GATT Invalid Handle / unable to read version number on first attempt when bonded about android-dfu-library

[philips77]

Hi, of course :)
As far I remember proper bonding support was added in SDK 8. There the bond information is passed to the bootloader and connection is secure also in bootloader mode. The bootloader after gets connected should send Service Changed indication (newer Android versions enable it automatically while for older the dfu lib will do before jumping to BL mode). From the log I see that it must have been enabled prior to starting DFU. After connecting to the bootloader the service waits for the indication:

I/DfuBaseService: Waiting 1600 ms for a possible Service Changed indication...

Android, when it's received, should refresh cache automatically and start service discovery. Calling gatt.discoverServices() will either return then from cache, or stop and restart discovery if it didn't finish. Now you should have correct services and read should work.

In your case it looks as if the indication wasn't sent out the phone ignored it. It was supported correctly on Android since the beginning, i think, but on some phones it may be the case (although we didn't have any customer issue regarding this and it used to work on all our phones).

Please check if you send this indication.
The service doesn't force refresh service when the device is bond as it does otherwise (refresh method has a parameter force). That's why it works without bonding.

If you are using s132 i assume you are using sdk 8+?

[JJansenJJansen]

Hi Aleksander, thank you very much for your very quick reply :)

We are indeed using SDK 11.0

Your suggestion makes sense, I am wondering whether the characteristisch changed indication is sent/received at all, even though we have enabled it in both the application and the bootloader. I will take a look at this.

What does surprise me is that the nrfConnect app does not seem to have an issue with it at all. Please take a look at the log from nrfConnect below. I do see a call to gatt.refresh just after the application disconnects and jumps to the bootloader. Is this how rediscovery is forced in the app?:

V 12:44:39.649 Connecting to FB:E5:EA:21:FC:CF...
D 12:44:39.649 gatt = device.connectGatt(autoConnect = false)
D 12:44:40.034 [Callback] Connection state changed with status: 0 and new state: CONNECTED (2)
I 12:44:40.034 Connected to FB:E5:EA:21:FC:CF
D 12:44:40.034 wait(600ms)
D 12:44:40.046 [Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
V 12:44:40.644 Discovering services...
D 12:44:40.644 gatt.discoverServices()
D 12:44:40.779 [Callback] Services discovered with status: 0
I 12:44:40.782 Services discovered
V 12:44:40.817 Generic Access (0x1800)

• Device Name [R W] (0x2A00)
• Appearance [R] (0x2A01)
• Peripheral Preferred Connection Parameters [R] (0x2A04)
  Generic Attribute (0x1801)
• Service Changed [I] (0x2A05)
     Client Characteristic Configuration (0x2902)
  Battery Service (0x180F)
• Battery Level [N R] (0x2A19)
     Client Characteristic Configuration (0x2902)
  Device Information (0x180A)
• Manufacturer Name String [R] (0x2A29)
• Serial Number String [R] (0x2A25)
• Hardware Revision String [R] (0x2A27)
• Firmware Revision String [R] (0x2A26)
  Device Firmware Update Service (00001530-1212-efde-1523-785feabcd123)
• DFU Packet [WNR] (00001532-1212-efde-1523-785feabcd123)
• DFU Control Point [N W] (00001531-1212-efde-1523-785feabcd123)
     Client Characteristic Configuration (0x2902)
• DFU Version [R] (00001534-1212-efde-1523-785feabcd123)
  Unknown Service (517caf00-4511-80a0-e611-8201eca2a07d)
• Unknown Characteristic [W] (517cfabc-4511-80a0-e611-8201eca2a07d)
• Unknown Characteristic [N R] (517caf01-4511-80a0-e611-8201eca2a07d)
     Client Characteristic Configuration (0x2902)
  V 12:44:45.941 Starting pairing...
  D 12:44:45.941 device.createBond()
  D 12:44:45.981 [Broadcast] Action received: android.bluetooth.device.action.BOND_STATE_CHANGED, bond state changed to: BOND_BONDING (11)
  D 12:44:46.740 [Broadcast] Action received: android.bluetooth.device.action.BOND_STATE_CHANGED, bond state changed to: BOND_BONDED (12)
  I 12:44:46.740 Device bonded
  V 12:45:18.664 [DFU] DFU service started
  V 12:45:18.664 [DFU] Opening file...
  I 12:45:18.743 [DFU] Image file opened (78868 bytes in total)
  D 12:45:18.743 [DFU] wait(1000)
  D 12:45:19.760 [DFU] wait(1000)
  V 12:45:20.732 [DFU] Connecting to DFU target...
  D 12:45:20.732 [DFU] gatt = device.connectGatt(autoConnect = false)
  I 12:45:20.798 [DFU] Connected to FB:E5:EA:21:FC:CF
  D 12:45:20.798 [DFU] wait(1600)
  V 12:45:22.389 [DFU] Discovering services...
  D 12:45:22.390 [DFU] gatt.discoverServices()
  I 12:45:22.437 [DFU] Services discovered
  D 12:45:22.520 [DFU] wait(1000)
  V 12:45:23.511 [DFU] Reading DFU version number...
  D 12:45:23.511 [DFU] gatt.readCharacteristic(00001534-1212-efde-1523-785feabcd123)
  I 12:45:23.574 [DFU] Read Response received from 00001534-1212-efde-1523-785feabcd123, value (0x): 01-00
  A 12:45:23.574 [DFU] Version number read: 0.1
  W 12:45:23.574 [DFU] Application with buttonless update found
  V 12:45:23.574 [DFU] Jumping to the DFU Bootloader...
  V 12:45:23.574 [DFU] Enabling notifications for 00001531-1212-efde-1523-785feabcd123
  D 12:45:23.574 [DFU] gatt.setCharacteristicNotification(00001531-1212-efde-1523-785feabcd123, true)
  D 12:45:23.574 [DFU] gatt.writeDescriptor(00002902-0000-1000-8000-00805f9b34fb, value=0x01-00)
  I 12:45:23.724 [DFU] Data written to descr.00001531-1212-efde-1523-785feabcd123, value (0x): 01-00
  V 12:45:23.724 [DFU] Notifications enabled for 00001531-1212-efde-1523-785feabcd123
  A 12:45:23.724 [DFU] Notifications enabled
  D 12:45:23.724 [DFU] wait(1000)
  V 12:45:24.727 [DFU] Writing to characteristic 00001531-1212-efde-1523-785feabcd123
  D 12:45:24.727 [DFU] gatt.writeCharacteristic(00001531-1212-efde-1523-785feabcd123)
  I 12:45:24.791 [DFU] Data written to 00001531-1212-efde-1523-785feabcd123, value (0x): 01-04
  A 12:45:24.791 [DFU] Jump to bootloader sent (Op Code = 1, Upload Mode = 4)
  D 12:45:24.883 [Callback] Connection state changed with status: 19 and new state: DISCONNECTED (0)
  W 12:45:24.883 Connection terminated by peer (status 19)
  I 12:45:24.883 Disconnected
  D 12:45:24.885 gatt.refresh() (hidden)
  I 12:45:24.902 [DFU] Disconnected by the remote device
  D 12:45:24.902 [DFU] gatt.close()
  D 12:45:24.937 [Broadcast] Action received: android.bluetooth.device.action.ACL_DISCONNECTED
  V 12:45:24.939 [DFU] DFU service started
  V 12:45:24.939 [DFU] Opening file...
  I 12:45:24.979 [DFU] Image file opened (78868 bytes in total)
  D 12:45:24.980 [DFU] wait(1000)
  D 12:45:26.039 [DFU] wait(1000)
  V 12:45:26.980 [DFU] Connecting to DFU target...
  D 12:45:27.027 [DFU] gatt = device.connectGatt(autoConnect = false)
  D 12:45:28.688 [Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
  I 12:45:28.693 [DFU] Connected to FB:E5:EA:21:FC:CF
  D 12:45:28.695 [DFU] wait(1600)
  V 12:45:30.295 [DFU] Discovering services...
  D 12:45:30.295 [DFU] gatt.discoverServices()
  I 12:45:30.305 [DFU] Services discovered
  D 12:45:30.330 [DFU] wait(1000)
  V 12:45:31.359 [DFU] Reading DFU version number...
  D 12:45:31.359 [DFU] gatt.readCharacteristic(00001534-1212-efde-1523-785feabcd123)
  I 12:45:31.406 [DFU] Read Response received from 00001534-1212-efde-1523-785feabcd123, value (0x): 08-00
  A 12:45:31.412 [DFU] Version number read: 0.8
  V 12:45:31.412 [DFU] Enabling notifications for 00001531-1212-efde-1523-785feabcd123
  D 12:45:31.412 [DFU] gatt.setCharacteristicNotification(00001531-1212-efde-1523-785feabcd123, true)
  D 12:45:31.412 [DFU] gatt.writeDescriptor(00002902-0000-1000-8000-00805f9b34fb, value=0x01-00)
  I 12:45:31.504 [DFU] Data written to descr.00001531-1212-efde-1523-785feabcd123, value (0x): 01-00
  V 12:45:31.504 [DFU] Notifications enabled for 00001531-1212-efde-1523-785feabcd123
  A 12:45:31.504 [DFU] Notifications enabled
  D 12:45:31.504 [DFU] wait(1000)
  V 12:45:32.505 [DFU] Writing to characteristic 00001531-1212-efde-1523-785feabcd123
  D 12:45:32.506 [DFU] gatt.writeCharacteristic(00001531-1212-efde-1523-785feabcd123)
  I 12:45:32.579 [DFU] Data written to 00001531-1212-efde-1523-785feabcd123, value (0x): 01-04
  A 12:45:32.579 [DFU] DFU Start sent (Op Code = 1, Upload Mode = 4)
  V 12:45:32.579 [DFU] Writing to characteristic 00001532-1212-efde-1523-785feabcd123
  D 12:45:32.579 [DFU] gatt.writeCharacteristic(00001532-1212-efde-1523-785feabcd123)
  I 12:45:32.579 [DFU] Data written to 00001532-1212-efde-1523-785feabcd123, value (0x): 00-00-00-00-00-00-00-00-14-34-01-00
  A 12:45:32.580 [DFU] Firmware image size sent (0b, 0b, 78868b)
  I 12:45:33.259 [DFU] Notification received from 00001531-1212-efde-1523-785feabcd123, value (0x): 10-01-01
  A 12:45:33.259 [DFU] Response received (Op Code = 1 Status = 1)
  A 12:45:33.259 [DFU] Writing Initialize DFU Parameters...
  V 12:45:33.259 [DFU] Writing to characteristic 00001531-1212-efde-1523-785feabcd123
  D 12:45:33.259 [DFU] gatt.writeCharacteristic(00001531-1212-efde-1523-785feabcd123)
  I 12:45:33.356 [DFU] Data written to 00001531-1212-efde-1523-785feabcd123, value (0x): 02-00
  V 12:45:33.356 [DFU] Writing to characteristic 00001532-1212-efde-1523-785feabcd123
  D 12:45:33.356 [DFU] gatt.writeCharacteristic(00001532-1212-efde-1523-785feabcd123)
  I 12:45:33.359 [DFU] Data written to 00001532-1212-efde-1523-785feabcd123, value (0x): FF-FF-FF-FF-FF-FF-FF-FF-01-00-FE-FF-70-A5
  V 12:45:33.360 [DFU] Writing to characteristic 00001531-1212-efde-1523-785feabcd123
  D 12:45:33.360 [DFU] gatt.writeCharacteristic(00001531-1212-efde-1523-785feabcd123)
  I 12:45:33.453 [DFU] Data written to 00001531-1212-efde-1523-785feabcd123, value (0x): 02-01
  I 12:45:33.453 [DFU] Notification received from 00001531-1212-efde-1523-785feabcd123, value (0x): 10-02-01
  A 12:45:33.454 [DFU] Initialize DFU Parameters completed
  A 12:45:33.456 [DFU] Response received (Op Code = 2, Status = 1)
  V 12:45:33.456 [DFU] Writing to characteristic 00001531-1212-efde-1523-785feabcd123
  D 12:45:33.456 [DFU] gatt.writeCharacteristic(00001531-1212-efde-1523-785feabcd123)
  I 12:45:33.596 [DFU] Data written to 00001531-1212-efde-1523-785feabcd123, value (0x): 08-0A-00
  A 12:45:33.596 [DFU] Packet Receipt Notif Req (Op Code = 8) sent (Value = 10)
  V 12:45:33.596 [DFU] Writing to characteristic 00001531-1212-efde-1523-785feabcd123
  D 12:45:33.596 [DFU] gatt.writeCharacteristic(00001531-1212-efde-1523-785feabcd123)
  I 12:45:33.648 [DFU] Data written to 00001531-1212-efde-1523-785feabcd123, value (0x): 03
  A 12:45:33.648 [DFU] Receive Firmware Image request sent
  A 12:45:33.691 [DFU] Uploading firmware...
  V 12:45:33.692 [DFU] Sending firmware to characteristic 00001532-1212-efde-1523-785feabcd123...
  I 12:46:31.709 [DFU] Notification received from 00001531-1212-efde-1523-785feabcd123, value (0x): 10-03-01
  A 12:46:31.710 [DFU] Response received (Op Code = 3, Status = 1)
  A 12:46:31.710 [DFU] Upload completed in 57988 ms

Thanks again for your assistance!

[philips77]

Yes, the refresh() called by nRF Connect is separate from the DFU lib (no [DFU] in the log there).
Actually, by default it does it only until Android 5 or 6 and is disabled for more recent versions. On your phone you may also disable it in Settings->Connectivity->Clear device cache->Never/Not bonded. It used to be that connecting to a device with clear cache was much more stable, now it's stable even without it and as it's a "trick" (called using reflections) I try not to use it if not explicitly required (like in DFU on not-bonded devices).

[JJansenJJansen]

I found the problem. It was indeed caused by the service changed indication not being sent in the bootloader, after fixing this the DFU continues flawlessly. Because we were testing with nrfConnect at first the problem was 'masked' by the forced refresh.
Thanks for the support Aleksander!

[philips77]

Glad to hear that! Good luck! :)