DFU for external BLE Sensor

[davidpatton]

Hi,

  I have a current project that is based on the nRf52840.  This project acts both as a peripheral and a central.  I have a need to update the firmware on a remote BLE sensor using DFU, i.e., I need to do exactly what the nRfConnect application does when it updates a peripheral firmware via DFU.  My thought was to use the nRf52840 dongle and develop this code on my PC and then port it to my embedded system.  I also thought the best starting point would be the source code for the nRfConnect application which I would port it but I see from user comments that nordic did not release the source code for this.  Is it possible to get this source code or is there another example that demonstrates what I need to accomplish?

Thanks!

[davidpatton]

Hi,

  I am a bit confused and am hoping that you can help.  I have a Laird BT610 sensor and when I connect to it it does not show a Secure DFU service; however, I can do an over the air update of this sensor using nRfConnect and a proper firmware.bin file for this sensor. The sensor does advertise the SMP Serviice.  Is nRfConnect using this service to perform the firmware update?

Thanks,

Dave

[Vidar Berg]

Hi Dave,

I am sorry for the confusion. I assumed your FW was based on our nRF5 SDK which uses a different DFU protocol.  So my initial reply does not apply to your case. As you may know, the nRF connect SDK is relying on the DFU protocol from MCUmgr for FW updates over BLE.

Here are the MCUmgr libraries we use for our ios and android apps:

https://github.com/NordicSemiconductor/Android-nRF-Connect-Device-Manager

https://github.com/NordicSemiconductor/IOS-nRF-Connect-Device-Manager

Best regards,

Vidar

[Vidar Berg]

Hi,

I am not familiar with the low level details of the mcumgr protocol or the cbor encoding, to be honest. But you can do DFU using the same image with nRF connect on Android or iOS, then inspect the log to see the cbor requests and responses that are being sent.

Here is the log I got from nRF connect on iOS for reference:

Let me know if this is not the data you are looking for.

Vidar

[davidpatton]

Hi,

  The image you sent contains the log output from the DFU, this is one level above where the actual bytes are sent.  Although that contains most of the data for an Upload block it is missing some stuff, I am looking for a log at the byte level.  Something that shows the actual bytes being sent over the BLE, if I get this I will know how to extract the data I need:

BLE Header (I don't really need this)
SMP Header (this is 8 bytes)
CBOR Data (this is variable length)

If possible a file containing the raw bytes would be AWESOME.  Thanks so much for your help, once I get this piece of information I am sure I will be able to complete this project.

Thanks,

Dave

[davidpatton]

Hi,

  I figured it out and just had my first successful Image Upload!  I actually discovered "adb" which is android debug and set that up which allowed me to capture EVERYTHING that nRfConnect was sending while it was doing a firmware update of the sensor.  Then I used looked at the capture file with the Wireshark application which allowed me to see the raw bytes that were being sent.  Once I had that I was able to figure it out.  Really there is literally no decent documentation ANYWHERE that describes the DFU vis SMP process on a byte level which is what is needed if you are developing a solution from scratch. 

Anyway, I wanted to thank you again for the help that you gave me, without that I would still be struggling. 

Many Thanks,

Dave Patton

[Vidar Berg]

Excellent! I did not even think of using debug logs from the phone. My plan was to try to log the data from the DFU target. I didn't get that far though. Not sure if I would have been able to log the data fast enough either.

I will report the missing documentation as a feature request. Hopefully we can add it so others who are developing their own DFU clients in the future do not have to reverse engineer the protocol like you had to.

Thanks for the update.

Vidar

[davidpatton]

Hi,

There is one piece of information that I have been unable to figure out.  The first block of data in the upload contains the entire image length and a "sha" field.  Below is a real example of the data in both binary and the "json" representation of the cbor data.  I need to know exactly what the "sha" is and how to calculate it so I can include the "sha" with my uploads.

Binary data = SMPHeader|CBOR_Data packet: 020000f400010001bf646461746158d53db8f3960000000000020000fca5070000000000011b0100860e536100000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff636c656e1a0007a8936373686143525249636f666600ff

SMPHeader: 020000f400010001

CBOR_Data: bf646461746158d53db8f3960000000000020000fca5070000000000011b0100860e536100000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff636c656e1a0007a8936373686143525249636f666600ff

cbor json: {"data": h'3DB8F3960000000000020000FCA5070000000000011B0100860E536100000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF', "len": 501907, "sha": h'525249', "off": 0}

Thanks,

Dave Patton

[Vidar Berg]

Hi Dave,

It's the sha-256 digest of your signed image, but only the first 3 bytes of it: https://github.com/zephyrproject-rtos/mcumgr/blob/master/cmd/img_mgmt/src/img_mgmt.c#L493-L501

The easiest way to get the digest (is placed in the image trailer) is to use the imgtool and run imgtool verify <signed_image>

Best regards,

Vidar

[davidpatton]

Hi, I am trying to move this code into my non-dev board project and for this file nrf_queue.c this is at the top of the file.

#if NRF_MODULE_ENABLED(NRF_QUEUE)

This currently is false so none of the code in this file is active.  I added this to my sdk_config.h

// <e> NRF_QUEUE_ENABLED - nrf_queue - Queue module
//==========================================================
#ifndef NRF_QUEUE_ENABLED
#define NRF_QUEUE_ENABLED 1
#endif
// <q> NRF_QUEUE_CLI_CMDS - Enable CLI commands specific to the module

however, that did not enable the code in nrf_queue.c.  How can I enable this code?

Thanks

Dave

[Vidar Berg]

Hi Dave,

Are you sure you need to create a new project for this? Normally it's sufficient to just change the board file (Using the SDK with other boards) in addition to maybe updating some of the global pre-processor defines. Anyway. The code in nrf_queue.c should become enabled as long as NRF_QUEUE_ENABLED==1. Maybe it's being defined as '0' elsewhere in your project?

Vidar

[davidpatton]

Hi,

  I did the DFU via SMP project on the Dev kit to get it working.  I now have to move that code to our real project that has many other things in it.  Unfortunately our project was based on an SDK that did not contain the BLE GATT QUEUE.  I copied the /ble/nrf_ble_gq directory from the 17.01 SDK to our project to add the BLE GAT QUEUE.  Then I added the following to the skd_config.h file:

// <e> NRF_QUEUE_ENABLED - nrf_queue - Queue module
//==========================================================
#ifndef NRF_QUEUE_ENABLED
#define NRF_QUEUE_ENABLED 1
#endif

// <o> NRF_BLE_GQ_BLE_OBSERVER_PRIO
// <i> Priority with which BLE events are dispatched to the GATT Queue module.

#ifndef NRF_BLE_GQ_BLE_OBSERVER_PRIO
#define NRF_BLE_GQ_BLE_OBSERVER_PRIO 1
#endif

// <e> NRF_BLE_GQ_ENABLED - nrf_ble_gq - BLE GATT Queue Module
//==========================================================
#ifndef NRF_BLE_GQ_ENABLED
#define NRF_BLE_GQ_ENABLED 1
#endif
// <o> NRF_BLE_GQ_DATAPOOL_ELEMENT_SIZE - Default size of a single element in the pool of memory objects.
#ifndef NRF_BLE_GQ_DATAPOOL_ELEMENT_SIZE
#define NRF_BLE_GQ_DATAPOOL_ELEMENT_SIZE 20
#endif

// <o> NRF_BLE_GQ_DATAPOOL_ELEMENT_COUNT - Default number of elements in the pool of memory objects.
#ifndef NRF_BLE_GQ_DATAPOOL_ELEMENT_COUNT
#define NRF_BLE_GQ_DATAPOOL_ELEMENT_COUNT 8
#endif

// <o> NRF_BLE_GQ_GATTC_WRITE_MAX_DATA_LEN - Maximal size of the data inside GATTC write request (in bytes).
#ifndef NRF_BLE_GQ_GATTC_WRITE_MAX_DATA_LEN
#define NRF_BLE_GQ_GATTC_WRITE_MAX_DATA_LEN 2
#endif

// <o> NRF_BLE_GQ_GATTS_HVX_MAX_DATA_LEN - Maximal size of the data inside GATTC notification or indication request (in bytes).
#ifndef NRF_BLE_GQ_GATTS_HVX_MAX_DATA_LEN
#define NRF_BLE_GQ_GATTS_HVX_MAX_DATA_LEN 16
#endif

To me this looks like all that should be required but I am getting a compile error that I can't figure out.  I tried searching online for others having this issue but I have been unable to find anything, can you help with this.  The code that is generating the error is:

NRF_BLE_GQ_DEF(m_ble_gatt_queue, /**< BLE GATT Queue instance. */
NRF_SDH_BLE_CENTRAL_LINK_COUNT,
NRF_BLE_GQ_QUEUE_SIZE);

Building ‘SkyHub’ from solution ‘Solution ‘SkyHub’’ in configuration ‘Release’
Preprocessing file_transfer.c
Preprocessing packet_processing.c
Preprocessing pc_uart_interface.c
Preprocessing mobile_app_interface.c
Preprocessing sky_dfu.c
Preprocessing skybitz_app.c
Preprocessing int_flash.c
Preprocessing mx25flash_spi.c
Preprocessing spi_flash.c
Preprocessing skycam_ota.c
Preprocessing con_controller.c
Compiling ‘file_transfer.c’
Compiling ‘packet_processing.c’
Compiling ‘pc_uart_interface.c’
Preprocessing rtc_timer.c
Compiling ‘mobile_app_interface.c’
Compiling ‘sky_dfu.c’
Compiling ‘mx25flash_spi.c’
Compiling ‘int_flash.c’
Compiling ‘skybitz_app.c’
unknown type name 'm_ble_gatt_queuereq_queue'
expected declaration specifiers or '...' before numeric constant
expected declaration specifiers or '...' before 'NRF_QUEUE_MODE_NO_OVERFLOW'
expected declaration specifiers or '...' before numeric constant
'm_ble_gatt_queuereq_queue' undeclared here (not in a function); did you mean 'm_ble_gatt_queuepurge_queue'?
conversion from 'unsigned int' to 'unsigned char' changes value from '4022250974' to '222' [-Woverflow]
Compiling ‘spi_flash.c’
Compiling ‘skycam_ota.c’
Compiling ‘con_controller.c’
Compiling ‘rtc_timer.c’
Build failed
 

Thanks,

Dave Patton

[davidpatton]

Hi,

  I forgot to mention that the file that gets the compile error contains these header includes>

#include "../../nRF_Includes/queue/nrf_queue.h"
#include "../../nRF_Includes/nrf_ble_gq/nrf_ble_gq.h"

I would have expected these headers to resolve the compile issues but they did not.