On Wed, 23 Mar 2022 at 13:36, Adam Pigg <adam@xxxxxxxxxxx> wrote:
>
> Hi Luiz
>
> On Wed, 23 Mar 2022 at 09:11, Adam Pigg <adam@xxxxxxxxxxx> wrote:
> >
> > Hi Luiz
> >
> > Good that you clearly know more about this than me!...
> >
> > On Tue, 22 Mar 2022 at 23:44, Luiz Augusto von Dentz
> > <luiz.dentz@xxxxxxxxx> wrote:
> > >
> > > Hi Adam,
> > >
> > > On Tue, Mar 22, 2022 at 4:35 PM Luiz Augusto von Dentz
> > > <luiz.dentz@xxxxxxxxx> wrote:
> > > >
> > > > Hi Adam,
> > > >
> > > > On Tue, Mar 22, 2022 at 4:09 PM Adam Pigg <adam@xxxxxxxxxxx> wrote:
> > > > >
> > > > > Thanks Luiz
> > > > >
> > > > > On Tue, 22 Mar 2022 at 21:35, Luiz Augusto von Dentz
> > > > > <luiz.dentz@xxxxxxxxx> wrote:
> > > > > >
> > > > > > Hi Adam,
> > > > > >
> > > > > > On Tue, Mar 22, 2022 at 3:40 AM Adam Pigg <adam@xxxxxxxxxxx> wrote:
> > > > > > >
> > > > > > > Hi Luiz
> > > > > > >
> > > > > > >
> > > > > > > On Tue, 22 Mar 2022 at 07:55, Adam Pigg <adam@xxxxxxxxxxx> wrote:
> > > > > > > >
> > > > > > > > Hi Luiz
> > > > > > > >
> > > > > > > > On Tue, 22 Mar 2022 at 00:44, Luiz Augusto von Dentz
> > > > > > > > <luiz.dentz@xxxxxxxxx> wrote:
> > > > > > > > >
> > > > > > > > > Hi Adam,
> > > > > > > > >
> > > > > > > > > On Mon, Mar 21, 2022 at 4:03 PM Adam Pigg <adam@xxxxxxxxxxx> wrote:
> > > > > > > > > >
> > > > > > > > > > Hi
> > > > > > > > > >
> > > > > > > > > > A bit of background, I write a linux desktop/mobile app called
> > > > > > > > > > Amazfish which interfaces with several watches over BLE using their
> > > > > > > > > > GATT services. To do this, I use the bluez dbus api (technically a
> > > > > > > > > > thin wrapper around it I wrote called qble
> > > > > > > > > > https://github.com/piggz/qble)
> > > > > > > > > >
> > > > > > > > > > All has been good so far, I support several generations of
> > > > > > > > > > Huami/Amazfit watches, as well as the open source Pinetime and
> > > > > > > > > > Bangle.js. For the Amazfit watches, i have implementations for older
> > > > > > > > > > devies such as the Bip, and newer ones such as the GTS.
> > > > > > > > > >
> > > > > > > > > > Much of the reverse engineering comes from the Android Gadget Bridge
> > > > > > > > > > project, which supports many more devices.
> > > > > > > > > >
> > > > > > > > > > My community of users donated to buy me a newer device called a GTR2,
> > > > > > > > > > which, according to the GB devs uses the same protocol as the slightly
> > > > > > > > > > older GTS, and the packet captures I have from Android would support
> > > > > > > > > > this.
> > > > > > > > > >
> > > > > > > > > > But this is where my trouble starts with Bluez, my existing
> > > > > > > > > > implementation doesnt work at all. Normally, after a connection, I
> > > > > > > > > > would wait for the ServicesResolved signal, which happens pretty fast
> > > > > > > > > > on all other devices, but on the GTR2, it takes about 30 seconds, by
> > > > > > > > > > which time, the watch has disconnected. (i get a disconnected signal
> > > > > > > > > > immediately after the ServicesResolved signal)
> > > > > > > > > >
> > > > > > > > > > To rule out my code, I have tried several things:
> > > > > > > > > > Gatttool
> > > > > > > > > > With gattool, i can connect, get the services, enable a notification,
> > > > > > > > > > write a value and get the expected results seemingly fine
> > > > > > > > > >
> > > > > > > > > > Python-gatt (using the bluez dbus api)
> > > > > > > > > > Im unable to iterate the services, like my app, it takes 30 seconds to
> > > > > > > > > > get the signal and then swiftly disconnects
> > > > > > > > > >
> > > > > > > > > > Gattlib (https://github.com/labapart/gattlib)
> > > > > > > > > > Gattlib is interesting as it appears to have "borrowed" much of its
> > > > > > > > > > code directly from bluez. When built against the system bluez, if the
> > > > > > > > > > version is > 5.42, it will use the dbus api. When I do this, again im
> > > > > > > > > > unable to list services on the watch. However, if I edit the build to
> > > > > > > > > > force it to use its internal gatt implementation, which appears to be
> > > > > > > > > > the same one used by gatttool, then, it IS able to interrogate the
> > > > > > > > > > watch.
> > > > > > > > > >
> > > > > > > > > > I have attached 3 files
> > > > > > > > > > 1. test python program which should print services, and associated btmon
> > > > > > > > > > 2. btmon output while using gatttool
> > > > > > > > > > 3. btmon output running gattlib discover example
> > > > > > > > > >
> > > > > > > > > > Note, other than discovery, I havnt been able to get gattlib to
> > > > > > > > > > read/write/notify!
> > > > > > > > > >
> > > > > > > > > > It seems as though I may be triggering a bug in the bluez dbus api?
> > > > > > > > > > Can anyone suggest anything?
> > > > > > > > >
> > > > > > > > > What version are you using? I would first try with the latest to see
> > > > > > > > > if that something already fixed.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > Im using 5.63 already, which is the latest tag (on opensuse tumbleweed)
> > > > > > > >
> > > > > > > > I'll also try bluetoothctl and attach logs using that, though I
> > > > > > > > suspect it will behave the same as the python library and my own
> > > > > > > > library.
> > > > > > > >
> > > > > > >
> > > > > > > Attached is the output of btmon while using bluetoothctl
> > > > > > >
> > > > > > > bluetoothctl behaves the same as my lib and python, it is unable to
> > > > > > > list services, and after a while, emits the ServicesResolved and
> > > > > > > disconnected messages at the same time. Im sure it should be able to
> > > > > > > list the services immediately after connect just like gatttool can.
> > > > > >
> > > > > > Looks like there is multiple rounds of MTU Exchange, not sure if that
> > > > > > is actually a problem but the spec does say it shall only be sent once
> > > > > > per client:
> > > > > >
> > > > > > BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part F
> > > > > > page 1424:
> > > > > >
> > > > > > This request shall only be sent once during a connection by the client.
> > > > > >
> > > > > > There is also no response to frame #30:
> > > > > > < ACL Data TX: Handle 3585 flags 0x00 dlen 7
> > > > > >
> > > > > > #30 [hci0] 26.641557
> > > > > > ATT: Read Request (0x0a) len 2
> > > > > > Handle: 0x0018
> > > > > >
> > > > > > So after 30 seconds (ATT timeout) without receiving any response it disconnects:
> > > > > >
> > > > >
> > > > > So, the verdict is that the watch isnt acting to spec right?
> > > > >
> > > > > Why does gatttool work ok, is it a completely different implementation?
> > > > >
> > > > > I understand if wouldnt be to spec, but would it be possible to make
> > > > > bluez more resilient to devices not acting to spec? Android and iOS
> > > > > work just fine in this regard, so could bluez handle mis-behaving
> > > > > devices more flexibly?
> > > >
> > > > That I can't really explain, perhaps it is timing related, something
> > > > with Exchange MTU since it appears to stop the device from responding
> > > > when it happens a second time.
> > > >
> > > > > Do you have any suggestions for things I could try? I looked for
> > > > > similar lines in the working gatttool log, and it doesnt have anything
> > > > > like that, seems to send flags 0x00 dlen 9 (instead of 7?) ... how is
> > > > > it behaving differently?
> > > >
> > > > Not sure really, does Android/iOS Exchange the MTU? Maybe we need a
> > > > timer to start it later or perhaps the problem first response to
> > > > exchange MTU does actually use the final_mtu which makes the watch to
> > > > trigger yet another exchange to have both rx and tx MTU the same so
> > > > try with the following change:
> > > >
> > > > diff --git a/src/shared/gatt-server.c b/src/shared/gatt-server.c
> > > > index 2adb4afbf..d326782bf 100644
> > > > --- a/src/shared/gatt-server.c
> > > > +++ b/src/shared/gatt-server.c
> > > > @@ -1499,7 +1499,7 @@ static void exchange_mtu_cb(struct bt_att_chan
> > > > *chan, uint8_t opcode,
> > > > final_mtu = MAX(MIN(client_rx_mtu, server->mtu), BT_ATT_DEFAULT_LE_MTU);
> > > >
> > > > /* Respond with the server MTU */
> > > > - put_le16(server->mtu, rsp_pdu);
> > > > + put_le16(final_mtu, rsp_pdu);
> > > > bt_att_chan_send_rsp(chan, BT_ATT_OP_MTU_RSP, rsp_pdu, 2);
> > > >
> > > > /* Set MTU to be the minimum */
> > >
> > > Hmm Im not sure if this will work since the peripheral seems to
> > > respond different values 252 vs 247, also the spec does say that:
> > >
> > > 'The Server Rx MTU parameter shall be set to the *maximum size* of the
> > > Attribute protocol PDU that the server can receive.
> > > The server and client shall set ATT_MTU to the *minimum of the Client Rx MTU
> > > and the Server Rx MTU*. The size is the same to ensure that a client can
> > > correctly detect the final packet of a long attribute read.'
> > >
> > > So my interpretation is that the minimum is calculated after the
> > > Exchange is complete so it doesn't require the Server MTU to be
> > > limited by the Client MTU, anyway if Android and iOS does apply the
> > > minimum logic before responding we can do the same.
> > >
> >
> > Maybe it will help if I attach an android packet capture....
> >
> > The attachedhttps://marc.info/?l=linux-bluetooth&m=164799909020040&w=2
> > log can be opened in Wireshark, and to my untrained eye, it looks like
> > the MTU negotiation is at packets 451 and 452, and 247 is used?
> >
> > Ill try and get the proposed patch built and see how it behaves
>
> Attached if the btmon and bluetoothctl. It doesnt seem to be there quite yet.
>
> There was one point before i applied the patch where bluetoothctl
> seemed to list the attributes quickly, but i havnt been able to
> reproduce that again with or without the patch.
>
For completeness, also attached the output of my program and btmon
My program should connect, wait for resolved signal, then read a char,
enable some notifications, and do a write. You can see the 30 second
wait between connect, resolved, and quickly followed by a disconnect.
> Thanks
>
>
> >
> > Thanks
> >
> > > >
> > > > >
> > > > > > < HCI Command: Disconnect (0x01|0x0006) plen 3
> > > > > >
> > > > > > #48 [hci0] 58.673128
> > > > > > Handle: 3585
> > > > > > Reason: Remote User Terminated Connection (0x13)
> > > > > >
> > > > > > > Thanks
> > > > > > >
> > > > > > >
> > > > > > > > > --
> > > > > > > > > Luiz Augusto von Dentz
> > > > > >
> > > > > >
> > > > > >
> > > > > > --
> > > > > > Luiz Augusto von Dentz
> > > >
> > > >
> > > >
> > > > --
> > > > Luiz Augusto von Dentz
> > >
> > >
> > >
> > > --
> > > Luiz Augusto von Dentz
Amazfish:
piggz@adam-laptop ~/projects/build-harbour-amazfish-Desktop-Debug $ ./daemon/harbour-amazfishd
2022-03-23 14:39:28.923 : Starting amazfish daemon
2022-03-23 14:39:28.932 : Starting notification monitor
2022-03-23 14:39:28.961 : void NavigationInterface::connectDaemon()
2022-03-23 14:39:28.962 : Interface is not valid
2022-03-23 14:39:28.962 : Registering service on dbus uk.co.piggz.amazfish
2022-03-23 14:39:28.963 : amazfish-daemon: succesfully registered to dbus sessionBus
2022-03-23 14:39:28.964 : DeviceFactory::createDevice: requested device of type: "Amazfit GTR 2"
2022-03-23 14:39:28.964 : Creating GTS Device
2022-03-23 14:39:28.964 : GtrDevice::GtrDevice(const QString&, QObject*)
2022-03-23 14:39:28.964 : Creating DBUS HRM
2022-03-23 14:39:28.968 : DRIVERS: ("org.kde.kdb.mysql", "org.kde.kdb.sqlite")
2022-03-23 14:39:28.969 : Database is: "/home/piggz/.local/share/harbour-amazfish/harbour-amazfish/amazfish.kexi"
2022-03-23 14:39:28.969 : KDbConnection object created.
2022-03-23 14:39:28.969 : KDbConnection::connect() OK.
2022-03-23 14:39:28.971 : ("mi_band_activity", "sports_data", "sports_meta")
2022-03-23 14:39:28.971 : DeviceInterface::connectToDevice: "/org/bluez/hci0/dev_F8_C3_D1_B0_5A_3A"
2022-03-23 14:39:28.971 : QBLEDevice::setDevicePath
2022-03-23 14:39:28.973 : true
2022-03-23 14:39:28.974 : AbstractDevice::connectToDevice
2022-03-23 14:39:28.974 : QBLEDevice::disconnectFromDevice
2022-03-23 14:39:28.975 : DeviceInterface::onConnectionStateChanged "connecting"
2022-03-23 14:39:28.975 : QBLEDevice::connectToDevice
2022-03-23 14:39:31.070 : virtual void GtrDevice::onPropertiesChanged(QString, QVariantMap, QStringList) "org.bluez.Device1" QMap(("Connected", QVariant(bool, true))) ()
2022-03-23 14:39:31.071 : DeviceInterface::onConnectionStateChanged "connected"
2022-03-23 14:40:01.356 : virtual void GtrDevice::onPropertiesChanged(QString, QVariantMap, QStringList) "org.bluez.Device1" QMap(("ServicesResolved", QVariant(bool, true))) ()
2022-03-23 14:40:01.387 : virtual void GtrDevice::initialise()
2022-03-23 14:40:01.388 : virtual void GtrDevice::parseServices()
2022-03-23 14:40:01.391 : Resolved services...
2022-03-23 14:40:01.391 : <!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
"http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd";>
<node><interface name="org.freedesktop.DBus.Introspectable"><method name="Introspect"><arg name="xml" type="s" direction="out"/>
</method></interface><interface name="org.bluez.Device1"><method name="Disconnect"></method><method name="Connect"></method><method name="ConnectProfile"><arg name="UUID" type="s" direction="in"/>
</method><method name="DisconnectProfile"><arg name="UUID" type="s" direction="in"/>
</method><method name="Pair"></method><method name="CancelPairing"></method><property name="Address" type="s" access="read"></property><property name="AddressType" type="s" access="read"></property><property name="Name" type="s" access="read"></property><property name="Alias" type="s" access="readwrite"></property><property name="Class" type="u" access="read"></property><property name="Appearance" type="q" access="read"></property><property name="Icon" type="s" access="read"></property><property name="Paired" type="b" access="read"></property><property name="Trusted" type="b" access="readwrite"></property><property name="Blocked" type="b" access="readwrite"></property><property name="LegacyPairing" type="b" access="read"></property><property name="RSSI" type="n" access="read"></property><property name="Connected" type="b" access="read"></property><property name="UUIDs" type="as" access="read"></property><property name="Modalias" type="s" access="read"></property><property name="Adapter" type="o" access="read"></property><property name="ManufacturerData" type="a{qv}" access="read"></property><property name="ServiceData" type="a{sv}" access="read"></property><property name="TxPower" type="n" access="read"></property><property name="ServicesResolved" type="b" access="read"></property><property name="WakeAllowed" type="b" access="readwrite"></property></interface><interface name="org.freedesktop.DBus.Properties"><method name="Get"><arg name="interface" type="s" direction="in"/>
<arg name="name" type="s" direction="in"/>
<arg name="value" type="v" direction="out"/>
</method><method name="Set"><arg name="interface" type="s" direction="in"/>
<arg name="name" type="s" direction="in"/>
<arg name="value" type="v" direction="in"/>
</method><method name="GetAll"><arg name="interface" type="s" direction="in"/>
<arg name="properties" type="a{sv}" direction="out"/>
</method><signal name="PropertiesChanged"><arg name="interface" type="s"/>
<arg name="changed_properties" type="a{sv}"/>
<arg name="invalidated_properties" type="as"/>
</signal>
</interface><interface name="org.bluez.AdminPolicyStatus1"><property name="AffectedByPolicy" type="b" access="read"></property></interface><node name="service0001"/><node name="service0028"/><node name="service0038"/><node name="service0040"/><node name="service0070"/><node name="service0084"/><node name="service008c"/><node name="service0094"/><node name="service0099"/></node>
2022-03-23 14:40:01.394 : 10 nodes
2022-03-23 14:40:01.400 : Creating service for: "00001801-0000-1000-8000-00805f9b34fb"
2022-03-23 14:40:01.403 : 2 nodes
2022-03-23 14:40:01.411 : Introspect:characteristics: ("00002a05-0000-1000-8000-00805f9b34fb")
2022-03-23 14:40:01.413 : Creating service for: "0000180a-0000-1000-8000-00805f9b34fb"
2022-03-23 14:40:01.415 : 7 nodes
2022-03-23 14:40:01.428 : Introspect:characteristics: ("00000014-0000-3512-2118-0009af100700", "00002a23-0000-1000-8000-00805f9b34fb", "00002a25-0000-1000-8000-00805f9b34fb", "00002a27-0000-1000-8000-00805f9b34fb", "00002a28-0000-1000-8000-00805f9b34fb", "00002a50-0000-1000-8000-00805f9b34fb")
2022-03-23 14:40:01.428 : BipInfoService::BipInfoService
2022-03-23 14:40:01.428 : Creating service for: "00001530-0000-3512-2118-0009af100700"
2022-03-23 14:40:01.429 : 3 nodes
2022-03-23 14:40:01.433 : Introspect:characteristics: ("00001531-0000-3512-2118-0009af100700", "00001532-0000-3512-2118-0009af100700")
2022-03-23 14:40:01.434 : BipFirmwareService::BipFirmwareService
2022-03-23 14:40:01.434 : Creating service for: "0000fee0-0000-1000-8000-00805f9b34fb"
2022-03-23 14:40:01.435 : 15 nodes
2022-03-23 14:40:01.453 : Introspect:characteristics: ("00000001-0000-3512-2118-0009af100700", "00000002-0000-3512-2118-0009af100700", "00000003-0000-3512-2118-0009af100700", "00000004-0000-3512-2118-0009af100700", "00000005-0000-3512-2118-0009af100700", "00000006-0000-3512-2118-0009af100700", "00000007-0000-3512-2118-0009af100700", "0000000e-0000-3512-2118-0009af100700", "00000010-0000-3512-2118-0009af100700", "00000016-0000-3512-2118-0009af100700", "00000017-0000-3512-2118-0009af100700", "00000020-0000-3512-2118-0009af100700", "00002a04-0000-1000-8000-00805f9b34fb", "00002a2b-0000-1000-8000-00805f9b34fb")
2022-03-23 14:40:01.453 : MiBandService::MiBandService
2022-03-23 14:40:01.454 : Creating service for: "0000fee1-0000-1000-8000-00805f9b34fb"
2022-03-23 14:40:01.455 : 9 nodes
2022-03-23 14:40:01.463 : Introspect:characteristics: ("00000009-0000-3512-2118-0009af100700", "0000fed0-0000-1000-8000-00805f9b34fb", "0000fed1-0000-1000-8000-00805f9b34fb", "0000fed2-0000-1000-8000-00805f9b34fb", "0000fed3-0000-1000-8000-00805f9b34fb", "0000fedd-0000-1000-8000-00805f9b34fb", "0000fede-0000-1000-8000-00805f9b34fb", "0000fedf-0000-1000-8000-00805f9b34fb")
2022-03-23 14:40:01.463 : MiBand2Service::MiBand2Service
2022-03-23 14:40:01.463 : auth: 0 crypt: 128 req: true
2022-03-23 14:40:01.464 : Creating service for: "0000180d-0000-1000-8000-00805f9b34fb"
2022-03-23 14:40:01.465 : 3 nodes
2022-03-23 14:40:01.468 : Introspect:characteristics: ("00002a37-0000-1000-8000-00805f9b34fb", "00002a39-0000-1000-8000-00805f9b34fb")
2022-03-23 14:40:01.468 : HRMService::HRMService
2022-03-23 14:40:01.468 : Creating service for: "00001811-0000-1000-8000-00805f9b34fb"
2022-03-23 14:40:01.469 : 3 nodes
2022-03-23 14:40:01.471 : Introspect:characteristics: ("00002a44-0000-1000-8000-00805f9b34fb", "00002a46-0000-1000-8000-00805f9b34fb")
2022-03-23 14:40:01.471 : AlertNotificationService::AlertNotificationService(const QString&, QObject*, uint8_t)
2022-03-23 14:40:01.471 : Creating service for: "00001802-0000-1000-8000-00805f9b34fb"
2022-03-23 14:40:01.472 : 2 nodes
2022-03-23 14:40:01.473 : Introspect:characteristics: ("00002a06-0000-1000-8000-00805f9b34fb")
2022-03-23 14:40:01.473 : Creating service for: "00003802-0000-1000-8000-00805f9b34fb"
2022-03-23 14:40:01.474 : 2 nodes
2022-03-23 14:40:01.475 : Introspect:characteristics: ("00004a02-0000-1000-8000-00805f9b34fb")
2022-03-23 14:40:01.475 : Read first
2022-03-23 14:40:01.475 : Reading from "00000020-0000-3512-2118-0009af100700"
2022-03-23 14:40:01.476 : ""
2022-03-23 14:40:01.476 : Starting notify for "00000017-0000-3512-2118-0009af100700"
2022-03-23 14:40:01.476 : Starting notify for "00000020-0000-3512-2118-0009af100700"
2022-03-23 14:40:01.477 : Starting notify for "00000016-0000-3512-2118-0009af100700"
2022-03-23 14:40:01.477 : Write something
2022-03-23 14:40:01.477 : Writing to "00000016-0000-3512-2118-0009af100700" : "01"
2022-03-23 14:40:01.477 : Got mi2 service
2022-03-23 14:40:01.477 : Starting notify for "00000009-0000-3512-2118-0009af100700"
2022-03-23 14:40:01.477 : Writing request for auth number
2022-03-23 14:40:01.478 : Writing to "00000009-0000-3512-2118-0009af100700" : "0100"
2022-03-23 14:40:03.520 : virtual void GtrDevice::onPropertiesChanged(QString, QVariantMap, QStringList) "org.bluez.Device1" QMap(("Connected", QVariant(bool, false))("ServicesResolved", QVariant(bool, false))) ()
2022-03-23 14:40:03.522 : DisConnected!
2022-03-23 14:40:03.522 : DeviceInterface::onConnectionStateChanged "disconnected"
^C
----------
btmon
piggz@adam-laptop ~ $ sudo btmon
Bluetooth monitor ver 5.63
= Note: Linux version 5.16.14-1-default (x86_64) 0.726131
= Note: Bluetooth subsystem version 2.22 0.726136
= New Index: DC:53:60:51:00:C6 (Primary,USB,hci0) [hci0] 0.726138
= Open Index: DC:53:60:51:00:C6 [hci0] 0.726139
= Index Info: DC:53:60:51:00:C6 (Intel Corp.) [hci0] 0.726139
@ MGMT Open: bluetoothd (privileged) version 1.21 {0x0001} 0.726141
< HCI Command: LE Set Scan Parameters (0x08|0x000b) plen 7 #1 [hci0] 4.976229
Type: Passive (0x00)
Interval: 60.000 msec (0x0060)
Window: 60.000 msec (0x0060)
Own address type: Public (0x00)
Filter policy: Accept all advertisement (0x00)
> HCI Event: Command Complete (0x0e) plen 4 #2 [hci0] 5.089949
LE Set Scan Parameters (0x08|0x000b) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2 #3 [hci0] 5.089966
Scanning: Enabled (0x01)
Filter duplicates: Enabled (0x01)
> HCI Event: Command Complete (0x0e) plen 4 #4 [hci0] 5.090948
LE Set Scan Enable (0x08|0x000c) ncmd 2
Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 29 #5 [hci0] 5.099979
LE Advertising Report (0x02)
Num reports: 1
Event type: Connectable undirected - ADV_IND (0x00)
Address type: Random (0x01)
Address: 7F:42:2B:17:94:D6 (Resolvable)
Data length: 17
Flags: 0x1a
LE General Discoverable Mode
Simultaneous LE and BR/EDR (Controller)
Simultaneous LE and BR/EDR (Host)
TX power: 12 dBm
Company: Apple, Inc. (76)
Type: Unknown (16)
Data: 5c1cad5d3f
RSSI: -83 dBm (0xad)
> HCI Event: LE Meta Event (0x3e) plen 43 #6 [hci0] 5.232980
LE Advertising Report (0x02)
Num reports: 1
Event type: Connectable undirected - ADV_IND (0x00)
Address type: Random (0x01)
Address: EF:51:CD:3C:7E:8F (Static)
Data length: 31
Flags: 0x06
LE General Discoverable Mode
BR/EDR Not Supported
Company: Anhui Huami Information Technology Co., Ltd. (343)
Data: 02ffffffffffffffffffffffffffffffff03ef51cd3c7e8f
RSSI: -72 dBm (0xb8)
> HCI Event: LE Meta Event (0x3e) plen 40 #7 [hci0] 5.512989
LE Advertising Report (0x02)
Num reports: 1
Event type: Scannable undirected - ADV_SCAN_IND (0x02)
Address type: Random (0x01)
Address: 79:F9:F9:87:54:DA (Resolvable)
Data length: 28
16-bit Service UUIDs (complete): 1 entry
Google (0xfe9f)
Service Data (UUID 0xfe9f): 0000000000000000000000000000000000000000
RSSI: -79 dBm (0xb1)
> HCI Event: LE Meta Event (0x3e) plen 43 #8 [hci0] 5.760998
LE Advertising Report (0x02)
Num reports: 1
Event type: Connectable undirected - ADV_IND (0x00)
Address type: Random (0x01)
Address: F8:C3:D1:B0:5A:3A (Static)
Data length: 31
Flags: 0x02
LE General Discoverable Mode
Company: Anhui Huami Information Technology Co., Ltd. (343)
Data: 02ffffffffffffffffffffffffffffffff03f8c3d1b05a3a
RSSI: -63 dBm (0xc1)
< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2 #9 [hci0] 5.761086
Scanning: Disabled (0x00)
Filter duplicates: Disabled (0x00)
> HCI Event: Command Complete (0x0e) plen 4 #10 [hci0] 5.766972
LE Set Scan Enable (0x08|0x000c) ncmd 2
Status: Success (0x00)
< HCI Command: LE Create Connection (0x08|0x000d) plen 25 #11 [hci0] 5.767037
Scan interval: 60.000 msec (0x0060)
Scan window: 60.000 msec (0x0060)
Filter policy: Accept list is not used (0x00)
Peer address type: Random (0x01)
Peer address: F8:C3:D1:B0:5A:3A (Static)
Own address type: Public (0x00)
Min connection interval: 30.00 msec (0x0018)
Max connection interval: 50.00 msec (0x0028)
Connection latency: 0 (0x0000)
Supervision timeout: 420 msec (0x002a)
Min connection length: 0.000 msec (0x0000)
Max connection length: 0.000 msec (0x0000)
> HCI Event: Command Status (0x0f) plen 4 #12 [hci0] 5.767984
LE Create Connection (0x08|0x000d) ncmd 2
Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 19 #13 [hci0] 6.617967
LE Connection Complete (0x01)
Status: Success (0x00)
Handle: 3585
Role: Central (0x00)
Peer address type: Random (0x01)
Peer address: F8:C3:D1:B0:5A:3A (Static)
Connection interval: 50.00 msec (0x0028)
Connection latency: 0 (0x0000)
Supervision timeout: 420 msec (0x002a)
Central clock accuracy: 0x00
@ MGMT Event: Device Connected (0x000b) plen 44 {0x0001} [hci0] 6.618004
LE Address: F8:C3:D1:B0:5A:3A (Static)
Flags: 0x00000008
Connection Locally Initiated
Data length: 31
Flags: 0x02
LE General Discoverable Mode
Company: Anhui Huami Information Technology Co., Ltd. (343)
Data: 02ffffffffffffffffffffffffffffffff03f8c3d1b05a3a
< HCI Command: LE Read Remote Used Features (0x08|0x0016) plen 2 #14 [hci0] 6.618057
Handle: 3585
> HCI Event: Command Status (0x0f) plen 4 #15 [hci0] 6.618956
LE Read Remote Used Features (0x08|0x0016) ncmd 1
Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 12 #16 [hci0] 6.669963
LE Read Remote Used Features (0x04)
Status: Success (0x00)
Handle: 3585
Features: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00
LE Encryption
< HCI Command: LE Start Encryption (0x08|0x0019) plen 28 #17 [hci0] 6.669998
Handle: 3585
Random number: 0x3c9dac4d04978c2c
Encrypted diversifier: 0xed2b
Long term key: cf7f359f6a275cf8e4b633bd93ae9c6c
> HCI Event: Command Status (0x0f) plen 4 #18 [hci0] 6.670963
LE Start Encryption (0x08|0x0019) ncmd 1
Status: Success (0x00)
> HCI Event: Encryption Change (0x08) plen 4 #19 [hci0] 7.068963
Status: Success (0x00)
Handle: 3585
Encryption: Enabled with AES-CCM (0x01)
< ACL Data TX: Handle 3585 flags 0x00 dlen 7 #20 [hci0] 7.069354
ATT: Exchange MTU Request (0x02) len 2
Client RX MTU: 517
> ACL Data RX: Handle 3585 flags 0x02 dlen 7 #21 [hci0] 7.118679
ATT: Exchange MTU Request (0x02) len 2
Client RX MTU: 247
< ACL Data TX: Handle 3585 flags 0x00 dlen 7 #22 [hci0] 7.118890
ATT: Exchange MTU Response (0x03) len 2
Server RX MTU: 247
> HCI Event: Number of Completed Packets (0x13) plen 5 #23 [hci0] 7.119996
Num handles: 1
Handle: 3585
Count: 1
> HCI Event: Number of Completed Packets (0x13) plen 5 #24 [hci0] 7.169966
Num handles: 1
Handle: 3585
Count: 1
> ACL Data RX: Handle 3585 flags 0x02 dlen 7 #25 [hci0] 7.218701
ATT: Exchange MTU Response (0x03) len 2
Server RX MTU: 252
< ACL Data TX: Handle 3585 flags 0x00 dlen 7 #26 [hci0] 7.218961
ATT: Read Request (0x0a) len 2
Handle: 0x0016
> HCI Event: Number of Completed Packets (0x13) plen 5 #27 [hci0] 7.269035
Num handles: 1
Handle: 3585
Count: 1
> ACL Data RX: Handle 3585 flags 0x02 dlen 19 #28 [hci0] 7.318699
ATT: Read Response (0x0b) len 14
Value: 416d617a66697420475452203200
< ACL Data TX: Handle 3585 flags 0x00 dlen 7 #29 [hci0] 7.318880
ATT: Read Request (0x0a) len 2
Handle: 0x0018
> HCI Event: Number of Completed Packets (0x13) plen 5 #30 [hci0] 7.418974
Num handles: 1
Handle: 3585
Count: 1
> ACL Data RX: Handle 3585 flags 0x02 dlen 7 #31 [hci0] 9.818580
ATT: Exchange MTU Request (0x02) len 2
Client RX MTU: 247
< ACL Data TX: Handle 3585 flags 0x00 dlen 7 #32 [hci0] 9.818909
ATT: Exchange MTU Response (0x03) len 2
Server RX MTU: 247
> HCI Event: Number of Completed Packets (0x13) plen 5 #33 [hci0] 9.868987
Num handles: 1
Handle: 3585
Count: 1
> ACL Data RX: Handle 3585 flags 0x02 dlen 11 #34 [hci0] 10.568667
ATT: Read By Type Request (0x08) len 6
Handle range: 0x0001-0xffff
Attribute type: Characteristic (0x2803)
< ACL Data TX: Handle 3585 flags 0x00 dlen 27 #35 [hci0] 10.568832
< ACL Data TX: Handle 3585 flags 0x01 dlen 27 #36 [hci0] 10.568848
< ACL Data TX: Handle 3585 flags 0x01 dlen 8 #37 [hci0] 10.568853
ATT: Read By Type Response (0x09) len 57
Attribute data length: 7
Attribute data list: 8 entries
Handle: 0x0002
Value: 020300002a
Handle: 0x0004
Value: 020500012a
Handle: 0x0006
Value: 020700a62a
Handle: 0x0009
Value: 200a00052a
Handle: 0x000c
Value: 0a0d00292b
Handle: 0x000e
Value: 020f002a2b
Handle: 0x0010
Value: 0211003a2b
Handle: 0x0013
Value: 021400502a
> HCI Event: Number of Completed Packets (0x13) plen 5 #38 [hci0] 10.619031
Num handles: 1
Handle: 3585
Count: 1
> HCI Event: Number of Completed Packets (0x13) plen 5 #39 [hci0] 10.620014
Num handles: 1
Handle: 3585
Count: 1
> HCI Event: Number of Completed Packets (0x13) plen 5 #40 [hci0] 10.620968
Num handles: 1
Handle: 3585
Count: 1
> ACL Data RX: Handle 3585 flags 0x02 dlen 11 #41 [hci0] 10.668689
ATT: Read By Type Request (0x08) len 6
Handle range: 0x0014-0xffff
Attribute type: Characteristic (0x2803)
< ACL Data TX: Handle 3585 flags 0x00 dlen 9 #42 [hci0] 10.669108
ATT: Error Response (0x01) len 4
Read By Type Request (0x08)
Handle: 0x0014
Error: Attribute Not Found (0x0a)
> HCI Event: Number of Completed Packets (0x13) plen 5 #43 [hci0] 10.718984
Num handles: 1
Handle: 3585
Count: 1
> ACL Data RX: Handle 3585 flags 0x02 dlen 11 #44 [hci0] 10.768626
ATT: Read By Type Request (0x08) len 6
Handle range: 0x0001-0xffff
Attribute type: Device Name (0x2a00)
< ACL Data TX: Handle 3585 flags 0x00 dlen 18 #45 [hci0] 10.768826
ATT: Read By Type Response (0x09) len 13
Attribute data length: 12
Attribute data list: 1 entry
Handle: 0x0003
Value: 426c75655a20352e3633
> HCI Event: Number of Completed Packets (0x13) plen 5 #46 [hci0] 10.819036
Num handles: 1
Handle: 3585
Count: 1
= bluetoothd: profiles/deviceinfo/deviceinfo.c:read_pnpid_cb() Error reading PNP_ID value: Request attribute has encountered an unlikely error 37.345944
< HCI Command: Disconnect (0x01|0x0006) plen 3 #47 [hci0] 39.373081
Handle: 3585
Reason: Remote User Terminated Connection (0x13)
> HCI Event: Command Status (0x0f) plen 4 #48 [hci0] 39.491061
Disconnect (0x01|0x0006) ncmd 1
Status: Success (0x00)
> HCI Event: Disconnect Complete (0x05) plen 4 #49 [hci0] 39.519016
Status: Success (0x00)
Handle: 3585
Reason: Connection Terminated By Local Host (0x16)
@ MGMT Event: Device Disconnected (0x000c) plen 8 {0x0001} [hci0] 39.519050
LE Address: F8:C3:D1:B0:5A:3A (Static)
Reason: Connection terminated by local host (0x02)
