NRF52840 DFU APP+BL+SD error,DFU request 4 failed with error: 0xB.

[shark]

hello

1.NRF52840 Upgrade APP+BL+SD  from SD15.3 to SD17.1.

2.BL use pca10056_s140_ble_debug,APP use ble_app_buttonless_dfu.

3.Program batch file.

nrfutil settings generate --application nRF5_SDK_15.3.0_59ac345/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --family NRF52840 --application-version 0 --bootloader-version 0 --bl-settings-version 2 settings.hex
nrfjprog --eraseall -f NRF52
nrfjprog --program settings.hex --chiperase
nrfjprog --program bootloader_hex/bootloader_w_softdevice_nrf52840.hex
nrfjprog --program nRF5_SDK_15.3.0_59ac345/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex -r

4.DFU packag batch file.

nrfutil pkg generate --hw-version 52 --sd-req 0xB6,0x0100 --application-version 1 --application nRF5_SDK_17.1.0_ddde560/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --softdevice nRF5_SDK_17.1.0_ddde560/components/softdevice/s140/hex/s140_nrf52_7.2.0_softdevice.hex --bootloader nRF5_SDK_17.1.0_ddde560/examples/dfu/secure_bootloader/pca10056_s140_ble_debug/arm5_no_packs/_build/nrf52840_xxaa_s140.hex --bootloader-version 1 --sd-id 0x0100 --key-file priv.pem dfu_15.3-17.1.zip.

5.Android APP nRD Connect DFU.

6.The RTT print error.

<debug> nrf_dfu_validation: 08 01 10 34 1A 02 80 02|...4....

<debug> nrf_dfu_validation: 20 00 28 00 30 00 38 84| .(.0.8.

<debug> nrf_dfu_validation: A4 03 42 24 08 03 12 20|..B$...

<debug> nrf_dfu_validation: 60 14 FA A9 4A D5 1E CE|`...J...

<debug> nrf_dfu_validation: E9 16 D8 8F A7 DE FC 41|.......A

<debug> nrf_dfu_validation: 12 32 92 3F CE 95 32 B8|.2.?..2.

<debug> nrf_dfu_validation: 08 25 48 60 4E 22 65 CA|.%H`N"e.

<debug> nrf_dfu_validation: 48 00 52 04 08 01 12 00|H.R.....

<debug> nrf_dfu_req_handler: Request handling complete. Result: 0xB

<warning> nrf_dfu_ble: DFU request 4 failed with error: 0xB.

[Einar Thorsrud]

Hi,

Can you share a bit more of the RTT log? It could be that a relevant error was printed before the part you see here (similar to in this thread).

[shark]

I`ve tried the suggestion in this ticket this thread,but it doesn`t work.

[Einar Thorsrud]

Hi,

The key information from the log are these lines:

<warning> nrf_dfu_ver_validation: Faulty HW version.
<warning> nrf_dfu_validation: Prevalidation failed.

So the HW version specified in the upgrade image (that was set with the --hw-version option for nrfutil) does not match the HW version specified in the bootloader's sdk_config.h with the NRF_DFU_HW_VERSION define. As this is not the same, the upgrade is aborted.

[shark]

1.The hardware version in SDK15.3 and SDK17.1 are as follow.

#ifndef NRF_DFU_HW_VERSION
#define NRF_DFU_HW_VERSION 52
#endif

2.How to solve this problem?

Thanks.

[shark]

This is the batch file that genrates the upgrade packege.

nrfutil pkg generate --hw-version 52 --sd-req 0xB6 --application-version 2 --application nRF5_SDK_17.1.0_ddde560/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --softdevice nRF5_SDK_17.1.0_ddde560/components/softdevice/s140/hex/s140_nrf52_7.2.0_softdevice.hex --bootloader nRF5_SDK_17.1.0_ddde560/examples/dfu/secure_bootloader/pca10056_s140_ble_debug/arm5_no_packs/_build/nrf52840_xxaa_s140.hex --bootloader-version 2 --sd-id 0x0100 --key-file priv.pem dfu_15.3-17.1.zip

[Einar Thorsrud]

Can you tripple check? Looking at the code, I am not able to see any other explanation for this. The error is printed from this snippet in the bootloader:

        else if (p_init->hw_version != NRF_DFU_HW_VERSION)
        {
            NRF_LOG_WARNING("Faulty HW version.");
            ret_val = EXT_ERR( NRF_DFU_EXT_ERROR_HW_VERSION_FAILURE);
        }

Are you sure the bootloader that is running was built with NRF_DFU_HW_VERSION set to 52? Did you program it now, or could it be that it does not run the bootloader you think it does?

And regarding the DFU image, could it have been a mixup? Can you check the zip file using "nrfutil pkg display <file>"?

[shark]

1.NRF_DFU_HW_VERSION default value is 52,unchanged.

2.nrfutil pkg display as follows.

PS F:\DFU\DFU_BLE-17.1> nrfutil pkg display dfu_15.3-17.1.zip

DFU Package: <dfu_15.3-17.1.zip>:
|
|- Image count: 2
|
|- Image #0:
   |- Type: sd_bl
   |- Image file: sd_bl.bin
   |- Init packet file: sd_bl.dat
      |
      |- op_code: INIT
      |- signature_type: ECDSA_P256_SHA256
      |- signature (little-endian): b'd9a8e3299fa1635bae74cc8433f06876c3f51a8d495ae60aec834620120ef8f1d6974ff5a11ab3b8e24ef2ddefa6298b32986319ab3cc194fa46b6b9e5cb8d28'
      |
      |- fw_version: 0x00000002 (2)
      |- hw_version 0x00000034 (52)
      |- sd_req: 0x100, 0xB6
      |- type: SOFTDEVICE_BOOTLOADER
      |- sd_size: 153140
      |- bl_size: 54452
      |- app_size: 0
      |
      |- hash_type: SHA256
      |- hash (little-endian): b'0a7f3e043cddef1e568a9eb01a623a24191306ce61a53e1606330e2205a39985'
      |
      |- boot_validation_type: ['VALIDATE_GENERATED_CRC', 'VALIDATE_GENERATED_CRC']
      |- boot_validation_signature (little-endian): [b'', b'']
      |
      |- is_debug: False

|
|- Image #1:
   |- Type: application
   |- Image file: nrf52840_xxaa.bin
   |- Init packet file: nrf52840_xxaa.dat
      |
      |- op_code: INIT
      |- signature_type: ECDSA_P256_SHA256
      |- signature (little-endian): b'870749823a8acbea22de7aaf6f7f5d03f41ab8d3e5a97d3b5279bbc65fa682796c4443b1821ad0f7f87f9d5b626a6a093983cf2e09dc979acf8e653ca51a57b7'
      |
      |- fw_version: 0x00000002 (2)
      |- hw_version 0x00000034 (52)
      |- sd_req: 0x100
      |- type: APPLICATION
      |- sd_size: 0
      |- bl_size: 0
      |- app_size: 53764
      |
      |- hash_type: SHA256
      |- hash (little-endian): b'd96f871639b078031f3b65ba7dd65667c9027e48a1c14fe383c7418665a228eb'
      |
      |- boot_validation_type: ['VALIDATE_GENERATED_CRC']
      |- boot_validation_signature (little-endian): [b'']
      |
      |- is_debug: False

[Einar Thorsrud]

Hm, that is most peculiar. Perhaps you can modify the bootloader and log a bit more. First of all, start with components/libraries/bootloader/dfu/nrf_dfu_ver_validation.c and the section I posted in my previous reply. Then print both p_init->hw_version and NRF_DFU_HW_VERSION separately to see which value they have there. Clearly they are not the same in this check, so it would be good to know which of them have a different value, and what that is. Then we can continue from there.

[shark]

1.Now there are other errors,as follows.

<debug> app: Shutting down transports (found: 1)

<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (command)

<debug> app: timer_stop (0x200057D4)

<debug> app: timer_activate (0x200057D4)

<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1

<debug> nrf_dfu_ble: Buffer 0x20006D5C acquired, len 141 (244)

<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (command)

<debug> nrf_dfu_ble: Freeing buffer 0x20006D5C

<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1

<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_CRC_GET (command)

<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1

<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_EXECUTE (command)

<debug> nrf_dfu_validation: PB: Init packet data len: 64

<info> nrf_dfu_validation: Signature required. Checking signature.

<info> nrf_dfu_validation: Calculating hash (len: 64)

<info> nrf_dfu_validation: Verify signature

<info> nrf_dfu_validation: Image verified

<warning> nrf_dfu_ver_validation: SD req not met.

<warning> nrf_dfu_validation: Prevalidation failed.

<debug> nrf_dfu_validation: Init command:

<debug> nrf_dfu_validation:  08 04 10 34 1A 02 80 02|...4....

<debug> nrf_dfu_validation:  20 00 28 00 30 00 38 84| .(.0.8.

<debug> nrf_dfu_validation:  A4 03 42 24 08 03 12 20|..B$... 

<debug> nrf_dfu_validation:  D9 6F 87 16 39 B0 78 03|.o..9.x.

<debug> nrf_dfu_validation:  1F 3B 65 BA 7D D6 56 67|.;e.}.Vg

<debug> nrf_dfu_validation:  C9 02 7E 48 A1 C1 4F E3|..~H..O.

<debug> nrf_dfu_validation:  83 C7 41 86 65 A2 28 EB|..A.e.(.

<debug> nrf_dfu_validation:  48 00 52 04 08 01 12 00|H.R.....

<debug> nrf_dfu_req_handler: Request handling complete. Result: 0xB

<warning> nrf_dfu_ble: DFU request 4 failed with error: 0xB

<debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE

<debug> nrf_dfu_ble: max_conn_interval: 6

<debug> nrf_dfu_ble: min_conn_interval: 6

<debug> nrf_dfu_ble: slave_latency: 0

<debug> nrf_dfu_ble: conn_sup_timeout: 500

<debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE

<debug> nrf_dfu_ble: max_conn_interval: 12

<debug> nrf_dfu_ble: min_conn_interval: 12

<debug> nrf_dfu_ble: slave_latency: 0

<debug> nrf_dfu_ble: conn_sup_timeout: 600

<debug> app: timer_stop (0x200057D4)

<debug> app: timer_fire (0x200057D4)

<info> app: Inactivity timeout.

<debug> app: Resetting bootloader.

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<info> app: Inside main15.12

<debug> app: In nrf_bootloader_init

<debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...

<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.

<debug> nrf_dfu_settings: Using settings page.

<debug> nrf_dfu_settings: Copying forbidden parts from backup page.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<debug> app: Enter nrf_bootloader_fw_activate

<info> app: No firmware to activate.

<debug> app: App is valid

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<debug> app: Running nrf_bootloader_app_start with address: 0x00001000

<debug> app: Disabling interrupts. NVIC->ICER[0]: 0x0

2.Test program code and generate upprade package batch file ,what do you think is the problem?

mergehex-bl_sd:

mergehex --merge nRF5_SDK_15.3.0_59ac345/examples/dfu/secure_bootloader/pca10056_ble_debug/arm5_no_packs/_build/nrf52840_xxaa_s140.hex nRF5_SDK_15.3.0_59ac345/components/softdevice/s140/hex/s140_nrf52_6.1.1_softdevice.hex --output bootloader_hex/bootloader_w_softdevice_nrf52840.hex

program_bl_sd15.3_app_settings:

nrfutil settings generate --application nRF5_SDK_15.3.0_59ac345/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --family NRF52840 --application-version 0 --bootloader-version 0 --bl-settings-version 2 settings.hex
nrfjprog --eraseall -f NRF52
nrfjprog --program settings.hex --chiperase
nrfjprog --program bootloader_hex/bootloader_w_softdevice_nrf52840.hex 
nrfjprog --program nRF5_SDK_15.3.0_59ac345/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex -r

generate_bl_sd15.3-17.1_app-pkg:

nrfutil pkg generate --hw-version 52 --sd-req 0xB6,0x0100 --application-version 4 --application nRF5_SDK_17.1.0_ddde560/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --softdevice nRF5_SDK_17.1.0_ddde560/components/softdevice/s140/hex/s140_nrf52_7.2.0_softdevice.hex --bootloader nRF5_SDK_17.1.0_ddde560/examples/dfu/secure_bootloader/pca10056_s140_ble_debug/arm5_no_packs/_build/nrf52840_xxaa_s140.hex --bootloader-version 3 --sd-id 0x0100 --key-file priv.pem dfu_15.3-17.1.zip

3.Now there are no print  "Faulty HW version." error.

[shark]

1.After changing the file, I finally saw that nrf Connect started to perform the upgrade, but only performed the upgrade once and then stopped. The upgrade should be performed twice, once for BL+SD and once for APP. The APP is not executed.

nrfutil pkg generate --hw-version 52 --sd-req 0xB6 --application-version 2 --application nRF5_SDK_17.1.0_ddde560/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --softdevice nRF5_SDK_17.1.0_ddde560/components/softdevice/s140/hex/s140_nrf52_7.2.0_softdevice.hex --bootloader nRF5_SDK_17.1.0_ddde560/examples/dfu/secure_bootloader/pca10056_s140_ble_debug/arm5_no_packs/_build/nrf52840_xxaa_s140.hex --bootloader-version 2 --sd-id 0xB6,0x0100 --key-file priv.pem dfu_15.3-17.1.zip

I changed from --sd-id 0x0100 to --sd-id 0xB6,0x0100.

2.Do not perform APP upgrade now，RTT print content。

<debug> app: Shutting down transports (found: 1)

<debug> nrf_dfu_ble: Shutting down BLE transport.

<debug> nrf_dfu_ble: Disconnecting.

<debug> nrf_dfu_ble: BLE transport shut down.

<debug> app: Resetting bootloader.

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<info> app: Inside main15.1

<debug> app: In nrf_bootloader_init

<debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...

<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.

<debug> nrf_dfu_settings: Using settings page.

<debug> nrf_dfu_settings: Copying forbidden parts from backup page.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<debug> app: Enter nrf_bootloader_fw_activate

<debug> app: Valid App

<debug> app: Enter nrf_dfu_app_continue

<info> nrf_bootloader_wdt: WDT is not enabled

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x00026000, len=8 pages), queue usage: 0

<debug> nrf_dfu_flash: Flash erase success: addr=0x00026000, pending 0

<debug> app: Copying 0x33000 to 0x26000, size: 0x8000

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x00026000, src=0x00033000, len=32768 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x00026000, pending 0

<debug> nrf_dfu_settings: Writing settings...

<debug> nrf_dfu_settings: Erasing old settings at: 0x000FF000

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FF000, len=1 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x000FF000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FF000, src=0x20007D90, len=896 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x000FF000, pending 0

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Writing settings...

<debug> nrf_dfu_settings: Erasing old settings at: 0x000FE000

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FE000, len=1 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x000FE000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FE000, src=0x20008110, len=896 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x000FE000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0002E000, len=6 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x0002E000, pending 0

<debug> app: Copying 0x3B000 to 0x2E000, size: 0x5204

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0002E000, src=0x0003B000, len=20996 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x0002E000, pending 0

<debug> nrf_dfu_settings: Writing settings...

<debug> nrf_dfu_settings: Erasing old settings at: 0x000FF000

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FF000, len=1 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x000FF000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FF000, src=0x20007D90, len=896 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x000FF000, pending 0

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Writing settings...

<debug> nrf_dfu_settings: Erasing old settings at: 0x000FE000

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FE000, len=1 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x000FE000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FE000, src=0x20008110, len=896 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x000FE000, pending 0

<debug> app: Setting app as valid

<debug> nrf_dfu_settings: Writing settings...

<debug> nrf_dfu_settings: Erasing old settings at: 0x000FF000

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FF000, len=1 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x000FF000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FF000, src=0x20007D90, len=896 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x000FF000, pending 0

E000.

<debug> nrf_dfu_settings: Writing settings...

<info> app: Inside main15.1

<debug> app: In nrf_bootloader_init

<debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...

<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.

<debug> nrf_dfu_settings: Using settings page.

<debug> nrf_dfu_settings: Copying forbidden parts from backup page.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<debug> app: Enter nrf_bootloader_fw_activate

<info> app: No firmware to activate.

<debug> app: App is valid

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<debug> app: Running nrf_bootloader_app_start with address: 0x00001000

<debug> app: Disabling interrupts. NVIC->ICER[0]: 0x0

[shark]

Is there a problem with packaging batch files? I refer to the batch file written by this ticket. DFU package