The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Poorp — Tue, 15 Jun 2021 15:58:07 GMT

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315360#315360"]I don't think this is caused by FW side, I think it is the app side,[/quote]

That has been my conclusion as well

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315360#315360"]. Are you able to modify back the FW to make it work with the app, [/quote]

Yes, and no. The bug seems to have started happening when we switched from 'numerical comparison'- to 'just works' bonding. Switching back stops it, but requires a different build of the app

Two things that may be relevant:

* In my limited testing, the bug does not occur in android when using the nrf connect app to trigger bonding by writing to an attribute that requires bonding, even with 'just works'

* My understanding is that the bug does not occur if my colleague calls 'startDiscovery' on the android side before initiating 'just works' bonding

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Kenneth — Tue, 15 Jun 2021 11:23:08 GMT

Thanks for the clarification.

I don't think this is caused by FW side, I think it is the app side, though it's not something we have seen before. Are you able to modify back the FW to make it work with the app, and possible narrow down the cause that way?

Kenneth

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Cornel Gligan — Mon, 14 Jun 2021 12:56:31 GMT

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315122#315122"]I assume that you first see an issue on the re-connect?[/quote]

As I said before, disconnect/reconnect works just fine. No errors triggered.

So before rebooting the phone, I tried disconnect/reconnect dozens of times and it just worked fine. The reconnection always happened successfully.

When the phone is rebooted then the bond is removed and that is the issue that the device is not bonded anymore (not present anymore int bonded devices list on Android side).

The issue happens even when is just one device connected.

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Poorp — Mon, 14 Jun 2021 12:21:47 GMT

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315122#315122"]If one of the devices are out of range and/or turned OFF, then there will a disconnect, until the peer again is in-range or turned ON, then there will be re-connect. I assume that you first see an issue on the re-connect?[/quote]

No, I should have been more clear. The short version is

1) Phone and one device are bonded/connected
2) device is turned off and never turned on again (so no more traffic)
[At this point the Phone still has the bond, and can reconnect if the device is turned on again (which it never is, but we tested]
3) Phone is rebooted, once it has started again the bond is gone

It is also worth noting that this bug does not happen if one uses nrf connect to trigger bonding by writing to one of the attributes. Only if it is done by our app

[quote userid="99439" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315120#315120"]Can you try to comment out CONFIG_BT_TINYCRYPT_ECC and possible add CONFIG_BT_ECC=n. I guess I should try this myself first.[/quote]

That fails to compile due to smp requiring them, I didn't investigate further than the compilation error. So there may be a workaround

subsys/bluetooth/host/libsubsys__bluetooth__host.a(smp.c.obj): in function `bt_smp_init':
/home/censored/.local/opt/ncs/zephyr/subsys/bluetooth/host/smp.c:5564: undefined reference to `bt_pub_key_gen'

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Kenneth — Mon, 14 Jun 2021 12:17:20 GMT

If one of the devices are out of range and/or turned OFF, then there will a disconnect, until the peer again is in-range or turned ON, then there will be re-connect. I assume that you first see an issue on the re-connect?

Kenneth

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Poorp — Mon, 14 Jun 2021 12:15:06 GMT

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315117#315117"] This log doesn't show the re-connect though. [/quote]

What do you mean "the reconnect"? In the steps to perform the bug there is only one connection, the inital on-boarding. After that the device is turned off and left off. Only the phone is turned on when the bond is deleted.

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315117#315117"]Can you try to comment out CONFIG_BT_TINYCRYPT_ECC and possible add CONFIG_BT_ECC=n. I guess I should try this myself first.[/quote]

I'll try that and report back

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Kenneth — Mon, 14 Jun 2021 12:11:28 GMT

[quote user="Poorp"]Here is an updated capture with the patch applied. The bug was triggered in the same manner as above[/quote]

This log doesn't show the re-connect though.

[quote user="Poorp"]Could you instruct me in how to do that? I know I can use e.g BT_SMP_SC_PAIR_ONLY to disable 'legacy just works', but I can't see any option to disable 'le just works'
thanks[/quote]

Can you try to comment out CONFIG_BT_TINYCRYPT_ECC and possible add CONFIG_BT_ECC=n. I guess I should try this myself first.

Kenneth

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Poorp — Mon, 14 Jun 2021 09:41:19 GMT

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315047#315047"]Please enable the patch before bonding, and use the patch. It may influence the issue in some way.[/quote]

Here is an updated capture with the patch applied. The bug was triggered in the same manner as above

devzone.nordicsemi.com/.../withPatchAplliedTriggered.pcapng

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315047#315047"]

If you can disable LE secure connection (and instead use just works) for security it could be interesting to see if the issue also exists.

[/quote]

Could you instruct me in how to do that? I know I can use e.g BT_SMP_SC_PAIR_ONLY to disable 'legacy just works', but I can't see any option to disable 'le just works'
thanks

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Kenneth — Mon, 14 Jun 2021 08:40:52 GMT

Please enable the patch before bonding, and use the patch. It may influence the issue in some way.

If you can disable LE secure connection (and instead use just works) for security it could be interesting to see if the issue also exists. With just works it would be possible to decrypt the link also.

Kenneth

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Poorp — Mon, 14 Jun 2021 08:25:49 GMT

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315030#315030"]This means (or at least suggests) that if the nRF52 is the peripheral device, then this FW have not followed the:[/quote][quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/315030#315030"]Can you double check with your collegues what may be calling bt_conn_set_security() here in the project, if not done by the bt_gatt_connected() in gatt.c?[/quote]

That patch isn't integrated into our build system yet, since we need to patch the OS.
Because of that some builds have it, others don't.

I have previously tested this bug both with and without this patch, and the behavior was the same in both cases. Which is the reason it was (accidentally) left disabled when running the logs in this case.

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Kenneth — Mon, 14 Jun 2021 07:12:41 GMT

The reason we are not able to decrypt the connection is due to LE secure connection is used (with diffie-hellman), unfortunately such connection can't be decrypted.

However, I can find that the slave send a security request upon re-connection here, ref:

This means (or at least suggests) that if the nRF52 is the peripheral device, then this FW have not followed the:

"I have been working on this problem in a different case, I want to find out if your issue is related. To confirm please comment out the line bt_conn_set_security() that is found in bt_gatt_connected() in gatt.c and repeat your setup. Please do this test first."

Can you double check with your collegues what may be calling bt_conn_set_security() here in the project, if not done by the bt_gatt_connected() in gatt.c?

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Poorp — Thu, 10 Jun 2021 17:59:27 GMT

Here is a third log where encryption seemingly succeed, but the bug was still triggered. Unfortunately it seems that the sniffer failed to capture the encryption keys. And despite several more runs the sniffer failed each time

I've also added a fourth log, it is an bt snoop log from android from a run where the bug was triggered. If I'm reading it correctly, then encryption succeed in that case.

Please let me know if there is anything else you need in order to be able to help us solve this bug.

devzone.nordicsemi.com/.../firstTriggeredButEncrypted.pcapng

devzone.nordicsemi.com/.../fourth_5F00_btsnoop_5F00_hci.log

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Poorp — Thu, 10 Jun 2021 16:40:23 GMT

Yeah, I noticed after posting.
Here are the correct files:
The file named triggered is when the bug happened, notTriggered is the same procedure (except maybe not with step 5 above) but the bug did not happen, peripheral remained after reboot of the phone

Edit: looking at the logs it seems the setup of encryption fails for some reason, it is worth noting that I did not see a disconnect on the peripheral side before pulling power.
devzone.nordicsemi.com/.../NOTtriggered.pcapng devzone.nordicsemi.com/.../triggered.pcapng

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Kenneth — Thu, 10 Jun 2021 16:39:14 GMT

I could only find one log file here?

Unfortunately you likely forgot to select the device you wanted to sniff from the device list:

https://infocenter.nordicsemi.com/topic/ug_sniffer_ble/UG/sniffer_ble/action_advertisement.html

Please do that.

Tip: In the filter text box you can add the following: "btle.data_header.llid > 0 && btle.length > 0" Then you should see in specific when connected when there is data between the central and peripheral, if you can't see anything with this filter, then it means you have not been able to pick up the communication.

Kenneth

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Poorp — Thu, 10 Jun 2021 16:18:28 GMT

Here is the log. The perephrials address is ce:d1:0e:8b:17:66

The exact steps performed were:

Peripheral was erased using nrfjprog --ereaseall
Peripheral was flashed with firmware and power cycled
Made sure the peripheral was not listed under "previously connected devices" in android
Rebooted the phone
After the phone is rebooted turn OFF and then turn ON Bluetooth on the phone (may not be required, but it appears the bug happens more reliably with this step)
Installed the android application from scratch and made sure its data was erased
On-boarded the peripheral - it was on-boarded successfully
Turned OFF the peripheral, it was disconnected from the phone
Rebooted the phone while the peripheral was still turned OFF

Expected Result: peripheral should still be bonded

Actual Result: peripheral was not bonded

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/313893#313893"]1. Does the problem also occur if you disconnect and reconnect the peripheral before step 6?[/quote]

When turning off/on the Bluetooth on the phone between steps 7 and 8 above:
Sometimes the peripheral disappears immediately, that is without a rebootdevzone.nordicsemi.com/.../bugtriggnorpa.pcapng

Sometimes the peripheral remains, and in those cases it remained after steps 8 and 9 were performed (peripheral turned off/ phone rebooted)

When the phone is rebooted without turning off/on bluetooth between steps 7 and 8, it seems the peripheral always disappears.

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Cornel Gligan — Mon, 07 Jun 2021 14:09:40 GMT

Hi Kenneth,

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/313893#313893"]Does the problem also occur if you disconnect and reconnect the peripheral before step 6?[/quote]

Before rebooting the phone, the connection is stable. The app reconnects every time with no problems.

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/313893#313893"]I have been working on this problem in a different case, I want to find out if your issue is related.[/quote]

That post is for one of our issues. One of my colleagues from the FW team posted it and my colleague said that the fix Nordic suggested is already integrated in the FW code. This issue doesn't trigger any error while connecting or while bonding as the issue in the link. So it is not the same issue.

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/313893#313893"]To confirm please comment out the line bt_conn_set_security() that is found in bt_gatt_connected() in gatt.c and repeat your setup. Please do this test first.[/quote]

My FW colleague told me this code is also already in.

[quote userid="2111" url="~/f/nordic-q-a/76024/the-nrf52-bonded-device-is-automatically-unbonded-when-the-android-phone-is-rebooted/313893#313893"] think we might need an on air sniffer log here to find the problem. Maybe you can do that with nRF sniffer tool if you have an nRF52-DK you can use for sniffer. [/quote]

I will ask my FW colleagues to take the sniffer log and attach it to this ticket.

Thank you!

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Kenneth — Mon, 07 Jun 2021 11:14:39 GMT

Hi,

I think we might need an on air sniffer log here to find the problem. Maybe you can do that with nRF sniffer tool if you have an nRF52-DK you can use for sniffer. Some other questions while waiting for your sniffer log

1. Does the problem also occur if you disconnect and reconnect the peripheral before step 6?

2. I have been working on this problem in a different case, I want to find out if your issue is related. To confirm please comment out the line bt_conn_set_security() that is found in bt_gatt_connected() in gatt.c and repeat your setup. Please do this test first.

Edit: Do make sure you re-bond after doing the change in step 2.

Best regards,
Kenneth

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Cornel Gligan — Mon, 07 Jun 2021 07:01:16 GMT

My colleague from FW side managed to narrow down the change which is reproducing the issue:

from

static struct bt_conn_auth_cb conn_auth_callbacks = {
.passkey_display = auth_passkey_display,
.passkey_entry = NULL,
.passkey_confirm = passkey_confirm,
.cancel = auth_cancel,
.pairing_confirm = pairing_confirm,
.pairing_complete = pairing_complete,
.pairing_failed = pairing_failed,
.bond_deleted = bond_deleted
};

into

static struct bt_conn_auth_cb conn_auth_callbacks = {
.passkey_display = NULL,
.passkey_entry = NULL,
.passkey_confirm = NULL,
.cancel = auth_cancel,
.pairing_confirm = pairing_confirm,
.pairing_complete = pairing_complete,
.pairing_failed = pairing_failed,
.bond_deleted = bond_deleted
};

I also noticed on the Android app side: after connecting and just before sending any request to the device, if the app code runs a remote device discovery (using the function bluetoothAdapter.startDiscovery()) until the nRF52 board is discovered, then the problem is not reproducing anymore.

Is the discovery required for the bond to be strong and not removed after phone reboots? Is the application missing something else?

Is the FW implementation missing anything triggering the need of running a discovery to make the bond stronger?

Thank you!

RE: The nRF52 bonded device is automatically unbonded when the Android phone is rebooted.

Cornel Gligan — Fri, 04 Jun 2021 15:31:31 GMT

I forgot to mention that the bond removal issue was tested and reproduced on the following phones:

Google Pixel 2 & Pixel 4 running Android 11
Oneplus 5 running Android 10
Doro 8080 running Android 9
Google Nexus 5X running Android 8.0

Minimum Android supported version in the Android app is set to Android 8 (SDK 26).

I am using version 2.2.4 version of the Android-BLE-Library from Nordic.