Service Discovery - ATT Read Transaction 0; Invalid Handle

[Dresse]

Hi Nordic,

I am working on a project where I connect via nrf52 DK, to a peripheral. I am runinng on SDK15, with the experimental build ble_app_interactive, inside the ble_central_and_peripheral folder. I have made some minor changes to the program, but these should not effect it in any way.

Now to the problem. When connecting to the peripheral, there is no problem. I am running with privacy on, since that is the only way to connect. After that i pair with LESC with the peripheral. All this works, but then i try to do service discovery, with the command GATT services <address>, but this is where it doesn't work anymore. The nrf52 does not get a response. I am using a sniffer, Ellisys, and here's a snip of what is going on.

I think it is the nrf52, which is trying to read attribute handle 0, which is not possible. I am not that strong in BLE yet, therefore I'm not able to see myself what is going on. I am also confused about the specific attribute handle. 

And after this, it is stuck, it keeps trying to read on attribute handle 0.

Hope you can help.

Regards Andreas

[MartinBL]

Hi,

I did a quick test with SDK 15.0.0 and paring and reading services seems to work for me. 

1. Does it work if you don't modify the example?
2. What are yo using as a peripheral?
3. Can you post the exact command sequence that you use to produce the problem?
4. Are you getting any logging information out of the peripheral and central?
5. Can you upload the sniffer trace file?

[Dresse]

Hi,
I have also tested this with my phone, and discoverying services work with that one.

1. The only thing i have modified, is that it only keeps devices which has a Complete Local Name, in their advertising packets. 

2. My peripheral is a hearing aid from Oticon. It is not a product that is available for the public yet. I am working on a project where I have to connect to their hearing aid, and then do some benchmarking. 
If I connect via my phone to the hearing aid, using the nrf connect app, I can connect to the hearing aid, and see services

3. Exact command sequence:
     1. privacy on

     2. scan on

     3. devices

     4. connect <specific address>

     5. pair LESC <specific address>

     6. gatt services <specific address>

And that is it. After that it doesn't write out the services, and if i try to do it again or disconnect from device, i get fatal error and system reset

4. With my setup, i can't get any logging out of the peripheral, besides the bluetooth communication. I am also not getting any logging beside my terminal setup, with the nrf52 DK.

5. I only have it as an Ellisys Bluetooth Trace File. Hopefully you can use that.

20181102_ServiceDiscoveryNordicHI.btt

[MartinBL]

Are you using SDK 15.0.0? Can you try SDK 15.2.0? I found a bug report related to service discovery which is supposed to have been fixed in SDK 15.2.0. The report is somewhat vague and the guy who handled it is out of office, so I'm not sure if it is relevant. 

[Dresse]

I was using 15.1.0. I have just tried with SDK 15.2.0 and it is still the same. Using gatt services <address>, i get no response, and if i try to disconnect, it crashes with Fatal error.

[Dresse]

Where does it chose which attribute handle to go for next? Is it something I can mess with, or is in the bluetooth stack, i.e. S132?

[Dresse]

So trying to come to some conclusions myself. Analyzing the code and the trace file, in cli_m.c, it has the handler for Service Discovery "cmd_services_discovery". It  uses the start handle 0x0001, and then it uses a function called "sd_ble_gattc_primary_services_discover", which is a function in the SoftDevice, if i have understood it correctly. 
Then comparing to the trace file. First it send an ATT Read By Group Type Request, which is the service discovery, on handle 1, which is what is set in "cmd_services_discovery", after this, i can't figure it out since it is hidden in the SoftDevice, i believe. It goes to the next available handle, which is 31, then 157, and then it just makes an ATT Read, which I would believe is just a characteristic? Maybe? I'm fairly new to this Bluetooth show, so please correct me if i am wrong. It makes an ATT Read on handle 31, and then on 66, and after this one, it tries to make an ATT Read on handle 0, which is nonexistence, and that is not a legitimate handle, and again, please correct me if I am wrong.And now it's stuck on trying to make an ATT read on handle 0, which is not possible.

Just trying to figure things out myself.