WB5x: HCI bugs over UART transport

[donpedro]

Hi All,

There seems to be multiple bugs in the HCI implementation for WB series chips.

Are there any newer builds of this image where these are fixed?

Setup:

• Using reference dongle from P-NUCLEO-WB55.
• stm32wb5x_FUS_fw.bin latest version - 1.1.2
• stm32wb5x_BLE_HCILayer_fw.bin - v1.10.0
• All bugs can be reproduced in STM32MONRF tool.

The following bugs are present:

1) When sending the HCI_HOST_BUFFER_SIZE, the stack responds with COMMAND_STATUS. This is incorrect. As the spec states: "When the Host_Buffer_Size command has completed, a Command Complete event shall be generated." (Spec 5.0, page 957).

Treating the COMMAND_STATUS as COMMAND_COMPLETE fixes the problem, however this is no according to spec.

1a) There is actually a secondary bug here in the RF MON tool: The default parameters suggested have "Host_Total_Num_ACL_Data_Packets" set to zero by default, which of course will not be accepted. Should be 1.

2) When sending the HCI_LE_SET_SCAN_ENABLE, the default parameters do not work and the stack responds with error "0x83 - short window". This is because the default scan parameters are wrong. Setting them first with HCI_LE_SET_SCAN_PARAMETERS make the problem go away. The default should however always work of course.

Thanks,

/pedro

[donpedro]

Found another bug in the HCI build, which I cannot work-around:

3) When data (ACL traffic) is received over HCI, the data is correctly received as a normal H4 packet with a 1 byte header. However, when sending data, the data just seems to get stuck in the input pipe. No "NUMBER_OF_COMPLETED_PACKETS" event is ever received, and no data ever reaches the other end.

This bug is a show-stopper for using the HCI at all.

Not sure how to reproduce this the STM32MONRF tool, as I cannot find a way of sending raw data via the ACL. The fact that there is no command in the tool to do it, could explain why it does not work, as maybe no-one tried it.

Thanks,

/pedro

[donpedro]

Found another HCI bug:

4) On linux, the stack always throws a "read remote features" command right after the connection is completed.

This is on the WB55 responded with "Status: Controller Busy (0x3a)", which is of course not correct, as the controller is not doing anything.

The device does attach fine however using the command "sudo hciattach /dev/ttyACM0 any 115200"

On linux, it looks like this:

-- snip --

> HCI Event: LE Meta Event (0x3e) plen 31        #529 [hci0] 2923.471633

   LE Enhanced Connection Complete (0x0a)

    Status: Success (0x00)

    Handle: 2073

    Role: Slave (0x01)

    Peer address type: Public (0x00)

    Peer address: D4:25:8B:54:8E:CB (Intel Corporate)

    Local resolvable private address: 00:00:00:00:00:00 (Non-Resolvable)

    Peer resolvable private address: 00:00:00:00:00:00 (Non-Resolvable)

    Connection interval: 25.00 msec (0x0014)

    Connection latency: 0 (0x0000)

    Supervision timeout: 10000 msec (0x03e8)

    Master clock accuracy: 0x01

@ MGMT Event: Device Connected (0x000b) plen 13   {0x0001} [hci0] 2923.471672

    LE Address: D4:25:8B:54:8E:CB (Intel Corporate)

    Flags: 0x00000000

    Data length: 0

< HCI Command: LE Read Remote U.. (0x08|0x0016) plen 2 #530 [hci0] 2923.471763

    Handle: 2073

> HCI Event: Command Status (0x0f) plen 4        #531 [hci0] 2923.473599

   LE Read Remote Used Features (0x08|0x0016) ncmd 1

    Status: Controller Busy (0x3a)

< HCI Command: Disconnect (0x01|0x0006) plen 3     #532 [hci0] 2923.473631

    Handle: 2073

    Reason: Remote User Terminated Connection (0x13)

> HCI Event: Command Status (0x0f) plen 4        #533 [hci0] 2923.475603

   Disconnect (0x01|0x0006) ncmd 1

    Status: Success (0x00)

> ACL Data RX: Handle 2073 flags 0x02 dlen 11      #534 [hci0] 2923.491638

   ATT: Read By Group Type Request (0x10) len 6

    Handle range: 0x0001-0xffff

    Attribute group type: Primary Service (0x2800)

> HCI Event: LE Meta Event (0x3e) plen 11        #535 [hci0] 2923.516607

   LE Data Length Change (0x07)

    Handle: 2073

    Max TX octets: 251

    Max TX time: 2120

    Max RX octets: 251

    Max RX time: 2120

> HCI Event: Disconnect Complete (0x05) plen 4     #536 [hci0] 2923.666607

    Status: Success (0x00)

    Handle: 2073

    Reason: Connection Terminated By Local Host (0x16)

@ MGMT Event: Device Disconnected (0x000c) plen 8  {0x0001} [hci0] 2923.666630

    LE Address: D4:25:8B:54:8E:CB (Intel Corporate)

    Reason: Connection terminated by local host (0x02)

-- snip --

This one also needs to be fixed in the HCI build.

Overall, it looks like allot of small bugs need to be fixed for the HCI build to be usable.

Thanks,

/pedro

[donpedro]

Found yet another one:

5) When enabling scan, the "filter duplicates" option in the command does not work. No filtering is done, and the same device appear over and over again.

Thanks,

/pedro

[donpedro]

Looks like STs HCI interface is just broken.

I hope someone at ST gets a handle on this, as a working HCI (UART) interface is really handy.