目錄
img文件格式... 3
各個img文件的關係... 4
CSR OTA Update bootloader shared data. 5
觸摸屏固件升級... 6
小貼士... 6
術語... 7
參考資料... 7
CSR8510 Bluetooth 4.0 USB Dongle driver7
CSR µEnergy Over-the-Air application demo. 7
CSR µEnergy Over-the-Air Updater 2.4.0.13. 8
概述
藍牙遙控器固件升級採用CSRuEnergy SDK-2.4.2.1提供的Over-the-Air Update升級功能來實現。觸摸屏固件內嵌在鍵盤應用的代碼中，鍵盤應用初始化時檢查觸摸屏固件版本號，當版本號不相等時執行更新觸摸屏固件操作，否則略過更新。
OTA升級過程簡介
硬件：電腦、CSR8510Bluetooth 4.0 USB Dongle、藍牙遙控器
軟件：Windows操作系統、CSR µEnergy Over-the-AirUpdater 2.4.0.13
所需文件：keyboard_update.img
從OTA升級日誌上看，升級程序從藍牙遙控器讀取BDADDR、CRYSTAL_FTRIM、IDENTITY_ROOT、ENCRYPTION_ROOT等CS Key，並把這些Key的值合併到用於升級的keyboard應用的img文件中。藍牙遙控器進入bootloader模式，升級程序重新連接bootloader模式的藍牙遙控器，傳輸數據完成升級後藍牙遙控器重啓進入keyboard應用。
日誌
06:11:31 Status: Scanning for devices aborted.
06:11:31 Status: Device connecting...
06:11:31 Status: Connected to the device.
06:11:31 Status: Readingdatabase.
06:11:31 Status: Pairing request received.
06:11:31 Status: Bonded to device 0x.00:0b:82:6f:8b:bb
06:11:32 Status: Discovery successful
06:11:32 Status: Detected the CSR µEnergy OTA Update Application service.
06:11:32 Status: Connected to the device.
06:11:32 Status: Configuring device notifications...
06:11:32 Status: Configuring device indications...
06:11:32 Status: Reading information from the device...
06:11:32 Status: Current application position is 1.
06:11:32 Status: Reading CS Key block...
06:11:32 Status: Reading the Bluetooth address of the device...
06:11:32 Status: Bluetooth address: 00:0b:82:6f:8b:bb.
06:11:32 Status: Reading the device's crystal trim...
06:11:32 Status: Crystaltrim: 0x20.
06:11:32 Status: Reading the device's Identity Root...
06:11:32 Status: Identity Root: 0x00000000000000000000000100000000
06:11:32 Status: Reading the device's Encryption Root...
06:11:32 Status: Encryption Root: 0x00000000000000000000000300000000
06:11:32 Status: Merging the image and key file...
06:11:32 Status: Switching the device to bootloader mode.
06:11:32 Status: Current application position has been set successfully.
06:11:32 Status: Switching the device to bootloader mode.
06:11:32 Status: Disconnected from the device (source = 0x2d, reason= 0x80c).
06:11:32 Status: Device connecting...
06:11:32 Status: Connected to the device.
06:11:32 Status: Readingdatabase.
06:11:32 Status: Bonded to device 0x.00:0b:82:6f:8b:bb
06:11:32 Status: Bonded to device 0x.00:0b:82:6f:8b:bb
06:11:33 Status: Discovery successful
06:11:33 Status: OTA bootloader mode is supported.
06:11:33 Status: Connected to the OTA bootloader.
06:11:33 Status: Reading bootloader version...
06:11:33 Status: Connected to OTA bootloader version 5.
06:11:33 Status: Configuring device notifications...
06:11:33 Status: Reading information from the device...
06:11:33 Error: Failed to read the current application position.
06:11:33 Status: Setting the current application position to 2...
06:11:33 Error: Failed to set the current application position (code = 6).
06:11:33 Status: Reading the Bluetooth address of the device...
06:11:33 Status: Bluetooth address: 00:0b:82:6f:8b:bb.
06:11:33 Status: Reading the device's crystal trim...
06:11:33 Status: Crystaltrim: 0x20.
06:11:33 Status: Reading the device's Identity Root...
06:11:33 Status: Identity Root: 0x00000000000000000000000100000000
06:11:33 Status: Reading the device's Encryption Root...
06:11:33 Status: Encryption Root: 0x00000000000000000000000300000000
06:11:33 Status: Merging the image and key file...
06:11:33 Status: Updating device...
06:12:11 Status: Device has been updated successfully.
06:12:15 Status: Disconnected from the device (source = 0x2d, reason= 0x80c).
img文件格式
|
偏移 |
|
|
|
|
@000000 |
CTRL_HEADER_CRC |
|
Control header |
|
@000002 |
CTRL_HEADER_BLOCKS |
|
|
|
@000004 |
CTRL_HEADER_SCL |
|
|
|
@000006 |
BLOCK OFFSET |
Block 0 header CS key block |
|
|
@000008 |
BLOCK DESTINATION |
||
|
@00000a |
BLOCK LENGTH |
||
|
@00000c |
BLOCK CRC |
||
|
|
BLOCK OFFSET |
Block 1 header |
|
|
|
BLOCK DESTINATION |
||
|
|
BLOCK LENGTH |
||
|
|
BLOCK CRC |
||
|
|
… |
… |
|
|
|
BLOCK OFFSET |
Block n header |
|
|
|
BLOCK DESTINATION |
||
|
|
BLOCK LENGTH |
||
|
|
BLOCK CRC |
||
|
|
|
Block 0 data |
data |
|
|
|
Block 1 data |
|
|
|
|
|
|
|
|
|
Block n data |
CTRL_HEADER_CRC爲Control header中CTRL_HEADER_BLOCKS及之後數據的校驗和。
CTRL_HEADER_BLOCKS高8位表示有多少數據塊。
Block header描述數據塊偏移地址、加載地址、數據長度（單位字節）、數據校驗和。
BLOCK CRC爲對應塊的數據的校驗和。
詳見以下文件：
C:\CSR_uEnergy_SDK-2.4.2.1\otau_demo\source\CSConfig.h
C:\CSR_uEnergy_SDK-2.4.2.1\otau_demo\source\CSConfig.cpp
各個img文件的關係
|
用於SPI燒寫 |
keyboard.img |
bootloader.img |
① |
|
bootloader shared data |
② |
||
|
keyboard_update.img |
用於OTA升級 |
CSR µEnergy SDK 2.4.2.1(xIDE) 中“ProjectProperties”的“Include OTAUpdate Bootloader”爲“No”時，只生成keyboard.img，此文件可用於OTA升級。
①從C:/CSR_uEnergy_SDK-2.4.2.1/tools/lib/otau/bootloader.img複製，並根據CS key文件更新了相應的CS key。
② C:/CSR_uEnergy_SDK-2.4.2.1/tools/bin/otauimgcmd命令設置dev_name auth_key，dev_name由“Project Properties”中的“Device Name（OTA Update Bootloader）”來指定，auth_key由“Project Properties”中的“Authertication Key（OTA Update Bootloader）”來指定
OTA EEPROM Memory Map
|
Address |
Content |
|
|
0x0000 |
CSR OTA Update bootloader |
bootloader.img |
|
0x3c00 |
CSR OTA Update bootloader shared data |
|
|
0x3d00 |
Application |
keyboard_update.img |
|
0xf000 |
Application NVM |
① |
① CSR µEnergy SDK 2.4.2.1 (xIDE) 中，“Project Properties”的“CS Key File“指定的文件keyboard_csr101x_A05.keyr，通過修改&nvm_start_address = xxxx來指定。不能與keyboard.img有重疊，否則會在keyboard應用運行後破壞EEPROM裏的數據完整性而導致問題。
CSR OTA Update bootloader shareddata
|
Address |
Length |
Content |
Value Range |
|
0x3c00 |
2 |
|
|
|
0x3c02 |
2 |
The CSR OTA Update version |
5 |
|
0x3c04 |
2 |
app_id |
0,1,2 |
|
0c3c06 |
2 |
|
|
|
0c3c08 |
2 |
flags |
bit4 bit3 IS_BONDED bit2 service_changed_config bit1 local_random_address |
|
0x3c0a |
10 |
CONN_HOST_ADDR |
|
|
0x3c14 |
8 |
local_random_address |
|
|
0x3c1c |
16 |
IRK |
|
|
0x3c2c |
2 |
LINK_DIVERSIFIER |
|
|
0x3c2e |
16 |
dev_name |
|
|
0x3c3e |
16 |
auth_key |
|
|
0x3c4e |
|
|
|
Application NVM
|
Offset |
Content |
|
|
|
0x0 |
SANITY |
|
|
|
0x2 |
Bonded flag |
Application Data |
|
|
0x4 |
Bonded addr |
|
|
|
0xe |
SM DIV |
|
|
|
0x10 |
SM IRK |
|
|
|
0x20 |
Service_changed |
GATT Data |
|
|
0x22 |
Service_changed_config |
|
|
|
0x24 |
Length |
GAP Data |
|
|
0x26 |
Name[20] |
|
|
|
0x4e |
INPUT_BOOT_RPT_CLIENT_CONFIG |
HID |
|
|
0x50 |
INPUT_RPT_CLIENT_CONFIG |
|
|
|
0x52 |
CONSUMER_RPT_CLIENT_CONFIG |
|
|
|
0x54 |
MOUSE_RPT_CLIENT_CONFIG |
|
|
|
0x56 |
LEVEL_CLIENT_CONFIG |
BATTERY_SERVICE |
|
|
0x58 |
REFRESH_CLIENT_CONFIG |
SCAN_PARAM_SERVICE |
|
* 如果NVM中的SANITY無效，應用會往NVM寫數據，有效則會從NVM讀取數據。通過OTA升級keyboard應用後掃描到的設備名沒有隨之更新與此有關。
Bonded addr
|
Uint16 |
0 |
type |
0-public 1-random |
TYPED_BD_ADDR_T |
|
Uint24 |
xx44 |
lap |
BD_ADDR_T |
|
|
5566 |
||||
|
Uint8 |
xx33 |
uap |
||
|
Uint16 |
1122 |
nap |
觸摸屏固件升級
*_senisens_upgrade.[ch]由C同學從廠家提供的驅動移植而來。fwdataall.h，觸摸屏固件uint16數組。keyboard.c文件中AppInit函數最後處調用touch_upgrade_check及touch_upgrade_fw來實現
替換觸摸屏固件
使用小工具將觸摸屏固件轉換成uint16數組數據，替換文件中的原有數據，重新編譯生成img文件。
小貼士
修改缺省發射功率
|
value |
0 |
1 |
2 |
3 |
4 |
5 |
6 |
7 |
|
dBm |
-18 |
-14 |
-10 |
-6 |
-2 |
+2 |
+6 |
+8 |
* CSR µEnergy SDK 2.4.2.1(xIDE) 中，“ProjectProperties”的“CS Key File“指定的文件keyboard_csr101x_A05.keyr，通過修改&tx_power_level = xxxx來指定
修改藍牙地址
* CSR µEnergy SDK 2.4.2.1(xIDE) 中，“ProjectProperties”的“CS Key File“指定的文件keyboard_csr101x_A05.keyr，通過修改&BDADDR = xxxx xxxx xxxx後重新編譯，將生成的keyboard.img通過SPI接口燒寫到藍牙遙控器。
* 利用CSR µEnergy SDK 2.4.2.1中CsConfig圖形化工具通過SPI連接到藍牙遙控器進行修改，此操作只修改了bootloader中的BDADDR CS Key，通過OTA方式升級一次鍵盤應用，鍵盤應用中的藍牙地址纔會修改過來。
擦除EEPROM
c:/CSR_uEnergy_SDK-2.4.2.1/tools/bin/e2cmd.exe-norun -trans "SPITRANS=USB SPIPORT=0" fill 0xffff
將EEPROM內容保存到文件eeprom.img
c:/CSR_uEnergy_SDK-2.4.2.1/tools/bin/e2cmd.exe-trans "SPITRANS=USB SPIPORT=0" dump eeprom.img
下載keyboard.img到EEPROM並運行
c:/CSR_uEnergy_SDK-2.4.2.1/tools/bin/e2cmd.exe-trans "SPITRANS=USB SPIPORT=0" download keyboard.img
術語
CRC CyclicRedundancy Check
EEPROM ElectricallyErasable Programmable Read-Only Memory
NVM Non-volatileMemory
OTA Over-the-AirUpdate
參考資料
CSR8510 Bluetooth 4.0 USB Dongledriver
C:\CSR_uEnergy_SDK-2.4.2.1\drivers\CSR8510Bluetooth 4.0 USB Dongle
CSR µEnergy Over-the-Air applicationdemo
C:\CSR_uEnergy_SDK-2.4.2.1\apps\otau_demo
CS-304564-AN-6_ModifyingAnApplicationToSupportOTAUpdate.pdf
CS-316019-AN-2_Over-the-AirUpdateSystemApplicationNote.pdf
CS-316220-SP-1_Over-the-AirUpdateApplicationAndBootloaderServicesSpecification.pdf
CSR µEnergy Over-the-Air Updater 2.4.0.13
C:\CSR_uEnergy_SDK-2.4.2.1\otau_demo\source
CS Key
C:\CSR_uEnergy_SDK-2.4.2.1\otau_demo\source\cskey_db.xml
CSR µEnergy SDK tools
CSR_uEnergy_SDK-2.4.2.1\tools\bin
csconfigcmd
csconfigcmd, version 2.4.2.149Release
Copyright Cambridge Silicon Radio Limited2010 - 2014.
==============================================================================
ERROR: One of the following parameters mustbe given:
"query" "merge""dump" "default" "versions"
==============================================================================
CSR uEnergy Configuration Store CommandLine Application
A tool used to view and modifyconfiguration keys in SPI flash and EEPROM.
Usage:
csconfigcmd (query <outfile> <queryfile> | merge<file> | dump <file> |
default | versions)[-otauappversion <csrver> | -otauappoffset
<offset>] [-usb<port> | -lpt <port>] [-quiet] [-help]
[-imagefile <infile>][-mul <port>] [-norun] [-machine]
query <outfile> <queryfile>
Writes individual key values given in <queryfile> from the targetto
<outfile>.
<outfile> = filename for the result of the query.
<queryfile> = filename of the query file.
merge <file>
Updates the target with the contents of <file>.
<file> = path and filename of file to merge.
dump <file>
Writes all target key values to a result <file>.
<file> = output path and filename.
default
Reset all keys back to their default values.
versions
Retrieve the IC identification, firmware and CS keys version numbers.
-otauappversion <csrver>
Manipulate OTA Update ready application keys for the specified CSR OTA
Update version.
<csrver> = The CSR OTA Update version (5).
-otauappoffset <offset>
Manipulate OTA Update ready application keys for an application at the
specified offset.
<offset> = The application offset in bytes.
-usb <port>
Indicates USB-SPI port.
<port> = USB-SPI port e.g. -usb 0 or -usb nnnnnn (where nnnnnn isthe
serial number of the USB-SPI converter).
-lpt <port>
Indicates LPT-SPI port.
<port> = LPT-SPI multi-port e.g. -lpt 1 to select LPT1.
-quiet
Suppress non-essential output.
-help
Display this help text.
-imagefile <infile>
Manipulate an IMG/XUV file (instead of a SPI connection).
<infile> = input filename.
-mul <port>
Indicates SPI multi-port.
<port> = LPT-SPI multi-port (a number from 0 upwards; typicallyupto
15) e.g. -mul 2.
-norun
Do not automatically restart the chip afterwards.
-machine
Shows information in an easilyparsed form (if appropriate).
otauimgcmd
otauimgcmd, version 2.4.2.149Release
Copyright Cambridge Silicon Radio Limited2013 - 2014.
==============================================================================
ERROR: One of the following parameters mustbe given:
"merge" "set"
==============================================================================
CSR uEnergy OTA Update Image ManipulationTool
A tool used to merge bootloader andapplication images and set OTA Update
shared data settings.
Usage:
otauimgcmd (merge <bootimage> <appimage> <outimage><csrver> | set <image>
<csrver> <name><value>) [-quiet] [-help] [-dataoffset
<offset>] [-appoffset<offset>]
merge <bootimage> <appimage> <outimage> <csrver>
Merges OTA Update bootloader and application images to produce a
composite OTA Update enabled firmware image.
<bootimage> = The OTA Update bootloader image file (.img format).
<appimage> = The application image file (.img format).
<outimage> = The output image file name (.img format).
<csrver> = The CSR OTA Update version (0 or 5). The versiondetermines
the shared data and application offsets, which can be overridden using
the -dataoffset and -appoffset options. If the version is set to 0,
-appoffset must be specified.
set <image> <csrver> <name> <value>
Sets a configuration value. Supported only for CSR OTA Update
versions.
<image> = The image file name (.img format).
<csrver> = The CSR OTA Update version (5). The version determinesthe
shared data offset, which can be overridden using the -dataoffset
option.
<name> = Configuration setting name ("dev_name","auth_key" or
"app_id").
<value> = Configuration setting value (as a string).
-quiet
Suppress non-essential output.
-help
Display this help text.
-dataoffset <offset>
Override the shared data offset.
<offset> = Shared data offset in bytes (ignored if zero).
-appoffset <offset>
Override the application offset.
<offset> = Application offset in bytes (ignored if zero).
e2cmd
c:\CSR_uEnergy_SDK-2.4.2.1\tools\bin\e2cmd.exe,version 2.4.2.149 Release
Copyright Cambridge Silicon Radio Limited2007 - 2014.
========================================================================
== Error: Not enough arguments given
========================================================================
c:\CSR_uEnergy_SDK-2.4.2.1\tools\bin\e2cmd.exe[-trans "..."] [-norun] [-pio_sda <val>] [-pio_scl <val>][-pio_wp <val>]
[ info | header [<val>]|
download <filename> | broad <filename> <devs> |
dump <filename> | verify <filename> |
fill <val> | broadfill <value> <devs> |
read <addr> | write <addr> <value> |
readblock <addr> <size> |
writeblock <addr> <val0> <val1> <val2> ...]
Options:
-help - Show usage information.
-trans - Space separated string of optional transport options, such as:
SPITRANS=LPT | USB
SPIPORT=<port_num>
SPIMUL=<device_on_multispi>
-quiet - Suppress non-essential output.
-norun - Prevents restart before exit.
-machine - Shows information in an easily parsed form (if appropriate).
-pio_sda <val> - The PIO to use for the I2C SDA line.
<val> is the PIOnumber 0-31.
-pio_scl <val> - The PIO to use for the I2C SCL line.
<val> is the PIOnumber 0-31.
-pio_wp <val> - The PIO touse for the EEPROM write protect line.
<val> is the PIOnumber 0-31 or
"not_used" if WP isnot controlled by a PIO.
-unlock <file> - Unlocks aSPI-lockable chip.
<file> is the filecontaining the key used for SPI-unlocking.
Commands:
info - Display information about the connected IC and EEPROM.
header [<val>] - Write the BlueCore header to the EEPROM. Anoptional value
can be specified to override the default size written in the header.
It must be in log2 bytes (i.e. address width: number of bits that make
up the address into the byte memory array). E.g. 12 for a 32Kbit EEPROM.
The optional value must be equal or less than the address width of the
whole EEPROM. The default is the whole EEPROM.
NOTE: Supported for BlueCore ICs only.
download <filename> - Download data from an EEPROM image file toEEPROM.
broad <filename> <devs>
Broadcast data from an EEPROM image file to EEPROMs via a gang
programmer.
<devs> lists chips to download to as a bitfield, see note below.
If <devs> is 0 then all devices found will be used.
dump <filename> - Copies the data from EEPROM to an EEPROM imagefile.
verify <filename> - Checks the contents of EEPROM match an EEPROMimage
file.
fill <val> - Fills the EEPROM with the word value.
broadfill <val> <devs>
Broadcast fills EEPROMs (via gang programmer) with the given word
value.
<devs> lists chips to download to as a bitfield, see note below.
If <devs> is 0 then all devices found will be used.
NOTE : The "devs" value expected by the "broad"commands is, by
default, decimal e.g. a value of 17, represents a bit mask of
10001 and therefore contains devices 0 and 4 but not 1,2 and 3.
If you wish to give a hexadecimal value for this or any other
value argument listed above, use a "0x" prefix.
CSR internal Commands (used at own risk):
read <addr> - Read word from hex addr.
write <addr> <value> - Write word to hex addr.
readblock <addr> <size> - Read<= 4096 words from hex addr.
writeblock <addr> <vals> - Write <= 4096 words to hexaddr.