Simple paring failed from BlueZ towards btstack

30 views
Skip to first unread message

F1st Ir0n

unread,
Nov 13, 2024, 5:52:35 AM11/13/24
to btstack-dev
Hi,

I am running btstack with Infineon CYW55573. I tried to initiate paring from a Raspberry Pi with BlueZ stack towards 55573 but paring failed all the time. Looks like BlueZ on RPI received "Simple Paring Complete" with status "Authentication Failure"  which is probably sent by 55573.
Any comments will be appreciated!

My application settings for btstack/CYW55573:

l2cap_init();


// register for HCI events

hci_event_callback_registration.callback = &packet_handler;

hci_add_event_handler(&hci_event_callback_registration);


gap_discoverable_control(true);

gap_connectable_control(true);

gap_set_bondable_mode(true);

gap_ssp_set_enable(true);

gap_ssp_set_io_capability(IO_CAPABILITY_DISPLAY_ONLY);


// turn on!

hci_power_control(HCI_POWER_ON);


Logs collected from my host with btstack and 55573:


[00:01:36.462] EVT <= 04 0A 03 7B 82 EB 27 B8 68 12 2C 01
[00:01:36.462] LOG -- hci.c.3802: Connection_incoming: B8:27:EB:82:7B:03, type 1
[00:01:36.462] LOG -- hci.c.326: create_connection_for_addr B8:27:EB:82:7B:03, type fd
[00:01:36.463] LOG -- hci.c.7264: sending hci_accept_connection_request
[00:01:36.463] CMD => 09 04 07 03 7B 82 EB 27 B8 01
[00:01:36.464] EVT <= 0F 04 00 01 09 04
[00:01:36.475] EVT <= 03 0B 00 0B 00 03 7B 82 EB 27 B8 01 00
[00:01:36.476] LOG -- hci.c.3835: Connection_complete (status=0) B8:27:EB:82:7B:03
[00:01:36.476] LOG -- hci.c.3872: New connection: handle 11, B8:27:EB:82:7B:03
[00:01:36.476] LOG -- hci.c.8193: BTSTACK_EVENT_NR_CONNECTIONS_CHANGED 1
ACL link 0xb established.
[00:01:36.477] EVT <= 1B 03 0B 00 05
[00:01:36.503] EVT <= 32 09 03 7B 82 EB 27 B8 01 00 03
[00:01:36.503] LOG -- hci.c.517: pairing started, ssp 1, initiator 0, requested level 0
Paring started from B8:27:EB:82:7B:03 on link 0xb, ssp 1, initiator 0
Peer io_capability 1 oob_data_present 0 authentication_requirements 3
[00:01:36.504] EVT <= 31 06 03 7B 82 EB 27 B8
[00:01:36.505] LOG -- hci.c.8371: gap_mitm_protection_required_for_security_level 0
[00:01:36.505] CMD => 2B 04 09 03 7B 82 EB 27 B8 00 00 04
[00:01:36.506] EVT <= 0E 0A 01 2B 04 00 03 7B 82 EB 27 B8
[00:01:36.761] EVT <= 33 0A 03 7B 82 EB 27 B8 06 69 05 00
SSP User Confirmation Request with numeric value '354566'
SSP User Confirmation Auto accept
[00:01:36.761] CMD => 2C 04 06 03 7B 82 EB 27 B8
[00:01:36.762] EVT <= 0E 0A 01 2C 04 00 03 7B 82 EB 27 B8


Logs collected from Raspberry Pi btmon

@ MGMT Command: Add Device (0x0033) plen 8                                                                                                                                                     {0x0001} 2.579602
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Action: Allow incoming connection (0x01)
@ MGMT Event: Device Flags Changed (0x002a) plen 15                                                                                                                                            {0x0001} 2.579649
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Supported Flags: 0x00000000
        Current Flags: 0x00000000
@ MGMT Event: Command Complete (0x0001) plen 10                                                                                                                                                {0x0001} 2.579661
      Add Device (0x0033) plen 7
        Status: Success (0x00)
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
@ MGMT Command: Pair Device (0x0019) plen 8                                                                                                                                                    {0x0001} 2.579898
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Capability: KeyboardDisplay (0x04)
< HCI Command: Create Connection (0x01|0x0005) plen 13                                                                                                                                               #1 2.579972
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Packet type: 0xcc18
          DM1 may be used
          DH1 may be used
          DM3 may be used
          DH3 may be used
          DM5 may be used
          DH5 may be used
        Page scan repetition mode: R2 (0x02)
        Page scan mode: Mandatory (0x00)
        Clock offset: 0x0000
        Role switch: Allow slave (0x01)
> HCI Event: Command Status (0x0f) plen 4                                                                                                                                                            #2 2.581604
      Create Connection (0x01|0x0005) ncmd 1
        Status: Success (0x00)
> HCI Event: Connect Complete (0x03) plen 11                                                                                                                                                         #3 3.009478
        Status: Success (0x00)
        Handle: 11
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Link type: ACL (0x01)
        Encryption: Disabled (0x00)
< HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2                                                                                                                                   #4 3.009936
        Handle: 11
> HCI Event: Command Status (0x0f) plen 4                                                                                                                                                            #5 3.010783
      Read Remote Supported Features (0x01|0x001b) ncmd 1
        Status: Success (0x00)
> HCI Event: Read Remote Supported Features (0x0b) plen 11                                                                                                                                           #6 3.010893
        Status: Success (0x00)
        Handle: 11
        Features: 0xbf 0xfe 0xcf 0xfe 0xdb 0xff 0x7b 0x87
          3 slot packets
          5 slot packets
          Encryption
          Slot offset
          Timing accuracy
          Role switch
          Sniff mode
          Power control requests
          Channel quality driven data rate (CQDDR)
          SCO link
          HV2 packets
          HV3 packets
          u-law log synchronous data
          A-law log synchronous data
          CVSD synchronous data
          Paging parameter negotiation
          Power control
          Transparent synchronous data
          Flow control lag (most significant bit)
          Broadcast Encryption
          Enhanced Data Rate ACL 2 Mbps mode
          Enhanced Data Rate ACL 3 Mbps mode
          Enhanced inquiry scan
          Interlaced inquiry scan
          Interlaced page scan
          RSSI with inquiry results
          Extended SCO link (EV3 packets)
          EV4 packets
          EV5 packets
          AFH capable slave
          AFH classification slave
          LE Supported (Controller)
          3-slot Enhanced Data Rate ACL packets
          5-slot Enhanced Data Rate ACL packets
          Sniff subrating
          Pause encryption
          AFH capable master
          AFH classification master
          Enhanced Data Rate eSCO 2 Mbps mode
          Enhanced Data Rate eSCO 3 Mbps mode
          3-slot Enhanced Data Rate eSCO packets
          Extended Inquiry Response
          Simultaneous LE and BR/EDR (Controller)
          Secure Simple Pairing
          Encapsulated PDU
          Erroneous Data Reporting
          Non-flushable Packet Boundary Flag
          Link Supervision Timeout Changed Event
          Inquiry TX Power Level
          Enhanced Power Control
          Extended features
< HCI Command: Read Remote Extended Features (0x01|0x001c) plen 3                                                                                                                                    #7 3.010978
        Handle: 11
        Page: 1
> HCI Event: Command Status (0x0f) plen 4                                                                                                                                                            #8 3.011612
      Read Remote Extended Features (0x01|0x001c) ncmd 1
        Status: Success (0x00)
> HCI Event: Read Remote Extended Features (0x23) plen 13                                                                                                                                            #9 3.011730
        Status: Success (0x00)
        Handle: 11
        Page: 1/2
        Features: 0x0b 0x00 0x00 0x00 0x00 0x00 0x00 0x00
          Secure Simple Pairing (Host Support)
          LE Supported (Host)
          Secure Connections (Host Support)
< HCI Command: Remote Name Request (0x01|0x0019) plen 10                                                                                                                                            #10 3.011832
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Page scan repetition mode: R2 (0x02)
        Page scan mode: Mandatory (0x00)
        Clock offset: 0x0000
> HCI Event: Max Slots Change (0x1b) plen 3                                                                                                                                                         #11 3.012093
        Handle: 11
        Max slots: 5
> HCI Event: Command Status (0x0f) plen 4                                                                                                                                                           #12 3.022846
      Remote Name Request (0x01|0x0019) ncmd 1
        Status: Success (0x00)
> HCI Event: Remote Name Req Complete (0x07) plen 255                                                                                                                                               #13 3.033157
        Status: Success (0x00)
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Name: BTstack 50:26:EF:CF:0F:D2
@ MGMT Event: Device Connected (0x000b) plen 45                                                                                                                                                {0x0001} 3.033287
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Flags: 0x00000008
          Unknown device flag (0x00000008)
        Data length: 32
        Name (complete): BTstack 50:26:EF:CF:0F:D2
        Class: 0x7a020c
          Major class: Phone (cellular, cordless, payphone, modem)
          Minor class: Smart phone
          Networking (LAN, Ad hoc)
          Capturing (Scanner, Microphone)
          Object Transfer (v-Inbox, v-Folder)
          Audio (Speaker, Microphone, Headset)
          Telephony (Cordless telephony, Modem, Headset)
< HCI Command: Authentication Requested (0x01|0x0011) plen 2                                                                                                                                        #14 3.033370
        Handle: 11
> HCI Event: Command Status (0x0f) plen 4                                                                                                                                                           #15 3.033995
      Authentication Requested (0x01|0x0011) ncmd 1
        Status: Success (0x00)
> HCI Event: Link Key Request (0x17) plen 6                                                                                                                                                         #16 3.034251
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
< HCI Command: Link Key Request Negative Reply (0x01|0x000c) plen 6                                                                                                                                 #17 3.034379
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
> HCI Event: Command Complete (0x0e) plen 10                                                                                                                                                        #18 3.035075
      Link Key Request Negative Reply (0x01|0x000c) ncmd 1
        Status: Success (0x00)
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
> HCI Event: IO Capability Request (0x31) plen 6                                                                                                                                                    #19 3.035096
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
< HCI Command: IO Capability Request Reply (0x01|0x002b) plen 9                                                                                                                                     #20 3.035246
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        IO capability: DisplayYesNo (0x01)
        OOB data: Authentication data not present (0x00)
        Authentication: Dedicated Bonding - MITM required (0x03)
> HCI Event: Command Complete (0x0e) plen 10                                                                                                                                                        #21 3.035981
      IO Capability Request Reply (0x01|0x002b) ncmd 1
        Status: Success (0x00)
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
> HCI Event: IO Capability Response (0x32) plen 9                                                                                                                                                   #22 3.042068
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        IO capability: DisplayOnly (0x00)
        OOB data: Authentication data not present (0x00)
        Authentication: General Bonding - MITM not required (0x04)
> HCI Event: User Confirmation Request (0x33) plen 10                                                                                                                                               #23 3.293438
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Passkey: 354566
@ MGMT Event: User Confirmation Request (0x000f) plen 12                                                                                                                                       {0x0001} 3.293526
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Confirm hint: 0x00
        Value: 0x00056906
@ MGMT Command: User Confirmation Reply (0x001c) plen 7                                                                                                                                        {0x0001} 5.595341
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
< HCI Command: User Confirmation Request Reply (0x01|0x002c) plen 6                                                                                                                                 #24 5.595411
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
> HCI Event: Command Complete (0x0e) plen 10                                                                                                                                                        #25 5.600398
      User Confirmation Request Reply (0x01|0x002c) ncmd 1
        Status: Success (0x00)
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
@ MGMT Event: Command Complete (0x0001) plen 10                                                                                                                                                {0x0001} 5.600463
      User Confirmation Reply (0x001c) plen 7
        Status: Success (0x00)
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)

> HCI Event: Simple Pairing Complete (0x36) plen 7                                                                                                                                                 #26 23.433469
        Status: Authentication Failure (0x05)
        Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)

> HCI Event: Auth Complete (0x06) plen 3                                                                                                                                                           #27 23.433576
        Status: Authentication Failure (0x05)
        Handle: 11
@ MGMT Event: Command Complete (0x0001) plen 10                                                                                                                                               {0x0001} 23.433618
      Pair Device (0x0019) plen 7
        Status: Authentication Failed (0x05)
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
@ MGMT Command: Remove Device (0x0034) plen 7                                                                                                                                                 {0x0001} 23.434090
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
@ MGMT Event: Command Complete (0x0001) plen 10                                                                                                                                               {0x0001} 23.434173
      Remove Device (0x0034) plen 7
        Status: Success (0x00)
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
> HCI Event: Disconnect Complete (0x05) plen 4                                                                                                                                                     #28 23.434963
        Status: Success (0x00)
        Handle: 11
        Reason: Connection Timeout (0x08)
@ MGMT Event: Device Disconnected (0x000c) plen 8                                                                                                                                             {0x0001} 23.435012
        BR/EDR Address: 50:26:EF:CF:0F:D2 (OUI 50-26-EF)
        Reason: Connection timeout (0x01)

Matthias Ringwald

unread,
Nov 13, 2024, 5:57:26 AM11/13/24
to btsta...@googlegroups.com
Hi there

Could you process the log from the CYW5557x with tool/create_packet_log.py and post it here? It can be viewed with Wireshark.
Could you try to use IO_CAPABILITY_DISPLAY_YES_NO? I'm just wondering how a user would accept a numeric comparison if she doesn't have a way to press yes/no.

Best
Matthias
> --
> You received this message because you are subscribed to the Google Groups "btstack-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to btstack-dev...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/btstack-dev/25df05e3-6050-4bcf-a9e8-08cde22555cbn%40googlegroups.com.

F1st Ir0n

unread,
Nov 13, 2024, 7:26:27 AM11/13/24
to btsta...@googlegroups.com
Hi Matthias,

Thanks for the reply. The log is attached. I also tried to use different IO capabilities but got the same failure.

simple_paring_failure.pklg

Matthias Ringwald

unread,
Nov 13, 2024, 8:38:37 AM11/13/24
to btsta...@googlegroups.com
Hi again

Thanks for the packet log. The log ends after BTstack send the

> [042C] User Confirmation Request Reply - B8:27:EB:82:7B:03

and the Controller responded with

> Command Complete [042C] - User Confirmation Request Reply

On the BlueZ side, the pairing is reported as failed after a timeout.

It's not clear what's going wrong. You might try to connect from some other device, e.g. a smartphone, or try outgoing connections.

We've tested CYW5557x a bit in the past and pairing worked as expected.
Which PatchRAM did you use?

best
Matthias
> To view this discussion visit https://groups.google.com/d/msgid/btstack-dev/CAPMcjg7r%3DK0x4Z4Eaa3VsMpQeWTNLcrLVDSVTiVpEY-ZoRMhpw%40mail.gmail.com.
> <simple_paring_failure.pklg>

F1st Ir0n

unread,
Nov 15, 2024, 4:57:21 AM11/15/24
to btsta...@googlegroups.com
Hi Matthias,

Thanks for the hints. Now the pairing issue is gone but I don't really understand why.

Matthias Ringwald

unread,
Nov 15, 2024, 11:50:06 AM11/15/24
to btsta...@googlegroups.com
Hi there

What did you do to make the pairing issue go away?

Did you change the PatchRAM? Or did you change anything else?

Best
Matthias
> To view this discussion visit https://groups.google.com/d/msgid/btstack-dev/CAPMcjg57GfrRFZzLt4BQYTYBW_d%2BNAcsQofVYGRyL9hO%3DqFkAA%40mail.gmail.com.

F1st Ir0n

unread,
Nov 15, 2024, 3:40:45 PM11/15/24
to btsta...@googlegroups.com
I guess the pairing issue might be related to the initializing sequence of CYW55573. Previously my initializing sequence was:
Power recycle the chip by manipulating BT_REG_ON
Continue to application and application calls hci_power_control(HCI_POWER_ON)
HCI stack sends HCI_RESET
HCI stack reads Local Version Information
--HCI stack skips Local Name and Update Baudrate which I proposed in my pull request.
HCI stack downloads patch ram
HCI stack continues to configure the chip with application settings

And I had a pairing issue.

Now my initializing sequence is:
Power recycle the chip
Send HCI_RESET
Read Local version information
Download patch ram
Continue to application and application calls hci_power_control(HCI_POWER_ON)
HCI stack send HCI_RESET
HCI stack reads Local Version Information
HCI stack reads Local Name
HCI stack sends Update Baudrate
HCI stack continues to configure the chip with application settings

But I have no time to verify this assumption.



Reply all
Reply to author
Forward
0 new messages