![[ZIGBEE] 20A Zigbee socket with energy metering (Tuya TS011F_plug_3)](https://obrazki.elektroda.pl/1000454900_1749493372_thumb.jpg)
![[W600 / TW-03] Door Sensor - Bootloop on 1.18.110/109 Firmware](https://obrazki.elektroda.pl/5552096400_1749191730_thumb.jpg)
Currently trying to get bluetooth working (amebad only).
I can at least get it to show in hcitool, but cannot get it up.
This is done via a variant of uart-tcp bridge.
It seems that some opcodes are not implemented.
Bluetooth: hci0: Opcode 0x0c52 failed: -56
And realtek library is built to support only LE mode, not BR/EDR(legacy).
Unsure if i'll manage to get it to work, but at least i'll report what i've done and if someone might figure out what to do in the future.
I should also note that this is done via hci_driver from Tuya rtl8721cs source.
Added after 2 [hours] 32 [minutes]:
I wasn't able to fix it in sdk code, so i had to adapt linux bluetooth driver.
I was able to get it running, but no tests were done.
But while i can somewhat control it via hcitool, bluetoothctl doesn't see it.
I can at least get it to show in hcitool, but cannot get it up.
This is done via a variant of uart-tcp bridge.
sudo socat pty,link=/dev/virtualcom0,b115200,raw,echo=0 TCP:192.168.1.19:8721
sudo btattach -B /dev/virtualcom0 -S 115200 -P h4hciconfig -a
hci0: Type: Primary Bus: UART
BD Address: 94:C9:60:E2:39:AB ACL MTU: 0:0 SCO MTU: 0:0
DOWN
RX bytes:256 acl:0 sco:0 events:12 errors:0
TX bytes:530 acl:0 sco:0 commands:12 errors:0
Features: 0xff 0xff 0xff 0xfe 0xdb 0xff 0x7b 0x87
Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
Link policy:
Link mode: PERIPHERAL ACCEPT
hcitool[1529994]: @ RAW Open: hcitool (privileged) version 2.22 {0x0002} 1818.467367
hcitool[1529994]: @ RAW Close: hcitool {0x0002} 1818.467378
hciconfig[1530015]: @ RAW Open: hciconfig (privileged) version 2.22 {0x0002} 1822.803105
= Open Index: 94:C9:60:E2:39:AB [hci0] 1822.803117
= Index Info: 94:C9:60:E2:39:AB (Realtek Semiconductor Corporation) [hci0] 1822.803118
< HCI Command: Reset (0x03|0x0003) plen 0 #111 [hci0] 1822.803150
> HCI Event: Command Complete (0x0e) plen 4 #112 [hci0] 1822.813042
Reset (0x03|0x0003) ncmd 3
Status: Success (0x00)
< HCI Command: Read Local Supported Features (0x04|0x0003) plen 0 #113 [hci0] 1822.813190
> HCI Event: Command Complete (0x0e) plen 12 #114 [hci0] 1822.832294
Read Local Supported Features (0x04|0x0003) ncmd 2
Status: Success (0x00)
Features: 0xff 0xff 0xff 0xfe 0xdb 0xff 0x7b 0x87
3 slot packets
5 slot packets
Encryption
Slot offset
Timing accuracy
Role switch
Hold mode
Sniff mode
Park state
Power control requests
Channel quality driven data rate (CQDDR)
SCO link
HV2 packets
HV3 packets
u-law log synchronous data
A-law log synchronous data
CVSD synchronous data
Paging parameter negotiation
Power control
Transparent synchronous data
Flow control lag (least significant bit)
Flow control lag (middle bit)
Flow control lag (most significant bit)
Broadcast Encryption
Enhanced Data Rate ACL 2 Mbps mode
Enhanced Data Rate ACL 3 Mbps mode
Enhanced inquiry scan
Interlaced inquiry scan
Interlaced page scan
RSSI with inquiry results
Extended SCO link (EV3 packets)
EV4 packets
EV5 packets
AFH capable peripheral
AFH classification peripheral
LE Supported (Controller)
3-slot Enhanced Data Rate ACL packets
5-slot Enhanced Data Rate ACL packets
Sniff subrating
Pause encryption
AFH capable central
AFH classification central
Enhanced Data Rate eSCO 2 Mbps mode
Enhanced Data Rate eSCO 3 Mbps mode
3-slot Enhanced Data Rate eSCO packets
Extended Inquiry Response
Simultaneous LE and BR/EDR (Controller)
Secure Simple Pairing
Encapsulated PDU
Erroneous Data Reporting
Non-flushable Packet Boundary Flag
Link Supervision Timeout Changed Event
Inquiry TX Power Level
Enhanced Power Control
Extended features
< HCI Command: Read Local Version Information (0x04|0x0001) plen 0 #115 [hci0] 1822.832551
> HCI Event: Command Complete (0x0e) plen 12 #116 [hci0] 1822.849989
Read Local Version Information (0x04|0x0001) ncmd 2
Status: Success (0x00)
HCI version: Bluetooth 5.0 (0x09) - Revision 56870 (0xde26)
LMP version: Bluetooth 5.0 (0x09) - Subversion 58706 (0xe552)
Manufacturer: Realtek Semiconductor Corporation (93)
< HCI Command: Read BD ADDR (0x04|0x0009) plen 0 #117 [hci0] 1822.850128
> HCI Event: Command Complete (0x0e) plen 10 #118 [hci0] 1822.869119
Read BD ADDR (0x04|0x0009) ncmd 2
Status: Success (0x00)
Address: 94:C9:60:E2:39:AB (Zhongshan B&T technology.co.,ltd)
< HCI Command: Read Local Supported Commands (0x04|0x0002) plen 0 #119 [hci0] 1822.869373
> HCI Event: Command Complete (0x0e) plen 68 #120 [hci0] 1822.888391
Read Local Supported Commands (0x04|0x0002) ncmd 2
Status: Success (0x00)
Commands: 157 entries
Inquiry (Octet 0 - Bit 0)
Inquiry Cancel (Octet 0 - Bit 1)
Create Connection (Octet 0 - Bit 4)
Disconnect (Octet 0 - Bit 5)
Create Connection Cancel (Octet 0 - Bit 7)
Accept Connection Request (Octet 1 - Bit 0)
Reject Connection Request (Octet 1 - Bit 1)
Link Key Request Reply (Octet 1 - Bit 2)
Link Key Request Negative Reply (Octet 1 - Bit 3)
PIN Code Request Reply (Octet 1 - Bit 4)
PIN Code Request Negative Reply (Octet 1 - Bit 5)
Change Connection Packet Type (Octet 1 - Bit 6)
Authentication Requested (Octet 1 - Bit 7)
Set Connection Encryption (Octet 2 - Bit 0)
Change Connection Link Key (Octet 2 - Bit 1)
Remote Name Request (Octet 2 - Bit 3)
Remote Name Request Cancel (Octet 2 - Bit 4)
Read Remote Supported Features (Octet 2 - Bit 5)
Read Remote Version Information (Octet 2 - Bit 7)
Read Clock Offset (Octet 3 - Bit 0)
Read LMP Handle (Octet 3 - Bit 1)
QoS Setup (Octet 4 - Bit 6)
Role Discovery (Octet 4 - Bit 7)
Read Link Policy Settings (Octet 5 - Bit 1)
Write Link Policy Settings (Octet 5 - Bit 2)
Read Default Link Policy Settings (Octet 5 - Bit 3)
Write Default Link Policy Settings (Octet 5 - Bit 4)
Flow Specification (Octet 5 - Bit 5)
Set Event Mask (Octet 5 - Bit 6)
Reset (Octet 5 - Bit 7)
Set Event Filter (Octet 6 - Bit 0)
Flush (Octet 6 - Bit 1)
Read PIN Type (Octet 6 - Bit 2)
Write PIN Type (Octet 6 - Bit 3)
Create New Unit Key (Octet 6 - Bit 4)
Read Stored Link Key (Octet 6 - Bit 5)
Write Stored Link Key (Octet 6 - Bit 6)
Delete Stored Link Key (Octet 6 - Bit 7)
Write Local Name (Octet 7 - Bit 0)
Read Local Name (Octet 7 - Bit 1)
Read Connection Accept Timeout (Octet 7 - Bit 2)
Write Connection Accept Timeout (Octet 7 - Bit 3)
Read Page Timeout (Octet 7 - Bit 4)
Write Page Timeout (Octet 7 - Bit 5)
Read Scan Enable (Octet 7 - Bit 6)
Write Scan Enable (Octet 7 - Bit 7)
Read Page Scan Activity (Octet 8 - Bit 0)
Write Page Scan Activity (Octet 8 - Bit 1)
Read Inquiry Scan Activity (Octet 8 - Bit 2)
Write Inquiry Scan Activity (Octet 8 - Bit 3)
Read Authentication Enable (Octet 8 - Bit 4)
Write Authentication Enable (Octet 8 - Bit 5)
Read Class of Device (Octet 9 - Bit 0)
Write Class of Device (Octet 9 - Bit 1)
Read Voice Setting (Octet 9 - Bit 2)
Write Voice Setting (Octet 9 - Bit 3)
Read Automatic Flush Timeout (Octet 9 - Bit 4)
Write Automatic Flush Timeout (Octet 9 - Bit 5)
Read Num Broadcast Retransmissions (Octet 9 - Bit 6)
Write Num Broadcast Retransmissions (Octet 9 - Bit 7)
Read Transmit Power Level (Octet 10 - Bit 2)
Read Sync Flow Control Enable (Octet 10 - Bit 3)
Write Sync Flow Control Enable (Octet 10 - Bit 4)
Set Controller To Host Flow Control (Octet 10 - Bit 5)
Host Buffer Size (Octet 10 - Bit 6)
Host Number of Completed Packets (Octet 10 - Bit 7)
Read Link Supervision Timeout (Octet 11 - Bit 0)
Write Link Supervision Timeout (Octet 11 - Bit 1)
Read Number of Supported IAC (Octet 11 - Bit 2)
Read Current IAC LAP (Octet 11 - Bit 3)
Write Current IAC LAP (Octet 11 - Bit 4)
Read Page Scan Mode (Octet 11 - Bit 7)
Write Page Scan Mode (Octet 12 - Bit 0)
Set AFH Host Channel Classification (Octet 12 - Bit 1)
Read Inquiry Scan Type (Octet 12 - Bit 4)
Write Inquiry Scan Type (Octet 12 - Bit 5)
Read Inquiry Mode (Octet 12 - Bit 6)
Write Inquiry Mode (Octet 12 - Bit 7)
Read Page Scan Type (Octet 13 - Bit 0)
Write Page Scan Type (Octet 13 - Bit 1)
Read AFH Channel Assessment Mode (Octet 13 - Bit 2)
Write AFH Channel Assessment Mode (Octet 13 - Bit 3)
Read Local Version Information (Octet 14 - Bit 3)
Read Local Supported Features (Octet 14 - Bit 5)
Read Buffer Size (Octet 14 - Bit 7)
Read BD ADDR (Octet 15 - Bit 1)
Read Failed Contact Counter (Octet 15 - Bit 2)
Reset Failed Contact Counter (Octet 15 - Bit 3)
Read Link Quality (Octet 15 - Bit 4)
Read RSSI (Octet 15 - Bit 5)
Read AFH Channel Map (Octet 15 - Bit 6)
Read Clock (Octet 15 - Bit 7)
Read Loopback Mode (Octet 16 - Bit 0)
Write Loopback Mode (Octet 16 - Bit 1)
Enable Device Under Test Mode (Octet 16 - Bit 2)
Read Extended Inquiry Response (Octet 17 - Bit 0)
Write Extended Inquiry Response (Octet 17 - Bit 1)
Refresh Encryption Key (Octet 17 - Bit 2)
Read Simple Pairing Mode (Octet 17 - Bit 5)
Write Simple Pairing Mode (Octet 17 - Bit 6)
Read Local OOB Data (Octet 17 - Bit 7)
Read Inquiry Response TX Power Level (Octet 18 - Bit 0)
Write Inquiry Transmit Power Level (Octet 18 - Bit 1)
IO Capability Request Reply (Octet 18 - Bit 7)
User Confirmation Request Reply (Octet 19 - Bit 0)
User Confirmation Request Neg Reply (Octet 19 - Bit 1)
User Passkey Request Reply (Octet 19 - Bit 2)
User Passkey Request Negative Reply (Octet 19 - Bit 3)
Remote OOB Data Request Reply (Octet 19 - Bit 4)
Write Simple Pairing Debug Mode (Octet 19 - Bit 5)
Enhanced Flush (Octet 19 - Bit 6)
Remote OOB Data Request Neg Reply (Octet 19 - Bit 7)
Send Keypress Notification (Octet 20 - Bit 2)
IO Capability Request Negative Reply (Octet 20 - Bit 3)
Read Encryption Key Size (Octet 20 - Bit 4)
Read Enhanced Transmit Power Level (Octet 24 - Bit 0)
Read LE Host Supported (Octet 24 - Bit 5)
Write LE Host Supported (Octet 24 - Bit 6)
LE Set Event Mask (Octet 25 - Bit 0)
LE Read Buffer Size (Octet 25 - Bit 1)
LE Read Local Supported Features (Octet 25 - Bit 2)
LE Set Random Address (Octet 25 - Bit 4)
LE Set Advertising Parameters (Octet 25 - Bit 5)
LE Read Advertising Channel TX Power (Octet 25 - Bit 6)
LE Set Advertising Data (Octet 25 - Bit 7)
LE Set Scan Response Data (Octet 26 - Bit 0)
LE Set Advertise Enable (Octet 26 - Bit 1)
LE Set Scan Parameters (Octet 26 - Bit 2)
LE Set Scan Enable (Octet 26 - Bit 3)
LE Create Connection (Octet 26 - Bit 4)
LE Create Connection Cancel (Octet 26 - Bit 5)
LE Read Accept List Size (Octet 26 - Bit 6)
LE Clear Accept List (Octet 26 - Bit 7)
LE Add Device To Accept List (Octet 27 - Bit 0)
LE Remove Device From Accept List (Octet 27 - Bit 1)
LE Connection Update (Octet 27 - Bit 2)
LE Set Host Channel Classification (Octet 27 - Bit 3)
LE Read Channel Map (Octet 27 - Bit 4)
LE Read Remote Used Features (Octet 27 - Bit 5)
LE Encrypt (Octet 27 - Bit 6)
LE Rand (Octet 27 - Bit 7)
LE Start Encryption (Octet 28 - Bit 0)
LE Long Term Key Request Reply (Octet 28 - Bit 1)
LE Long Term Key Request Neg Reply (Octet 28 - Bit 2)
LE Read Supported States (Octet 28 - Bit 3)
LE Receiver Test (Octet 28 - Bit 4)
LE Transmitter Test (Octet 28 - Bit 5)
LE Test End (Octet 28 - Bit 6)
LE Set Data Length (Octet 33 - Bit 6)
LE Read Suggested Default Data Length (Octet 33 - Bit 7)
LE Write Suggested Default Data Length (Octet 34 - Bit 0)
LE Read Maximum Data Length (Octet 35 - Bit 3)
LE Read PHY (Octet 35 - Bit 4)
LE Set Default PHY (Octet 35 - Bit 5)
LE Set PHY (Octet 35 - Bit 6)
LE Enhanced Receiver Test (Octet 35 - Bit 7)
LE Enhanced Transmitter Test (Octet 36 - Bit 0)
< HCI Command: Write Extended Inquiry Response (0x03|0x0052) plen 241 #121 [hci0] 1822.888608
FEC: Not required (0x00)
> HCI Event: Command Complete (0x0e) plen 4 #122 [hci0] 1822.923086
Write Extended Inquiry Response (0x03|0x0052) ncmd 2
Status: Unknown HCI Command (0x01)
= Close Index: 94:C9:60:E2:39:AB [hci0] 1822.923258
[1530015]: @ RAW Close: hciconfig {0x0002} 1822.923764
It seems that some opcodes are not implemented.
Bluetooth: hci0: Opcode 0x0c52 failed: -56
And realtek library is built to support only LE mode, not BR/EDR(legacy).
Unsure if i'll manage to get it to work, but at least i'll report what i've done and if someone might figure out what to do in the future.
I should also note that this is done via hci_driver from Tuya rtl8721cs source.
Added after 2 [hours] 32 [minutes]:
I wasn't able to fix it in sdk code, so i had to adapt linux bluetooth driver.
I was able to get it running, but no tests were done.
hci0: Type: Primary Bus: UART
BD Address: 94:C9:60:E2:39:AB ACL MTU: 0:0 SCO MTU: 0:0
UP RUNNING
RX bytes:500 acl:0 sco:0 events:19 errors:0
TX bytes:99 acl:0 sco:0 commands:19 errors:0
Features: 0xff 0xff 0xff 0xfe 0xdb 0xff 0x7b 0x87
Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
Link policy:
Link mode: PERIPHERAL ACCEPT
Name: 'RTK_BT_5.0'
Can't read class of device on hci0: Input/output error (5)But while i can somewhat control it via hcitool, bluetoothctl doesn't see it.
