NRF52840 DFU APP+BL+SD error,DFU request 4 failed with error: 0xB.

[shark]

hello

1.NRF52840 Upgrade APP+BL+SD  from SD15.3 to SD17.1.

2.BL use pca10056_s140_ble_debug,APP use ble_app_buttonless_dfu.

3.Program batch file.

nrfutil settings generate --application nRF5_SDK_15.3.0_59ac345/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --family NRF52840 --application-version 0 --bootloader-version 0 --bl-settings-version 2 settings.hex
nrfjprog --eraseall -f NRF52
nrfjprog --program settings.hex --chiperase
nrfjprog --program bootloader_hex/bootloader_w_softdevice_nrf52840.hex
nrfjprog --program nRF5_SDK_15.3.0_59ac345/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex -r

4.DFU packag batch file.

nrfutil pkg generate --hw-version 52 --sd-req 0xB6,0x0100 --application-version 1 --application nRF5_SDK_17.1.0_ddde560/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --softdevice nRF5_SDK_17.1.0_ddde560/components/softdevice/s140/hex/s140_nrf52_7.2.0_softdevice.hex --bootloader nRF5_SDK_17.1.0_ddde560/examples/dfu/secure_bootloader/pca10056_s140_ble_debug/arm5_no_packs/_build/nrf52840_xxaa_s140.hex --bootloader-version 1 --sd-id 0x0100 --key-file priv.pem dfu_15.3-17.1.zip.

5.Android APP nRD Connect DFU.

6.The RTT print error.

<debug> nrf_dfu_validation: 08 01 10 34 1A 02 80 02|...4....

<debug> nrf_dfu_validation: 20 00 28 00 30 00 38 84| .(.0.8.

<debug> nrf_dfu_validation: A4 03 42 24 08 03 12 20|..B$...

<debug> nrf_dfu_validation: 60 14 FA A9 4A D5 1E CE|`...J...

<debug> nrf_dfu_validation: E9 16 D8 8F A7 DE FC 41|.......A

<debug> nrf_dfu_validation: 12 32 92 3F CE 95 32 B8|.2.?..2.

<debug> nrf_dfu_validation: 08 25 48 60 4E 22 65 CA|.%H`N"e.

<debug> nrf_dfu_validation: 48 00 52 04 08 01 12 00|H.R.....

<debug> nrf_dfu_req_handler: Request handling complete. Result: 0xB

<warning> nrf_dfu_ble: DFU request 4 failed with error: 0xB.

[Einar Thorsrud]

Hi,

Can you share a bit more of the RTT log? It could be that a relevant error was printed before the part you see here (similar to in this thread).

[shark]

I`ve tried the suggestion in this ticket this thread,but it doesn`t work.

[shark]

1.NRF_DFU_HW_VERSION default value is 52,unchanged.

2.nrfutil pkg display as follows.

PS F:\DFU\DFU_BLE-17.1> nrfutil pkg display dfu_15.3-17.1.zip

DFU Package: <dfu_15.3-17.1.zip>:
|
|- Image count: 2
|
|- Image #0:
   |- Type: sd_bl
   |- Image file: sd_bl.bin
   |- Init packet file: sd_bl.dat
      |
      |- op_code: INIT
      |- signature_type: ECDSA_P256_SHA256
      |- signature (little-endian): b'd9a8e3299fa1635bae74cc8433f06876c3f51a8d495ae60aec834620120ef8f1d6974ff5a11ab3b8e24ef2ddefa6298b32986319ab3cc194fa46b6b9e5cb8d28'
      |
      |- fw_version: 0x00000002 (2)
      |- hw_version 0x00000034 (52)
      |- sd_req: 0x100, 0xB6
      |- type: SOFTDEVICE_BOOTLOADER
      |- sd_size: 153140
      |- bl_size: 54452
      |- app_size: 0
      |
      |- hash_type: SHA256
      |- hash (little-endian): b'0a7f3e043cddef1e568a9eb01a623a24191306ce61a53e1606330e2205a39985'
      |
      |- boot_validation_type: ['VALIDATE_GENERATED_CRC', 'VALIDATE_GENERATED_CRC']
      |- boot_validation_signature (little-endian): [b'', b'']
      |
      |- is_debug: False

|
|- Image #1:
   |- Type: application
   |- Image file: nrf52840_xxaa.bin
   |- Init packet file: nrf52840_xxaa.dat
      |
      |- op_code: INIT
      |- signature_type: ECDSA_P256_SHA256
      |- signature (little-endian): b'870749823a8acbea22de7aaf6f7f5d03f41ab8d3e5a97d3b5279bbc65fa682796c4443b1821ad0f7f87f9d5b626a6a093983cf2e09dc979acf8e653ca51a57b7'
      |
      |- fw_version: 0x00000002 (2)
      |- hw_version 0x00000034 (52)
      |- sd_req: 0x100
      |- type: APPLICATION
      |- sd_size: 0
      |- bl_size: 0
      |- app_size: 53764
      |
      |- hash_type: SHA256
      |- hash (little-endian): b'd96f871639b078031f3b65ba7dd65667c9027e48a1c14fe383c7418665a228eb'
      |
      |- boot_validation_type: ['VALIDATE_GENERATED_CRC']
      |- boot_validation_signature (little-endian): [b'']
      |
      |- is_debug: False

[Einar Thorsrud]

Hm, that is most peculiar. Perhaps you can modify the bootloader and log a bit more. First of all, start with components/libraries/bootloader/dfu/nrf_dfu_ver_validation.c and the section I posted in my previous reply. Then print both p_init->hw_version and NRF_DFU_HW_VERSION separately to see which value they have there. Clearly they are not the same in this check, so it would be good to know which of them have a different value, and what that is. Then we can continue from there.

[shark]

1.Now there are other errors,as follows.

<debug> app: Shutting down transports (found: 1)

<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_CREATE (command)

<debug> app: timer_stop (0x200057D4)

<debug> app: timer_activate (0x200057D4)

<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1

<debug> nrf_dfu_ble: Buffer 0x20006D5C acquired, len 141 (244)

<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_WRITE (command)

<debug> nrf_dfu_ble: Freeing buffer 0x20006D5C

<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1

<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_CRC_GET (command)

<debug> nrf_dfu_req_handler: Request handling complete. Result: 0x1

<debug> nrf_dfu_req_handler: Handle NRF_DFU_OP_OBJECT_EXECUTE (command)

<debug> nrf_dfu_validation: PB: Init packet data len: 64

<info> nrf_dfu_validation: Signature required. Checking signature.

<info> nrf_dfu_validation: Calculating hash (len: 64)

<info> nrf_dfu_validation: Verify signature

<info> nrf_dfu_validation: Image verified

<warning> nrf_dfu_ver_validation: SD req not met.

<warning> nrf_dfu_validation: Prevalidation failed.

<debug> nrf_dfu_validation: Init command:

<debug> nrf_dfu_validation:  08 04 10 34 1A 02 80 02|...4....

<debug> nrf_dfu_validation:  20 00 28 00 30 00 38 84| .(.0.8.

<debug> nrf_dfu_validation:  A4 03 42 24 08 03 12 20|..B$... 

<debug> nrf_dfu_validation:  D9 6F 87 16 39 B0 78 03|.o..9.x.

<debug> nrf_dfu_validation:  1F 3B 65 BA 7D D6 56 67|.;e.}.Vg

<debug> nrf_dfu_validation:  C9 02 7E 48 A1 C1 4F E3|..~H..O.

<debug> nrf_dfu_validation:  83 C7 41 86 65 A2 28 EB|..A.e.(.

<debug> nrf_dfu_validation:  48 00 52 04 08 01 12 00|H.R.....

<debug> nrf_dfu_req_handler: Request handling complete. Result: 0xB

<warning> nrf_dfu_ble: DFU request 4 failed with error: 0xB

<debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE

<debug> nrf_dfu_ble: max_conn_interval: 6

<debug> nrf_dfu_ble: min_conn_interval: 6

<debug> nrf_dfu_ble: slave_latency: 0

<debug> nrf_dfu_ble: conn_sup_timeout: 500

<debug> nrf_dfu_ble: Received BLE_GAP_EVT_CONN_PARAM_UPDATE

<debug> nrf_dfu_ble: max_conn_interval: 12

<debug> nrf_dfu_ble: min_conn_interval: 12

<debug> nrf_dfu_ble: slave_latency: 0

<debug> nrf_dfu_ble: conn_sup_timeout: 600

<debug> app: timer_stop (0x200057D4)

<debug> app: timer_fire (0x200057D4)

<info> app: Inactivity timeout.

<debug> app: Resetting bootloader.

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<info> app: Inside main15.12

<debug> app: In nrf_bootloader_init

<debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...

<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.

<debug> nrf_dfu_settings: Using settings page.

<debug> nrf_dfu_settings: Copying forbidden parts from backup page.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<debug> app: Enter nrf_bootloader_fw_activate

<info> app: No firmware to activate.

<debug> app: App is valid

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<debug> app: Running nrf_bootloader_app_start with address: 0x00001000

<debug> app: Disabling interrupts. NVIC->ICER[0]: 0x0

2.Test program code and generate upprade package batch file ,what do you think is the problem?

mergehex-bl_sd:

mergehex --merge nRF5_SDK_15.3.0_59ac345/examples/dfu/secure_bootloader/pca10056_ble_debug/arm5_no_packs/_build/nrf52840_xxaa_s140.hex nRF5_SDK_15.3.0_59ac345/components/softdevice/s140/hex/s140_nrf52_6.1.1_softdevice.hex --output bootloader_hex/bootloader_w_softdevice_nrf52840.hex

program_bl_sd15.3_app_settings:

nrfutil settings generate --application nRF5_SDK_15.3.0_59ac345/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --family NRF52840 --application-version 0 --bootloader-version 0 --bl-settings-version 2 settings.hex
nrfjprog --eraseall -f NRF52
nrfjprog --program settings.hex --chiperase
nrfjprog --program bootloader_hex/bootloader_w_softdevice_nrf52840.hex 
nrfjprog --program nRF5_SDK_15.3.0_59ac345/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex -r

generate_bl_sd15.3-17.1_app-pkg:

nrfutil pkg generate --hw-version 52 --sd-req 0xB6,0x0100 --application-version 4 --application nRF5_SDK_17.1.0_ddde560/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --softdevice nRF5_SDK_17.1.0_ddde560/components/softdevice/s140/hex/s140_nrf52_7.2.0_softdevice.hex --bootloader nRF5_SDK_17.1.0_ddde560/examples/dfu/secure_bootloader/pca10056_s140_ble_debug/arm5_no_packs/_build/nrf52840_xxaa_s140.hex --bootloader-version 3 --sd-id 0x0100 --key-file priv.pem dfu_15.3-17.1.zip

3.Now there are no print  "Faulty HW version." error.

[shark]

1.After changing the file, I finally saw that nrf Connect started to perform the upgrade, but only performed the upgrade once and then stopped. The upgrade should be performed twice, once for BL+SD and once for APP. The APP is not executed.

nrfutil pkg generate --hw-version 52 --sd-req 0xB6 --application-version 2 --application nRF5_SDK_17.1.0_ddde560/examples/ble_peripheral/ble_app_buttonless_dfu/pca10056/s140/arm5_no_packs/_build/nrf52840_xxaa.hex --softdevice nRF5_SDK_17.1.0_ddde560/components/softdevice/s140/hex/s140_nrf52_7.2.0_softdevice.hex --bootloader nRF5_SDK_17.1.0_ddde560/examples/dfu/secure_bootloader/pca10056_s140_ble_debug/arm5_no_packs/_build/nrf52840_xxaa_s140.hex --bootloader-version 2 --sd-id 0xB6,0x0100 --key-file priv.pem dfu_15.3-17.1.zip

I changed from --sd-id 0x0100 to --sd-id 0xB6,0x0100.

2.Do not perform APP upgrade now，RTT print content。

<debug> app: Shutting down transports (found: 1)

<debug> nrf_dfu_ble: Shutting down BLE transport.

<debug> nrf_dfu_ble: Disconnecting.

<debug> nrf_dfu_ble: BLE transport shut down.

<debug> app: Resetting bootloader.

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<info> app: Inside main15.1

<debug> app: In nrf_bootloader_init

<debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...

<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.

<debug> nrf_dfu_settings: Using settings page.

<debug> nrf_dfu_settings: Copying forbidden parts from backup page.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<debug> app: Enter nrf_bootloader_fw_activate

<debug> app: Valid App

<debug> app: Enter nrf_dfu_app_continue

<info> nrf_bootloader_wdt: WDT is not enabled

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x00026000, len=8 pages), queue usage: 0

<debug> nrf_dfu_flash: Flash erase success: addr=0x00026000, pending 0

<debug> app: Copying 0x33000 to 0x26000, size: 0x8000

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x00026000, src=0x00033000, len=32768 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x00026000, pending 0

<debug> nrf_dfu_settings: Writing settings...

<debug> nrf_dfu_settings: Erasing old settings at: 0x000FF000

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FF000, len=1 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x000FF000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FF000, src=0x20007D90, len=896 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x000FF000, pending 0

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Writing settings...

<debug> nrf_dfu_settings: Erasing old settings at: 0x000FE000

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FE000, len=1 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x000FE000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FE000, src=0x20008110, len=896 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x000FE000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x0002E000, len=6 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x0002E000, pending 0

<debug> app: Copying 0x3B000 to 0x2E000, size: 0x5204

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x0002E000, src=0x0003B000, len=20996 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x0002E000, pending 0

<debug> nrf_dfu_settings: Writing settings...

<debug> nrf_dfu_settings: Erasing old settings at: 0x000FF000

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FF000, len=1 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x000FF000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FF000, src=0x20007D90, len=896 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x000FF000, pending 0

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Writing settings...

<debug> nrf_dfu_settings: Erasing old settings at: 0x000FE000

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FE000, len=1 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x000FE000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FE000, src=0x20008110, len=896 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x000FE000, pending 0

<debug> app: Setting app as valid

<debug> nrf_dfu_settings: Writing settings...

<debug> nrf_dfu_settings: Erasing old settings at: 0x000FF000

<debug> nrf_dfu_flash: nrf_fstorage_erase(addr=0x0x000FF000, len=1 pages), queue usage: 1

<debug> nrf_dfu_flash: Flash erase success: addr=0x000FF000, pending 0

<debug> nrf_dfu_flash: nrf_fstorage_write(addr=0x000FF000, src=0x20007D90, len=896 bytes), queue usage: 1

<debug> nrf_dfu_flash: Flash write success: addr=0x000FF000, pending 0

E000.

<debug> nrf_dfu_settings: Writing settings...

<info> app: Inside main15.1

<debug> app: In nrf_bootloader_init

<debug> nrf_dfu_settings: Calling nrf_dfu_settings_init()...

<debug> nrf_dfu_flash: Initializing nrf_fstorage_nvmc backend.

<debug> nrf_dfu_settings: Using settings page.

<debug> nrf_dfu_settings: Copying forbidden parts from backup page.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<debug> app: Enter nrf_bootloader_fw_activate

<info> app: No firmware to activate.

<debug> app: App is valid

<info> nrf_dfu_settings: Backing up settings page to address 0xFE000.

<debug> nrf_dfu_settings: Destination settings are identical to source, write not needed. Skipping.

<debug> app: Running nrf_bootloader_app_start with address: 0x00001000

<debug> app: Disabling interrupts. NVIC->ICER[0]: 0x0

[shark]

Is there a problem with packaging batch files? I refer to the batch file written by this ticket. DFU package