Initializing nrf_fstorage_sd backend.
<debug> nrf_dfu_validation: PB: Init packet data len: 64
<debug> app: Enter main loop
<debug> nrf_dfu_ble: Connected
<debug> nrf_dfu_ble: Received BLE_GAP_EVT_DATA_LENGTH_UPDATE_REQUEST.
<debug> nrf_dfu_ble: Received BLE_GAP_EVT_DATA_LENGTH_UPDATE (251, max_rx_time 2120).
<debug> nrf_dfu_ble: Received BLE_GATTS_EVT_EXCHANGE_MTU_REQUEST (request: 500, reply: 247).
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_SELECT (command)
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> app: Shutting down transports (found: 1)
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (command)
<debug> app: timer_stop (0x200057D4)
<debug> app: timer_activate (0x200057D4)
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_ble: Buffer 0x2000910C acquired, len 141 (244)
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (command)
<debug> nrf_dfu_ble: Freeing buffer 0x2000910C
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_CRC_GET (command)
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_EXECUTE (command)
<debug> nrf_dfu_validation: PB: Init packet data len: 64
<info> nrf_dfu_validation: Signature required. Checking signature.
<info> nrf_dfu_validation: Calculating init packet hash (init packet len: 64)
<info> nrf_dfu_validation: Verify signature
<info> nrf_dfu_validation: Image verified
<debug> app: Enter nrf_dfu_cache_prepare()
<debug> app: required_size: 0xBA50.
<debug> app: single_bank: false.
<debug> app: keep_app: false.
<debug> app: keep_softdevice: true.
<debug> app: SD_PRESENT: true.
<debug> app: Bank contents:
<debug> app: Bank 0 code: 0x00: Size: 0x0
<debug> app: Bank 1 code: 0x00: Size: 0xBA50
<debug> app: pass: 0.
<debug> app: cache_address: 0x26000.
<debug> app: cache_too_small: false.
<debug> app: keep_firmware: false.
<debug> app: delete_more: false.
<debug> nrf_dfu_validation: Write address set to 0x00026000
<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.
<debug> nrf_dfu_req_handler: Writing valid init command to flash.
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_SELECT (data)
<debug> nrf_dfu_req_handler: crc = 0x0, offset = 0x0, max_size = 0x1000
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> app: Shutting down transports (found: 1)
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (data)
<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x00026000, len=1 pages), queue usage: 0
<debug> nrf_dfu_req_handler: Creating object with size: 4096. Offset: 0x00000000, CRC: 0x00000000
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_flash: Flash erase success: addr=0x00026000, pending 0

init packet(.dat file) getting properly not issues in that.

why i am getting any data of .bin firmware file?

how to send a bin file which i extracted from cloud ??

RE: NRF52840 OTA over BLE

Hung Bui — Tue, 21 Jul 2020 14:42:19 GMT

Hi Sowmiya,

I would suggest to have a look at my example here first. I provided an example of DFU master with UART and SPI. From that you would have an overview on what the DFU protocol on UART would look like and how you can send the binary , create object etc.
After that you would need to develop your own code to do BLE DFU based on this example and the BLE DFU protocol documentation .