Writing BT stack to connect with Wiimote - problems connecting I'm working on a project which intends to connect an embedded microprocessor (the host/master) to a Wiimote. I only have the Bluetooth HCI interface to work with (no L2CAP, HID). I'm able to successfully complete an inquiry returning a Wiimote BD_ADDR (and other information). I am in effect compressing the L2CAP and HID protocols into a thin embedded implementation. I am stuck at establishing a connection (using only HCI calls). The reply (BT event) that is returned provides an error code indicating a page timeout. I've checked to ensure my local controller (BT master) has authentication disabled. I have checked to be sure I have the correct BD_ADDR for my Wiimote. Any ideas about what additional setup is required before I attempt establishing a (raw - HCI level) connection to the Wiimote? Thanks. [edit] I tried connecting with the Wiimote in discoverable mode (pressing sync button under the back cover). I was able to establish a connection (Connection Complete event returns status 0x00), but it was immediately terminated (received a Disconnection Complete event).http://forum.wiibrew.org/read.php?7,73034,73034#msg-73034Fri, 12 Jun 2026 12:33:55 +0200 Phorum 5.2.23 http://forum.wiibrew.org/read.php?7,73034,73109#msg-73109 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73109#msg-73109
I still don't understand why I cannot send an ACL packet with PB=02. But I'm past that obstacle.]]> ags000 HardwareMon, 24 Jun 2013 05:26:22 +0200 http://forum.wiibrew.org/read.php?7,73034,73105#msg-73105 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73105#msg-73105
I tried setting the host buffer size to match the controller reported buffer sizes. This returned a success status.

Then I tried issuing the same command to establish an L2CAP channel - and same symptoms: no response at all.

In frustration (perhaps desperation) I decided to fiddle with the LLID bits. I'm still confused by the description in the spec, which seems self-contradictory to me.

As it turns out, if I issue the connection request (for an L2CAP channel) using PB of 00, I get a response! With PB=03 or 02, no response. This is really confusing. And, the response is sent with LLID = 20. I just don't understand this. (NOTE: to try to simplify, I'm testing using a USB BT dongle on my desktop, not the wiimote).

So once I send the (L2CAP) connection request (PSM==01), I receive an extended features request, then a configuration request (for MTU size). I do get a connection response with successful status. I wasn't prepared for all this traffic, so hadn't coded responses. Ultimately, the connection was terminated (reason==0x13, Remote User Terminated Connection).

So I still can't figure out the proper use of LLID, but I have successfully created my first L2CAP channel.

BTW, both the host and remote device report a version of 04, or BT 2.1 + EDR.

Still don't understand the LLID flag.]]> ags000 HardwareThu, 13 Jun 2013 07:43:07 +0200 http://forum.wiibrew.org/read.php?7,73034,73101#msg-73101 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73101#msg-73101
With controller to host flow control disabled, wouldn't you expect the value of num_ACL_data_packets to be ignored and irrelevant? (I'll still try it, though). I did try values of 0 for both ACL data and synchronous data, thinking this would indicate unlimited buffers. It may be the buffer size that is the problem, even if 0 buffers is an acceptable parameter value.

Is there any way to test behavior of a working wiimote interface - to see what happens if a connection (link) is established but no L2CAP channels are established for a minute? I still don't understand why the successful connection is disconnected (every time) just seconds after the connection is established.]]> ags000 HardwareWed, 12 Jun 2013 22:15:58 +0200 http://forum.wiibrew.org/read.php?7,73034,73100#msg-73100 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73100#msg-73100 tueidj HardwareWed, 12 Jun 2013 20:41:34 +0200 http://forum.wiibrew.org/read.php?7,73034,73099#msg-73099 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73099#msg-73099
When I tried to set the host buffer size with the Host Buffer Size command, there was no response. It was as though the command I was sending was incorrect. Eventually, after sending other commands, I finally got a Hardware Error Event. This is what I sent to the controller:

01 330C 07 4000 20 0100 0100

Which I believe indicates:

UART HCI command; Host Buffer Size command opcode; parameter length; 64 bytes ACL data buffer size; 32 bytes synchronous data buffer size; 1 ACL data buffer; 1 synchronous data buffer

Is there something wrong with this? Some improper setting (or understanding on my part) may be why the controller never sends ACL data to the host.]]> ags000 HardwareWed, 12 Jun 2013 16:54:03 +0200 http://forum.wiibrew.org/read.php?7,73034,73090#msg-73090 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73090#msg-73090- hci_reset
- hci_read_buffer_size
- hci_read_bd_addr
- hci_host_buffer_size
- hci_write_pin_type(0 = variable)
- hci_write_page_timeout
- hci_write_scan_enable(2 = page scanning enabled)
Additional optional commands (things the wiimote doesn't care about but are good practice):
- hci_write_cod
- hci_change_local_name


"The event code 0xFF is reserved for the event code used for vendor-specific debug events." Manufacturer specific stuff, for example the wii uses it to signal when the red sync button on the front panel has been pressed.]]> tueidj HardwareTue, 11 Jun 2013 23:06:56 +0200 http://forum.wiibrew.org/read.php?7,73034,73089#msg-73089 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73089#msg-73089
Quote

The Read_Buffer_Size command must be issued by the Host before it sends any data to the Controller.

I can see this is good practice, but will violating it cause a problem? Since the data packets from the wiimote are so small, I was simply going to use buffers sized for the MTU size (48 bytes). I presume there would only be an issue if I attempted to send a data packet larger than the controller's buffer size. I will test it later just to be sure.

I also noted that upon power-up of the local controller (but not on reset) an event packet is sent by the controller. I presume this is some manufacturer-specific information (I will contact the manufacturer to verify) - have you heard of such a thing? I don't recognize the event code 0xFF. The byte sequence is:

04FF1FC302000F000D000010000037000100004E0100000000000000000000000000]]> ags000 HardwareTue, 11 Jun 2013 22:02:55 +0200 http://forum.wiibrew.org/read.php?7,73034,73088#msg-73088 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73088#msg-73088 tueidj HardwareTue, 11 Jun 2013 21:04:17 +0200 http://forum.wiibrew.org/read.php?7,73034,73087#msg-73087 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73087#msg-73087
I was able to send ACL data (based on the "Number of Completed Packets Event" received) with the BT dongle. However, I never received any ACL data (there was never an acknowledgement of the connection request). This is how I got into the LLID and BT version issue. I observed that if I use the LLID (PB flag) of 11 (which appears to be correct for v4.0 but not v1.2 as you point out) with the BT dongle (which is v4.0) then I receive the "Number of Completed Packets Event" (but still no acknowledgment of the connection request). If I use the LLID (PB flag) of 0b10 (which is valid for v1.2 but not v4.0) then I get neither the "Number of Completed Packets Event" nor an acknowledgment of the connection request from the BT dongle.

My hypothesis is that with the BT dongle (v4.0) and an LLID/PB value of 0b11, that represents a complete L2CAP PDU and it is forwarded on by the remote controller (in this case as a signaling command on (fixed) channel 1). That is why I receive the "Number of Completed Packets Event". When I use the LLID/PB value of 0b10, that is a start packet, and the local controller is waiting for the continuation packet. While that may be plausible, that would imply that there is not backwards compatibility, which I find unusual. Also, while I'm clearly not an expert, it seems that the controller could easily recognize an L2CAP B-frame (complete L2CAP PDU) and know that the packet is complete. (if I understand correctly).

This is why I started wondering if there is some flow control setting (on my host controller - not the BT dongle or the wiimote) that is interfering with reception of the ACL data. Since I'm using a UART HCI transport, I only have RX and TX lines, and the RX path through my UART is working because that's the path to receive events from the controller.

Is it possible to validate that the wiimote will maintain a connection (link) with another BT device even if no L2CAP channel is established within some timeout period? I am only seeing the disconnect when using the wiimote, not the BT dongle. (but still, I can't establish an L2CAP channel on either)]]> ags000 HardwareTue, 11 Jun 2013 19:31:53 +0200 http://forum.wiibrew.org/read.php?7,73034,73086#msg-73086 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73086#msg-73086 tueidj HardwareTue, 11 Jun 2013 18:32:53 +0200 http://forum.wiibrew.org/read.php?7,73034,73085#msg-73085 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73085#msg-73085
I'm using the exact sequence to establish the L2CAP channel as in the log you provided (with the exception that the connection handle is different). I'm using:


02 2A20 0C00 0800 0100 02 01 0400 1100 4300

HCI trasport - ACL data
Connection handle 0x002A, PB 0b10, BC 0b00
Packet length 0x000C
L2CAP header - length 0x0008
L2CAP header - channelID 0x0001 (signaling channel)
signal command 0x02 (connection request)
id 0x01
data length 0x0004
PSM 0x0011
source channel ID 0x0043

Is is possible to conduct an experiment with a working wiimote connection? I'm wondering if the wiimote behaves differently (than the BT dongle I was using) in that it will accept a connection but will drop that connection if the HID channels (PSM 11 and 13) are not established within a timeout period. I could understand this behavior since in normal operation the wiimote is always using those channels and does not need to support any others (although from the log I can see it also supports PSM 1 for SDP). (The BT dongle accepted a connection and it was not dropped even though I did not establish any L2CAP channels) I'm trying to break this down into smaller pieces and look for a way to understand what is happening.

I have never received any ACL data. When experimenting with the USB dongle on my desktop, I did receive a Number of Competed Packets event when I sent ACL data to that device (attempting to establish an L2CAP connection but never ACL data back with the connection response.

Is there something that can be interfering with receipt of ACL data? I was wondering if flow control may be an issue.]]> ags000 HardwareTue, 11 Jun 2013 17:27:42 +0200 http://forum.wiibrew.org/read.php?7,73034,73078#msg-73078 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73078#msg-73078The only thing I can think of that might help is to set the page scan type (HCI_Write_Page_Scan_Type) to 1.]]> tueidj HardwareTue, 11 Jun 2013 11:01:03 +0200 http://forum.wiibrew.org/read.php?7,73034,73077#msg-73077 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73077#msg-73077
I am able to inquire and find the wiimote (reports back the BD_ADDR)
I am not able to read the wiimote (remote) name (returns error code 0x04 - "Page Timeout")

Is there something I need to do to make a v4 radio talk to a v2 radio?]]> ags000 HardwareTue, 11 Jun 2013 08:18:41 +0200 http://forum.wiibrew.org/read.php?7,73034,73076#msg-73076 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73076#msg-73076Both of "in MTU" values are translated wrong, there's another one further down (0xB900).]]> tueidj HardwareTue, 11 Jun 2013 04:57:44 +0200 http://forum.wiibrew.org/read.php?7,73034,73074#msg-73074 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73074#msg-73074
1) This is the 3rd time I've noticed someone using local CID=0x43 when opening the first L2CAP channel. Am I mistaken that the first dynamic (non-fixed, non-assigned) CID available is 0x40? (or is it just a coincidence?)

2) Just checking: is there a typo in the text description for the line below (the MTU=256, not 1)?

L2CAP config request: DCID 0x0044, 0, in MTU=1, out flushto=65535
DATA_OUT(18): 0b 20 14 00 10 00 01 00 04 02 0c 00 44 00 00 00 01 02 00 01 02 02 ff ff

Thanks again - I'll report back on progress.]]> ags000 HardwareTue, 11 Jun 2013 00:41:10 +0200 http://forum.wiibrew.org/read.php?7,73034,73072#msg-73072 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73072#msg-73072It might help to view logs of bluetooth data between a wii and a wiimote. Here's a log from a game performing device discovery, connection, authentication, HID connection establishment and traffic etc.:
[www.tueidj.net]
CTRL_* corresponds to HCI commands, DATA_* is HCI ACL data. Flow direction is from the host's (the wii) point of view. Note that all the "Read Remote Version", "Read Remote Clock Offset" commands and SDP queries aren't necessary, the wii only does them to be sure it's talking to a wiimote.]]> tueidj HardwareMon, 10 Jun 2013 22:12:16 +0200 http://forum.wiibrew.org/read.php?7,73034,73071#msg-73071 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73071#msg-73071
In other words, my understanding is that basically a channel (identified by the CID) must declare a PSM. Only one PSM is associated with any channel. The ACL data packet (for BR/EDR controllers) always contains an L2CAP packet; an L2CAP packet header specifies the length and CID, which in turn is associated with exactly one PSM, which enables the appropriate interpretation/routing of the contents to the proper protocol at the destination.

Is this basically correct?]]> ags000 HardwareMon, 10 Jun 2013 20:32:22 +0200 http://forum.wiibrew.org/read.php?7,73034,73070#msg-73070 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73070#msg-73070
I had (am having) trouble understanding this flag. When I read the spec I took note of what I found to be conflicting information (BT Core Spec v4, Volume 2 Part E section 5.4.2: "HCI ACL Data Packets"). My plan is to implement a very rudimentary, purpose-built stack to support the wiimote (only). Since the reports from the wiimote maximum size is 21 bytes, I plan to have all packets less than the minimum allowable MTU size of 48 bytes. With this in mind, there would be no L2CAP fragmented packets - every packet would be complete. This is what I thought the "0b11" value was to represent.

However, I found a small L2CAP embedded implementation (remote/client side, not host side) that appeared to use the "0b10" value for all packets. Inline comments explicitly stated that fragmented packets would not be supported.

Finally, the NOTE in the specification (see below) seems to be in complete conflict with the information in the table immediately above it (table does not render here so I've included the relevant columns/rows below also). Perhaps I'm confusing the LLID with the PB? Where is the LLID if not in the PB flag?

I tried modifying the byte stream to use the "0b10" PB value, but then instead of getting a "Number of Completed Packets" event, there was no response at all. Do I need to follow the "0b10" packet with another empty packet with PB==0b01?

--- From the spec ----

Packet_Boundary_Flag: Size: 2 Bits

Value: 00
Parameter Description: First non-automatically-flushable packet of Higher Layer Message (start of a non-automatically-flushable L2CAP PDU) from Host to Controller.
Host to Controller: Allowed
Controller to Host: Not allowed (except during loop-back)

Value: 01
Parameter Description: Continuing fragment of Higher Layer Message
Host to Controller: Allowed
Controller to Host: Allowed

Value: 10
Parameter Description: First automatically-flushable packet of Higher Layer Message (start of an automatically-flushable L2CAP PDU).
Host to Controller: Allowed
Controller to Host: Allowed

Value: 11
Parameter Description: A complete L2CAP PDU. Automatically flushable.
Host to Controller: Allowed
Controller to Host: Not Allowed

NOTE: The start of a non-flushable packet of a Higher Layer Message (start of a non-automatically-flushable L2CAP PDU) with the PBF of 00 shall be transmitted with an LLID of 10. All continuing fragment packets of a Higher Layer Message shall be transmitted with an LLID of 01.]]> ags000 HardwareMon, 10 Jun 2013 18:52:01 +0200 http://forum.wiibrew.org/read.php?7,73034,73069#msg-73069 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73069#msg-73069 tueidj HardwareMon, 10 Jun 2013 16:15:44 +0200 http://forum.wiibrew.org/read.php?7,73034,73063#msg-73063 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73063#msg-73063
Once I get a sequence of commands that work on the desktop I'll code it to run without delay and see how it works with the wiimote.

I'm currently stuck trying to open PSM 11 and 13 for the HID interface (using the connection to the desktop). There is probably something basic I'm missing. I'm able to connect, and verify the that link quality is good (0xFF) - but cannot open channels for the HID interface. I'm sending ACL data to the L2CAP signal channel (0x0001) and instead of receiving a Connection Response, I am just getting a Number of Completed Packets event. It is as though the ACL data is being accepted, but is not recognized and/or interpreted as a valid L2CAP packet by the remote controller.

Specifically, here's the byte sequence I'm sending for an Echo Request after establishing a connection to the remote controller:

02 2A30 0800 0400 0100 08 01 0000

Which is:

02: UART HCI transport header - ACL data
2A30: connection handle 02A (bits 0-11) - little endian order) of the ACL-U link (returned by the HCI connect command) and PB flag==0b11 (bits 12,13), BC flag == 0b00 (bits 14,15).
0800: length of ACL payload (little endian representation of 0008)
0400: L2CAP header length (little endian representation of 0004)
0100: L2CAP CID for the signaling channel (little endian representation of 0001)
08: L2CAP code - Echo Request
01: L2CAP Identifier
0000: Data Length

Can anyone see what I'm doing wrong here?]]> ags000 HardwareMon, 10 Jun 2013 06:28:00 +0200 http://forum.wiibrew.org/read.php?7,73034,73062#msg-73062 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73062#msg-73062 tueidj HardwareMon, 10 Jun 2013 05:58:20 +0200 http://forum.wiibrew.org/read.php?7,73034,73058#msg-73058 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73058#msg-73058 ags000 HardwareSun, 09 Jun 2013 18:37:08 +0200 http://forum.wiibrew.org/read.php?7,73034,73050#msg-73050 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73050#msg-73050 ags000 HardwareSat, 08 Jun 2013 06:22:43 +0200 http://forum.wiibrew.org/read.php?7,73034,73048#msg-73048 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73048#msg-73048 tueidj HardwareSat, 08 Jun 2013 03:00:49 +0200 http://forum.wiibrew.org/read.php?7,73034,73046#msg-73046 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73046#msg-73046
I may need to rethink my project/design. I did not realize that even if I know the BD_ADDR of the wiimote it still needs to be discoverable before a connection can be established. I've read and re-read the WiiBrew/Wiimote page many times and didn't understand that. Is this true if the wiimote is bonded to the host?

Is there an alternative design that you can explain? Such as have the wiimote initiate the connection (how? does it first need to be bonded with the BT host before that will work?) and then (presumably) the wiimote requests a role change so the host acts as master?

Thanks for following up on this.]]> ags000 HardwareFri, 07 Jun 2013 21:36:23 +0200 http://forum.wiibrew.org/read.php?7,73034,73043#msg-73043 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73043#msg-73043What was the disconnection reason given by the wiimote?]]> tueidj HardwareFri, 07 Jun 2013 19:27:17 +0200 http://forum.wiibrew.org/read.php?7,73034,73040#msg-73040 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73040#msg-73040
I did try connecting with the Wiimote discoverable, and a connection was established, but immediately terminated (by the Wiimote).]]> ags000 HardwareFri, 07 Jun 2013 17:00:42 +0200 http://forum.wiibrew.org/read.php?7,73034,73039#msg-73039 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73039#msg-73039
From experience 0x0018 (DM1+DH1) definitely works for the packet type, R1 should be used as the page scan repetition mode, clock offset can be copied from the inquiry result with clock_offset_valid set or just leave it unset (that's what nintendo does). Role switching should be enabled, although the wiimote won't request a role switch in this situation.

The wiimote definitely must be in discoverable mode otherwise it won't respond to pages, preventing any incoming connections. Once you get the connection complete event it should just wait for L2CAP comms (the LEDs stay flashing until told to do something else).]]> tueidj HardwareFri, 07 Jun 2013 10:33:17 +0200 http://forum.wiibrew.org/read.php?7,73034,73038#msg-73038 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73038#msg-73038
BD_ADDR, Packet_Type, Page_Scan_Repetition_Mode, Reserved, Clock_Offset, Allow_Role_Switch

The BD_ADDR was returned in the inquiry result.
I tried packet types NULL (should default to DM1 per the spec), DM1, all legal (per EDR 2.1+ spec) types (DM1,3,5 and DH1,3,5) and even 0xFF just for kicks (it was rejected as an illegal parameter).
I used page scan repetition mode "R1"
I tried using the clock offset returned in the inquiry result, as well as NULL (so the clock_offset_valid_flag bit was cleared).
I do not enable role switching.

At this level, I'm not aware of any way to specify the PSM, as that is L2CAP, above HCI.

I presume either I am using wrong values (for the Wiimote) or there is some other setup that has to happen before I attempt to connect. I have checked the host controller configuration and verified that authorization is not required. I have not taken any other steps for configuration other than the inquiry to get the Wiimote BD_ADDR.

Thanks for any info you can share.]]> ags000 HardwareThu, 06 Jun 2013 23:44:26 +0200 http://forum.wiibrew.org/read.php?7,73034,73036#msg-73036 Re: Writing BT stack to connect with Wiimote - problems connectinghttp://forum.wiibrew.org/read.php?7,73034,73036#msg-73036 tueidj HardwareThu, 06 Jun 2013 14:28:47 +0200