Equipment

I have two systems, which I'll refer to as "laptop" and "embedded system". I'm able to reconnect on the laptop without re-pairing. My problem is that I'm not able to on the embedded system.

I'm connecting/reconnecting to a headless SPP (serial port protocol) device, which I'm assuming is Bluetooth 2.0, but I'm not really sure. There is a button I can press to enter pairing mode, which blinks a blue LED quickly to show it's in pairing mode. The device does not enter pairing mode unless I press the button.

If I run sudo sdptool search --bdaddr XX:XX:XX:XX:XX:XX SP (I've replaced the bluetooth device address with XX's) I get:

Searching for SP on XX:XX:XX:XX:XX:XX ...

Service Name: (redacted)-SPP

Service RecHandle: 0x10000

Service Class ID List:

  "Serial Port" (0x1101)

Protocol Descriptor List:

  "L2CAP" (0x0100)

  "RFCOMM" (0x0003)

    Channel: 1

Laptop

The laptop is running standard Ubuntu MATE 16.04, with MATE GUI, bluez 5.37, blueman-applet, bluetoothd and dbus running, python, etc.

I can use the blueman-applet "Setup New Device...", which starts the "Bluetooth device setup assistant". I then push the device button, the device is recognized, I choose to pair, I choose to connect to the serial port. I'm given /dev/rfcomm0, which works to communicate with the device. I see "Fully" under the device name in blueman-applet (I'm not sure what "Fully" means in this context, but it seems to indicate a good state).

If I then power off the laptop and device, then power them back on, blueman-applet still shows the device and I can connect it to the serial port. No pairing needed.

Embedded System

The embedded system is an ARM device running OpenWRT, with bluez 5.47 installed. There is no GUI or blueman-applet. The system is not running bluetoothd nor dbus (although both are available) and does not have python installed. I am allowed to run bluetoothd and/or dbus, but only if they are necessary. I am not allowed to install python under any circumstances, so if I require functionality that only python scripts are providing, I'll have to port it to C. If that turns out to be needed, any hints on what scripts I'll need to port would be welcome.

On the embedded system I put the device into pairing mode, then issue these commands:

echo 1234 | sudo /usr/bin/btmgmt --index hci0 pair XX:XX:XX:XX:XX:XX

sudo /usr/bin/rfcomm -i hci0 bind 0 XX:XX:XX:XX:XX:XX 1

I can then connect to /dev/rfcomm0.

If I power off the bluetooth device, and issue these commands, I'm able to reconnect:

sudo /usr/bin/rfcomm -i hci0 release 0

sudo /usr/bin/rfcomm -i hci0 connect 0 XX:XX:XX:XX:XX:XX 1

However, if I power cycle the embedded system, I get:

Can't connect RFCOMM socket: Operation now in progress

And if I try again:

Can't connect RFCOMM socket: Connection refused

Running sudo hcidump -X gives:

< HCI Command: Create Connection (0x01|0x0005) plen 13

    bdaddr XX:XX:XX:XX:XX:XX ptype 0xcc18 rswitch 0x01 clkoffset 0x0000

    Packet type: DM1 DM3 DM5 DH1 DH3 DH5 

> HCI Event: Command Status (0x0f) plen 4

    Create Connection (0x01|0x0005) status 0x00 ncmd 1

> HCI Event: Connect Complete (0x03) plen 11

    status 0x00 handle 11 bdaddr XX:XX:XX:XX:XX:XX type ACL encrypt 0x00

< HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2

    handle 11

> HCI Event: Command Status (0x0f) plen 4

    Read Remote Supported Features (0x01|0x001b) status 0x00 ncmd 1

> HCI Event: Read Remote Supported Features (0x0b) plen 11

    status 0x00 handle 11

    Features: 0xff 0xee 0x8d 0xfa 0x9b 0xef 0x79 0x83

< HCI Command: Read Remote Extended Features (0x01|0x001c) plen 3

    handle 11 page 1

> HCI Event: Command Status (0x0f) plen 4

    Read Remote Extended Features (0x01|0x001c) status 0x00 ncmd 1

> HCI Event: Read Remote Extended Features (0x23) plen 13

    status 0x00 handle 11 page 1 max 1

    Features: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00

< HCI Command: Remote Name Request (0x01|0x0019) plen 10

    bdaddr XX:XX:XX:XX:XX:XX mode 2 clkoffset 0x0000

< ACL data: handle 11 flags 0x00 dlen 10

    L2CAP(s): Info req: type 2

> HCI Event: Command Status (0x0f) plen 4

    Remote Name Request (0x01|0x0019) status 0x00 ncmd 1

> HCI Event: Max Slots Change (0x1b) plen 3

    handle 11 slots 5

> ACL data: handle 11 flags 0x02 dlen 12

    L2CAP(s): Info rsp: type 2 result 1

      Not supported

< ACL data: handle 11 flags 0x00 dlen 12

    L2CAP(s): Connect req: psm 3 scid 0x0040

> HCI Event: Number of Completed Packets (0x13) plen 5

    handle 11 packets 2

> HCI Event: Remote Name Req Complete (0x07) plen 255

    status 0x00 bdaddr XX:XX:XX:XX:XX:XX name '(redacted)'

> ACL data: handle 11 flags 0x02 dlen 16

    L2CAP(s): Connect rsp: dcid 0x0041 scid 0x0040 result 3 status 0

      Connection refused - security block

> HCI Event: Disconn Complete (0x05) plen 4

    status 0x00 handle 11 reason 0x05

    Reason: Authentication Failure

Of course if I then push the pairing button and start over with btmgmt, etc, I'm able to connect. I can't use that as my solution, though, because I need to be able to pair the device once and then connect automatically after that.

From the hcidump output, my assumption is that the key generated during the initial pairing process has been lost (or is at least not loaded). I've spent a few days trying to understand the bluez source code, and then even looking at the kernel module source code to try to understand what is going on, but the code is very confusing to me, I think because everything is going through dbus, and then through HCI... or something like that, I really have very little idea what is going on with the bluetooth stack. So far I haven't been able to figure out where the pairing key generation was happening or where keys were being persisted on disk.

Question

Without running bluetoothd/dbus (and not having python), how can I reconnect via the console to a previously paired device after power cycling the embedded system?

If that's not possible, how can I reconnect as above if I have bluetoothd/dbus running (but still no python)?

If that's not possible either, which source code file is the pairing key generation code in (function would be helpful too), which source code file/function is the key persistence code in, and where are pairing keys stored on disk? Any other hints on how to hack it into doing what I want?

Thanks a lot!