Skip to content

Bluetooth: Controller: Assertion in ull_conn.c when using hci_uart sample with mcumgr doing HCI Reset #93049

Open
@cvinayak

Description

@cvinayak

Describe the bug

mcumgr[192519]: < ACL Data TX: Handle 0 flags 0x01 dlen 24                                                                                                                            #11520303 [hci1] 28712.711689
      ATT: Write Command (0x52) len 424
        Handle: 0x000e Type: Vendor specific (da2e7828-fbce-4e01-ae9e-261174997c48)
          Data[166]: 0200019e00012801a3646461746159018500d88d002000000000000000008c0b00208c0b0020940b0020940b00200100010000000000000000001095040080d2002015e015e00769500110002000a0900b036c42b4704aa4af9e9f32a9cec8b7137610a9090f9a5bc66f41fd4b0a01002000fc5701dc6135e1323847bdc40f04d2e5bee5833b23c29f93593d00018cfa99942000000166e51953be2a1504cafb8f908459fe2d
> HCI Event: Number of Completed Packets (0x13) plen 5                                                                                                                                #11520304 [hci1] 28712.719554
        Num handles: 1
        Handle: 0 Address: F4:81:FA:23:32:D0 (Static)
        Count: 1
        #11520298: len 27 (21 Kb/s)
        Latency: 10 msec (1-52 msec ~10 msec)
> HCI Event: Number of Completed Packets (0x13) plen 5                                                                                                                                #11520305 [hci1] 28712.720594
        Num handles: 1
        Handle: 0 Address: F4:81:FA:23:32:D0 (Static)
        Count: 1
        #11520299: len 27 (19 Kb/s)
        Latency: 11 msec (1-52 msec ~11 msec)
> HCI Event: Number of Completed Packets (0x13) plen 5                                                                                                                                #11520306 [hci1] 28712.720595
        Num handles: 1
        Handle: 0 Address: F4:81:FA:23:32:D0 (Static)
        Count: 1
        #11520301: len 27 (19 Kb/s)
        Latency: 11 msec (1-52 msec ~11 msec)
> HCI Event: Number of Completed Packets (0x13) plen 5                                                                                                                                #11520307 [hci1] 28712.721576
        Num handles: 1
        Handle: 0 Address: F4:81:FA:23:32:D0 (Static)
        Count: 1
        #11520303: len 24 (21 Kb/s)
        Latency: 9 msec (1-52 msec ~10 msec)
> ACL Data RX: Handle 0 flags 0x02 dlen 26                                                                                                                                            #11520308 [hci1] 28712.730780
      ATT: Handle Value Notification (0x1b) len 21
        Handle: 0x000e Type: Vendor specific (da2e7828-fbce-4e01-ae9e-261174997c48)
          Data[19]: 0300000b00012801bf636f66661a0003d834ff
mcumgr[192519]: < HCI Command: Disconnect (0x01|0x0006) plen 3                                                                                                                        #11520309 [hci1] 28712.731162
        Handle: 0 Address: F4:81:FA:23:32:D0 (Static)
        Reason: Remote User Terminated Connection (0x13)
> HCI Event: Command Status (0x0f) plen 4                                                                                                                                             #11520310 [hci1] 28712.732601
      Disconnect (0x01|0x0006) ncmd 1
        Status: Success (0x00)
mcumgr[192519]: < HCI Command: Read BD ADDR (0x04|0x0009) plen 0                                                                                                                      #11520311 [hci1] 28712.732837
> HCI Event: Command Complete (0x0e) plen 10                                                                                                                                          #11520312 [hci1] 28712.733532
      Read BD ADDR (0x04|0x0009) ncmd 1
        Status: Success (0x00)
        Address: 00:00:00:00:00:00 (OUI 00-00-00)
mcumgr[192519]: @ USER Close: mcumgr                                                                                                                                                   {0x0002} [hci1] 28712.733685
= Close Index: 00:00:00:00:00:00                                                                                                                                                                [hci1] 28712.733698
@ MGMT Event: Index Added (0x0004) plen 0                                                                                                                                              {0x0001} [hci1] 28712.733701
bluetoothd[613]: @ MGMT Command: Remove Advertisement Monitor (0x0053) plen 2                                                                                                          {0x0001} [hci1] 28712.734010
        Handle: 0
@ MGMT Event: Command Complete (0x0001) plen 5                                                                                                                                         {0x0001} [hci1] 28712.734036
      Remove Advertisement Monitor (0x0053) plen 2
        Status: Success (0x00)
        Handle: 0
bluetoothd[613]: @ MGMT Command: Read Experimental Features Information (0x0049) plen 0                                                                                                {0x0001} [hci1] 28712.734096
@ MGMT Event: Command Complete (0x0001) plen 65                                                                                                                                        {0x0001} [hci1] 28712.734102
      Read Experimental Features Information (0x0049) plen 62
        Status: Success (0x00)
        Features: 3
        UUID: BlueZ Experimental Simultaneous Central and Peripheral
        Flags: 0x00000000
        UUID: BlueZ Experimental ISO Socket
        Flags: 0x00000001
          Active
        UUID: Vendor specific
        Flags: 0x00000000
bluetoothd[613]: @ MGMT Command: Read Controller Information (0x0004) plen 0                                                                                                           {0x0001} [hci1] 28712.734170
@ MGMT Event: Command Complete (0x0001) plen 283                                                                                                                                       {0x0001} [hci1] 28712.734174
      Read Controller Information (0x0004) plen 280
        Status: Success (0x00)
        Address: 00:00:00:00:00:00 (OUI 00-00-00)
        Version: Bluetooth 5.4 (0x0d)
        Manufacturer: The Linux Foundation (1521)
        Supported settings: 0x0001be1b
          Powered
          Connectable
          Discoverable
          Bondable
          Low Energy
          Advertising
          Secure Connections
          Debug Keys
          Privacy
          Static Address
          PHY Configuration
        Current settings: 0x00008a00
          Low Energy
          Secure Connections
          Static Address
        Class: 0x000000
          Major class: Miscellaneous
          Minor class: 0x00
        Name: mbp-himal-archlinux #2
        Short name: 
bluetoothd[613]: = Battery Provider Manager created                                                                                                                                                    28712.734518
mcumgr[192544]: @ RAW Open: mcumgr (privileged) version 2.22                                                                                                                                  {0x0002} 28712.741086
= Open Index: 00:00:00:00:00:00                                                                                                                                                                 [hci1] 28712.741098
< HCI Command: Reset (0x03|0x0003) plen 0                                                                                                                                             #11520313 [hci1] 28712.741147
> HCI Event: Vendor (0xff) plen 16                                                                                                                                                    #11520314 [hci1] 28712.742590
        aa 75 6c 6c 5f 63 6f 6e 6e 2e 63 00 c8 07 00 00  .ull_conn.c.....

Regression

  • This is a regression.

Steps to reproduce

# Build and flash uart_hci onto nRF52840-DK
west build -p auto -d build_uart_hci/ --board nrf52840dk/nrf52840 samples/bluetooth/hci_uart
west flash -d build_uart_hci

# Build device firmware A
west build -p auto -d build_A --board nrf54l15dk/nrf54l15/cpuapp samples/subsys/mgmt/mcumgr/smp_svr/ -DCONFIG_DEBUG=y -DCONFIG_MCUMGR_TRANSPORT_BT_PERM_RW=y -DCONFIG_BT_DEVICE_NAME=\"firmwareA\" -DEXTRA_CONF_FILE="overlay-bt.conf" --sysbuild
# Build and flash device firmware B onto nRF54l15-DK
west build -p auto -d build_B --board nrf54l15dk/nrf54l15/cpuapp samples/subsys/mgmt/mcumgr/smp_svr/ -DCONFIG_DEBUG=y -DCONFIG_MCUMGR_TRANSPORT_BT_PERM_RW=y -DCONFIG_BT_DEVICE_NAME=\"firmwareB\" -DEXTRA_CONF_FILE="overlay-bt.conf" --sysbuild
west flash -d build_B

# Attach HCI
sudo btattach -S 1000000 -B /dev/ttyACM1 &
# Start FOTA to firmware A
sudo mcumgr --conntype ble --hci 1 --timeout 60 --connstring peer_name=\"firmwareA\" image upload build_A/smp_svr/zephyr/zephyr.signed.bin
# Start FOTA to firmware B
sudo mcumgr --conntype ble --hci 1 --timeout 60 --connstring peer_name=\"firmwareB\" image upload build_B/smp_svr/zephyr/zephyr.signed.bin

Repeated use that causes the assertion, can be even over 500 iterations:

#! /bin/sh

cnt=1
while [ $cnt -le 1000 ]
do
	echo "Count $cnt"
	/home/jack/go/bin/mcumgr --conntype ble --hci 1 --timeout 60 --connstring peer_name="firmwareB" image upload build_A/smp_svr/zephyr/zephyr.signed.bin
	((cnt++))
done

Relevant log output

Impact

Annoyance – Minor irritation; no significant impact on usability or functionality.

Environment

Commit: 970c715

Additional Context

Reproduced in commit 0cd83c4 in #93028

Metadata

Metadata

Assignees

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions