OTA over BLE from nrf2840 central to nrf52840 using gatt

[sowmiya]

Hai ,

           I am using nrf52840 and 15.2 SDK  for ota over BLE. I  have made bootloader for OTA over BLE and tested same with nrf connect application using dfu package zip file. firmware is upgraded successfully and working fine.

          Now I need to upgrade firmware using  NRF52840 to another nrf52840 , as per the protocol i  have to send ping response , create object , init file ,check and so on.. 

sending ping response to bootloader but not getting any response for the ping response . traced the log from nrf connect application . have to write on 0x0001 characteristic , what is the correct way to write on characteristic , i am using ble_app_blinky_c example .

Kindly let me know how to write on particular characteristic on ble central?

thanks,

sowmiya

[Hung Bui]

Hi Sowmiya, 

We currently don't have an example of doing BLE DFU from a nRF52 to another NRF52. We do have example running on PC, Android, iOS but we don't have the embedded example one. 

You would need to implement that on your own. As you may have studied the protocol, implementing  ping response , create object , init file ,check and so on..  is exactly what you need to do. 

Before we go deep into the bootloader, could you clarify that you have worked on a central device before ? Do you know how to do service discovery, write to a characteristic, get notification, etc ? 

[sowmiya]

yes, i have worked on ble central writing data on led char handle  to the peripheral and also getting notification back from peripheral to central.

for bootloader i had changed the service uuid , then i have to write on 0x0001 and 0x0002  characteritics for the dfu.

[Hung Bui]

Hi Sowmiya, 
I would suggest to follow this documentation closely. 
The ping command NRF_DFU_OP_PING is not a common one and it is not supported if the flag NRF_DFU_PROTOCOL_REDUCED is used (by default it's used).

I would suggest to use a sniffer trace to capture a successful DFU session using nRF Connect app on the phone or PC. This way you have a golden sample that you can follow. 

We have an example of doing master DFU from a nRF52 but it's on UART/SPI. It could be a good source of reference for you. Have a look here.

[sowmiya]

i have tried over ble with other MCU ,as per the dfu protocol i have sended each commands over gatt i got response from nrf and it was correct then for firmware .bin file i had downloaded sending each packets with 244 bytes of data ,NRF_SDH_BLE_GATT_MAX_MTU_SIZE 247 3 bytes for opcode and remaining for dfu packet len.

i am sending first one packet from MCU to nrf52840 , before sending data encoded each packets by slip library and sending by gatt but i am getting only 2 set of 244 bytes on bootloader side.

given the logs on booloader side below , not writing after that , nrf gets resetting 

<error> app: Received a fault! id: 0x00000001, pc: 0x00014A3A, info: 0x00000000

how to send the packets i dont know the error which is occuring on bootloader side ?

<info> app: Inside main
<debug> app: In nrf_bootloader_init
<debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...
<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.
<warning> nrf_dfu_settings: Resetting bootloader settings since neither the settings page nor the backup are valid (CRC error).
<debug> nrf_dfu_settings: Writing settings...
<debug> nrf_dfu_settings: Erasing old settings at: 0x000FF000
<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FF000, len=1 pages), queue usage: 0
<debug> nrf_dfu_flash: Flash erase success: addr=0x000FF000, pending 0
<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FF000, src=0x2000A1A8, len=440 bytes), queue usage: 1
<debug> nrf_dfu_flash: Flash write success: addr=0x000FF000, pending 0
<debug> app: Enter nrf_bootloader_fw_activate
<info> app: No firmware to activate.
<debug> app: Enter nrf_dfu_app_is_valid
<debug> app: No valid app to boot.
<debug> app: DFU mode because app is not valid.
<info> nrf_bootloader_wdt: WDT is not enabled
<debug> app: in weak nrf_dfu_init_user
<debug> app: timer_stop (0x200057D4)
<debug> app: timer_activate (0x200057D4)
<info> app: Entering DFU mode.
<debug> app: Initializing transports (found: 1)
<debug> nrf_dfu_ble: Initializing BLE DFU transport
<debug> nrf_dfu_ble: Setting up vector table: 0x000F1000
<debug> nrf_dfu_ble: Enabling SoftDevice.
<debug> nrf_dfu_ble: Configuring BLE stack.
<debug> nrf_dfu_ble: Enabling the BLE stack.
<debug> nrf_dfu_ble: No advertising name found
<debug> nrf_dfu_ble: Using default advertising name
<debug> nrf_dfu_ble: Advertising...
<debug> nrf_dfu_ble: BLE DFU transport initialized.
<debug> nrf_dfu_flash: Initializing nrf_fstorage_sd backend.
<debug> app: Enter main loop
<debug> nrf_dfu_ble: Connected
<debug> nrf_dfu_ble: Received BLE_GAP_EVT_DATA_LENGTH_UPDATE_REQUEST.
<debug> nrf_dfu_ble: Received BLE_GAP_EVT_DATA_LENGTH_UPDATE (251, max_rx_time 2120).
<debug> nrf_dfu_ble: Received BLE_GATTS_EVT_EXCHANGE_MTU_REQUEST (request: 500, reply: 247).
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_SELECT (command)
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> app: Shutting down transports (found: 1)
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (command)
<debug> app: timer_stop (0x200057D4)
<debug> app: timer_activate (0x200057D4)
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_ble: Buffer 0x2000910C acquired, len 141 (244)
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (command)
<debug> nrf_dfu_ble: Freeing buffer 0x2000910C
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_CRC_GET (command)
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_EXECUTE (command)
<debug> nrf_dfu_validation: PB: Init packet data len: 64
<info> nrf_dfu_validation: Signature required. Checking signature.
<info> nrf_dfu_validation: Calculating init packet hash (init packet len: 64)
<info> nrf_dfu_validation: Verify signature
<info> nrf_dfu_validation: Image verified
<debug> app: Enter nrf_dfu_cache_prepare()
<debug> app: required_size: 0x5A08.
<debug> app: single_bank: false.
<debug> app: keep_app: false.
<debug> app: keep_softdevice: true.
<debug> app: SD_PRESENT: true.
<debug> app: Bank contents:
<debug> app: Bank 0 code: 0x00: Size: 0x0
<debug> app: Bank 1 code: 0x00: Size: 0x0
<debug> app: pass: 0.
<debug> app: cache_address: 0x26000.
<debug> app: cache_too_small: false.
<debug> app: keep_firmware: false.
<debug> app: delete_more: false.
<debug> nrf_dfu_validation: Write address set to 0x00026000
<debug> nrf_dfu_settings: Writing settings...
<debug> nrf_dfu_settings: Erasing old settings at: 0x000FF000
<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FF000, len=1 pages), queue usage: 1
<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FF000, src=0x2000A1A8, len=440 bytes), queue usage: 2
<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.
<debug> nrf_dfu_settings: Writing settings...
<debug> nrf_dfu_settings: Erasing old settings at: 0x000FE000
<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FE000, len=1 pages), queue usage: 3
<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FE000, src=0x2000A360, len=440 bytes), queue usage: 4
<debug> nrf_dfu_req_handler: Writing valid init command to flash.
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_SELECT (data)
<debug> nrf_dfu_req_handler: crc = 0x0, offset = 0x0, max_size = 0x1000
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> app: Shutting down transports (found: 1)
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (data)
<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x00026000, len=1 pages), queue usage: 5
<debug> nrf_dfu_req_handler: Creating object with size: 4096. Offset: 0x00000000, CRC: 0x00000000
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_flash: Flash erase success: addr=0x000FF000, pending 5
<debug> nrf_dfu_flash: Flash write success: addr=0x000FF000, pending 4
<debug> nrf_dfu_flash: Flash erase success: addr=0x000FE000, pending 3
<debug> nrf_dfu_flash: Flash write success: addr=0x000FE000, pending 2
<debug> nrf_dfu_flash: Flash erase success: addr=0x00026000, pending 1
<debug> app: Shutting down transports (found: 1)
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (data)
<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x00026000, len=1 pages), queue usage: 1
<debug> nrf_dfu_req_handler: Creating object with size: 4096. Offset: 0x00000000, CRC: 0x00000000
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_flash: Flash erase success: addr=0x00026000, pending 1
<debug> nrf_dfu_ble: Buffer 0x2000910C acquired, len 244 (244)
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (data)
<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x00026000, src=0x2000910C, len=244 bytes), queue usage: 1
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_flash: Flash write success: addr=0x00026000, pending 1
<debug> nrf_dfu_ble: Freeing buffer 0x2000910C
<debug> nrf_dfu_ble: Buffer 0x2000910C acquired, len 244 (244)
<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (data)
<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000260F4, src=0x2000910C, len=244 bytes), queue usage: 1
<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1
<debug> nrf_dfu_flash: Flash write success: addr=0x000260F4, pending 1
<debug> nrf_dfu_ble: Freeing buffer 0x2000910C
<debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE
<debug> nrf_dfu_ble: max_conn_interval: 12
<debug> nrf_dfu_ble: min_conn_interval: 12
<debug> nrf_dfu_ble: slave_latency: 0
<debug> nrf_dfu_ble: conn_sup_timeout: 600
<error> app: Received a fault! id: 0x00000001, pc: 0x00014A3A, info: 0x00000000

[Hung Bui]

Please try to capture a sniffer trace when you test. 

From the log I can see that the connection parameter update happened and the connection interval was set to 12 (15ms) As far as I know the bootloader is not tested for short connection interval lower than 20ms. Please try to test with longer interval ( would suggest to test with says 50ms first).

Please try testing with very small and simple application image first before you upload the real image.