Bee项目文档规范 RTL8762C OTA User Manual EN
User Manual:
Open the PDF directly: View PDF 
.
Page Count: 35
| Download | |
| Open PDF In Browser | View PDF |
RTL8762C OTA User Manual
ek
alt
Re
Co
de
nfi
V1.01
al
nti
2018/06/11
RTL8762C OTA User Manual
Revision History
Date
Version
Comments
Author
2018/06/09
V1.0
First release version
Ken
2018/06/11
V1.0.1
Modify Indications for image version.
2018/09/12
V1.1
Correction, formatting
Reviewer
Astor
ek
alt
Re
Co
al
nti
de
nfi
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
2
RTL8762C OTA User Manual
Contents
Revision History ................................................................................................................................................ 2
1
Overview ................................................................................................................................................... 5
1.1
Function Description ................................................................................................................................. 5
1.2
OTA Mechanics .......................................................................................................... 错误!未定义书签。
2
Flash layout ............................................................................................................................................... 6
3
Image Header Format ................................................................................................. 错误!未定义书签。
4
Package and flash layout sample ............................................................................................................. 13
Re
4.1
Support bank switching...................................................................................................................... 13
FLASH Layout ................................................................................................................................ 13
4.1.2
Usage of package tool without switching bank ............................................................................... 19
4.1.3
Usage of package tool with bank switching .................................................................................... 14
ek
alt
4.1.1
Attentions of RTKBLEMPTool Usage ...................................................................... 错误!未定义书签。
6
OTA Protocol .......................................................................................................................................... 22
Co
5
DFU Service ............................................................................................................................................ 22
6.2
OTA Service ............................................................................................................................................ 24
de
nfi
6.1
OTA CMD ....................................................................................................................................... 24
6.2.2
Device Mac ...................................................................................................................................... 25
6.2.3
Patch Version ................................................................................................................................... 25
6.2.4
APP Version .................................................................................................................................... 25
6.2.5
Patch Extension Version .................................................................................................................. 26
6.2.6
Test Mode ........................................................................................................................................ 26
6.2.7
Device Info ...................................................................................................................................... 26
6.2.8
Image Counter ................................................................................................................................. 28
6.2.9
Image Version .................................................................................................................................. 29
al
nti
6.2.1
7
Usage of Master application .................................................................................................................... 34
8
Reference ................................................................................................................................................. 35
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
3
RTL8762C OTA User Manual
Table List
Table 2.1: Flash Layout ............................................................................................................................................. 6
Table 2.5: OTA Header Format .................................................................................................................................. 9
Table 2.6: Fields of OTA Header ............................................................................................................................. 10
Table 2.7: Image Header Layout.............................................................................................................................. 10
Table 2.8: Image Header Field..................................................................................................................................11
Table 4.1: FLASH Layout Sample .......................................................................................................................... 14
Table 6.1: Dfu opcode.............................................................................................................................................. 23
Table 6.2: Ota Characteristic ................................................................................................................................... 24
Table 6.3: OTA CMD characteristics ....................................................................................................................... 25
Re
Table 6.4: Device Mac characteristics ..................................................................................................................... 25
Table 6.5: Patch Version characteristic for bee2 (don’t recommend, described in image version) ......................... 25
alt
Table 6.6: APP Version characteristic for bee2 (don’t recommend, described in image version) ........................... 26
Table 6.7: Patch Extension Version characteristic ................................................................................................... 26
ek
Table 6.8: Test Mode characteristics ........................................................................................................................ 26
Table 6.9: Device info characteristic for Bee2......................................................................................................... 27
Co
Table 6.10: Device info Format For Bee2 (OTA version = 1) ................................................................................. 28
Table 6.11: Image Counter characteristics ............................................................................................................... 28
al
nti
de
nfi
Table 6.12: Image Counter characteristics ............................................................................................................... 29
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
4
1
Overview
1.1 Function Description
OTA (Over The Air) represents the technology that apply Bluetooth to update image (code and data) that runs in
RTL8762C Flash.
Note: This document is also applied to RLT8752 series.
1.2 Related Emphasis
1． Flash Layout
3． Package
ek
alt
4． Ota Protocol
Re
2． IMG format
Co
al
nti
de
nfi
RTL8762C OTA User Manual
2 Flash layout
Flash layout of RTL8762C consists of OEM Config, OTA Bank0, OTA Bank1, FLASH Transport Layer(FTL),
OTA TMP and APP defined section, as shown in Figure 2.1. Start address for accessing Flash is 0x800000.
Start Address: 0x801000
OEM Config
Start Address: Variable
OTA Bank0
OTA Bank1
Re
FTL(FLASH Transport Layer)
OTA TMP(Reserved for legacy)
alt
APP Defined Section
ek
Figure 2.1: Flash Layout
Co
Memory and corresponding function of Flash is shown in Table 2.1
Size
Segment
Address
(Bytes)
Functions
de
Starting
nfi
Memory
Storage of Config information, including
0x801000
al
nti
OEM Config
0x1000
Bluetooth address, AES Key and Customizable
Flash Layout.
If not in bank switching mode, this region contains
the project data and codes to be executed,
including OTA Header, Secure boot, Patch, APP,
OTA Bank 0
Variable
Variable length
(defined in
(defined in OEM
OEM Config)
Config)
Data1, Data2. OTA_TMP is the backup region of
this OTA.
In bank switching mode, OTA Bank 0 and OTA
Bank 1 is backup region of each other. Suppose
OTA Bank 0 is execution region, then OTA Bank
1 is backup region.
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
6
RTL8762C OTA User Manual
Variable
Variable length
(defined in
(defined in OEM
OEM Config)
Config)
Variable
Variable length
(defined in
(defined in OEM
OEM Config)
Config)
OTA Bank 1
This region only exists when bank switching
method is applied. It has same functions and same
size with Bank 0 in bank switching mode
A software technology that access Flash with
logical address. Customer no longer needs to focus
FTL
on operations on Flash physical layer.
This region also balances consumption.
Variable length
(defined in
(defined in OEM
OEM Config)
Config)
Variable
Variable length
(defined in
(defined in OEM
OEM Config)
Config)
OTA_TMP
APP Defined
Section
Used as backup region of OTA if not in bank
switching mode. Its size should be no less than
largest image in OTA Bank 0.
The rest of Flash that can be customized. This
region cannot be managed by OTA scheme.
alt
Re
Variable
Table 2.1 FLASH Memory and Function Description
ek
OTA bank layout is shown in Figure 2.2, and description for each part is shown in Table 2.2.
Co
OTA Header
Low
Address
Secure Boot Loader
nfi
Patch
App Data0
App Data1
al
nti
de
App
High
Address
Figure 2.2 Layout of Bank 0/1
Memory
Starting Address
Size
Functions
Segment
Determined in the
OTA Header
This region contains the OTA Header version and start
4KB
OEM Config
address and size of the images in the bank
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
7
RTL8762C OTA User Manual
region
Determined in the
Secure Boot
Loader
OTA Header
Variable
This region contains secure boot loader.
region
Determined in the
This region contains the code that optimize and extend
Patch
OTA Header
Variable
the protocol stack and system in ROM.
region
Determined in the
App
OTA Header
Variable
This region contains project code.
Variable
Data region used in project.
region
App Data0
Re
Determined in the
OTA Header
region
alt
Determined in the
OTA Header
region
Variable
ek
App Data1
Data region used in project.
Co
Table 2.2 Flash Segmentation
de
nfi
3 Image Header Format
OTA Header image is made up of header (1KB) and dummy payload (3KB). OTA Header is generated by
al
nti
MPPackTool. Different fields of header are shown in Figure 2.3.
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
8
RTL8762C OTA User Manual
ctrl_header(12bytes)
uuid(16bytes)
exe_base(4bytes)
load_base(4bytes)
RSVD0(12bytes)
magic_pattern(4bytes)
RSVD1(44bytes)
git_version(16bytes)
RSA Public Key(260bytes)
ver_val(4bytes)
secure_boot_addr(4bytes)
secure_boot_size(4bytes)
rom_patch_addr(4bytes)
Header
(1024 bytes)
Re
rom_patch_size(4bytes)
app_addr(4bytes)
app_size(4bytes)
alt
app_data1_addr(4bytes)
app_data1_size(4bytes)
ek
app_data2_addr(4bytes)
app_data2_size(4bytes)
RSVD2(64bytes)
Co
payload_signature(256bytes)
payload_mac(16bytes)
header_signature(256bytes)
nfi
header_mac(16bytes)
de
Payload(3K bytes)
al
nti
Figure 3.1: OTA Header Format
Header fields and corresponding functions are shown in Table 2.3
Length
Fields
Functions
(Byte)
ctrl_header
12
Control message of OTA Header
secure_boot_addr
4
Start address of secure boot image
secure_boot_size
4
Size of secure boot image
rom_patch_addr
4
Start address of ROM patch image
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
9
RTL8762C OTA User Manual
rom_patch_size
4
Size of ROM patch image
app_addr
4
Start address of application image
app_size
4
Size of application image
app_data1_addr
4
Start address of application data1
app_data1_size
4
Size of application data1
app_data2_addr
4
Start address of application data2
app_data2_size
4
Size of application data2
Table 3.3: Fields of OTA Header
Image of patch, APP and App data is made up of image header (1KB) and corresponding payload. Image header
Re
of patch and APP is generated while compiling and linking, and that of App data is added by APP DATA Tool.
Header fields are shown in Figure 2.4, and corresponding functions are shown in Table 2.4
ek
alt
ctrl_header(12bytes)
uuid(16bytes)
exe_base(4bytes)
Co
load_base(4bytes)
load_len(4bytes)
RSVD0(8bytes)
nfi
magic_pattern(4bytes)
dec_key(16bytes)
de
RSVD1(28bytes)
Header
(1024 bytes)
git_version(16bytes)
al
nti
RSA Public Key(260bytes)
SHA256(32bytes)
RSVD2(76bytes)
payload_signature(256bytes)
payload_mac(16bytes)
header_signature(256bytes)
header_mac(16bytes)
Figure 3.4: Image Header Layout
Fields
Length(Byte)
Functions
ctrl_header
12
Control information field of Image Header
git_version
16
Information field of version control
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
10
RTL8762C OTA User Manual
Table 3.4: Image Header Field
ctrl_header format in Image Header is shown as follows:
typedef struct _IMG_CTRL_HEADER_FORMAT
{
uint8_t ic_type;
uint8_t secure_version;
union
{
struct
alt
{
Re
uint16_t value;
uint16_t xip: 1; // payload is executed on flash
ek
uint16_t enc: 1; // all the payload is encrypted
uint16_t load_when_boot: 1; // load image when boot
Co
uint16_t enc_load: 1; // encrypt load part or not
uint16_t enc_key_select: 3; // referenced to ENC_KEY_SELECT
uint16_t not_ready : 1; //for copy image in ota
nfi
uint16_t not_obsolete : 1; //for copy image in ota
de
uint16_t integrity_check_en_in_boot : 1; // enable image integrity
check in boot flow
al
nti
uint16_t rsvd: 6;
};
} ctrl_flag;
uint16_t image_id;
uint16_t crc16;
uint32_t payload_len;
} T_IMG_CTRL_HEADER_FORMAT;
ic_type represents IC type, which has the value of 5 when RTL8762C/RTL8752 chip is used. secure_version
indicates version of secure boot image.
image_id identifies different types of image, among which SCCD, OCCD and FactoryCode cannot be updated
through OTA. The types are enumerated in IMG_ID.
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
11
RTL8762C OTA User Manual
typedef enum _IMG_ID
{
SCCD
OCCD
= 0x278D,
= 0x278E,
FactoryCode
OTA
SecureBoot
= 0x278F,
= 0x2790, /* OTA header */
= 0x2791,
= 0x2792,
AppPatch
= 0x2793,
AppData1
= 0x2794,
AppData2
= 0x2795,
IMAGE_MAX
= 0x2796,
alt
} IMG_ID;
Re
RomPatch
ek
payload_length represents the size of image in byte, excluding 1KB image header.
crc16 indicates check method, which can be crc check and SHA256 check. 0 represents crc check and 1 represents
Co
SHA256 check.
ctrl_flag and OTA related bit field can be not_ready and not_obsolete. not_ready indicates whether OTA write is
nfi
successfully completed and its default value is 0. When image is about to be written into backup region, not_ready
will be set to 1 at first. Not until update transmission is completed and integrity check is passed will the not_ready
de
flag be set to 0 to indicate that image is ready.
not_obsolete indicates if the image should be abandoned and its default value is 1. This parameter is invalid in
al
nti
bank switching mode. When not in bank switching mode, if not_ready is read 0 and not_obsolete is read 1, image
will be moved from OTA_TMP region to specified region (APP region, Patch region or App data region).
not_obsolete flag will be written 0 after transfer completed.
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
12
RTL8762C OTA User Manual
4 Package and flash layout sample
4.1 Support bank switching
Related tool and their functions:
FlashMapGenerateToo:
Generate flash map.ini and flash_map.h, flash_map.h should be put in same
l
directory with project and generate APP Image. flash map.ini is the input file of
MPPackTool and MPTool to ensure image has the same address with the address in
settings.
MPPackTool:
Package OTA files.
MPTool:
Perform address conversion operation on Patch.
alt
Re
4.1.1 FLASH Layout
ek
Bank switching method needs 2 OTA Banks that are completely same to become the backup of each other. Its’s
Co
advantage is that program can directly jump to new bank when reboot. However, OTA update in bank switching
mode takes more flash memory to speed up update, so the size of flash memory should be larger if bank switching
method is applied.
nfi
If flash size is comparatively large, user can update firmware by applying bank switching method. Take 1 MB
de
Flash as example, the suggested Flash layout is shown below:
size
start address
1) SOCV Header
4K
0x800000
4K
0x801000
400K
0x802000
al
nti
sample layout for flash(total size = 1MB)
2) OEM Header
3) OTA Bank0
a) OTA Header
4K
b) Secure boot loader
16K
0x803000
c) Patch code
40K
0x807000
d) APP code
160K
0x811000
e) APP data1
180K
0x839000
f) APP data2
0K
4) OTA Bank1 (same as OTA Bank0)
a) OTA Header
400K
0x866000
4K
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
13
RTL8762C OTA User Manual
b) Secure boot loader
16K
0x867000
c) Patch code
40K
0x86B000
d) APP code
160K
0x875000
e) APP data1
180K
0x89D000
f) APP data2
0K
5) FTL
16K
6) OTA Temp
0K
7) APP Defined Section
0x8A1000
200K
Table 4.1: FLASH Layout Sample
alt
Re
Note: Flash Layout should be determined based on actual size of image and data.
4.1.2 Usage of package tool with bank switching
ek
1． Use FlashMapGenerateTool to ‘flash map.ini’ and ‘flash map.h’. Copy ‘flash map.h’ to project directory and
Co
open project with Keil. Link and compile the project to generate “app_MP_sdk#####+version+MD5.bin” file
for packaging. To apply Bank switching method, “mem_config.h” in project directory should be modified.
nfi
/** @brief set app bank to support OTA: 1 is ota bank1, 0 is ota bank0 */
de
#define APP_BANK
0
al
nti
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
14
RTL8762C OTA User Manual
ek
alt
Re
Figure 4.1 Generate Flash Layout
Co
Note: The ‘flash map.ini’ generated should keep consistent with the one used in mass production.
de
nfi
2． Open MP_PackTool, load the ‘flash map.ini’ file generated in step 1 and generate OTA Header0, OTA
al
nti
Header1 separately.
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
15
RTL8762C OTA User Manual
ek
alt
Re
Co
nfi
Figure 4.2 MP PACK Tool Load Flash Layout
de
OTA Header1 follows the same procedure.
al
nti
3． Generate OTA Header0 and OTA Header1. Take OTA Header0 as an example, as shown below. Generating
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
16
RTL8762C OTA User Manual
ek
alt
Re
Co
nfi
Figure 4.3 Generate OTA Header
bank be valid after OTA.
al
nti
de
Note: Only if the version number of OTA Header to be packaged is higher than that of current version, can new
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
17
RTL8762C OTA User Manual
4． Generate packet file of ImgPacketFile-xxxxxx.bin in current directory, which is used for updating.
ek
alt
Re
Co
nfi
de
Figure 4.4 Package to generate PACK
Note: 1. Both OTA Head0 and OTA Header1 need to be packaged to PACK, different from the mode without bank
al
nti
switching.
2. All the contents defined in Flash layout need to be packaged, especially Header, Patch and APP of OTA.
3. It is recommended that package both bank0 and bank1 in PACK.
4. Patch image address needs to be converted through RTKBLEMPTool.
5. APP DATA file is generated with APP DATA generation script, for detailed information refer to Bee2
Tools User Guide.
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
18
RTL8762C OTA User Manual
4.2 Do not support bank switching
4.2.1 FLASH Layout
The differences between the method without bank switching and the one with bank switching are:
1. OTA Bank1 region needn’t be allocated.
2. OTA Temp region needs to be allocated and its size should be no less than the largest image in OTA Bank0.
Thus, the method without bank switching saves more flash. After OTA transmission is completed and program is
rebooted, the data in OTA Temp region will be moved to the image region specified by OTA Bank0. The data
won’t be valid until program is rebooted, which increase the duration of update.
Re
The suggested Flash layout is shown below:
sample layout for flash(total size = 256KB)
alt
1) OEM Header
start addr
4K
0x801000
140K 0x802000
ek
2) OTA Bank0
size
4K
b) Secure boot loader
4K
0x80D000
c) Patch code
40K
0x803000
92K
0x80E000
0K
0x825000
d) APP code
Co
a) OTA Header
nfi
e) APP data1
de
f) APP data2
0K
0K
0x825000
4) FTL
16K
0x825000
92K
0x829000
5) OTA Temp
6) APP Defined Section
al
nti
3) OTA Bank1 (same as OTA Bank0)
0K
Table 4-2：FLASH Layout Sample
Note: The space for APP data is not allocated in this sample; FLASH Layout should be distributed based on
actual size of image and data.
4.2.2 Usage of package tool without bank switching
1． Use FlashMapGenerateTool to ‘flash map.ini’ and ‘flash map.h’. Copy ‘flash map.h’ to project directory and
open project with Keil. Link and compile the project to generate “app_MP_sdk#####+version+MD5.bin” file
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
19
RTL8762C OTA User Manual
for packaging. To apply Without Bank switching method, “mem_config.h” in project directory should be
modified.
/** @brief set app bank to support OTA: 1 is ota bank1, 0 is ota bank0 */
#define APP_BANK
0
ek
alt
Re
Co
de
nfi
Figure 4.5 flash layout generation
al
nti
2． Open MP_PackTool to load flash_map.ini generated in previous step and load corresponding image.
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
20
RTL8762C OTA User Manual
ek
alt
Re
Co
nfi
Figure 4.6 MP PACK Tool Load flash layout
de
Note: 1. OTA Head0 doesn’t need to be packaged to PACK, different from the mode with bank switching.
2. Content of Secure boot loader Image is defined in Flash Layout, but it’s not recommended to package if
al
nti
there isn’t any new version of Secure boot loader Image.
3. If only ROM Patch Image or APP Image, either of them can be packaged.
4. Patch image address needs to be converted through RTKBLEMPTool generally. Patch address here is the
same with the default address (0x803000) and it can be used without conversion.
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
21
RTL8762C OTA User Manual
5 OTA Protocol
5.1 DFU Service
DFU Service uuid: { 0x12, 0xA2, 0x4D, 0x2E, 0xFE, 0x14, 0x48, 0x8e, 0x93, 0xD2, 0x17, 0x3C, 0x87, 0x62,
0x00, 0x00}.
Re
DFU Service defines two Characteristics：
Data Characteristic accepts img data (write no response);
alt
Control Point Characteristic accepts control commands (write/notification);
ek
Control points supported by DFU Service:
M
Properties
Write
Parameter Description
Applicable
Response Parameter
Response
nfi
Start DFU①
Requirement
Co
Procedure
ic_type(UINT8)
Value(s)
ARV
None
de
secure_version (UINT8)
ctrl_flag.value(UINT16)
al
nti
image_id (UINT16)
crc16((UINT16)
payload_len (UINT32)
Receive FW image
M
Write
image_id (2byte-UINT16)
ARV
None
nImageLength
(4Byte-UINT32)
Validate FW
M
Write
image_id (2byte-UINT16)
ARV
None
Activate Image and
M
Write
None
None
None
M
Write
None
None
None
Reset
Reset System
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
22
RTL8762C OTA User Manual
M
Write
image_id(UINT16)
ARV
origin_image_version
Report Received
(UINT32)
Image Information
cur_offset (UINT32)
M
Write
connIntervalMin(UINT16)
ARV
None
ARV
Max buffer size(UINT16)
connIntervalMax
Connection
(UINT16)
parameter update
connLatency(UINT16)
supervisionTimeout
(UINT16)
Buffer check enable
M
IC type
O
Copy Img②
Mtu size(UINT16)
Write
mBufferSize(UINT16)
Write
Write
ARV
mCrc(UINT16)
Next send
offset(UINT32)
None
ek
M
None
alt
size&crc
Write
Re
Buffer check
M
image_id(UINT16)
ARV
ic_type(UINT8)
ARV
None
destination_addr(UINT32)
Co
copysize(UINT32)
Table 5.1: Dfu opcode
nfi
Note:
1. Parameter of “Start DFU” is ctrlheader of image. It will be written into flash as a part of update file after
written into Flash.
de
receiving ctrlheader. The 12 bytes received parameter of Start DFU will be decrypted first, then resolved to be
al
nti
2. To update APP data with bank switching when secure version and APPDATA version are the same, this
command can be used to copy contents of source bank to the destination bank directly without OTA data
transporting
To transmit data with buffer check enabled, the size of buffer check must be (16 ∗ 2n) bytes and no more than
max buffer size (returned by buffer check enable commands). If AES enabled, every 16-byte data will be
encrypted with AES. When data is received, it needs to be decrypted first. For the last 16 bytes don’t need
encryption. When buffer is full, data in buffer will be written into Flash.
To transmit data with buffer check disabled, data of 20*n (n=1,2,4,5,10) bytes is sent each time. Data won’t be
written into Flash until RTL8762C receives 2000 bytes of data.
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
23
RTL8762C OTA User Manual
If AES enabled, the data with the size of 16× 𝑞 will be encrypted, and the data with the size of 𝑟 won’t be
encrypted. 𝑞 and 𝑟 follows the formula:
𝒔𝒊𝒛𝒆 = 𝟏𝟔 × 𝒒 + 𝒓,
where 𝑞 stands for ‘quotient’ and 𝑟 stands for ‘remainder’.
5.2 OTA Service
OTA Service uuid: { 0x12, 0xA2, 0x4D, 0x2E, 0xFE, 0x14, 0x48, 0x8e, 0x93, 0xD2, 0x17, 0x3C, 0xFF, 0xD0，
0x00, 0x00}.
OTA Service defines the following Characteristics：
Device Mac
Mandatory Properties
Description
M/O
WriteWithoutResponse
Refer to OTA CMD
alt
OTA CMD
Requirement
M
Read
Refer to Device Mac
M
Read
Refer to Patch Version
M
Read
Refer to App Version
O
Read
Re
Characteristic Name
Patch Version
ek
App Version
Device Info
M
Image Counter
O
Image Version
M
WriteWithoutResponse
Refer to Test Mode
Read
Refer to Device Info
WriteResponse
Refer to Image Counter
Read
Refer to Image Version
al
nti
de
O
Version
nfi
Test Mode
Refer to Patch Extension
Co
Patch Extension Version
Table 5.2: OTA Characteristic
5.2.1 OTA CMD
UUID: 0xFFD1
This characteristic allows device to access control point of OTA. If DFU service runs in ROM code, it uses this
command to enter DFU mode.
Field
Names
Format
Value
Uint8
1
Requirement
OTA CMD
Mandatory
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
24
RTL8762C OTA User Manual
Table 5.3: OTA CMD characteristics
5.2.2 Device Mac
UUID: 0xFFD2
This characteristic is used to read BDA (Bluetooth Device Address) of RTL8762C to compare with the scanned
BDA in OTA mode.
Field
Name
Format
Value
Uint8*6
XX:XX:XX:XX:XX:XX
Requirement
Re
Device Mac
Mandatory
Table 5.4: Device Mac characteristics
ek
alt
5.2.3 Patch Version
Co
UUID: 0xFFD3
This characteristic is used to read patch version and compatible with Bee1. Patch version information is described
de
nfi
in “Image version” in Bee2.
Field
Name
Format
Patch Version
Mandatory
Uint32
Value
al
nti
Requirement
0xNNNNNNNN
Table 5.5: Patch Version characteristic for Bee2 (not recommend, described in image version)
5.2.4 APP Version
UUID: 0xFFD4
This characteristic is used to read APP version and compatible with Bee1 (not recommended in Bee2). APP
version information is described in “Image version” in Bee2.
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
25
RTL8762C OTA User Manual
Field
Name
Format
Value
Uint32
0xNNNNNNNN
Requirement
APP Version
Mandatory
Table 5.6: APP Version characteristic for Bee2 (not recommend, described in image version)
5.2.5 Patch Extension Version
UUID: 0xFFD5
This characteristic is used to read patch extension version. It is only used for Bee1 but not for Bee2.
Re
Field
Name
Format
Value
Uint16
0xNNNN
Requirement
alt
Patch extension
Optional
Version
ek
Table 5.7: 错误!未找到引用源。Patch Extension Version characteristic
Co
5.2.6 Test Mode
nfi
UUID: 0xFFD8
de
This characteristic allow device to exit control point in test mode and write ‘1’ to clear test flag to quit MP mode.
Requirement
Test mode
Optional
al
nti
Field
Name
Format
Value
Uint8
1
Table 5.8: Test Mode characteristics
Note: This characteristic is not related to OTA.
5.2.7 Device Info
UUID: 0xFFF1
This characteristic is used to read device information, and its description is shown below:
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
26
RTL8762C OTA User Manual
For the other BT SoC chip, the characteristic is as below.
Field
Name
Format
Value
Requirement
As Table
Device info
Mandatory
As Table 6.10
6.10
Table 5.9: Device info characteristic for Bee2.
ICType
Version
8bit
8bit
BBpro:
4
BEE2:5
Bit3~0:
OTA
version
= 0x1
Bit7~4:
Reserve
d:0x0.
Secure
Version
Format
Max
Buffer
Size
Reserved
8bit
16bit
16bit
0xNNNN
0x00
Bit
0
alt
Re
Value
8bit
MODE
0:normal mode
1:Support buffer
check
0:Aes flag not set
1
1:Aes flag Set
Bit
0: Only encrypt first
2
16 bytes of OTA data
ek
Bit
Co
in normal mode.
1:Encrypt 16*N bytes
of OTA date in normal
nfi
mode
Bit3
0: Disable Copy
de
Image.
1: Enable Copy Image.
0: Update one Image at
a time.
al
nti
Bit4
1: Update multiple
Images at a time.
Image Version Indicator
Format
(Attach to above table)
32bit
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
27
RTL8762C OTA User Manual
0xNNNNNNNN
Indications for each image version. Each indication uses 2 bits.
00: image does not exist.
01: image exists in bank0, OTA should update image for bank1.
10: image exists in bank1, OTA should update image for bank0.
11: image is standalone. OTA should update image for standalone.
bit[1:0]: Image 0
…
Value
bit[2N+1:2N]:Image N
(Attach to above table)
Image indicator for bee2 is as below:
SOCV Config File
Image 1
System Config File
Image 2
OTA Header File
Image 3
Secure Boot Loader Image
ek
alt
Re
Image 0
Image 4
ROM Patch Image
Image 5
APP Image
Image 7
Co
Image 6
APP Data1 File
APP Data2 File
nfi
Table 5.10: Device info Format For Bee2 (OTA version = 1)
de
5.2.8 Image Counter
al
nti
UUID: 0xFFF2
This characteristic is used to write response and inform device how many image files are about to be written.
Field
Name
Format
Value
Uint8
0xNN
Requirement
Image Counter
Optional
Table 5.11: Image Counter characteristics
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
28
RTL8762C OTA User Manual
5.2.9 Image Version
UUID: 0xFFE0~FFEF
This characteristic is used to read image versions of device. Each image version occupies 4 bytes. Limited to
MTU size (20 bytes), user needs to define another characteristic (UUID: 0xFFE0~FFEF) to read next image
version when number of image is greater than 5. The number of device img versions is indicated by Image Version
Indicator, which is defined in Device Info (0xfff1).
Field
Name
Format
Value
Requirement
Re
Image Version
mandatory
Uint32*N
Table 5.12: Image Counter characteristics
ek
alt
Co
al
nti
de
nfi
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
29
RTL8762C OTA User Manual
5.3 OTA Procedure
5.3.1
OTA procedure without buffer check
BeeController
BeeTarget
Connect to target
MTU size Change request
MTU size update
Enable DFU Control Point Notification
Re
Write: DFU CP(opcode 0x07-Connection parameter update)
alt
(req opcode 0x07):Notification
ek
Connection parameter update
Write: DFU CP(opcode 0x06-Report Target image information)
Co
(req opcode 0x06 Original FW version):Notification
Write: DFU CP(opcode 0x01-Start DFU: Image Header
nfi
Check whether it is need to update image
de
(ic_type, secure_version, ctrl_flag.value, image_id, crc16,
payload_len and nPadding)
(req opcode 0x01):Notification
WriteWithoutResponse: DFU Packet characteristic(First FW image)
.
.
.
al
nti
Write: DFU CP(opcode 0x02-Receive FW image)
WriteWithoutResponse: DFU Packet characteristic(Final FW image)
Write: DFU CP(opcode 0x03-Valid FW)
(req opcode 0x03):Notification
Write: DFU CP(opcode 0x04-Activate and Reset)
Disconnect
Activate new
image&reset
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
30
RTL8762C OTA User Manual
5.3.2 OTA procedure with buffer check
ek
alt
Re
Co
al
nti
de
nfi
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
31
RTL8762C OTA User Manual
BeeController
BeeTarget
Connect to target
MTU size Change request
MTU size update
Enable DFU Control Point Notification
Write: DFU CP(opcode 0x09-Buffer Check Enable)
(req opcode 0x09 Max buffersize&MTU Size):Notification
Write: DFU CP(opcode 0x07-Connection parameter update)
(req opcode 0x07):Notification
Connection parameter update
Write: DFU CP(opcode 0x06-Report Target image information)
Re
(req opcode 0x06 Original FW version):Notification
alt
Check whether it is need to update image
payload_len and nPadding)
ek
Write: DFU CP(opcode 0x01-Start DFU: Image Header
(ic_type, secure_version, ctrl_flag.value, image_id,
crc16,
(req opcode 0x01):Notification
Co
Write: DFU CP(opcode 0x02-Receive FW image)
WriteWithoutResponse: DFU Packet characteristic(First FW image)
Write: DFU CP(opcode 0x0B-Report Buffer CRC )
nfi
...Writes until a Crc check buffer is full
(req opcode 0x0B):Notification
al
nti
Repeat Write buffer
&Buffer Check
de
.
.
.
WriteWithoutResponse: DFU Packet characteristic(Final FW image)
...Writes until File end
Write: DFU CP(opcode 0x0B-Report Buffer CRC )
(req opcode 0x0B):Notification
Write: DFU CP(opcode 0x03-Valid FW)
(req opcode 0x03):Notification
Write: DFU CP(opcode 0x04-Activate and Reset)
Disconnect
Activate new
image&reset
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
32
RTL8762C OTA User Manual
5.3.3 Multiple File Update
1． Without bank switching, a new file cannot be updated until the previous file has been verified and program
has been rebooted when packaged file includes Patch, APP or APPDATA.
2． With bank switching, program cannot be rebooted until all the files have been updated and verified when the
packaged file includes OTA Header, Patch, APP or APPDATA. Otherwise, this update will be invalid for that
all the files in bank region must come into effect to ensure the program is running properly with bank
switching.
ek
alt
Re
Co
al
nti
de
nfi
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
33
RTL8762C OTA User Manual
6 Usage of Master application
Omitted
ek
alt
Re
Co
al
nti
de
nfi
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
34
RTL8762C OTA User Manual
7 Reference
[1] 《RTL8762C Device Firmware Update Profile Rom Version》
[2] 《RTL8762C Device Firmware Update Service Rom Version》
ek
alt
Re
Co
al
nti
de
nfi
Copyright 2018 Realtek Semiconductor Corporation.
All Rights Reserved.
35
Source Exif Data:
File Type : PDF File Type Extension : pdf MIME Type : application/pdf PDF Version : 1.5 Linearized : No Encryption : Standard V2.3 (128-bit) User Access : (none) Creator : Microsoft® Word 2016 Title : Bee项目文档规范 Author : Chuanguo Xue Producer : Microsoft® Word 2016; modified using iTextSharp 5.0.5 (c) 1T3XT BVBA Subject : Draft v0.1 Modify Date : 2018:09:21 11:34:40+08:00 Create Date : 2018:09:21 11:20:42+08:00 Tagged PDF : Yes Language : zh-CN Page Count : 35EXIF Metadata provided by EXIF.tools