NRF9160: FOTA over BT SMP

[k.szpila]

Hello,

In our current project we are using NRF9160 with NRF52811 as BT device over HCI. Firmware on NRF52811 is just Bluetooth: HCI UART example with pinmux changed to match our hardware.

I want to perform firmware upgrade of NRF9160 over BT. I have added to `prj.con` file configs based on mcumgr/smp_svr example `overlay-bt.conf`. The only difference is
that I used `CONFIG_MCUMGR_SMP_UART` instead of `CONFIG_MCUMGR_SMP_SHELL` for smaller footprint.

This is my prj.con file.

# Add NEWLIB_LIB c instead of minimal version

CONFIG_NEWLIB_LIBC=y

# Enable library

CONFIG_APP_SETTINGS=y

# BT Configuration

CONFIG_BT=y

CONFIG_BT_GATT_BAS=y

CONFIG_BT_DEBUG_LOG=y

CONFIG_BT_SMP=y

CONFIG_BT_SIGNING=y

CONFIG_BT_PERIPHERAL=y

CONFIG_BT_GATT_DIS=y

CONFIG_BT_ATT_PREPARE_COUNT=2

CONFIG_BT_PRIVACY=y

CONFIG_BT_DEVICE_NAME="Test device"

CONFIG_BT_DEVICE_APPEARANCE=833

CONFIG_BT_DEVICE_NAME_DYNAMIC=y

CONFIG_BT_DEVICE_NAME_MAX=65

CONFIG_BT_GATT_DIS_FW_REV=y

CONFIG_BT_GATT_DIS_PNP=n

CONFIG_BT_SETTINGS=y

# Wait until nrf52 operational after resetting it on dev kit

CONFIG_BT_WAIT_NOP=y

# Enable UART1 for BT

CONFIG_UART_1_NRF_FLOW_CONTROL=y

# PWM for buzzer

CONFIG_PWM=y

# TWI for accelerometer

CONFIG_I2C=y

CONFIG_I2C_2=y

# General config

CONFIG_HEAP_MEM_POOL_SIZE=4096

# DTLS support

CONFIG_MODEM_KEY_MGMT=y

CONFIG_LWM2M_DTLS_SUPPORT=y

CONFIG_LWM2M_PEER_PORT=5684

CONFIG_LWM2M_SECURITY_KEY_SIZE=33

# LTE link control

CONFIG_LTE_PSM_REQ_RPTAU="11100000"

CONFIG_LTE_PSM_REQ_RAT="00011110"

# GPS driver

CONFIG_NRF9160_GPS_COEX0_STRING="AT%XCOEX0=1,1,1570,1580"

# BSD library

CONFIG_BSD_LIBRARY_TRACE_ENABLED=n

# Main thread

CONFIG_MAIN_STACK_SIZE=4096

# FOTA

CONFIG_DFU_TARGET=y

CONFIG_IMG_MANAGER=y

CONFIG_IMG_ERASE_PROGRESSIVELY=y

CONFIG_BOOTLOADER_MCUBOOT=y

CONFIG_MCUBOOT_IMAGE_VERSION="0.1.0"

CONFIG_DOWNLOAD_CLIENT=y

CONFIG_FOTA_DOWNLOAD=y

CONFIG_FLASH=y

CONFIG_MPU_ALLOW_FLASH_WRITE=y

CONFIG_REBOOT=y

CONFIG_BOOT_SIGNATURE_KEY_FILE="../../key.pem"

# File system

CONFIG_FLASH_MAP=y

CONFIG_FILE_SYSTEM=y

CONFIG_FILE_SYSTEM_LITTLEFS=y

# Logging

CONFIG_USE_SEGGER_RTT=y

CONFIG_LOG_BACKEND_UART=n

CONFIG_LOG_PRINTK=y

# Misc

CONFIG_TINYCBOR=y

CONFIG_CBOR_FLOATING_POINT=y

CONFIG_CJSON_LIB=y

CONFIG_LOG_IMMEDIATE=y

# Allow for large Bluetooth data packets.

CONFIG_BT_L2CAP_TX_MTU=260

CONFIG_BT_RX_BUF_LEN=260

# Enable the Bluetooth (unauthenticated) and UART mcumgr transports.

CONFIG_MCUMGR_SMP_BT=y

CONFIG_MCUMGR_SMP_BT_AUTHEN=n

CONFIG_MCUMGR_SMP_UART=y

CONFIG_MCUMGR_CMD_IMG_MGMT=y

CONFIG_MCUMGR_CMD_OS_MGMT=y

CONFIG_MCUMGR_CMD_FS_MGMT=y

With this configuration I'm able to connect to the device using NRF connect android app. The DFU button is visible. I'm able to choose what firmware sent to the device, but right after
starting DFU it is immediately stoped. BLE is not disconnected after that. For firmware update i'm using `app_update.bin` from `build/zephyr/` directory.

This is a log from NRF connect app:

nRF Connect, 2021-02-23
Test device (44:57:0A:cd:F3:66)
11:53:46.711    Connecting to 44:57:0A:cd:F3:66...
11:53:46.711    gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, preferred PHY = LE 1M)
11:53:47.197    [Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
11:53:47.217    [Callback] Connection state changed with status: 0 and new state: CONNECTED (2)
11:53:47.217    Connected to 44:57:0A:cd:F3:66
11:53:47.238    Discovering services...
11:53:47.238    gatt.discoverServices()
11:53:47.731    Connection parameters updated (interval: 7.5ms, latency: 0, timeout: 5000ms)
11:53:48.636    [Callback] Services discovered with status: 0
11:53:48.637    Services discovered
11:53:48.694    Generic Attribute (0x1801)
- Service Changed [I] (0x2A05)
   Client Characteristic Configuration (0x2902)
- Client Supported Features [R W] (0x2B29)
- Database Hash [R] (0x2B2A)
Generic Access (0x1800)
- Device Name [R W] (0x2A00)
- Appearance [R] (0x2A01)
- Peripheral Preferred Connection Parameters [R] (0x2A04)
Battery Service (0x180F)
- Battery Level [N R] (0x2A19)
   Client Characteristic Configuration (0x2902)
Unknown Service (00000020-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [WNR] (00000021-0000-1000-8000-00805f9b34fb)
Device Information (0x180A)
- Model Number String [R] (0x2A24)
- Manufacturer Name String [R] (0x2A29)
- Firmware Revision String [R] (0x2A26)
Unknown Service (00000030-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [R W] (00000030-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [N R] (00000031-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
- Unknown Characteristic [N R] (00000032-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
- Unknown Characteristic [N R] (00000033-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
- Unknown Characteristic [N R] (00000034-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
- Unknown Characteristic [N R] (00000035-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
- Unknown Characteristic [N R] (00000036-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
- Unknown Characteristic [N R] (00000037-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
- Unknown Characteristic [N R] (00000038-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
- Unknown Characteristic [N R] (00000039-0000-1000-8000-00805f9b34fb)
   Client Characteristic Configuration (0x2902)
Unknown Service (00000040-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [WNR] (00000041-0000-1000-8000-00805f9b34fb)
Unknown Service (00000050-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [R] (00000051-0000-1000-8000-00805f9b34fb)
Unknown Service (00000010-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [R] (00000011-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [R] (00000012-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [R] (00000013-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [R] (00000014-0000-1000-8000-00805f9b34fb)
- Unknown Characteristic [R] (00000015-0000-1000-8000-00805f9b34fb)
SMP Service (8d53dc1d-1db7-4cd3-868b-8a527460aa84)
- SMP Characteristic [N WNR] (da2e7828-fbce-4e01-ae9e-261174997c48)
   Client Characteristic Configuration (0x2902)
11:53:48.694    gatt.setCharacteristicNotification(00002a05-0000-1000-8000-00805f9b34fb, true)
11:53:48.697    gatt.setCharacteristicNotification(00002a19-0000-1000-8000-00805f9b34fb, true)
11:53:48.699    gatt.setCharacteristicNotification(00000031-0000-1000-8000-00805f9b34fb, true)
11:53:48.701    gatt.setCharacteristicNotification(00000032-0000-1000-8000-00805f9b34fb, true)
11:53:48.703    gatt.setCharacteristicNotification(00000033-0000-1000-8000-00805f9b34fb, true)
11:53:48.705    gatt.setCharacteristicNotification(00000034-0000-1000-8000-00805f9b34fb, true)
11:53:48.707    gatt.setCharacteristicNotification(00000035-0000-1000-8000-00805f9b34fb, true)
11:53:48.708    gatt.setCharacteristicNotification(00000036-0000-1000-8000-00805f9b34fb, true)
11:53:48.710    gatt.setCharacteristicNotification(00000037-0000-1000-8000-00805f9b34fb, true)
11:53:48.711    gatt.setCharacteristicNotification(00000038-0000-1000-8000-00805f9b34fb, true)
11:53:48.713    gatt.setCharacteristicNotification(00000039-0000-1000-8000-00805f9b34fb, true)
11:53:48.726    Connection parameters updated (interval: 45.0ms, latency: 0, timeout: 5000ms)
11:53:53.804    [McuMgr] Connecting...
11:53:53.811    [McuMgr] gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, LE 1M)
11:53:53.829    [McuMgr] [Callback] Connection state changed with status: 0 and new state: 2 (CONNECTED)
11:53:53.835    [McuMgr] Connected to 44:57:0A:cd:F3:66
11:53:53.843    [McuMgr] wait(300)
11:53:54.151    [McuMgr] Discovering services...
11:53:54.158    [McuMgr] gatt.discoverServices()
11:53:54.173    [McuMgr] Services discovered
11:53:54.177    [McuMgr] Primary service found
11:53:54.181    [McuMgr] Requesting new MTU...
11:53:54.185    [McuMgr] gatt.requestMtu(515)
11:53:54.668    [McuMgr] MTU changed to: 65
11:53:54.676    [McuMgr] gatt.setCharacteristicNotification(da2e7828-fbce-4e01-ae9e-261174997c48, true)
11:53:54.684    [McuMgr] Enabling notifications for da2e7828-fbce-4e01-ae9e-261174997c48
11:53:54.689    [McuMgr] gatt.writeDescriptor(00002902-0000-1000-8000-00805f9b34fb, value=0x01-00)
11:53:55.473    [McuMgr] Data written to descr. 00002902-0000-1000-8000-00805f9b34fb, value: (0x) 01-00
11:53:55.482    [McuMgr] Notifications enabled
11:53:55.486    [McuMgr] Writing characteristic da2e7828-fbce-4e01-ae9e-261174997c48 (WRITE COMMAND)
11:53:55.490    [McuMgr] gatt.writeCharacteristic(da2e7828-fbce-4e01-ae9e-261174997c48)
11:53:55.495    [McuMgr] Data written to da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 00-00-00-02-00-01-00-00-BF-FF
11:53:55.499    [McuMgr] "Operation: READ
Flags: 0
Length: 2
Group Id: 1 (IMAGE)
Sequence Num: 0
Command Id: 0 (STATE)
Message: {}" sent
11:53:55.923    [McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 01-00-00-86-00-01-00-00-BF-66-69-6D-61-67-65-73-9F-BF-64-73-6C-6F-74-00-67-76-65-72-73-69-6F-6E-65-30-2E-31-2E-30-64-68-61-73-68-58-20-6C-02-0C-DB-50-22-02-AC-6D-D5-2D-9D-03-64-A7-DD-5E
11:53:55.929    [McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 70-E4-A5-A4-63-6D-6B-CF-F8-E2-45-EE-23-D9-42-68-62-6F-6F-74-61-62-6C-65-F5-67-70-65-6E-64-69-6E-67-F4-69-63-6F-6E-66-69-72-6D-65-64-F5-66-61-63-74-69-76-65-F5-69-70-65-72-6D-61-6E-65-6E
11:53:55.935    [McuMgr] Notification received from da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 74-F4-FF-FF-6B-73-70-6C-69-74-53-74-61-74-75-73-00-FF
11:53:55.946    [McuMgr] "{"images":[{"slot":0,"version":"0.1.0","hash":"bAIM21AiAqxt1S2dA2Sn3V5w5KWkY21rz/jiRe4j2UI=","bootable":true,"pending":false,"confirmed":true,"active":true,"permanent":false}],"splitStatus":0}" received
11:53:55.955    [McuMgr] Uploading firmware...
.
Is it even possible to perform FOTA over SMP BT on NRF9160?

[Simon]

I have not tried to run the smp_svr on the nRF960 BLE Host, and not sure if it's supported. However, is the solution in this thread: https://devzone.nordicsemi.com/f/nordic-q-a/59186/nrf91-firmware-upgrade-over-ble/251577 an option? If not I'll look into your inital question.

I'll ask internally if we have any solutions for this, and the proper way of going about it.

Best regards,

Simon

[Simon]

Have you made any progress on this? A colleague have made some cross DFU projects, inluding a sample where an nRF52 chip updates the nRF9160 over BLE. Check it out here:

[email protected]

However, in these projects the nRF5 SDK (SDK 16.0) is used on the nRF52, not NCS.

[k.szpila]

HI, Simon.
Sorry for a late replay. I will look at the proposed solution this week.

I wanted to use BLE over HCI because our device will also have other services, not only DFU. I not sure if I'm correct but it looks like I won't be able to do that with the solution you proposed. Am I correct?

[Simon]

k.szpila said:

I wanted to use BLE over HCI because our device will also have other services, not only DFU. I not sure if I'm correct but it looks like I won't be able to do that with the solution you proposed. Am I correct?

 I have not tested this actually, I will put off some time the next days and test it out.

[Simon]

Were the solutions I provided you with suficcient?

[k.szpila]

Hi Simon,

Sorry for a late replay. I have tried to use example of `ncs\nrf\samples\bluetooth\peripheral_uart` like in the link you provided. Unfortunately I could'nt make it work with HCI.

We need HCI or some other way to use other BT services that our device is providing.

[Simon]

Have you made any progress on this? There was some discussion internally about this, and it seems like you should work fine performing FOTA over SMP BT on the host (nrf9160) when the controller is on the nrf52840 (hci_uart or hci_lpuart). These are the configs you should add to support SMP BT FOTA:

CONFIG_BT_L2CAP_TX_MTU=252
CONFIG_BT_L2CAP_RX_MTU=252
CONFIG_BT_RX_BUF_LEN=260
# Add the immutable bootloader
CONFIG_SECURE_BOOT=y
# Add MCUBoot as second-stage BL
CONFIG_BOOTLOADER_MCUBOOT=y
# Add MCUMGR for DFU over BLE
CONFIG_MCUMGR=y
CONFIG_MCUMGR_CMD_OS_MGMT=y
CONFIG_MCUMGR_CMD_IMG_MGMT=y
CONFIG_MCUMGR_SMP_BT=y
# TODO: remove this, only for debug
CONFIG_MCUMGR_SMP_BT_AUTHEN=n

If you don't get it to work, could you try to share the application you're working with (and LMK what ncs version you're using), then I can try to do some debugging myself.

Best regards,

Simon

[k.szpila]

Thanks, its now working perfectly, although I have a question.

In different project using NRF52 we have:

CONFIG_BT_L2CAP_TX_MTU=517

CONFIG_BT_L2CAP_RX_MTU=517

CONFIG_BT_RX_BUF_LEN=525

so image transfer will be faster.

For NRF9160 this values were not working. Bootloader was yielding invalid image error.

So I flashed NRF9160 with my application, and then tried to do FOTA over SMP using the same image,
so images in both slots should be the same. Then I dumped to a file, flash region with both bootloader slots. In slot 1 (FOTA upgrage) there was a lot of mismatching bytes in random places, so image hash was different resulting in mentioned error.

So my question is why this values works:

```
CONFIG_BT_L2CAP_TX_MTU=252
CONFIG_BT_L2CAP_RX_MTU=252
CONFIG_BT_RX_BUF_LEN=260
```

and how to determine bigger values that will also work.

[Simon]

Could you share your application(s)? Such that I have the exact same setup as you, and can try to reproduce it on my end.