Connection problem to nRF51822 from Linux

[martonmiklos]

I am developing a HID keyboard based on an nRF51822.

The firmware source available here:

https://github.com/martonmiklos/ble_keyboard_fw

(It is based on the ble_sdk_app_hids_mouse example.)

I am building it with S130 softdevice with nRF5_SDK_12.3.0_d7731ad

I am trying to connect to the device from Ubuntu 18.04 with bluez 5.48 kernel 4.15.0-65.

I can connect to the device with gattool:

mm@lapos:~$ gatttool -t random -b E8:83:76:AE:34:7D -I
[E8:83:76:AE:34:7D][LE]> connect
Attempting to connect to E8:83:76:AE:34:7D
Connection successful
[E8:83:76:AE:34:7D][LE]> info
Error: info: command not found
[E8:83:76:AE:34:7D][LE]>
char-desc char-read-uuid char-write-req connect exit included primary sec-level
char-read-hnd char-write-cmd characteristics disconnect help mtu quit
[E8:83:76:AE:34:7D][LE]> char
char-desc char-read-hnd char-read-uuid char-write-cmd char-write-req characteristics
[E8:83:76:AE:34:7D][LE]> characteristics
handle: 0x0002, char properties: 0x0a, char value handle: 0x0003, uuid: 00002a00-0000-1000-8000-00805f9b34fb
handle: 0x0004, char properties: 0x02, char value handle: 0x0005, uuid: 00002a01-0000-1000-8000-00805f9b34fb
handle: 0x0006, char properties: 0x02, char value handle: 0x0007, uuid: 00002a04-0000-1000-8000-00805f9b34fb
handle: 0x000a, char properties: 0x02, char value handle: 0x000b, uuid: 00002a29-0000-1000-8000-00805f9b34fb
handle: 0x000c, char properties: 0x02, char value handle: 0x000d, uuid: 00002a50-0000-1000-8000-00805f9b34fb
handle: 0x000f, char properties: 0x12, char value handle: 0x0010, uuid: 00002a19-0000-1000-8000-00805f9b34fb

So far so good.

However if I try to connect with bluetoothctl I could not get it connected:

mm@lapos:~$ bluetoothctl
[NEW] Controller 00:15:83:D1:A9:E6 BT 4.0 [default]
[NEW] Device 44:D3:A9:5D:02:89 44-D3-A9-5D-02-89
[NEW] Device 73:EA:BF:EA:52:2C 73-EA-BF-EA-52-2C
[NEW] Device A0:6F:AA:9E:3E:03 LG SJ5(03)
[NEW] Device E8:83:76:AE:34:7D MM-keyboard
[NEW] Device FD:04:9E:1A:C6:AE MM Plane
[NEW] Controller D0:DF:9A:3F:6F:4C Internal
[NEW] Device 94:FD:2E:02:E8:06 Jolla C
[NEW] Device 50:56:A8:00:18:42 Jolla
Agent registered
[bluetooth]#
advertise default-agent exit menu power scan system-alias version
agent devices help pair quit select trust
block disconnect info pairable remove set-alias unblock
connect discoverable list paired-devices reset-alias show untrust
[bluetooth]# menu
Missing name argument
[bluetooth]# agent KeyboardOnly
Agent is already registered
[bluetooth]# default-agent
Default agent request successful
[bluetooth]# pairable on
Changing pairable on succeeded
[bluetooth]# pair E8:83:76:AE:34:7D
Attempting to pair with E8:83:76:AE:34:7D
[bluetooth]# trust E8:83:76:AE:34:7D
Changing E8:83:76:AE:34:7D trust succeeded
[bluetooth]# connet E8:83:76:AE:34:7D
Invalid command
[bluetooth]# connect E8:83:76:AE:34:7D
Attempting to connect to E8:83:76:AE:34:7D
[CHG] Device E8:83:76:AE:34:7D Connected: yes
[CHG] Device E8:83:76:AE:34:7D Connected: no
Failed to pair: org.bluez.Error.AuthenticationCanceled
Connection successful
[CHG] Device E8:83:76:AE:34:7D Connected: yes
[CHG] Device E8:83:76:AE:34:7D Connected: no
[CHG] Device E8:83:76:AE:34:7D Paired: yes

During this procedure the btmon shows the following HCI communication:

< HCI Command: LE Create Connection (0x08|0x000d) plen 25 #10 [hci1] 7.822253
Scan interval: 60.000 msec (0x0060)
Scan window: 60.000 msec (0x0060)
Filter policy: White list is not used (0x00)
Peer address type: Random (0x01)
Peer address: E8:83:76:AE:34:7D (Static)
Own address type: Public (0x00)
Min connection interval: 7.50 msec (0x0006)
Max connection interval: 15.00 msec (0x000c)
Connection latency: 20 (0x0014)
Supervision timeout: 3000 msec (0x012c)
Min connection length: 0.000 msec (0x0000)
Max connection length: 0.000 msec (0x0000)
> HCI Event: Command Status (0x0f) plen 4 #11 [hci1] 7.826173
LE Create Connection (0x08|0x000d) ncmd 1
Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 19 #12 [hci1] 9.865108
LE Connection Complete (0x01)
Status: Success (0x00)
Handle: 39
Role: Master (0x00)
Peer address type: Random (0x01)
Peer address: E8:83:76:AE:34:7D (Static)
Connection interval: 15.00 msec (0x000c)
Connection latency: 20 (0x0014)
Supervision timeout: 3000 msec (0x012c)
Master clock accuracy: 0x00
@ MGMT Event: Device Connected (0x000b) plen 37 {0x0003} [hci1] 9.865224
LE Address: E8:83:76:AE:34:7D (Static)
Flags: 0x00000000
Data length: 24
Appearance: Mouse (0x03c2)
Flags: 0x05
LE Limited Discoverable Mode
BR/EDR Not Supported
16-bit Service UUIDs (complete): 1 entry
Human Interface Device (0x1812)
Name (complete): MM-keyboard
@ MGMT Event: Device Connected (0x000b) plen 37 {0x0002} [hci1] 9.865224
LE Address: E8:83:76:AE:34:7D (Static)
Flags: 0x00000000
Data length: 24
Appearance: Mouse (0x03c2)
Flags: 0x05
LE Limited Discoverable Mode
BR/EDR Not Supported
16-bit Service UUIDs (complete): 1 entry
Human Interface Device (0x1812)
Name (complete): MM-keyboard
@ MGMT Event: Device Connected (0x000b) plen 37 {0x0001} [hci1] 9.865224
LE Address: E8:83:76:AE:34:7D (Static)
Flags: 0x00000000
Data length: 24
Appearance: Mouse (0x03c2)
Flags: 0x05
LE Limited Discoverable Mode
BR/EDR Not Supported
16-bit Service UUIDs (complete): 1 entry
Human Interface Device (0x1812)
Name (complete): MM-keyboard
< HCI Command: LE Read Remote Used Features (0x08|0x0016) plen 2 #13 [hci1] 9.865401
Handle: 39
> HCI Event: Command Status (0x0f) plen 4 #14 [hci1] 9.869026
LE Read Remote Used Features (0x08|0x0016) ncmd 1
Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 12 #15 [hci1] 10.484014
LE Read Remote Used Features (0x04)
Status: Success (0x00)
Handle: 39
Features: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00
LE Encryption
< HCI Command: LE Start Encryption (0x08|0x0019) plen 28 #16 [hci1] 10.484145
Handle: 39
Random number: 0xff9f0b8649b6cf46
Encrypted diversifier: 0x3ffe
Long term key: e085b0c06f0bdfede3bd0238fc181ed4
> HCI Event: Command Status (0x0f) plen 4 #17 [hci1] 10.491077
LE Start Encryption (0x08|0x0019) ncmd 1
Status: Success (0x00)
> HCI Event: Encryption Change (0x08) plen 4 #18 [hci1] 10.544072
Status: PIN or Key Missing (0x06)
Handle: 39
Encryption: Disabled (0x00)
< HCI Command: Disconnect (0x01|0x0006) plen 3 #19 [hci1] 10.544177
Handle: 39
Reason: Authentication Failure (0x05)
> HCI Event: Command Status (0x0f) plen 4 #20 [hci1] 10.546048
Disconnect (0x01|0x0006) ncmd 1
Status: Success (0x00)
> HCI Event: Disconnect Complete (0x05) plen 4 #21 [hci1] 10.560070
Status: Success (0x00)
Handle: 39
Reason: Connection Terminated By Local Host (0x16)
@ MGMT Event: Device Disconnected (0x000c) plen 8 {0x0003} [hci1] 10.560120
LE Address: E8:83:76:AE:34:7D (Static)
Reason: Connection terminated due to authentication failure (0x04)
@ MGMT Event: Device Disconnected (0x000c) plen 8 {0x0002} [hci1] 10.560120
LE Address: E8:83:76:AE:34:7D (Static)
Reason: Connection terminated due to authentication failure (0x04)
@ MGMT Event: Device Disconnected (0x000c) plen 8 {0x0001} [hci1] 10.560120
LE Address: E8:83:76:AE:34:7D (Static)
Reason: Connection terminated due to authentication failure (0x04)

I have tried to bypass the link encryption failure here:

https://github.com/Jewelbots/twi_test/blob/master/nrf51_sdk/components/ble/peer_manager/security_dispatcher.c#L227

As the comments says "All return values from the following can be safely ignored." but it did not helped.

I have also tried to play with the security related config here:

https://github.com/martonmiklos/ble_keyboard_fw/blob/master/main.c#L135

But I have not managed to get a working config,

Any help would be highly appericiated!

[Kenneth]

I am not familiar with linux, but I notice in your log it says: "Status: PIN or Key Missing (0x06)", I think the following suggestion will fix that:

https://devzone.nordicsemi.com/f/nordic-q-a/47718/pairing-rejected-by-nordic_bps/189277#189277

[martonmiklos]

Just tried it, unfortunately it has the same issue.

[martonmiklos]

For the sake of posterity:

- I have deleted the connection from bluetoothctrl with

```[bluetooth]# remove E8:83:76:AE:34:7D
[DEL] Device E8:83:76:AE:34:7D MM-keyboard
Device has been removed```

Then scanned again, and I am able to connect:

```

Attempting to connect to E8:83:76:AE:34:7D
[CHG] Device E8:83:76:AE:34:7D Connected: yes
Connection successful
[NEW] Primary Service
/org/bluez/hci1/dev_E8_83_76_AE_34_7D/service0008
00001801-0000-1000-8000-00805f9b34fb
Generic Attribute Profile
[NEW] Primary Service
/org/bluez/hci1/dev_E8_83_76_AE_34_7D/service0009
0000180a-0000-1000-8000-00805f9b34fb
Device Information
[NEW] Characteristic
/org/bluez/hci1/dev_E8_83_76_AE_34_7D/service0009/char000a
00002a29-0000-1000-8000-00805f9b34fb
Manufacturer Name String
[NEW] Characteristic
/org/bluez/hci1/dev_E8_83_76_AE_34_7D/service0009/char000c
00002a50-0000-1000-8000-00805f9b34fb
PnP ID
[CHG] Device E8:83:76:AE:34:7D UUIDs: 00001800-0000-1000-8000-00805f9b34fb
[CHG] Device E8:83:76:AE:34:7D UUIDs: 00001801-0000-1000-8000-00805f9b34fb
[CHG] Device E8:83:76:AE:34:7D UUIDs: 0000180a-0000-1000-8000-00805f9b34fb
[CHG] Device E8:83:76:AE:34:7D UUIDs: 0000180f-0000-1000-8000-00805f9b34fb
[CHG] Device E8:83:76:AE:34:7D ServicesResolved: yes
[agent] Passkey: 581922

```

Now I am facing with an another issue: I cannot get it paired and the connection is broken from time-to time.

[Kenneth]

Seems you have enabled MITM, and the passkey you see there you must insert into the peripheral as shown in the message sequence chart:
https://infocenter.nordicsemi.com/topic/com.nordic.infocenter.s132.api.v7.0.1/group___b_l_e___g_a_p___p_e_r_i_p_h___b_o_n_d_i_n_g___p_k___c_e_n_t_r_a_l___o_o_b___m_s_c.html 

For debugging you may disable MITM for now.