AIROC™ Wi-Fi and Wi-Fi Bluetooth Combos Forum Discussions

[HarveyZ]

Hardware: STM32H743 Nucleo connects to LWB5+ via UART

Software: https://github.com/Infineon/stm32-connectivity/releases/tag/release-v1.3.0 tailored to the above host

Call sequences:

1. btsnd_hcic_reset (in libbtstack)
2. bt_post_reset_cback
3. bt_start_fw_download
4. cybt_prm_download
5. wiced_bt_dev_vendor_specific_command(HCI_VSC_DOWNLOAD_MINI_DRV...)
6. cybt_prm_command_complete_cback

After that the host software was stuck in the firmware downloading process. The host kept sending the first chunk of the firmware but couldn't move forward.

The response message from the radio was probably dropped somewhere in libbtstack so cybt_prm_command_complete_cback was not called again which maintains the state machine of the firmware downloading process.

7. cybt_prm_send_next_patch
8. wiced_bt_dev_vendor_specific_command(HCI_VSC_WRITE_RAM...)

  -- the first chunk of the firmware was seen on the wire and the radio chip responsed

  host tx:

    0x01, 0x4C, 0xFC, 0x46, 0x00, 0xB5, 0x21, 0x00, 0x42, 0x52, 0x43, 0x4D, 0x63, 0x66, 0x67, 0x53,

    0x00, 0x00, 0x00, 0x00, 0x32, 0x00, 0x00, 0x00, 0x01, 0x01, 0x04, 0x18, 0x92, 0x00, 0x00, 0x00,

    0x03, 0x06, 0xAC, 0x1F, 0x00, 0xA0, 0x73, 0x43, 0x00, 0x01, 0x1C, 0x42, 0xB5, 0x21, 0x00, 0x00,

    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x00, 0x00

  host rx:

    0x04, 0x0e, 0x04, 0x01, 0x4c, 0xfc, 0x00

9. cybt_hci_rx_task was waked up and the above rx message was processed by the task correctly

  --handle_hci_rx_event

  --wiced_bt_process_hci_events

  I couldn't figure out what happened in the libbtstack but cybt_prm_command_complete_cback was not called again.

[Owen_Zhang123]

Could you share the whole hci log when the problem happens?

[HarveyZ]

Looks like the forum doesn't accept long reply. Try to separate it into several pieces.

My debugging trace setup is like following:

void host_stack_platform_interface_init(void)
{

...
host_stack_platform_if.pf_hci_trace_cback_t = NULL;

...
}

I tried to get it working but without success.

[HarveyZ]

Traffic on the wire:

btsnd_hcic_reset
tx:0x01 0x03 0x0c 0x00
rx:0x04 0x0e 0x04 0x01 0x03 0x0c 0x01

HCI_VSC_DOWNLOAD_MINI_DRV?
tx:0x01 0x2e 0xfc 0x00
rx:0x04 0x0e 0x04 0x01 0x2e 0xfc 0x00

HCI_VSC_DOWNLOAD_MINI_DRV?
tx:0x01 0x2e 0xfc 0x00
rx:0x04 0x0e 0x04 0x01 0x2e 0xfc 0x00

HCI_VSC_WRITE_RAM?
tx:
0x01,
0x4C, 0xFC, 0x46, 0x00, 0xB5, 0x21, 0x00, 0x42, 0x52, 0x43, 0x4D, 0x63, 0x66, 0x67, 0x53, 0x00,
0x00, 0x00, 0x00, 0x32, 0x00, 0x00, 0x00, 0x01, 0x01, 0x04, 0x18, 0x92, 0x00, 0x00, 0x00, 0x03,
0x06, 0xAC, 0x1F, 0x00, 0xA0, 0x73, 0x43, 0x00, 0x01, 0x1C, 0x42, 0xB5, 0x21, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFE, 0x00, 0x00,

rx:0x04 0x0e 0x04 0x01 0x4c 0xfc 0x00

The last two message were repeatedly seen on the wire.

[Owen_Zhang123]

The 0x01,0x4C, 0xFC command is write RAM. The minidriver FW needs several write cycle to complete. So you will see many write ram command. It is normal if the content is different.

[HarveyZ]

Hi Owen, Thanks for your reply.

I understand that the host send firmware data to the radio piece by piece. In the 1.3.0 package the firmware itself is in a C byte array(w_bt_fimware_controller.c->brcm_patchram_buf). I clearly saw many pieces in the byte array. The first piece is 70(0x46) bytes, the second piece is 204(0xCC) bytes, etc.

The problem is that the host was repeatedly sending the first piece which is 70 bytes.

[Owen_Zhang123]

It seems the host doesn't enter the send next packet loop. Please refer to the readme file to enable the trace log and set the trace level to CYBT_TRACE_LEVEL_DEBUG to see which step is stuck. 

https://github.com/Infineon/stm32-connectivity/blob/release-v1.3.0/Middlewares/Third_Party/btstack-i...

[HarveyZ]

Hi @Owen_Zhang123 , I will check that and get back to you.