Android CHIPTool - Crash when interacting with clusters (groups & temperatureMeasurement)

[jacobbluhm]

I am seeing the Android CHIPTool crash when I send certain commands to clusters. I can read attributes from this cluster, and even send the removeAllGroups command.  The issue is with the AddGroup command in the groups cluster - Error output from android:

10-06 15:32:58.361 21352 21352 D AndroidRuntime: Shutting down VM
--------- beginning of crash
10-06 15:32:58.363 21352 21352 E AndroidRuntime: FATAL EXCEPTION: main
10-06 15:32:58.363 21352 21352 E AndroidRuntime: Process: com.google.chip.chiptool, PID: 21352
10-06 15:32:58.363 21352 21352 E AndroidRuntime: java.lang.ClassCastException: java.lang.String cannot be cast to java.lang.Integer
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at chip.devicecontroller.ClusterInfoMapping.lambda$getCommandMap$70(ClusterInfoMapping.java:7709)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at chip.devicecontroller.-$$Lambda$ClusterInfoMapping$cIWpw-xlwNrySAuCbV94O7DtfOY.invokeCommand(Unknown Source:0)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at com.google.chip.chiptool.clusterclient.clusterinteraction.ClusterDetailFragment.setInvokeCommandOnClickListener$lambda-2(ClusterDetailFragment.kt:153)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at com.google.chip.chiptool.clusterclient.clusterinteraction.ClusterDetailFragment.lambda$L3VHqSpfGvBTNuxjIdwuacnYJ6Y(Unknown Source:0)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at com.google.chip.chiptool.clusterclient.clusterinteraction.-$$Lambda$ClusterDetailFragment$L3VHqSpfGvBTNuxjIdwuacnYJ6Y.onClick(Unknown Source:11)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at android.view.View.performClick(View.java:7288)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at android.view.View.performClickInternal(View.java:7258)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at android.view.View.access$4000(View.java:808)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at android.view.View$PerformClick.run(View.java:28019)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at android.os.Handler.handleCallback(Handler.java:883)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:100)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at android.os.Looper.loop(Looper.java:214)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at android.app.ActivityThread.main(ActivityThread.java:7615)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:492)
10-06 15:32:58.363 21352 21352 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:964)

It seems that any command that has a parameter will result in a crash.

Unrelated to this issue I've also seen the CHIPTool crash when sending the readTemperatureMeasurementAttribute. It resulted in the same Exception: java.lang.ClassCastException

Im using the latest CHIPTool .apk in this github repo -> https://github.com/nrfconnect/sdk-connectedhomeip/releases/tag/v2.1.0

Using this .apk -> chip-tool-android_armv7l.apk

[Jørgen Holmefjord]

Hi,

Are you using the latest nRF Connect SDK version as vell (v2.1.0)? The CHIP tool version should match the nRF Connect SDK version to make sure that the APIs match.

Best regards,
Jørgen

[Jørgen Holmefjord]

Hi,

I checked with our Matter team, and they recommend using chip-tool instead of Android CHIP Tool, for CLI-like tools. Our experience is that Android CHIP Tool has been buggy in interactive mode, and it is not actively being developed by us. You could open an issue about Android CHIP Tool here: https://github.com/project-chip/connectedhomeip/issues

Best regards,
Jørgen

[jacobbluhm]

Here is the BLE Sniffer trace when attempting to commission from the chip-tool on Mac, connection starts at line 2253.

BLE Sinffer from failed commission Mac chip-tool.pcapng

Here is the BLE Sniffer trace of a successful commission from the Android CHIPTool, connection starts at line 1433

BLE Sniffer from successful commission Android CHIPTool.pcapng

[Jørgen Holmefjord]

Hi,

It looks like the Mac is sending some bad frames, and/or sending the LL_PHY_RSP at the wrong time, causing a conflict. The frames all reports as CRC error and are retransmitted multiple times:

I will check with our Matter team if they have experienced this before, but if you have a different computer (preferably a Linux PC) that you can test with, that may work better.

[jacobbluhm]

I am working on securing a Linux PC to test. Do you recommend a certain Linux distribution?

Any word back from the Matter team on this issue?

[Jørgen Holmefjord]

I believe Ubuntu 22.04 LTS 64-bit would be the best option.

Our Matter team had not seen this issue before, but it looks like a Bluetooth Host issue and not directly Matter related. I can check with our Bluetooth team if they have some suggestions.

[Jørgen Holmefjord]

Hi,

I checked with our Softdevice team, and the master is not allowed to send a PHY_RSP to a PHY_REQ. It should have send a PHY_UPDATE_IND. See Bluetooth Core specification v5.3, Vol 6, Part D, Section 6.15. This looks like a bug on the Bluetooth stack in the Mac, but since the Sniffer trace reports CRC errors, we can't fully trust it. We would like to reproduce this internally and capture a sniffer trace with better equipment if possible to confirm the bug.

Can you provide me more details about the Mac that you use when seeing this error? Which model number, OS version, etc. did you use?

Alternatively, if you are able to generate the sniffer trace without the CRC errors, that would also be helpful!

Best regards,
Jørgen

[jacobbluhm]

OS Ver: macOS Monterey Version 12.6

Model number: MacBook Pro (15-inch, 2017) -- Which I think is A1707

Processor: 2.8GHz Quad-Core Intel Core i7

[Jørgen Holmefjord]

Thanks, I will check internally if we have a similar Macbook available, but it would still be helpful if you could manage to capture the sniffer trace without the CRC errors. If you have another sniffer than the nRF sniffer available, this may also be used if you are not able to capture it successfully using our sniffer.

[jacobbluhm]

Still not sure what the issue with using the chip-tool on Mac, but the chip-tool worked as expected for me on a Linux computer running Ubuntu 22.04 LTS