OTAU CSR102x CSR102x is a product of Qualcomm Technologies International, Ltd. Qualcomm® Bluetooth® Low Energy Terminology clarification In this document you will notice a number of references are made to Qualcomm Bluetooth Low Energy SDK. While this is the official name of the SDK moving forward, within the actual SDK you will see it currently referred to as CSR µEnergy. In addition, many of the directories and folders may have the CSR µEnergy SDK naming convention. Please be assured these are the same thing. Thank you for your understanding while we take the necessary steps to phase out the use of CSR µEnergy across our product lines. 2 CSR102x OTAU CSR102x OTAU Overview A protocol permitting the transfer of an application wirelessly to a CSR102x from a host, allowing application upgrades as a background process. • Operates on 2 application stores. • Updates one store while running from the other. Our Bluetooth Low Energy Software Development Kit and its additional modules contain a number of example profile implementation with OTAU services built in. These slides summarise the inner-workings of the OTAU process. CSR102x is a product of Qualcomm Technologies International, Ltd. 3 CSR102x OTAU Overview What are stores? • Applications, user areas and config data are stored in different areas of the CSR102x memory architecture. ROM ...... Store 0 • Each area of the memory is referred to as a STORE • Stores have unique IDs and are configurable in size via the .stores file in the project folder OTP Store Header ...... Store 0 Store Data Secure Store Store 1 sMEM ...... Store 0 • Stores start in the first available memory location as determined by the SDK Store 1 Store 1 Store 2 MTP CSR102x is a product of Qualcomm Technologies International, Ltd. 4 CSR102x OTAU Overview GATT Packets • Protocol to transfer data between two entities over Bluetooth • Host: the controlling part e.g. application on a smartphone • Device: the controlled part e.g. a Bluetooth device • Each message sent and received by each device is represented as a byte array and is acknowledged by the receiver • Packets consist of a Vendor ID, a command – 2 bytes – and its payload – byte array • All commands have CSR Vendor as vendor ID: 0x000A CSR102x is a product of Qualcomm Technologies International, Ltd. 5 CSR102x OTA Protocol Acknowledgement packet • Each command packet sent has to receive an acknowledgement. • The acknowledgement packet format is as follow: • • Over Bluetooth Low Energy: The acknowledgement command ID number is defined as follow: commandID | 0x8000 where « commandID » is the ID number for the acknowledged command • The status byte encodes the success or failure of the command sent. GATT Data Format CSR102x is a product of Qualcomm Technologies International, Ltd. 6 CSR102x OTAU protocol Sending a packet To send packets, both the host and the device act differently: • Host sends a packet To send a packet, the host writes the packet to the Command Endpoint characteristic. • Device sends a packet To send a packet, the host receives a notification sent by the device through the Response Endpoint characteristic. CSR102x is a product of Qualcomm Technologies International, Ltd. 7 Message Sequence OTAU Message Sequence Diagram Sequence Init Data Transfer Validation Commit Initialise and begin process Transfer and acknowledge blocks of program data Verify that data has been received correctly Re-initialise with new updated application 9 OTAU Sequence Diagram Breakdown Initialisation UPGRADE_SYNC • Called at start of upgrade process • Host defines 4 byte identifier • Identifier is used to determine whether this is a new update or a resumption from a previously aborted update • Device returns current state and acknowledges identifier Device Host UPGRADE_SYNC_REQ UPGRADE_SYNC_CFM UPGRADE_START • Sent by Host to request start of procedure • Device responds with readiness state and battery level (allowing host to decide whether or not to proceed) UPGRADE_START_REQ UPGRADE_START_CFM 10 OTAU Sequence Diagram Breakdown Data Transfer START_DATA • Sent by host - begins transfer. DATA_BYTES_REQ • Sent by device – contains a 4byte data length and 4 byte offset request to the host. UPGRADE_DATA • Sent by host - contains Data Payload along with a “more data” flag 0 = more data to follow 1 = Last packet Device Host UPGRADE_START_DATA_REQ UPGRADE_DATA_BYTES_REQ (N) UPGRADE_DATA 11 OTAU Sequence Diagram Breakdown Validation IS_VALIDATION_DONE • Sent By Host to enquire state of executable validation. • Device responds with CFM message if not complete, with a requested backoff time • Device responds with TRANSFER_COMPLETE_IND When validation phase has been completed. TRANSFER_COMPLETE_RES • Sent by host in response to TRANSFER_COMPLETE_IND with an ACTION (0x00 = CONTINUE, 0x01 = ABORT) • If Action is to CONTINUE, then the Device should perform a warm reboot Host Device UPGRADE_IS_VALIDATION_DONE_REQ UPGRADE_IS_VALIDATION_DONE_CFM UPGRADE_IS_VALIDATION_DONE_REQ UPGRADE_TRANSFER_COMPLETE_IND UPGRADE_TRANSFER_COMPELTE_RES 12 OTAU Sequence Diagram Breakdown VMU COMMIT PHASE UPGRADE_COMMIT_RES • Host response to Device commit request • Contains Action data payload 0x00 = Continue 0x01 = Abort Upgrade UPGRADE_COMPLETE_IND • Sent by Device indicating that the upgrade process has been completed. Device Host UPGRADE_COMMIT_RES UPGRADE_COMPLETE_IND 13 Bluetooth Low Energy upgrade protocols Bluetooth Low Energy Characteristics To transport packets, the following Bluetooth Low Energy service and characteristics are used. • Service • Name: “CSR GAIA” • UUID: 00001100-d102-11e1-9b23-00025b00a5a5 • Characteristic 1 from “CSR GAIA” • Name: “CSR GAIA Command Endpoint” • UUID: 00001101-d102-11e1-9b23-00025b00a5a5 • Characteristic 2 from “CSR GAIA” • Name: “CSR GAIA Response Endpoint” • UUID: 00001102-d102-11e1-9b23-00025b00a5a5 14 OTAU File Format SDK Output File BIN file The file that is transferred over the air is the BIN output file generated by the SDK <project_name>_0.bin This is different from standard XUV file used to program the device directly from the SDK. This format has nominally sections • HEADER • PARTITION DATA • FOOTER However more than one partition data section can exist, depending on the flash partition of the device. Partition data format MUST MATCH the partitions of the target device. 16 SDK Output File BIN file UPGRADE HEADER • Contains information to permit the device to determine whether it can accept the upgrade file UPGRADE PARTITIONS • Multiple Partitions possible • Contains Length and Type fields (Application / Data etc) UPGRADE FOOTER • Indicates the end of the upgrade file being downloaded. Bytes ID “APPUHDR2” (ascii) 8 LENGTH (bytes) 4 DEVICE VARIANT (ascii) 8 UPGRADE VERSION (Major, Minor) 4 COMPATIBLE UPGRADES # 2 COMPATIBLE UPGRADE 1 ... COMPATIBLE UPGRADE N 4 PS CONFIG VERSION 2 PARTITION 2 HEADER PREVIOUS PS CONFIG # 2 2 PARTITION 2 DATA PREV CONFIG VERSION 1 ... PREV CONFIG VERSION N UPGRADE HEADER PARTITION 1 HEADER PARTITION 1 DATA 2 Bytes PARTITION N HEADER PARTITION N DATA NOTE: ACTIVE APP STORE IS STORED IN CSKEYS CSKEYS ARE NOT UPDATED OVER THE AIR 4 ID “PARTDATA” (ascii) 8 LENGTH (bytes) 4 PARTITION TYPE 2 PARTITION NUM 2 PARTITION DATA UPGRADE FOOTER LENGTH - 4 Bytes ID “APPUPFTR” (ascii) 8 LENGTH (bytes) 4 OEM SIGNATURE LENGTH CSR102x supports only single Partition BIN files CSR102x is a product of Qualcomm Technologies International, Ltd. 17 Thank you Follow us on: For more information, visit us at: www.qualcomm.com & www.qualcomm.com/blog All data and information contained in or disclosed by this document is confidential and proprietary information of Qualcomm Technologies, Inc. and/or its affiliated companies and all rights therein are expressly reserved. By accepting this material the recipient agrees that this material and the information contained therein is to be held in confidence and in trust and will not be used, copied, reproduced in whole or in part, nor its contents revealed in any manner to others without the express written permission of Qualcomm Technologies, Inc. Nothing in these materials is an offer to sell any of the components or devices referenced herein. ©2016 Qualcomm Technologies, Inc. and/or its affiliated companies. All Rights Reserved. Qualcomm is a trademark of Qualcomm Incorporated, registered in the United States and other countries. Other products and brand names may be trademarks or registered trademarks of their respective owners. References in this presentation to “Qualcomm” may mean Qualcomm Incorporated, Qualcomm Technologies, Inc., and/or other subsidiaries or business units within the Qualcomm corporate structure, as applicable. Qualcomm Incorporated includes Qualcomm’s licensing business, QTL, and the vast majority of its patent portfolio. Qualcomm Technologies, Inc., a wholly-owned subsidiary of Qualcomm Incorporated, operates, along with its subsidiaries, substantially all of Qualcomm’s engineering, research and development functions, and substantially all of its product and services businesses, including its semiconductor business, QCT.
