DFU with Android 7.0 fails on connection

David K. gravatar image

asked 2017-09-13 15:27:06 +0100

updated 2017-09-13 21:13:13 +0100

Dear Helpers,

We are facing an issue. It is all related to DFU (secure buttonless) and Android 7.0 (deployed on a Samsung A5).

We have a code that is running perfectly that allows advertising / scanning and connection with an nrf52832. I have a series of smartphone with NRF Connect and playing with : connecting to the module, starting DFU (using the service/characteristic command sent) and connecting on the newly "created" DFU target. It works on Android 6.0.1 (LG K8) / Android 5.0.1 (Samsung S4). But on Nougat....

So on Nougat, using NRFConnect (4.13.2), I can :

  • Connect to my module (s132 v3.1, SDK 12.3)

  • Discover services

  • Start the DFU and the module reboots correctly

  • try to connect to DFUTarget... but, the module reboots immediately without any "appearing" reasons. The I have shows the event BLE_GAP_EVT_CONNECTED and then nothing and reboots.

I tried to set (bootloader and DFU compiles and executes) :

ble_opt_t ble_opt;
memset(&ble_opt, 0, sizeof(ble_opt));

ble_opt.gap_opt.compat_mode_2.mode_2_enable = 1;

err_code = sd_ble_opt_set(BLE_GAP_OPT_COMPAT_MODE_2,&ble_opt);

and also :

void data_len_ext_set(void) {
ret_code_t err_code;
ble_opt_t  opt;

memset(&opt, 0x00, sizeof(opt));

opt.gap_opt.ext_len.rxtx_max_pdu_payload_size = 0;

err_code = sd_ble_opt_set(BLE_GAP_OPT_EXT_LEN, &opt);

without success.

The only relevent debug log comes from the phone and says :

BluetoothRemoteDevices: aclStateChangeCallback: State:DisConnected to Device:XX:XX:XX:XX:XX:XX

BluetoothGatt: onClientConnectionState() - status=8 clientIf=7 device=XX:XX:XX:XX:XX:XX

BluetoothEventManager: onReceive :: android.bluetooth.device.action.ACL_DISCONNECTED


BluetoothUtils: getBtEnabledContainers(): btContainers = []

PanService: onReceive : android.bluetooth.device.action.ACL_DISCONNECTED

bt_btif : btif_dm_upstreams_cback ev: BTA_DM_BUSY_LEVEL_EVT

bt_btif : BTA_DM_BUSY_LEVEL_EVT :: p_data->busy_level.level_flags : 0x0

EnhancedTetheringManager: isLastConnectedDevice : XX:XX:XX:XX:XX:XX

SapService: Unexpected error!

SamsungAlarmManager: setExact Intent (T:2/F:1/AC:false) 20170913T145244 - CU:10021/CP:4688

SamsungAlarmManager: setLocked to kernel - T:2 / 20170913T145244, SetElapsed=277088718, nowELAPSED=277087734

KnoxKeyguardUpdateMonitor: BroadcastReceiver onReceive

KnoxKeyguardUpdateMonitor: BroadcastReceiver onReceive action: android.bluetooth.device.action.ACL_DISCONNECTED

KnoxKeyguardUpdateMonitor: BroadcastReceiver ACTION_ACL_DISCONNECTED

DfuBaseService: Connection state change error: 8 newState: 0

DfuBaseService: Device got disconnected before service discovery finished

DfuBaseService: Action received: android.bluetooth.device.action.ACL_DISCONNECTED

BluetoothGatt: refresh() - device: XX:XX:XX:XX:XX:XX

BtGatt.GattService: refreshDevice() - address=XX:XX:XX:XX:XX:XX

DfuBaseService: Refreshing result: true

DfuBaseService: Cleaning up...

TrustAgent.Tracker: [BluetoothConnectionTracker] Bluetooth connect broadast for DfuTarg XX:XX:XX:XX:XX:XX

BluetoothGatt: close()

BluetoothGatt: unregisterApp() - mClientIf=7

BtGatt.GattService: unregisterClient() - clientIf=7

TrustAgent.Tracker: [BluetoothConnectionTracker] Bluetooth disconnect broadast for DfuTarg XX:XX:XX:XX:XX:XX

I am struggling on that with Nougat...

Any help would be appreciated.



Edit 1 : We have tested on a mobile device that is running Android 7.1.1... And it's working. The mobile is a Motorola.

edit retag flag offensive close delete report spam



Thanks a lot. I'll try before 5:00PM and let you know by then. Cheers,


David K. ( 2017-09-14 14:29:00 +0100 )editconvert to answer

Dear Sigurd,

We have moved one step forward...

Connection is now possible, but DFU fails after "first packet" is transfered.

Here is the log from NRF Connect :

E 15:53:14.936 [DFU] Remote DFU error: REMOTE DFU OPERATION FAILED V 15:53:14.936 [DFU] Disconnecting... D 15:53:14.987 [DFU] gatt.disconnect() I 15:53:14.987 [DFU] Disconnected

And here is the log on the ble module side :

BOOT:INFO:Received select object


BOOT:INFO:Sending Object Info: [0x60, 0x06, 0x01 max: 0:x00000100 0:x00000000, CRC:0x00000000]

BOOT:DEBUG:timer 1

BOOT:INFO:Set receipt notif

BOOT:INFO:Sending Response: [0x2, 0x1]

BOOT:INFO:Received create object

:INFO:Before OP create command

:INFO:Valid Command Create

BOOT:INFO:Sending Response: [0x1, 0x1]

BOOT:DEBUG:timer 1

:INFO:Before OP write command

:INFO:Before OP write command


BOOT:INFO:Received calculate CRC ...

David K. ( 2017-09-14 16:00:47 +0100 )editconvert to answer

1 answer

Sort by » oldest newest most voted
sigurdon gravatar image

answered 2017-09-14 14:02:28 +0100

David K. gravatar image

updated 2017-09-14 17:33:35 +0100


The Samsung A-series phone have several bugs with how they do LL control procedures as mentioned in this post.

But first, let's try to disable the DLE feature completely, and see if that makes any difference:


err_code = sd_ble_opt_set(BLE_GAP_OPT_DLE_DISABLE, &opt);

in the buttom of the data_len_ext_set() function. data_len_ext_set() should then look like this:

void data_len_ext_set(void)
    ret_code_t err_code;
    ble_opt_t  opt;

    memset(&opt, 0x00, sizeof(opt));

    opt.gap_opt.ext_len.rxtx_max_pdu_payload_size = 0;

    err_code = sd_ble_opt_set(BLE_GAP_OPT_EXT_LEN, &opt);

    err_code = sd_ble_opt_set(BLE_GAP_OPT_DLE_DISABLE, &opt);
edit flag offensive delete publish link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer. Do not ask a new question or reply to an answer here.

[hide preview]

Question Tools

1 follower


Asked: 2017-09-13 15:27:06 +0100

Seen: 249 times

Last updated: sep. 13 '17