QN902x example takes >20 seconds to bond with iOS 12.3

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

QN902x example takes >20 seconds to bond with iOS 12.3

1,997 Views
hugho_keeffe
Contributor I

SETUP:

  1. NXP QN902x_SDK_1.4.0 on a QN9020_MINIDK_V8 board.
  2. BLPS example program that comes with the SDK
  3. nRF Connect application running on an iPhone with iOS 12.3

PROBLEM:

I am seeing the following two problems when using the example program:-

  1. Bonding takes circa 25 seconds to complete
  2. Once bonding is complete, if I disconnect and reconnect, the status is still shown as bonded by both the phone app and the firmware debug printfs. However, I get authentication errors when I try to read the characteristics.

The following changes have been made to the BLPS example program:-

  1. \Projects\BLE\src\profiles\blp\blps\blps.c

Set all characteristic declarations to AUTH as opposed to ENABLE.

  1. \Projects\BLE\src\app\app_config.h

Set the SMP Security level and IO capability definitions to...

        #define QN_SEC_MODE_LEVEL       GAP_SEC1_AUTH_PAIR_ENC

        #define QN_IO_CAP_ABILITY       SMP_IO_CAP_DISPLAY_ONLY

  1. \Projects\BLE\prj_blps\src\usr_config.h

Set the chip version to B2....

#define CFG_9020_B2

  1. Keil Project File

Exclude qn9020b4_lib_peripheral_v42.lib from the build

Include qn9020b2_lib_peripheral_v42.lib in the build

 

On initial power-up / connection, the following debug printfs are shown:-

QN BLE is ready.

Advertising start.

Connection with 6526DEE2CD55 result is 0x0.

IRK request indication idx is 0.

Slave update success.

Update parameter complete, interval: 0xc6, latency: 0x0, sup to: 0x12c.

Accept Bond request indi received from 6526:DE:E2CD55.

TK request indication idx is 0.

PASSKEY: 123456

<NOTE:- Circa 25 seconds delay>

Key 1 indication idx is 0.

Key 2 indication idx is 0.

Bond request complete handle: 0000, bonded: 1, status: 0x00.

 

 

When I look at the characteristics (0x2A49 for example) on the phone app, it shows that it has read it successfully as per the following screen grab:-

 P1.png

When I disconnect via the app on the phone, the following debug printfs are shown:-

 

Disconnect with 5527BB25B41F reason is 0x13.

Advertising start.

 

When I reconnect via the app on the phone, the following debug printfs are shown:-

 

Connection with 5527BB25B41F result is 0x0.

IRK request indication idx is 0.

IRK request indication idx is 255.

Update parameter complete, interval: 0xc6, latency: 0x0, sup to: 0x12c.

LTK request indication idx is 0, auth_req is 13.

Start encryption complete, idx 0, status 0, key_size 0, sec_prop 12, bonded 1.

Slave update success.

 

 

When I now look at the characteristics (0x2A49 for example) on the phone app, it shows authentication insufficient as as per the following screen grab:-

 P2.png

Any help appreciated in advance.

Thanks

Hugh

Labels (1)
0 Kudos
9 Replies

1,611 Views
hugho_keeffe
Contributor I

Quick Update 2-Aug-2019: For anyone following, NXP found the problem in their SDK and provided us with an update directly which I can confirm fixes all of the above issues. 

0 Kudos

1,613 Views
hugho_keeffe
Contributor I

Hi Mario,

I've programmed the supplied binary file on to the board using QN902x ISP Studio v1.30.exe.

 

The following debug printfs were captured for the initial BLE connection:-

 

QN BLE is ready.

Advertising start.

Connection with 79299E6CEAC6 result is 0x0.

IRK request indication idx is 0.

IRK request indication idx is 255.

Slave update success.

Accept Bond request indi received from 7929:9E:6CEAC6.

Update parameter complete, interval: 0xc6, latency: 0x0, sup to: 0x12c.

TK request indication idx is 0.

PASSKEY: 123456

<20 second delay>

Key 1 indication idx is 0.

Key 2 indication idx is 0.

Bond request complete handle: 0000, bonded: 1, status: 0x00.

 

 

The phones Settings->Bluetooth screen shows the device as being paired.

The characteristic 2A49 is read successfully by the nrf Connect app.

 

Powered down the board and closed the app.

Powered up the board, opened the nrf Connect app and connected.

 

 

The following debug printfs were captured:-

 

 

QN BLE is ready.

Advertising start.

Connection with 79299E6CEAC6 result is 0x0.

IRK request indication idx is 0.

IRK request indication idx is 255.

Update parameter complete, interval: 0xc6, latency: 0x0, sup to: 0x12c.

LTK request indication idx is 0, auth_req is 0.

Start encryption complete, idx 0, status 0, key_size 0, sec_prop 12, bonded 0.

Slave update success.

 

 

Characteristic 2A49 is still read successfully by the nrf Connect app, however "bonded 0" above would seem to indicate that bonding is not in place.

 

 

I read the NVDS contents using QN902x NVDS Configurator v1.29.exe. Binary file attached. All bytes after 0xD0 are 0xFF's; which would indicate that bonding information is not being stored.

We would prefer if you  send source-code in future as opposed to binary files.

Thanks

Hugh

0 Kudos

1,613 Views
mario_castaneda
NXP TechSupport
NXP TechSupport

Hi Hugh,

Please look at my Database description below:

/// Full BLPS Database Description - Used to add attributes into the database
const struct atts_desc blps_att_db[BPS_IDX_NB] =
{
    // Blood Pressure Service Declaration
    [BPS_IDX_SVC]                          =   {ATT_DECL_PRIMARY_SERVICE, PERM(RD, ENABLE), sizeof(blps_bps_svc),
                                                                              sizeof(blps_bps_svc), (uint8_t *)&blps_bps_svc},
//[MC]
                // Blood Pressure Measurement Characteristic Declaration
                [BPS_IDX_BP_MEAS_CHAR]                =   {ATT_DECL_CHARACTERISTIC, PERM(RD, AUTH/*ENABLE*/), sizeof(blps_bp_meas_char),
                                                                                           sizeof(blps_bp_meas_char), (uint8_t *)&blps_bp_meas_char},
                // Blood Pressure Measurement Characteristic Value
                [BPS_IDX_BP_MEAS_VAL]                 =   {ATT_CHAR_BLOOD_PRESSURE_MEAS, PERM(IND, AUTH/*ENABLE*/), BLPS_BP_MEAS_MAX_LEN,
                                                                                           0, NULL},                          
[BPS_IDX_BP_MEAS_IND_CFG]             =   {ATT_DESC_CLIENT_CHAR_CFG, PERM(RD, ENABLE)|PERM(WR, ENABLE), sizeof(uint16_t),
      0, NULL},
                //[MC]
// Blood Pressure Feature Characteristic Declaration
[BPS_IDX_BP_FEATURE_CHAR]            =   {ATT_DECL_CHARACTERISTIC, PERM(RD, AUTH/*ENABLE*/), sizeof(blps_bp_feature_char),
                                                                                              sizeof(blps_bp_feature_char), (uint8_t *)&blps_bp_feature_char},
// Blood Pressure Feature Characteristic Value
[BPS_IDX_BP_FEATURE_VAL]             =   {ATT_CHAR_BLOOD_PRESSURE_FEATURE, PERM(RD, AUTH/*ENABLE*/), sizeof(uint16_t),
                                                                                                                      0, NULL},
//[MC]
// Intermediate Cuff Pressure Characteristic Declaration
[BPS_IDX_INTM_CUFF_PRESS_CHAR]        =   {ATT_DECL_CHARACTERISTIC, PERM(RD, AUTH/*ENABLE*/), sizeof(blps_interm_cuff_press_char),
                                                                                                              sizeof(blps_interm_cuff_press_char), (uint8_t *)&blps_interm_cuff_press_char},
// Intermediate Cuff Pressure Characteristic Value
[BPS_IDX_INTM_CUFF_PRESS_VAL]         =   {ATT_CHAR_INTERMEDIATE_CUFF_PRESSURE, PERM(NTF, AUTH/*ENABLE*/), BLPS_BP_MEAS_MAX_LEN,
                                                                                                              0, NULL},
// Intermediate Cuff Pressure Characteristic - Client Characteristic Configuration Descriptor
[BPS_IDX_INTM_CUFF_PRESS_NTF_CFG]   =   {ATT_DESC_CLIENT_CHAR_CFG, PERM(RD, ENABLE)|PERM(WR, ENABLE), sizeof(uint16_t),
                                                                                                              0, NULL},
};

I bonded the QN with the iPhone correctly.

I deleted the device from the phone information.

I tried to connect again and the QN device request again for new keys.

pastedImage_1.png

I read out the NVDS. The first time, the QN saved the bonding information, but after I removed the device from the iOS if the iPhone wants to connect again, the QN ask for the passkey and the bonding process start again.

Please see the NVDS memory, and how the device set the tag valid to invalid.

pastedImage_2.png

Please let me know your findings.

Regards,

Mario

0 Kudos

1,613 Views
hugho_keeffe
Contributor I

PS. The bonding information is not being wrote to NVDS for my test case (All bytes from 0xD0 upwards remain at 0xFF).  Attached for reference is my NVDS bin file.

0 Kudos

1,613 Views
mario_castaneda
NXP TechSupport
NXP TechSupport

Hi Hugh,

Could you please run one more test with the next bin file?

The characteristics BPS_IDX_BP_MEAS_CHAR, BPS_IDX_BP_FEATURE_CHAR, and BPS_IDX_INTM_CUFF_PRESS_CHAR has the AUTH

Let me know your findings.

Regards,

Mario

0 Kudos

1,612 Views
hugho_keeffe
Contributor I

Hi Mario,

Thanks for your help, however.....


1. From the source we received from you:

1.1 Most of the characteristic permissions have been set to ENABLE as opposed to AUTH. This has the effect that iOS does not prompt for a passkey when it connects to the device.

1.2 AUTH was turned on only for write access to characteristic BPS_IDX_BP_MEAS_IND_CFG. We expect that you would have to write to BPS_IDX_BP_MEAS_IND_CFG to force the bonding to begin.


2. In our original problem description we state that all characteristic permissions were set to AUTH.


3. With your other changes in place (but with all characteristic permissions set to AUTH), bonding does appear to be taking place, however, there there is still a circa 20 seconds delay in bonding as per our original problem description AND when we disconnect/re-connect on the app side we are unable to access characteristics (e.g. 2A49 ) due to an "authentication insufficient" error as per our original problem description.


Regards,

Hugh

0 Kudos

1,612 Views
mario_castaneda
NXP TechSupport
NXP TechSupport

Hi,

I ran by my side and the bonding process takes around 25 seconds, but 

but the bonding is correct, LE Secure Connections Auth Passkey repeat the process 20 times.

The only change that I did:

        #define QN_SEC_MODE_LEVEL       GAP_SEC2_AUTH_DATA_SGN
        #define QN_IO_CAP_ABILITY       SMP_IO_CAP_DISPLAY_ONLY

I used iOS 12.3 and it works, could you please try by your side again?

Regards,

Mario

0 Kudos

1,611 Views
hugho_keeffe
Contributor I

Hi Mario,

Thanks.

1. 25 seconds for bonding is still incorrect. Would you agree ?

2. Is your hardware setup and SDK version the same as ours ?

3. We did try your suggestion and the results follow. Still have bonding problems


Using:

        #define QN_SEC_MODE_LEVEL          GAP_SEC2_AUTH_DATA_SGN

         #define QN_IO_CAP_ABILITY             SMP_IO_CAP_DISPLAY_ONLY

Still seeing the 20 seconds delay but bonding is not performed. Debug printfs from four consecutive tests are given below. All of them have "bonded: 0" in the last line which would indicate that bonding was not completed. When I checked in the iOS->Settings->Bluetooth screen, the device is not being shown as bonded, which concurs with the debug printfs.

Are using the exact same test setup that we had described (apart from their QN_SEC_MODE_LEVEL  change), the only other variable I can think of is the contents of the NVDS memory on the BLE chip. Ours follows:

BBB.png

The configuration can be read/written by a "QN902x NVDS Configurator" Windows tool supplied in the SDK. 

Bonding debug logs follow:

QN BLE is ready.

Advertising start.

Connection with 7D88DC1A11A3 result is 0x0.

IRK request indication idx is 0.

Slave update success.

Update parameter complete, interval: 0xc6, latency: 0x0, sup to: 0x12c.

Accept Bond request indi received from 7D88:DC:1A11A3.

TK request indication idx is 0.

PASSKEY: 123456

<Long Delay>

Key 1 indication idx is 0.

Bond request complete handle: 0000, bonded: 0, status: 0x00.

 

QN BLE is ready.

Advertising start.

Connection with 7D88DC1A11A3 result is 0x0.

IRK request indication idx is 0.

Slave update success.

Update parameter complete, interval: 0xc6, latency: 0x0, sup to: 0x12c.

Accept Bond request indi received from 7D88:DC:1A11A3.

TK request indication idx is 0.

PASSKEY: 123456

<Long Delay>

Key 1 indication idx is 0.

Bond request complete handle: 0000, bonded: 0, status: 0x00.

 

QN BLE is ready.

Advertising start.

Connection with 7D88DC1A11A3 result is 0x0.

IRK request indication idx is 0.

Slave update success.

Update parameter complete, interval: 0xc6, latency: 0x0, sup to: 0x12c.

Accept Bond request indi received from 7D88:DC:1A11A3.

TK request indication idx is 0.

PASSKEY: 123456

<Long Delay>

Key 1 indication idx is 0.

Bond request complete handle: 0000, bonded: 0, status: 0x00.

 

QN BLE is ready.

Advertising start.

Connection with 7D88DC1A11A3 result is 0x0.

IRK request indication idx is 0.

Slave update success.

Update parameter complete, interval: 0xc6, latency: 0x0, sup to: 0x12c.

Accept Bond request indi received from 7D88:DC:1A11A3.

TK request indication idx is 0.

PASSKEY: 123456

<Long Delay>

Key 1 indication idx is 0.

Bond request complete handle: 0000, bonded: 0, status: 0x00.

 

 Thanks

Hugh

0 Kudos

1,614 Views
mario_castaneda
NXP TechSupport
NXP TechSupport

Hi Hugh,

Could you please change some lines in your code?

app_gap_task.c

#if (QN_SECURE_CONNECTIONS)
    auth |= GAP_AUTH_REQ_SEC_CON_BOND; //GAP_AUTH_REQ_SEC_CON_NO_BOND;
#endif

app_gap.c

#if (QN_SECURE_CONNECTIONS)
    auth |= GAP_AUTH_REQ_SEC_CON_BOND; //GAP_AUTH_REQ_SEC_CON_NO_BOND;
#endif

If you want to increase the bonded device.

#define APP_MAX_BONDED_DEVICE_NUMBER    5// 1

app_config.h

        #if (QN_SECURE_CONNECTIONS)
        #define QN_SEC_MODE_LEVEL  GAP_SEC2_AUTH_DATA_SGN //AP_SEC1_NOAUTH_PAIR_ENC
        #define QN_IO_CAP_ABILITY  SMP_IO_CAP_DISPLAY_ONLY//SMP_IO_CAP_NO_INPUT_NO_OUTPUT 

As you can see the bonded count increase.

pastedImage_1.png

If you enabled the CFG_NVDS_WRITE define and if you read out your NVDS will look like this.

pastedImage_2.png

If you see the random address has been saved in the NVDS section.

Please let me know if you still have issues with the bonding process.

Regards,

Mario

0 Kudos