GATTTool with random address is not working with ESP32 HCI

[danergo]

Hi!

I'm using ESP32 as a Bluetooth co-processor, with the ESP-IDF provided hciuart sample.

However, I can't connect to devices which requires random addressing:

Code: Select all

# gatttool -t random -b DESTINATION -I
[DESTINATION][LE]> connect
Attempting to connect to DESTINATION
Error: connect to DESTINATION: Connection refused (111)

During this operation nothing is printed by btmon.

Is there something I have to modify in the provided hciuart sample to make this work?

[danergo]

Hi,

I've upgraded to the latest available BlueZ, and I have some updates.

Please confirm whether is this an ESP32 bug, or a BlueZ one, so I can continue my investigation either here or over there.

This is my command:

Code: Select all

gatttool -t random -b MAC_TO_CONN -I
[MAC_TO_CONN][LE]> connect
Attempting to connect to MAC_TO_CONN
Error: connect to MAC_TO_CONN: Function not implemented (38)

During this operation here is my btmon output:

Code: Select all

Bluetooth monitor ver 5.62
= Note: Linux version 5.10.63+ (armv6l)                                0.788425
= Note: Bluetooth subsystem version 2.22                               0.788450
= New Index: HCI_MAC (Primary,UART,hci0)              [hci0] 0.788457
= Open Index: HCI_MAC                                 [hci0] 0.788463
= Index Info: HCI_MAC (RivieraWaves S.A.S)            [hci0] 0.788468
@ MGMT Open: bluetoothd (privileged) version 1.18             {0x0001} 0.788476
< HCI Command: LE Set Scan Parameters (0x08|0x000b) plen 7   #1 [hci0] 6.115369
        Type: Passive (0x00)
        Interval: 60.000 msec (0x0060)
        Window: 60.000 msec (0x0060)
        Own address type: Public (0x00)
        Filter policy: Ignore not in accept list (0x01)
> HCI Event: Command Complete (0x0e) plen 4                  #2 [hci0] 6.118578
      LE Set Scan Parameters (0x08|0x000b) ncmd 5
        Status: Success (0x00)
< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2       #3 [hci0] 6.118737
        Scanning: Enabled (0x01)
        Filter duplicates: Enabled (0x01)
> HCI Event: Command Complete (0x0e) plen 4                  #4 [hci0] 6.121824
      LE Set Scan Enable (0x08|0x000c) ncmd 5
        Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 18                    #5 [hci0] 6.181503
      LE Advertising Report (0x02)
        Num reports: 1
        Event type: Connectable undirected - ADV_IND (0x00)
        Address type: Random (0x01)
        Address: MAC_TO_CONN (Static)
        Data length: 6
        Flags: 0x04
          BR/EDR Not Supported
        TX power: -8 dBm
        RSSI: -95 dBm (0xa1)
< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2       #6 [hci0] 6.181690
        Scanning: Disabled (0x00)
        Filter duplicates: Disabled (0x00)
> HCI Event: Command Complete (0x0e) plen 4                  #7 [hci0] 6.183300
      LE Set Scan Enable (0x08|0x000c) ncmd 5
        Status: Success (0x00)
< HCI Command: LE Create Connection (0x08|0x000d) plen 25    #8 [hci0] 6.183450
        Scan interval: 60.000 msec (0x0060)
        Scan window: 60.000 msec (0x0060)
        Filter policy: Accept list is not used (0x00)
        Peer address type: Random (0x01)
        Peer address: MAC_TO_CONN (Static)
        Own address type: Public (0x00)
        Min connection interval: 30.00 msec (0x0018)
        Max connection interval: 50.00 msec (0x0028)
        Connection latency: 0 (0x0000)
        Supervision timeout: 420 msec (0x002a)
        Min connection length: 0.000 msec (0x0000)
        Max connection length: 0.000 msec (0x0000)
> HCI Event: Command Status (0x0f) plen 4                    #9 [hci0] 6.242149
      LE Create Connection (0x08|0x000d) ncmd 5
        Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 31                   #10 [hci0] 6.345657
      LE Enhanced Connection Complete (0x0a)
        Status: Success (0x00)
        Handle: 0
        Role: Central (0x00)
        Peer address type: Random (0x01)
        Peer address: MAC_TO_CONN (Static)
        Local resolvable private address: 00:00:00:00:00:00 (Non-Resolvable)
        Peer resolvable private address: 00:00:00:00:00:00 (Non-Resolvable)
        Connection interval: 50.00 msec (0x0028)
        Connection latency: 0 (0x0000)
        Supervision timeout: 420 msec (0x002a)
        Central clock accuracy: 0x00
@ MGMT Event: Device Connected (0x000b) plen 19        {0x0001} [hci0] 6.345823
        LE Address: MAC_TO_CONN (Static)
        Flags: 0x00000000
        Data length: 6
        Flags: 0x04
          BR/EDR Not Supported
        TX power: -8 dBm
< HCI Command: LE Read Remote Used... (0x08|0x0016) plen 2  #11 [hci0] 6.346246
        Handle: 0
> HCI Event: Command Status (0x0f) plen 4                   #12 [hci0] 6.355264
      LE Read Remote Used Features (0x08|0x0016) ncmd 5
        Status: Success (0x00)
> HCI Event: Disconnect Complete (0x05) plen 4              #13 [hci0] 6.636850
        Status: Success (0x00)
        Handle: 0
        Reason: Connection Failed to be Established (0x3e)
@ MGMT Event: Device Disconnected (0x000c) plen 8      {0x0001} [hci0] 6.636961
        LE Address: MAC_TO_CONN (Static)
        Reason: Unspecified (0x00)

Please help me with this, I'm still using the "hci_controller" example as-is.

During this operation this gets printed to ESP32's debug port:

Code: Select all

lld_pdu_get_tx_flush_nb HCI packet count mismatch (0, 1)

[danergo]

And after so many failed connects, this happens on the debug port:

Code: Select all

lld_pdu_get_tx_flush_nb HCI packet count mismatch (0, 1)
lld_pdu_get_tx_flush_nb HCI packet count mismatch (0, 1)
...
lld_pdu_get_tx_flush_nb HCI packet count mismatch (0, 1)
Guru Meditation Error: Core  0 panic'ed (LoadProhibited). Exception was unhandled.

Core  0 register dump:
PC      : 0x400de1ed  PS      : 0x00060130  A0      : 0x80049b9c  A1      : 0x3ffcb410
A2      : 0x07ffffff  A3      : 0x0648d450  A4      : 0x00000009  A5      : 0x00000001
A6      : 0x3ffcb470  A7      : 0x00000000  A8      : 0x3ffc8104  A9      : 0x3ffcb3f0
A10     : 0x0030bb00  A11     : 0x00000001  A12     : 0x00000000  A13     : 0x3ffafd68
A14     : 0x00000000  A15     : 0x3ffb8360  SAR     : 0x00000016  EXCCAUSE: 0x0000001c
EXCVADDR: 0x00000008  LBEG    : 0x4000c2e0  LEND    : 0x4000c2f6  LCOUNT  : 0x00000000


Backtrace:0x400de1ea:0x3ffcb4100x40049b99:0x3ffcb470 0x400457cd:0x3ffcb4a0 0x40084260:0x3ffcb4e0 0x40019d11:0x3ffcb51




ELF file SHA256: d04c3ab240582862

Rebooting...

After this happens, I have to restart the hciattach process to be able to use any bluetooth feature on ESP32.

Please review this! I need an urgent help now!

Here is your bugreport if needed: https://github.com/espressif/esp-idf/issues/7699

[danergo]

Hahooooo, wakeup! Help is neeeeeeeeeeeeded!

your cpu is panicing!! 100% reproducability, blebleble


Noone cares. Just like @ samsung.

[danergo]

Could you please help me with this?