Android-DFU-Library
Android-DFU-Library copied to clipboard
NordicSemiconductor
DFU fails with "Characteristic write error: 133" on Galaxy Tab A8
DFU Bootloader version (please complete the following information):
- SDK version: nRF5 SDK 17.0.2 with nrf5 SDK for Mesh 5.0.0
- Bonding used: no
- Library version: 2.0.3 (through noridc_dfu plugin for Flutter: https://pub.dev/packages/nordic_dfu)
Device information (please complete the following information):
- Device: Samsung Galaxy Tab A8, SM-X200
- OS: Android 11 (SDK 30), Patch 2022-02-01
Describe the bug DFU reliably fails on Samsung Galaxy Tab A8 with Characteristic write error: 133. It (DFU) is, however, reliably working on dozens of other devices from Samsung, Lenovo, Google, Huawai, Vollaphone...
Logs Interesting part starts quite far down after: Sending Calculate Checksum command (Op Code = 3):
2022-06-22 22:06:07.561 I/DfuBaseService: DFU service created. Version: 2.0.3
2022-06-22 22:06:07.578 I/DfuBaseService: Starting DFU service in foreground
2022-06-22 22:06:07.595 I/DfuBaseService: Connecting to the device...
2022-06-22 22:06:07.597 D/BluetoothGatt: connect() - device: C6:8E:F1:CB:2C:B2, auto: false
2022-06-22 22:06:07.946 I/DfuBaseService: Connected to GATT server
2022-06-22 22:06:07.948 D/BluetoothGatt: discoverServices() - device: C6:8E:F1:CB:2C:B2
2022-06-22 22:06:07.949 I/DfuBaseService: Attempting to start service discovery... succeed
2022-06-22 22:06:10.682 I/DfuBaseService: Services discovered
2022-06-22 22:06:10.683 I/DfuImpl: Buttonless service without bond sharing found -> SDK 13 or newer
2022-06-22 22:06:11.692 I/DfuImpl: Enabling indications...
2022-06-22 22:06:12.935 I/DfuImpl: Sending Enter Bootloader (Op Code = 1)
2022-06-22 22:06:13.291 I/DfuImpl: Response received (Op Code = 1, Status = 1)
2022-06-22 22:06:13.293 I/DfuBaseService: Refreshing result: true
2022-06-22 22:06:13.294 I/DfuBaseService: Cleaning up...
2022-06-22 22:06:13.310 I/DfuImpl: Restarting to bootloader mode
2022-06-22 22:06:13.957 I/DfuImpl: Scanning for new address finished with: C6:8E:F1:CB:2C:B3
2022-06-22 22:06:13.963 I/DfuBaseService: Starting DFU service in foreground
2022-06-22 22:06:15.979 I/DfuBaseService: Connecting to the device...
2022-06-22 22:06:16.144 I/DfuBaseService: Connected to GATT server
2022-06-22 22:06:16.146 I/DfuBaseService: Attempting to start service discovery... succeed
2022-06-22 22:06:18.662 I/DfuBaseService: Services discovered
2022-06-22 22:06:18.664 W/DfuImpl: Secure DFU bootloader found
2022-06-22 22:06:19.673 I/DfuImpl: Requesting MTU = 517
2022-06-22 22:06:19.694 I/DfuImpl: MTU changed to: 247
2022-06-22 22:06:19.695 I/DfuImpl: Enabling notifications...
2022-06-22 22:06:20.726 I/DfuImpl: Setting object to Command (Op Code = 6, Type = 1)
2022-06-22 22:06:20.761 I/DfuImpl: Command object info received (Max size = 512, Offset = 0, CRC = 00000000)
2022-06-22 22:06:20.762 I/DfuImpl: Sending the number of packets before notifications (Op Code = 2, Value = 0)
2022-06-22 22:06:20.791 I/DfuImpl: Creating Init packet object (Op Code = 1, Type = 1, Size = 141)
2022-06-22 22:06:20.822 I/DfuImpl: Sending 141 bytes of init packet...
2022-06-22 22:06:20.822 I/DfuImpl: Sending init packet (Value = 12-8A-01-0A-44-08-01-12-40-08-03-10-03-1A-02-A4-02-20-00-28-00-30-00-38-90-D4-07-42-24-08-03-12-20-AA-86-6E-38-3F-ED-1A-FE-14-FD-82-3A-A3-AB-89-55-16-AC-27-A9-C8-8C-4F-8E-39-16-EB-52-72-B8-F7-1E-48-00-52-04-08-01-12-00-10-00-1A-40-0A-12-82-72-70-2D-00-DC-43-56-74-91-15-2F-73-3C-32-56-F5-C4-3B-D2-A8-00-DD-FA-3A-24-57-E2-52-07-6D-7A-8D-4A-37-08-A5-E1-31-62-CE-F9-8E-3A-3F-25-6E-34-E4-92-55-94-1E-D0-9A-98-DE-4A-FE-1A-AE-41)
2022-06-22 22:06:20.827 I/DfuImpl: Sending Calculate Checksum command (Op Code = 3)
2022-06-22 22:06:26.824 E/DfuImpl: Characteristic write error: 133
2022-06-22 22:06:26.825 D/BluetoothGatt: onClientConnectionState() - status=8 clientIf=9 device=C6:8E:F1:CB:2C:B3
2022-06-22 22:06:26.826 E/DfuBaseService: Unable to write Op Code 3 (error 133)
2022-06-22 22:06:26.828 W/DfuBaseService: Target device disconnected with status: 8
2022-06-22 22:06:26.834 I/DfuBaseService: Action received: android.bluetooth.device.action.ACL_DISCONNECTED
2022-06-22 22:06:26.836 I/DfuBaseService: Disconnecting from the device...
2022-06-22 22:06:26.848 I/DfuBaseService: Refreshing result: true
2022-06-22 22:06:26.848 I/DfuBaseService: Cleaning up...
2022-06-22 22:06:27.479 I/DfuBaseService: DFU service destroyed
Have you ever seen something similar?
Any ideas how to workaround or fix this issue are welcome.
I also noticed some weird behaviour regarding bluetooth and connectivity in general on our Tab A8.
This issue might be related to this: https://devzone.nordicsemi.com/f/nordic-q-a/88557/samsung-galaxy-tab-a8-does-not-work-with-nrf-mesh-android-app/371422 Here is the issue that is mentioned in the post: https://github.com/NordicSemiconductor/Android-nRF-Mesh-Library/issues/520
@wodyy666 Thanks for sharing these links!
There are all kind of issues on the Galaxy Tab A8, and the way it looks they won't be fixed for Android 11, however, the upgrade to Android 12 is scheduled for August, so hopefully the problems disappear with it...
How are you doing with your tests? Did you manage to reproduce this issue?
I'm in a process of fixing issues we found in version 2.2.0. I'll run some tests on Tab A8 this week.
@philips77 I am facing the same issue with the Motorola moto e20. I have tried all fixes from various GitHub issues and StackOverflow, but no luck ☹️ Even it fails on Nordic's DFU app (downloaded from the play store).
@RaviKoradiya For now, we've decided to just label the Galaxy Tab A8 as unsupported - well, and in that case the Moto e20 as well. Thank you for joining in and sharing the device details!
@philips77 Hi! We are facing also the same issue with Galaxy Tab A8. We can reproduce it with following setup:
- Android-DFU-Library, Git commit: 39cd896g (latest)
- Firmware: examples/dfu/secure_bootloader/pca10040_s132_ble_debug + examples/dfu/secure_dfu_test_images/hrs_application_s132.hex
- Hardware: Samsung S7+ Tablet, Samsung A8 Tablet, pca10040 dev board
Steps to reproduce:
- Flash pca10040 with secure DFU bootloader and softdevice
- Start Android-DFU-Library App
- Select hrs_application_s132.hex DFU image
- Select DfuTarg device
- Start firmware update
Expected behaviour:
- Init package after OP_CODE 0x01 is written:
- Bootloader logs "nrf_dfu_ble: Buffer 0x20008298 acquired, len 144 (244)"
- Tablet logs "I/DfuImpl: Checksum received (Offset = 144, CRC = 592A3B8C)"
Actual behaviour
- Init package is not written:
- Bootloader logs nothing after OP_CODE 0x01 confirmation
- Tablet logs
- "I/DfuImpl: Sending Calculate Checksum command (Op Code = 3)"
- "E/DfuImpl: Characteristic write error: 133"
We have also attached the collected logs from tablets and from bootloader for these scenarios. DFU Samsung A8 bug.zip
Some observations:
Comparing logs from bootloader connected to A8 and to S7+ we have noticed, that after MTU exchange there is slightly different behaviour. In S7+ case bootloader receives BLE_GAP_EVT_DATA_LENGTH_UPDATE (251, max_rx_time 2120) and in A8 case it receives BLE_GAP_EVT_DATA_LENGTH_UPDATE (27, max_rx_time 328).
Thank you for the analysis and steps to reproduce! This indeed seems to be an issue with that tablet. I'll try to find a workaround, if possible.
I didn't find time to test it on A8 this year, sorry for that. It will have to wait until 2023 😞
We had a similar report on a Galaxy S8 which refused to communicate with the mesh after it was upgraded to Android 13. Our customer fixed the issue by downgrading back to Android 12.1. Unfortunately the device logs went lost during the downgrade, leaving me clueless about what happened... Sorry for the vague report, but it seems like Samsung devices are about to make 2023 an interesting year for us.
Btw., thanks for providing the libraries! I wish you all the best for 2023.
Actual behaviour
Init package is not written: Bootloader logs nothing after OP_CODE 0x01 confirmation Tablet logs
I/DfuImpl: Sending Calculate Checksum command (Op Code = 3) E/DfuImpl: Characteristic write error: 133
I am getting this result. Which is great, I managed to replicate the issue.
I am able to replicate this issue by writing data manually using nRF Connect. Something is very bad with this Samsung Tab A8.
Tomorrow I'll check with a sniffer. Perhaps it has issues with MTU > 23.
I'm attaching the sniffer logs. You need Ellisys Bluetooth Analyzer to open (Windows only). Sniffer logs.zip
There are 2 logs, one from a PIxel 5 with Android 14, which works, and the other from Samsung Tab A8, which fails.
Issue
Edited: If you'd open the sniffer logs from the Samsung Tab A8 you'll see a packet LLCP Data Length Update. Even 2 of them. In the request, the tablet says it can receive (maxRx) 251 bytes, but can send (maxTx) only 27 bytes. Later, when it tries to actually send the data, it sends 251 without problems, but the peripheral doesn't even reply, as the packets are too long. See the next comment below.
~On Samsung everything works until it tries to send long packet (251 bytes using Data Length Extension). The same packet goes through from Pixel without problems, but when it's sent from the tablet the DK does not reply. I suspect a timing issue. Both devices use slightly different Connection Parameters. Perhaps Samsung does not send packets according to its own parameters and the DK ignores what is received. The tablet tries to send the 1st packet 397 times before disconnecting due to Supervision Timeout (no response from Slave, which is 6 seconds).~
~It's very hard to say what the timing issue is, but some replies from the DK are overlapping the transmitted packets by few hundreds us.~
Solution
I tried disabling MTU request when doing DFU from the Samsung Tab A8 and it seems to be working. So the issue is only when the tablet is trying to use Data Length Extension, short packets work fine.
You may try using this method to set the MTU to 23: https://github.com/NordicSemiconductor/Android-DFU-Library/blob/53ae6f8ed7f0f14f66aea1f9922fbe186ce16f33/lib/dfu/src/main/java/no/nordicsemi/android/dfu/DfuServiceInitiator.java#L399-L402
A helpful link to a related DevZone case: https://devzone.nordicsemi.com/f/nordic-q-a/88557/samsung-galaxy-tab-a8-does-not-work-with-nrf-mesh-android-app/387530
And a quotation:
We found an issue in the Samsung Galaxy A8 Bluetooth capabilities this summer, where it seems to send packets with a longer payload than what has been negotiated, which caused these issues with our devices, as they will terminate the connection if this happens. Our conclusion was that there wasn't anything to be done on the nRF side of the application to remedy this.
From this comment.
Here's the screenshot from the sniffer log:
As you can see, the Master claims maxRx = 27 bytes, but later sends 251.
I added an option in nRF DFU app to disable MTU request.
If you're using the library, use disableMtuRequest() in DfuServiceInitiator. This should do the trick.
@philips77 Shouldn't the library itself disable MTU request for devices with this issue ? As library users, should we disable mtu for every phones ? Or testing if we are on a Galaxy Tab ? 🤔🙁
Have a look at the PR. I'm not sure what device may have this issue. It's not possible to recover the connection when the issue happens, as it is killed because of Supervision Timeout after few seconds of retries. The lib would have to detect it, store it in Shared Preferences and not request again when retried.
For now, let's keep it simple and disable only for A8. We didn't get this issue for different devices.
@philips77 I think it's better integrated in the lib than as an option, yes. Thanks !