OTA

OTA (Over The Air) represents the technology that applies Bluetooth to upgrade image (code and data) that runs in RTL87x2G Flash.

OTA Scheme

Depending on different flash layout , there are two OTA schemes: supporting Bank switching and non-supporting Bank switching. Whether or not Bank switching is supported, the boot patch image is always independently dual-banked, serving the same function and acting as a backup for each other. For example, if the current boot patch is running in bank0, the OTA can only upgrade the boot patch in bank1. After the upgrade is complete, the system will restart and choose the bank with the higher version number to run. If the version numbers are the same, it will run in bank0.

In the non-supporting Bank switching OTA scheme, the OTA TMP area is used as an OTA backup area to store backup firmware. The BootLoader will eventually copy and activate the backup firmware. On the other hand, in the supporting Bank switching OTA scheme, OTA Bank0 and OTA Bank1 are used as mutually backup firmware storage areas. During the firmware update process, these two storage areas can be alternately used, ensuring that in the event of a firmware update failure, the system can revert to the previous backup firmware, thereby maintaining system stability and security.

The flash layout of the non-supporting Bank switching scheme and the supporting Bank switching scheme have the following differences.

  1. The capacity of the OTA Bank1 area is not allocated.

  2. The OTA TMP area needs to be allocated, and its size should not be less than the largest image size in OTA Bank0. Therefore, the non-supporting bank switching scheme relatively saves flash space. After the OTA transmission is completed, the boot program will copy the data in the OTA TMP area to the specified image area in OTA Bank0, and then restart to take effect, which relatively increases the restart time after the OTA upgrade is completed.

  3. The non-supporting Bank switching scheme also supports combined image upgrades, which is enabled by default. When using a combined image upgrade, when writing the image data to the OTA TMP area, it will calculate whether the remaining space in the OTA TMP area can accommodate the next image file that needs to be written. If it can, it will continue to write the next image file to the OTA TMP area. When it can’t, it will copy the data in the OTA TMP area to the OTA Bank0 area. The advantage of combined upgrading is to reduce the number of restarts and speed up the transmission rate.

  • Advantages: The total size of the bank is fixed. There is a backup bank. It is possible to dynamically adjust the size of each image in the bank.

  • Disadvantages: The utilization rate of flash space is low.

  • Maintenance: It is necessary to maintain images for two bank corresponding addresses. The image released by Realtek by default only supports running on bank0. If it is necessary to run on bank1, contact Realtek to obtain it.

  • Advantages: The utilization rate of flash space is higher.

  • Disadvantages: Each image cannot be upgraded at the same time, and there are situations where old and new combinations coexist. After OTA is completed, activating the image will increase the boot time for that time.

  • Maintenance: Only the Bank0 image is needed.

Tool Usage

Tool

Flash Map Generate Tool

Generate flash_map.h, flash map.ini and OTA Header file. Please refer to Flash Map Generate Tool.

Note

  • flash_map.h needs to be placed in the upper-level directory of the project to participate in the compilation and generate the APP image.

  • flash map.ini is the input file of MPPackTool and MP Tool, and it is necessary to ensure that the image is consistent with all the output addresses set.

MP Pack Tool

Package OTA files. Please refer to MP Pack Tool.

APP Data Tool

The APP Data file is generated through the SDK generation script. For details, please refer to the APP Data Tool Quick Start Guidertl87x2g_sdk_xxxx\tools\AppData.

User Data Tool

The User Data file is generated through the SDK generation script: rtl87x2g_sdk_xxxx\tools\UserData.

OTA Supporting Bank Switching Scheme

Flash Layout

Please refer to Flash Layout Sample(supporting Bank switching) .

Usage of Package Tool

  1. Use Flash Map Generate Tool to flash map.ini, flash_map.h, Bank0 OTA Header file and Bank1 OTA Header file.

    1. Select Flash Size.

    2. Select Enable bank switch.

    3. Set up two-level flash layout.

    4. Click Confirm to complete the flash layout settings.

    5. Modify OTA Header file version.

    6. Click Confirm to generate flash_map.h, flash map.ini, Bank0 OTA Header file and Bank1 OTA Header file.

    ../../../../_images/dual_bank_Flash_layout_config.png

    Flash layout config and generate ota header image

    Note

    The version number of the OTA Header used for packaging is higher than the version number of the original running version, so that the new bank can take effect normally after the OTA upgrade.

  2. Copy flash_map.h to the upper-level directory with project. Link and compile the project to generate app_MP_sdk#####+version+MD5.bin file for packaging.

    ../../../../_images/Build_APP_image.png

    Build APP image

    Note

    Supporting Bank switching scheme needs to compile the app images of OTA BANK0 and OTA BANK1. The demo app project in the Realtek released SDK can only compile the app image of OTA BANK0 by default. Compiling app image of OTA BANK1 needs modifying the macro ‘APP_BANK’ in mem_config.h in the upper-level directory as the project file to 1.

/** @brief set app bank to support OTA: 1 is ota bank1, 0 is ota bank0 */
#define APP_BANK                                  1
  1. Get the System Patch, BT Stack Patch, and BT Host image that runs in OTA Bank1.

    Note

    The default released System Patch, BT Stack Patch, and BT host image can only run in OTA Bank0. Please consult Realtek to get the system patch, stack patch, and BT Host image that runs in OTA Bank1 when choosing the supporting Bank switching scheme.

  2. Generate a packet file of ImgPacketFile-xxxxxx.bin in the current directory, which is used for updating.

    1. Select the ForOTA option.

    2. Load the generated flash map.ini.

    3. Load all OTA Bank0 and Bank1 images according to the set flash map.

    4. Click Confirm to generate the package file.

    ../../../../_images/MPPackTool_dual_bank.png

    Use the MP Pack Tool to package files – supporting Bank switching

    Note

    • Both the Bank0 OTA Header file and the Bank1 OTA Header file need to be packaged, different from the non-supporting Bank switching scheme.

    • All the contents defined in the flash layout need to be packaged.

    • It is recommended to package both Bank0 and Bank1.

OTA Non-supporting Bank Switching Scheme

Flash Layout

Please refer to Flash Layout Sample(non-supporting Bank switching) .

Usage of Package Tool

  1. Use Flash Map Generate Tool to flash map.ini, flash_map.h and Bank0 OTA Header file.

    1. Select Flash Size.

    2. Select Disable bank switch.

    3. Set up two-level flash layout.

    4. Click Confirm to complete the flash layout settings.

    5. Modify OTA Header file version.

    6. Click Confirm to generate flash_map.h, flash map.ini and Bank0 OTA Header file.

    ../../../../_images/single_bank_Flash_layout_config.png

    Configure Flash Layout and generate Bank0 OTA Header file

    Note

    The flash map.ini generated here needs to be consistent with the flash map.ini used in the MP stage.

  2. Copy flash_map.h to the project directory. Link and compile the project to generate app_MP_sdk#####+version +MD5.bin file for packaging. To apply the non-support Bank switching scheme, mem_config.h in the project directory should be modified.

/* @brief set app bank to support OTA: 1 is ota bank1, 0 is ota bank0 */
#define APP_BANK                                  0
  1. Open MP Pack Tool to load flash_map.ini generated in the previous step and load the corresponding image.

    1. Select ForOTA option.

    2. Load the generated flash map.ini.

    3. Load all OTA Bank0 images according to the set flash map.

    4. Click Confirm to generate the package file.

    ../../../../_images/MPPackTool_single_bank.png

    Use the MP Pack Tool to package files – non-supporting Bank switching

    Note

    • Bank0 OTA Header file can’t be packaged, which is different from the supporting Bank switching scheme.

    • If only Patch Image or APP Image, either of them can be packaged.

User Data Upgrade

Flash Layout

Below is an example of upgrading User Data with a 1M byte flash. The flash layout is shown in the table below.

Flash Layout Sample(User Data upgrade)

Sample Layout for flash (total size = 1M)

Size(Bytes)

Start Address

Reserved

4K

0x04000000

OEM Header

4K

0x04001000

Bank0 Boot Patch

32K

0x04002000

Bank1 Boot Patch

32K

0x0400A000

OTA Bank0

612K

0x04012000

  • OTA Header

4K

0x04012000

  • System Patch code

32K

0x04013000

  • BT Stack Patch code

60K

0x0401B000

  • BT Host code

212K

0x0402A000

  • APP code

192K

0x0405F000

  • APP Config File

4K

0x0408F000

  • APP data1

0K

0x04090000

  • APP data2

0K

0x04090000

  • APP data3

0K

0x04090000

  • APP data4

0K

0x04090000

  • APP data5

0K

0x04090000

  • APP data6

0K

0x04090000

OTA Bank1(Equal to 0)

0K

0x04090000

Bank0 Secure APP code

0K

0x04090000

Bank0 Secure APP Data

0K

0x04090000

Bank1 Secure APP code

0K

0x04090000

Bank1 Secure APP Data

0K

0x04090000

OTA Temp

212K

0x04090000

FTL

16K

0x040C5000

user data1

16K

0x040C9000

user data2

16K

0x040CD000

user data3

16K

0x040D1000

user data4

16K

0x040D5000

user data5

16K

0x040D9000

user data6

16K

0x040DD000

user data7

16K

0x040E1000

user data8

16K

0x040E5000

APP Defined Section

4K

0x040E9000

Usage of Package Tool

  1. Use Flash Map Generate Tool to flash map.ini, flash_map.h and Bank0 OTA Header file.

../../../../_images/user_data_Flash_layout_config.png

Configure Flash Layout and generate Bank0 OTA Header file

Note

The flash map.ini generated here needs to be consistent with the flash map.ini used in the MP stage.

  1. Use the script : rtl87x2g_sdk_xxxx\tools\UserData to generate a User Data file that supports packaging.

  2. Open MPPackTool to load flash_map.ini generated in previous step and load corresponding image.

    1. Select ForOTA option.

    2. Load the generated flash map.ini.

    3. Load User data image according to the set flash map.

    4. Click Confirm to generate the package file.

../../../../_images/MPPackTool_user_data.png

Use the MP Pack Tool to package files – User Data upgrade

Note

  • If only certain User Data needs to be updated, only one of them can be packaged.

  • Allows User Data to be packaged and upgraded together with other images.

OTA Protocol

OTA is divided into silent OTA and normal OTA depending on the transmission protocol.

  • Silent OTA
    During the image upgrade process, the original functions of the device can be used normally. After the upgrade is completed, it only takes a short restart time for the program to automatically switch to the new functions.
  • Normal OTA
    The function is stable. However, the upgrade process requires switching the device to DFU mode, and the original functions cannot be used until the upgrade is completed.

Both types of upgrades will use the OTA Service and DFU Service. The OTA Service is used to obtain device information or enter DFU mode, while the DFU Service is used to execute the upgrade process.

OTA Service

The uuid and characteristic of OTA Service are as follows.

{0x12, 0xA2, 0x4D, 0x2E, 0xFE, 0x14, 0x48, 0x8e, 0x93, 0xD2, 0x17, 0x3C, 0xFF, 0xD0, 0x00, 0x00}
OTA Characteristics

Characteristic Name

Require-

ment

UUID

Properties

Format

Value

Instruction

OTA CMD

M

0xFFD1

Write Without Response

Uint8

1

The control endpoint that allows the device to enter DFU mode

Device Mac

M

0xFFD2

Read

Uint8*6

XX:XX:XX:XX:XX:XX

Read BDA of RTL87x2G to compare with the scanned BDA in DFU mode

Device Info

M

0xFFF1

Read

Device info Format (OTA version=1)

Device info Format (OTA version=1)

Read device information

Protocol Type

M

0xFFF3

Read

Uint16

0xNNNN

A read request to obtain OTA protocol information

Image Version

M

0xFFE0~FFE1

Read

(Uint32+Uint16)*21+2

Byte0: bank num

  • 0: active bank

  • 1: inactive bank

Byte1: image num

Byte2~Byte3: image ID 1

Byte4~Byte7: image version 1

Byte8~Byte9: image ID 2

Byte10~Byte13: image Version 2

……

read image versions of device, see the following notes for details

Image Section Size

M

0xFFE4~FFE5

Read

(Uint32+Uint16)*21+1

Byte0: image num

Byte1~Byte2: image ID 1

Byte3~Byte6: image max size 1

Byte7~Byte8: image ID 2

Byte9~Byte12: image max size 2

……

a read request to obtain the maximum size of the firmware layout.

Device info Format (OTA version=1)

Byte

Value

Byte0

ic_type

Byte1

spec version

Byte2

Bit0: buffer check

0: not support buffer check

1: support buffer check

Bit1: AES

0: AES not enable

1: AES enable

Bit2: encryption mode

0: Encrypt First 16bytes

1: Encrypt 16*N bytes

Bit3

0: Update one Image at a time

1: Update Multi Image at a time

Byte3

Reserved

Byte4~5

OTA Temp Buffer Size(uint 4K)

Byte6

active OTA bank num

0: not support dual bank

1: dual bank, bank0 is active bank

2: dual bank, bank1 is active bank

Byte7

active Boot Patch bank num

0: not support dual bank

1: dual bank, bank0 is active bank

2: dual bank, bank1 is active bank

Byte8

active Secure APP bank num

0: not support dual bank

1: dual bank, bank0 is active bank

2: dual bank, bank1 is active bank

Byte9~10

crtl header offset

The offset of the ctrl header in the image header

DFU Service

DFU Service UUID characteristics are shown below.

{0x12, 0xA2, 0x4D, 0x2E, 0xFE, 0x14, 0x48, 0x8E, 0x93, 0xD2, 0x17, 0x3C, 0x87, 0x62, 0x00, 0x00}
  • Data Characteristic: accepts image data (write no response)

  • Control Point Characteristic: accepts control commands (write/notification)

Control points supported by DFU Service.

DFU Opcode

Opcode

value

Procedure

Requirement

Properties

Parameter Description

Applicable Response Value(s)

Response Parameter

0x01

Start DFU

M

Write

crc16((UINT16)

ic_type(UINT8)

secure_version(UINT8)

ctrl_flag.value(UINT16)

image_id(UINT16)

payload_len(UINT32)

ARV

None

0x02

Receive FW image

M

Write

image_id(UINT16)

nImageLength(UINT32)

ARV

None

0x03

Validate FW

M

Write

image_id(UINT16)

is the last image(UINT8)

ARV

None

0x04

Activate Image and Reset

M

Write

is enter dfu mode directly

after reset(UINT8)

ARV

None

0x05

Reset System

M

Write

None

None

None

0x06

Report Received Image Information

M

Write

image_id(UINT16)

ARV

origin_image_version(UINT32)

cur_offset (UINT32)

0x07

Connection parameter update

M

Write

connIntervalMin(UINT16)

connIntervalMax(UINT16)

connLatency(UINT16)

supervisionTimeout(UINT16)

ARV

None

0x09

Buffer check enable

M

Write

image_id(UINT16)

ARV

Max buffer size(UINT16)

Mtu size(UINT16)

0x0A

Buffer check size&crc

M

Write

mBufferSize(UINT16)

mCrc(UINT16)

ARV

Next send offset(UINT32)

0x0B

IC type

O

Write

None

ARV

ic_type(UINT8)

0x0D

Get image ver

M

Write

bank_num(UINT8)

ARV

bank_num(UINT8)

image_num(UINT8)

image_id1(UINT16)

image_version1(UINT16)

0x0F

Check sha256 value

O

Write

image_num(UINT16)

image_id(UINT16)

sha256 value(UINT16)

ARV

image_id(UINT16)

check ret(UINT8)

0x12

Report image number

M

Write

image id(UINT16)

current image number(UINT8)

total image number(UINT8)

ARV

None

Note

  • After receiving the control header of the image, it needs to be decrypted and then parsed. not_ready will be temporarily written to 1 and then written to flash.

  • During data transmission, if AES encryption is supported, every 16 bytes are encrypted. After the receiving end receives the data, it needs to be decrypted first. The last part, less than 16 bytes, is sent without encryption. When the buffer check size is full, write to flash.

OTA Procedure

OTA Bluetooth Transmission Process

../../../../_images/OTA_Bluetooth_transmission_process.png

OTA Bluetooth transmission process

  • BeeController: The device initiating the upgrade

  • BeeTarget: The device receiving the upgrade

OTA Activation Process

  • non-supporting Bank switching

    • supporting combined image upgrades: while writing the image data to the OTA TMP area, the remaining space in the OTA TMP area will be calculated to determine if it can accommodate the next image file to be written. If it can, the process continues by writing the next image file to the OTA TMP area. If it cannot, the data in the OTA TMP area is moved to the OTA Bank0 region, and after a restart, the copy and activation take effect. Subsequently, the next file can be upgraded.

    • non-supporting combined image upgrades: when the packaged file to be upgraded contains Patch, APP or APP DATA, one file upgrade needs to be successfully verified. After the copy is restarted and activated to take effect, the next file can be upgraded.

  • supporting Bank switching
    When the packaged files to be upgraded contains OTA Header file, Patch, APP, or APP DATA, each file must be individually transmitted and validated as successfully received before transmitting and validating the next file. All files must be successfully transmitted and validated before a reboot can occur; otherwise, the current upgrade attempt will be invalid. This is because, in the bank switching scheme, all files in the Bank area need to become effective together for the system to run properly.