This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC2541 1.4.1 stack pairing problem

Hello all,

When we switched from 1.4.0 stack to 1.4.1 we started seeing a new problem. It has occurred on 4/8 tested host devices, each with different iOS versions and hardware.

One BLE chip could not pair to one iOS device. It could pair to other iOS devices and the iOS device could pair to other BLE chips.

The mode of failure was, it would appear on the iOS Bluetooth settings. If the user selected that BLE chip, there would be a pairing request popup. The user would click OK, the pairing request popup would vanish, the device would be listed as connected for a second, and then it would go back to being not connected and broadcasting.

When the iOS device/chip gets into this state, pairing fails repeatedly. Rebooting the BLE does not help. Rebooting the host device does not help. 

On one device, the problem persisted for 6 days and then stopped for unknown reasons. The exact same code that failed before, now works on that device.

However, I believe this may be a vulnerability exposed by the stack change or my implementation of it.

When the iOS device/BLE chip combo was failing, if I put BLE code built the 1.4.0 stack, pairing would work. If I went back to any 1.4.1 stack code, even code that worked with that host device/BLE chip combo before, pairing would fail.

Attached is a sniff capture of the failure case.

After the start encryption request and response, the Master and slave both send acks. For some reason, the master then believes that the ack has failed and retries sending the ack 23 times. The BLE chip then goes back to advertising.

What could cause this?

Thanks in advance,

-S

831E_ImmediateDisconnect.psd

  • The issue appears to be that the slave stops showing up for connection events. This usually indicates a timing issue. Is this with custom hardware? Does the issue go away if you disable POWER_SAVINGS?

    Also, where is the processing in the slave when this occurs? Does it realize that the connection is dropped (you get a LINK_TERMINATED event) or is it off in the woods somewhere?
  • We never get a "link terminated" event.

    Most likely this is because when we were going from 1.4.0 to 1.4.1 we were using OTA and not clearing the bond record.

    We cleared the bond record with gapBondMgrEraseAllBondings and that fixed the issue for every device that showed the problem.

    Thanks,
    S