[Android] Chiptool app on Xiaomi tab 5 is crashing while pairing with Thread devices

[igor90ns]

Reproduction steps

ChipTool app is crashing while pairing with thread device, only on Xiaomi Tab 5 android device. On all other devices it seems that commissioning works fine

Issue is detected on official 1.2.0.1 release and in latest pull from master on date 05.04.2024

1. reset Thread device
2. In chiptool app click "PROVISION CHIP DEVICE WITH THREAD"
3. Scan QR code from device
4. Observe

2024-04-05 11:22:50.076 19285-19285 chip.BluetoothManager   com.google.chip.chiptool             I  Starting Bluetooth scan
2024-04-05 11:22:50.076 19285-19285 BluetoothAdapter        com.google.chip.chiptool             D  isLeEnabled(): ON
2024-04-05 11:22:50.089 19285-24398 BluetoothLeScanner      com.google.chip.chiptool             D  onScannerRegistered() - status=0 scannerId=9 mScannerId=0
2024-04-05 11:22:50.102  2152-3205  AppOps                  system_server                        E  Bad call made by uid 1002. Package "com.google.chip.chiptool" does not belong to uid 1002.
2024-04-05 11:22:50.250 19285-24981 NsdManager...ceResolver com.google.chip.chiptool             I  service F70C8E279278876C-000000000001B669(chip.platform.NsdManagerServiceResolver$2@445e5cb) onServiceUnregistered
2024-04-05 11:22:50.683 19285-19285 chip.BluetoothManager   com.google.chip.chiptool             I  Bluetooth Device Scanned Addr: F0:82:C0:56:F2:26, Name Matter-539
2024-04-05 11:22:50.727 19285-19285 BluetoothAdapter        com.google.chip.chiptool             D  isLeEnabled(): ON
2024-04-05 11:22:50.746 19285-19285 DeviceProv...ngFragment com.google.chip.chiptool             I  showMessage:Connecting to Matter-539
2024-04-05 11:22:50.750 19285-19285 chip.BluetoothManager   com.google.chip.chiptool             I  Connecting
2024-04-05 11:22:50.752 19285-19285 BluetoothGatt           com.google.chip.chiptool             D  connect() - device: F0:82:C0:56:F2:26, auto: false, eattSupport: false
2024-04-05 11:22:50.752 19285-19285 BluetoothGatt           com.google.chip.chiptool             D  registerApp()
2024-04-05 11:22:50.752 19285-19285 BluetoothGatt           com.google.chip.chiptool             D  registerApp() - UUID=c1b2c0ee-2f5e-4aaa-80be-2b804f07cf16
2024-04-05 11:22:50.772 19285-24398 BluetoothGatt           com.google.chip.chiptool             D  onClientRegistered() - status=0 clientIf=9
2024-04-05 11:22:51.060 19285-24981 NsdManager...ceResolver com.google.chip.chiptool             I  service F70C8E279278876C-000000000001B669(chip.platform.NsdManagerServiceResolver$2@13974c1) onServiceRegistered
2024-04-05 11:22:51.076 19285-24398 BluetoothGatt           com.google.chip.chiptool             D  onClientConnectionState() - status=0 clientIf=9 device=F0:82:C0:56:F2:26
2024-04-05 11:22:51.091 19285-24398 chip.BluetoothManager   com.google.chip.chiptool             I  Matter-539.onConnectionStateChange status = 0, newState=2
2024-04-05 11:22:51.091 19285-24398 chip.Bluet...tateChange com.google.chip.chiptool             I  Discovering Services...
2024-04-05 11:22:51.092 19285-24398 BluetoothGatt           com.google.chip.chiptool             D  discoverServices() - device: F0:82:C0:56:F2:26
2024-04-05 11:22:51.099 19285-24398 BluetoothGatt           com.google.chip.chiptool             D  onConfigureMTU() - Device=F0:82:C0:56:F2:26 mtu=247 status=0
2024-04-05 11:22:51.102 19285-24398 chip.BluetoothManager   com.google.chip.chiptool             D  Matter-539.onMtuChanged: connecting to CHIP device
2024-04-05 11:22:51.103 19285-19285 DeviceProv...ngFragment com.google.chip.chiptool             I  showMessage:Pairing
2024-04-05 11:22:51.118 19285-19285 CTL                     com.google.chip.chiptool             D  setDeviceAttestationDelegate() called
2024-04-05 11:22:51.118 19285-19285 ChipDeviceController    com.google.chip.chiptool             D  Bluetooth connection added with ID: 1
2024-04-05 11:22:51.118 19285-19285 ChipDeviceController    com.google.chip.chiptool             D  Pairing device with ID: 6
2024-04-05 11:22:51.118 19285-19285 CTL                     com.google.chip.chiptool             D  pairDevice() called with device ID, connection object, and pincode
2024-04-05 11:22:51.118 19285-19285 IN                      com.google.chip.chiptool             D  BleConnectionComplete: endPoint 0x72ce9b74b8
2024-04-05 11:22:51.118 19285-19285 DL                      com.google.chip.chiptool             D  Received GetMTU
2024-04-05 11:22:51.118 19285-19285 AndroidBleManager       com.google.chip.chiptool             D  Android Manufacturer: (Xiaomi)
2024-04-05 11:22:51.118 19285-19285 AndroidBleManager       com.google.chip.chiptool             D  Android Model: (21051182G)
2024-04-05 11:22:51.118 19285-19285 DL                      com.google.chip.chiptool             D  Received SendWriteRequest
2024-04-05 11:22:51.118 19285-19285 AndroidBleManager       com.google.chip.chiptool             E  Bad service
2024-04-05 11:22:51.118 19285-19285 IN                      com.google.chip.chiptool             E  Failed to establish BLE connection: src/ble/BLEEndPoint.cpp:132: Ble Error 0x00000407: GATT write characteristic operation failed
2024-04-05 11:22:51.118 19285-19285 IN                      com.google.chip.chiptool             D  Clearing BLE pending packets.
2024-04-05 11:22:51.118 19285-19285 BLE                     com.google.chip.chiptool             D  Auto-closing end point's BLE connection.
2024-04-05 11:22:51.118 19285-19285 DL                      com.google.chip.chiptool             D  Received CloseConnection
2024-04-05 11:22:51.118 19285-19285 BluetoothGatt           com.google.chip.chiptool             D  close()
2024-04-05 11:22:51.118 19285-19285 BluetoothGatt           com.google.chip.chiptool             D  unregisterApp() - mClientIf=9
2024-04-05 11:22:51.120 19285-19285 chip.BluetoothManager   com.google.chip.chiptool             D  onCloseBleComplete
2024-04-05 11:22:51.120 19285-19285 IN                      com.google.chip.chiptool             E  Failed to setup BLE endPoint: src/ble/BLEEndPoint.cpp:132: Ble Error 0x00000407: GATT write characteristic operation failed
2024-04-05 11:22:51.120 19285-19285 IN                      com.google.chip.chiptool             D  SecureSession[0xb4000072f507b480]: Allocated Type:1 LSID:56512
2024-04-05 11:22:51.120 19285-19285 SC                      com.google.chip.chiptool             D  Assigned local session key ID 56512
2024-04-05 11:22:51.120 19285-19285 EM                      com.google.chip.chiptool             D  <<< [E:20950i S:0 M:194076920] (U) Msg TX to 0:0000000000000000 [0000] [BLE] --- Type 0000:20 (SecureChannel:PBKDFParamRequest)
2024-04-05 11:22:51.120 19285-19285 IN                      com.google.chip.chiptool             E  SendMessage() to BLE failed: src/transport/raw/BLE.cpp:102: CHIP Error 0x00000003: Incorrect state
2024-04-05 11:22:51.120 19285-19285 IN                      com.google.chip.chiptool             D  SecureSession[0xb4000072f507b480]: Released - Type:1 LSID:56512
2024-04-05 11:22:51.120 19285-19285 DIS                     com.google.chip.chiptool             D  Closing all BLE connections
2024-04-05 11:22:51.120 19285-19285 CTL                     com.google.chip.chiptool             E  Failed to pair the device.
2024-04-05 11:22:51.133 19285-19285 AndroidRuntime          com.google.chip.chiptool             E  FATAL EXCEPTION: main
                                                                                                    Process: com.google.chip.chiptool, PID: 19285
                                                                                                    chip.devicecontroller.ChipDeviceControllerException: src/transport/raw/BLE.cpp:102: CHIP Error 0x00000003: Incorrect state
                                                                                                    	at chip.devicecontroller.ChipDeviceController.pairDevice(Native Method)
                                                                                                    	at chip.devicecontroller.ChipDeviceController.pairDevice(ChipDeviceController.java:223)
                                                                                                    	at chip.devicecontroller.ChipDeviceController.pairDevice(ChipDeviceController.java:165)
                                                                                                    	at com.google.chip.chiptool.provisioning.DeviceProvisioningFragment$startConnectingToDevice$1.invokeSuspend(DeviceProvisioningFragment.kt:229)
                                                                                                    	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
                                                                                                    	at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:241)
                                                                                                    	at android.os.Handler.handleCallback(Handler.java:942)
                                                                                                    	at android.os.Handler.dispatchMessage(Handler.java:99)
                                                                                                    	at android.os.Looper.loopOnce(Looper.java:211)
                                                                                                    	at android.os.Looper.loop(Looper.java:300)
                                                                                                    	at android.app.ActivityThread.main(ActivityThread.java:8503)
                                                                                                    	at java.lang.reflect.Method.invoke(Native Method)
                                                                                                    	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:561)
                                                                                                    	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:954

xiaomi crash.txt

Platform

android

Platform Version(s)

v1.2.0.1

Type

Manually tested with SDK

(Optional) If manually tested please explain why this is only manually tested

No response

Anything else?

No response

[igor90ns]

Any updates? or information is this issue affecting more then this device (is it SoC, manufacturer etc issue?)

[yunhanw-google]

Hi, @igor90ns

It seems to me we can suppress ChipDeviceControllerException when invoking pairing API for android, but the root cause is related to BLE Gatt Service, you may check whether svcId is null or not with your debugging build.

You mention "On all other devices it seems that commissioning works fine", I assume this fails with the particular thread device, which seems to soemthing wrong on its BLE configuration. with that thread device

connectedhomeip/src/platform/android/java/chip/platform/AndroidBleManager.java

Line 357 in 90732b2

BluetoothGattService subscribeSvc = bluetoothGatt.getService(svcUUID);

UUID svcUUID = convertBytesToUUID(svcId);
BluetoothGattService sendSvc = bluetoothGatt.getService(svcUUID);
if (sendSvc == null) {
  Log.e(TAG, "Bad service");
  return false;
}

[igor90ns]

Hi, @igor90ns

It seems to me we can suppress ChipDeviceControllerException when invoking pairing API for android, but the root cause is related to BLE Gatt Service, you may check whether svcId is null or not with your debugging build.

connectedhomeip/src/platform/android/java/chip/platform/AndroidBleManager.java

Line 357 in 90732b2

BluetoothGattService subscribeSvc = bluetoothGatt.getService(svcUUID);

UUID svcUUID = convertBytesToUUID(svcId);
BluetoothGattService sendSvc = bluetoothGatt.getService(svcUUID);
if (sendSvc == null) {
  Log.e(TAG, "Bad service");
  return false;
}

I am using libraries and i cant access values, but when I set breakpoint i can see that var6 is null
UUID var5 = convertBytesToUUID(svcId);
BluetoothGattService var6 = var4.getService(var5);
if (var6 == null) {
Log.e(TAG, "Bad service");
return false;

You mention "On all other devices it seems that commissioning works fine", I assume this fails with the particular thread device, which seems to soemthing wrong on its BLE configuration. with that thread device

No, it means that I have tried same use case with different mobile devices (Samsung S22, Google Pixel 7, Huawei P9 Lite) and it works correctly with thread devices, but when i try same on Xiaomi Tab 5 (model 21051182g) with android 13 chiptool app crashes.

Regarding thread device, I have used Nanoleaf bulb and led strip (matter certified devices)

[joonhaengHeo]

@igor90ns
I also found a similar issue. (LG Valvet in Android 12 version.)
Can you check if it is modified with the PR I uploaded?

[yunhanw-google]

@igor90ns feel free to reopen or create a new issue if it is still problematic, thanks