Unable to find zephyr-based LE devices with updated BCM4345C0.hcd

ricardosalveti commented 5 years ago

OpenEmbedded uses this repository as source for the BCM firmware, and the recent update to use the current HEAD (which includes an updated BCM4345C0.hcd) created a regression when scanning for BT LE devices (zephyr based).

With the older firmware hcitool lescan returns all my zephyr-based le devices, like: root@raspberrypi3-64:~# hcitool lescan LE Scan ... D4:E7:DD:8A:B3:86 (unknown) D4:E7:DD:8A:B3:86 ZMP IPSP node 61:BC:8C:EA:10:D0 (unknown) 61:BC:8C:EA:10:D0 (unknown) D4:E7:25:CB:93:63 (unknown) D4:E7:25:CB:93:63 ZMP IPSP node

But with the latest firmware I don't get any of the ZMP IPSP nodes (and I got quite a few locally): root@raspberrypi3-64:~# hcitool lescan LE Scan ... 50:D2:5B:30:54:F2 (unknown) 61:BC:8C:EA:10:D0 (unknown) 52:80:24:B4:BA:96 (unknown) 52:80:24:B4:BA:96 (unknown)

Both seems to find LE-devices, just the ZMP ones that the latest firmware is unable to find. One thing is that the zephyr-based le devices are all using static random address (no public address on the development boards), so I wonder if there was any changed behavior with LE devices on the latest firmware.

Is there a more complete changelog available somewhere, for the updated firmware?

Thanks!

ricardosalveti commented 5 years ago

The btmon output of lescan with the older firmware:

> HCI Event: LE Meta Event (0x3e) plen 19                                                                          #8 [hci0] 13.874882
      LE Advertising Report (0x02)
        Num reports: 1
        Event type: Connectable undirected - ADV_IND (0x00)
        Address type: Random (0x01)
        Address: D4:E7:F9:59:DE:77 (Static)
        Data length: 7
        Flags: 0x06
          LE General Discoverable Mode
          BR/EDR Not Supported
        16-bit Service UUIDs (complete): 1 entry
          Internet Protocol Support (0x1820)
        RSSI: -53 dBm (0xcb)
> HCI Event: LE Meta Event (0x3e) plen 27                                                                          #9 [hci0] 13.875788
      LE Advertising Report (0x02)
        Num reports: 1
        Event type: Scan response - SCAN_RSP (0x04)
        Address type: Random (0x01)
        Address: D4:E7:F9:59:DE:77 (Static)
        Data length: 15
        Name (complete): ZMP IPSP node
        RSSI: -53 dBm (0xcb)

Scan parameters are the same with both versions:

< HCI Command: LE Set Scan Parameters (0x08|0x000b) plen 7                                                          #1 [hci0] 4.730923
        Type: Active (0x01)
        Interval: 10.000 msec (0x0010)
        Window: 10.000 msec (0x0010)
        Own address type: Public (0x00)
        Filter policy: Accept all advertisement (0x00)
> HCI Event: Command Complete (0x0e) plen 4                                                                         #2 [hci0] 4.731466
      LE Set Scan Parameters (0x08|0x000b) ncmd 1
        Status: Success (0x00)
< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2                                                              #3 [hci0] 4.731572
        Scanning: Enabled (0x01)
        Filter duplicates: Enabled (0x01)
> HCI Event: Command Complete (0x0e) plen 4                                                                         #4 [hci0] 4.732069
      LE Set Scan Enable (0x08|0x000c) ncmd 1
        Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 43                                                                           #5 [hci0] 4.746153

pelwell commented 5 years ago

One thing is that the zephyr-based le devices are all using static random address (no public address on the development boards)

Is it possible to test with public addresses, to see if that is relevant?

ricardosalveti commented 5 years ago

Is it possible to test with public addresses, to see if that is relevant?

@pelwell not even after forcing a public address.

This is the output I get with the older firmware, to confirm the address is public:

> HCI Event: LE Meta Event (0x3e) plen 19                                                                        #144 [hci0] 11.220050
      LE Advertising Report (0x02)
        Num reports: 1
        Event type: Connectable undirected - ADV_IND (0x00)
        Address type: Public (0x00)
        Address: D4:E7:F9:59:DE:77 (OUI D4-E7-F9)
        Data length: 7
        Flags: 0x06
          LE General Discoverable Mode
          BR/EDR Not Supported
        16-bit Service UUIDs (complete): 1 entry
          Internet Protocol Support (0x1820)
        RSSI: -34 dBm (0xde)
> HCI Event: LE Meta Event (0x3e) plen 27                                                                        #145 [hci0] 11.220882
      LE Advertising Report (0x02)
        Num reports: 1
        Event type: Scan response - SCAN_RSP (0x04)
        Address type: Public (0x00)
        Address: D4:E7:F9:59:DE:77 (OUI D4-E7-F9)
        Data length: 15
        Name (complete): ZMP IPSP node
        RSSI: -35 dBm (0xdd)

Checking with other zephyr samples, doesn't work even with the simplest one (beacon sample). Since I'm testing with nordic based mcus, they all describe themselves as bt 5.0 devices, not sure if that would make any difference here.

From btmon it seems the new firmware advertises itself as a 4.2 adapter, but the required extensions are all there, only LE Ping that seems to be missing with the new firmware, but not sure how relevant that would be here:

-        HCI version: Bluetooth 4.1 (0x07) - Revision 139 (0x008b)
-        LMP version: Bluetooth 4.1 (0x07) - Subversion 24857 (0x6119)
+        HCI version: Bluetooth 4.2 (0x08) - Revision 252 (0x00fc)
+        LMP version: Bluetooth 4.2 (0x08) - Subversion 24857 (0x6119)
-          Build: 0139
+          Build: 0252
-        Name: BCM4345C0 UART 37.4 MHz wlbga_ref_iLNA_iTR_eLG 0139
+        Name: BCM43455 37.4MHz Raspberry Pi 3+-0141
-        Data packet length: 27
-        Num data packets: 15
+        Data packet length: 251
+        Num data packets: 7
-        Features: 0x1f 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+        Features: 0x2f 0x00 0x00 0x00 0x00 0x00 0x00 0x00
           LE Encryption
           Connection Parameter Request Procedure
           Extended Reject Indication
           Slave-initiated Features Exchange
-          LE Ping
+> HCI Event: Command Complete (0x0e) plen 68               #31 [hci0] 26.198001
       Read Local Supported Commands (0x04|0x0002) ncmd 1
         Status: Success (0x00)
-        Commands: 199 entries
+        Commands: 203 entries
           Inquiry (Octet 0 - Bit 0)
           Inquiry Cancel (Octet 0 - Bit 1)
           Periodic Inquiry Mode (Octet 0 - Bit 2)
@@ -436,31 +440,35 @@
           Write Extended Inquiry Length (Octet 33 - Bit 3)
           LE Remote Connection Parameter Request Reply (Octet 33 - Bit 4)
           LE Remote Connection Parameter Request Negative Reply (Octet 33 - Bit 5)
+          LE Set Data Length (Octet 33 - Bit 6)
+          LE Read Suggested Default Data Length (Octet 33 - Bit 7)
+          LE Write Suggested Default Data Length (Octet 34 - Bit 0)
           LE Read Local P-256 Public Key (Octet 34 - Bit 1)
           LE Generate DHKey (Octet 34 - Bit 2)
+> HCI Event: Command Complete (0x0e) plen 14               #63 [hci0] 26.209650
       Read Local Extended Features (0x04|0x0004) ncmd 1
         Status: Success (0x00)
         Page: 2/2
-        Features: 0x7f 0x0b 0x00 0x00 0x00 0x00 0x00 0x00
+        Features: 0x33 0x0b 0x00 0x00 0x00 0x00 0x00 0x00
           Connectionless Slave Broadcast - Master
           Connectionless Slave Broadcast - Slave
-          Synchronization Train
-          Synchronization Scan
           Inquiry Response Notification Event
           Generalized interlaced scan
-          Coarse Clock Adjustment
           Secure Connections (Controller Support)
           Ping
           Train nudging

ricardosalveti commented 5 years ago

Testing with https://github.com/sonyxperiadev/device-sony-suzu/blob/master/rootdir/vendor/firmware/BCM4345C0.hcd as well and it works just fine, as with the older firmware.

Looking at what the firmware exports, it is also 4.2 based, but an older build number.

The differences with the latest rpi firmware:

-        HCI version: Bluetooth 4.2 (0x08) - Revision 252 (0x00fc)
+        HCI version: Bluetooth 4.2 (0x08) - Revision 181 (0x00b5)
-          Build: 0252
+          Build: 0181
-        Name: BCM43455 37.4MHz Raspberry Pi 3+-0141
+        Name: BCM4345C0 Sony Loire UART 37.4 MHz BT 4.2 cfg121-0121
-        Features: 0x2f 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+        Features: 0x3f 0x00 0x00 0x00 0x00 0x00 0x00 0x00
           LE Encryption
           Connection Parameter Request Procedure
           Extended Reject Indication
           Slave-initiated Features Exchange
+          LE Ping
           LE Data Packet Length Extension
+> HCI Event: Command Complete (0x0e) plen 14               #62 [hci0] 44.312890
       Read Local Extended Features (0x04|0x0004) ncmd 1
         Status: Success (0x00)
         Page: 2/2
-        Features: 0x33 0x0b 0x00 0x00 0x00 0x00 0x00 0x00
+        Features: 0x7f 0x0b 0x00 0x00 0x00 0x00 0x00 0x00
           Connectionless Slave Broadcast - Master
           Connectionless Slave Broadcast - Slave
+          Synchronization Train
+          Synchronization Scan
           Inquiry Response Notification Event
           Generalized interlaced scan
+          Coarse Clock Adjustment
           Secure Connections (Controller Support)
           Ping
           Train nudging

It basically adds back the same supported and extended features missing with the latest rpi firmware, and is also 4.2 based.

ricardosalveti commented 5 years ago

Tested with the firmware provided by H87020c_00_OPEN_EU_OP_0817 (Android LG G6), and I'm able to reproduce the same issue I'm having with the latest rpi firmware.

Comparing features, it is also lacking the same supported and extended features, so this might explain that the issue is just part of the updates provided by cypress.

The only difference when comparing with LG's firmware:

-        HCI version: Bluetooth 4.2 (0x08) - Revision 252 (0x00fc)
+        HCI version: Bluetooth 4.2 (0x08) - Revision 223 (0x00df)
-          Build: 0252
+          Build: 0223
-        Name: BCM43455 37.4MHz Raspberry Pi 3+-0141
+        Name: BCM4345C0 37.4MHz BT_4.2 LGE G6-Global(ePA)-0139

pelwell commented 5 years ago

I've reported this to Cypress - we'll see what the come back with.

pelwell commented 5 years ago

@ricardosalveti I have a test firmware from Cypress - download it from here: https://drive.google.com/file/d/1DUVJ4LH1fBp1x_C4VxprcjAqxYIt64oi/view?usp=sharing

Please try it and report back.

ricardosalveti commented 5 years ago

I can confirm that this test firmware work as before, finding my zephyr-based devices.

Diff between old/test firmware:

-        HCI version: Bluetooth 4.1 (0x07) - Revision 139 (0x008b)
-        LMP version: Bluetooth 4.1 (0x07) - Subversion 24857 (0x6119)
+        HCI version: Bluetooth 4.2 (0x08) - Revision 156 (0x009c)
+        LMP version: Bluetooth 4.2 (0x08) - Subversion 24857 (0x6119)
         Manufacturer: Broadcom Corporation (15)
           Firmware: 003.001.025
-          Build: 0139
-< HCI Command: Read BD ADDR (0x04|0x0009) plen 0            #5 [hci0] 14.015519
-> HCI Event: Command Complete (0x0e) plen 10                #6 [hci0] 14.016345
+          Build: 0156
-        Name: BCM4345C0 UART 37.4 MHz wlbga_ref_iLNA_iTR_eLG 0139
-< HCI Command: Read Voice Setting (0x03|0x0025) plen 0     #13 [hci0] 14.027664
-> HCI Event: Command Complete (0x0e) plen 6                #14 [hci0] 14.028391
+        Name: BCM4345C0 UART 37.4 MHz wlbga_ref_iLNA_iTR_eLG 0156

pelwell commented 5 years ago

Excellent. In due course there will be a new official release, but until then it would be helpful if you could keep testing this version.

ricardosalveti commented 5 years ago

Sure, let you know if I get any unexpected behavior.

pelwell commented 5 years ago

Despite the quick turnaround on a working firmware, Cypress now want to work out what made the difference.

Can you try with this generic version of 0141, i.e. 0141.0000? Then:

If it's not working, I need the full logs for both 139.0000 and 141.0000 from the FW loading to the problem is seen.

If it's working, I need the full logs for both 141.0000 and 141.252 from the FW loading to the problem is seen.

ricardosalveti commented 5 years ago

Can you try with this generic version of 0141, i.e. 0141.0000?

0141 also fails to find my zephyr-based devices, and the differences when comparing with 0139:

-< HCI Command: Read Local Version I.. (0x04|0x0001) plen 0  #3 [hci0] 39.522869
-> HCI Event: Command Complete (0x0e) plen 12                #4 [hci0] 39.524435
+< HCI Command: Read Local Version I.. (0x04|0x0001) plen 0  #3 [hci0] 48.962094
+> HCI Event: Command Complete (0x0e) plen 12                #4 [hci0] 48.962924
       Read Local Version Information (0x04|0x0001) ncmd 1
         Status: Success (0x00)
-        HCI version: Bluetooth 4.1 (0x07) - Revision 139 (0x008b)
-        LMP version: Bluetooth 4.1 (0x07) - Subversion 24857 (0x6119)
+        HCI version: Bluetooth 4.2 (0x08) - Revision 141 (0x008d)
+        LMP version: Bluetooth 4.2 (0x08) - Subversion 24857 (0x6119)
         Manufacturer: Broadcom Corporation (15)
           Firmware: 003.001.025
-          Build: 0139
-< HCI Command: Read BD ADDR (0x04|0x0009) plen 0            #5 [hci0] 39.524528
-> HCI Event: Command Complete (0x0e) plen 10                #6 [hci0] 39.525274
+          Build: 0141
+< HCI Command: Read BD ADDR (0x04|0x0009) plen 0            #5 [hci0] 48.963041
+> HCI Event: Command Complete (0x0e) plen 10                #6 [hci0] 48.963750

-< HCI Command: Read Local Name (0x03|0x0014) plen 0        #11 [hci0] 39.532284
-> HCI Event: Command Complete (0x0e) plen 252              #12 [hci0] 39.535975
+< HCI Command: Read Local Name (0x03|0x0014) plen 0        #11 [hci0] 48.965727
+> HCI Event: Command Complete (0x0e) plen 252              #12 [hci0] 48.969270
       Read Local Name (0x03|0x0014) ncmd 1
         Status: Success (0x00)
-        Name: BCM4345C0 UART 37.4 MHz wlbga_ref_iLNA_iTR_eLG 0139
-< HCI Command: Read Voice Setting (0x03|0x0025) plen 0     #13 [hci0] 39.536058
-> HCI Event: Command Complete (0x0e) plen 6                #14 [hci0] 39.536724
+        Name: 43455 LGE-iPA BT4.2 0141
+< HCI Command: Read Voice Setting (0x03|0x0025) plen 0     #13 [hci0] 48.969449
+> HCI Event: Command Complete (0x0e) plen 6                #14 [hci0] 48.970091

-< HCI Command: LE Read Buffer Size (0x08|0x0002) plen 0    #23 [hci0] 39.540268
-> HCI Event: Command Complete (0x0e) plen 7                #24 [hci0] 39.541159
+< HCI Command: LE Read Buffer Size (0x08|0x0002) plen 0    #23 [hci0] 48.976018
+> HCI Event: Command Complete (0x0e) plen 7                #24 [hci0] 48.976877
       LE Read Buffer Size (0x08|0x0002) ncmd 1
         Status: Success (0x00)
-        Data packet length: 27
-        Num data packets: 15
-< HCI Command: LE Read Local Suppo.. (0x08|0x0003) plen 0  #25 [hci0] 39.541252
-> HCI Event: Command Complete (0x0e) plen 12               #26 [hci0] 39.542195
+        Data packet length: 251
+        Num data packets: 7

+< HCI Command: LE Read Local Suppo.. (0x08|0x0003) plen 0  #25 [hci0] 48.976949
+> HCI Event: Command Complete (0x0e) plen 12               #26 [hci0] 48.977887
       LE Read Local Supported Features (0x08|0x0003) ncmd 1
         Status: Success (0x00)
-        Features: 0x1f 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+        Features: 0x2f 0x00 0x00 0x00 0x00 0x00 0x00 0x00
           LE Encryption
           Connection Parameter Request Procedure
           Extended Reject Indication
           Slave-initiated Features Exchange
-          LE Ping
-< HCI Command: LE Read Supported S.. (0x08|0x001c) plen 0  #27 [hci0] 39.542279
-> HCI Event: Command Complete (0x0e) plen 12               #28 [hci0] 39.543115
+          LE Data Packet Length Extension

-< HCI Command: Read Local Supporte.. (0x04|0x0002) plen 0  #29 [hci0] 39.543175
-> HCI Event: Command Complete (0x0e) plen 68               #30 [hci0] 39.544692
+< HCI Command: Read Local Supporte.. (0x04|0x0002) plen 0  #29 [hci0] 48.978843
+> HCI Event: Command Complete (0x0e) plen 68               #30 [hci0] 48.980362
       Read Local Supported Commands (0x04|0x0002) ncmd 1
         Status: Success (0x00)
-        Commands: 199 entries
+        Commands: 203 entries
           Inquiry (Octet 0 - Bit 0)
           Inquiry Cancel (Octet 0 - Bit 1)
           Periodic Inquiry Mode (Octet 0 - Bit 2)
@@ -433,31 +433,35 @@
           Write Extended Inquiry Length (Octet 33 - Bit 3)
           LE Remote Connection Parameter Request Reply (Octet 33 - Bit 4)
           LE Remote Connection Parameter Request Negative Reply (Octet 33 - Bit 5)
+          LE Set Data Length (Octet 33 - Bit 6)
+          LE Read Suggested Default Data Length (Octet 33 - Bit 7)
+          LE Write Suggested Default Data Length (Octet 34 - Bit 0)
           LE Read Local P-256 Public Key (Octet 34 - Bit 1)
           LE Generate DHKey (Octet 34 - Bit 2)
-< HCI Command: Write Extended In.. (0x03|0x0052) plen 241  #31 [hci0] 39.544756
+          LE Read Maximum Data Length (Octet 35 - Bit 3)
+< HCI Command: Write Extended In.. (0x03|0x0052) plen 241  #31 [hci0] 48.980495
         FEC: Not required (0x00)

-< HCI Command: Read Page Scan Type (0x03|0x0046) plen 0    #47 [hci0] 39.554729
-> HCI Event: Command Complete (0x0e) plen 5                #48 [hci0] 39.555473
+< HCI Command: Read Page Scan Type (0x03|0x0046) plen 0    #47 [hci0] 48.992893
+> HCI Event: Command Complete (0x0e) plen 5                #48 [hci0] 48.993658
       Read Page Scan Type (0x03|0x0046) ncmd 1
         Status: Success (0x00)
         Type: Standard Scan (0x00)
-< HCI Command: LE Set Event Mask (0x08|0x0001) plen 8      #49 [hci0] 39.555540
-        Mask: 0x00000000000001bf
+< HCI Command: LE Set Event Mask (0x08|0x0001) plen 8      #49 [hci0] 48.993727
+        Mask: 0x00000000000001ff
           LE Connection Complete
           LE Advertising Report
           LE Connection Update Complete
           LE Read Remote Used Features Complete
           LE Long Term Key Request
           LE Remote Connection Parameter Request
+          LE Data Length Change
           LE Read Local P-256 Public Key Complete
           LE Generate DHKey Complete

-< HCI Command: Read Local Extended.. (0x04|0x0004) plen 1  #57 [hci0] 39.559351
+< HCI Command: LE Read Maximum Dat.. (0x08|0x002f) plen 0  #57 [hci0] 48.997591
+> HCI Event: Command Complete (0x0e) plen 12               #58 [hci0] 48.998491
+      LE Read Maximum Data Length (0x08|0x002f) ncmd 1
+        Status: Success (0x00)
+        Max TX octets: 251
+        Max TX time: 2120
+        Max RX octets: 251
+        Max RX time: 2120
+< HCI Command: LE Read Suggested D.. (0x08|0x0023) plen 0  #59 [hci0] 48.998553
+> HCI Event: Command Complete (0x0e) plen 8                #60 [hci0] 48.999374
+      LE Read Suggested Default Data Length (0x08|0x0023) ncmd 1
+        Status: Success (0x00)
+        TX octets: 27
+        TX time: 328
+< HCI Command: Read Local Extended.. (0x04|0x0004) plen 1  #61 [hci0] 48.999435
         Page: 2
-> HCI Event: Command Complete (0x0e) plen 14               #58 [hci0] 39.560271
+> HCI Event: Command Complete (0x0e) plen 14               #62 [hci0] 49.000366
       Read Local Extended Features (0x04|0x0004) ncmd 1
         Status: Success (0x00)
         Page: 2/2
-        Features: 0x7f 0x0b 0x00 0x00 0x00 0x00 0x00 0x00
+        Features: 0x33 0x0b 0x00 0x00 0x00 0x00 0x00 0x00
           Connectionless Slave Broadcast - Master
           Connectionless Slave Broadcast - Slave
-          Synchronization Train
-          Synchronization Scan
           Inquiry Response Notification Event
           Generalized interlaced scan
-          Coarse Clock Adjustment
           Secure Connections (Controller Support)
           Ping
           Train nudging

Wonder if the lack LE Ping is what is causing this behavior, since 0156 also supports LE Ping and it works fine there.

Btmon logs for both 0139 and 0141:

0139.txt 0141.txt

When it works, lescan is able to find 'ZMP IPSP node' nodes.

pelwell commented 5 years ago

Thank you - I've passed on your findings.

pelwell commented 5 years ago

I have a new test firmware - this should be the same as the current release (a Pi-tailored 141 firmware) but with LE Ping enabled. Download it here.

ricardosalveti commented 5 years ago

I have a new test firmware

Still doesn't work.

Comparing with the sony's firmware from earlier comment (which works fine), here are the differences:

-< HCI Command: Read Local Version In.. (0x04|0x0001) plen 0  #3 [hci0] 9.733570
-> HCI Event: Command Complete (0x0e) plen 12                 #4 [hci0] 9.734535
+< HCI Command: Read Local Version I.. (0x04|0x0001) plen 0  #3 [hci0] 24.886980
+> HCI Event: Command Complete (0x0e) plen 12                #4 [hci0] 24.887832
       Read Local Version Information (0x04|0x0001) ncmd 1
         Status: Success (0x00)
-        HCI version: Bluetooth 4.2 (0x08) - Revision 181 (0x00b5)
+        HCI version: Bluetooth 4.2 (0x08) - Revision 1219 (0x04c3)
         LMP version: Bluetooth 4.2 (0x08) - Subversion 24857 (0x6119)
         Manufacturer: Broadcom Corporation (15)
           Firmware: 003.001.025
-          Build: 0181
-< HCI Command: Read BD ADDR (0x04|0x0009) plen 0             #5 [hci0] 9.734593
-> HCI Event: Command Complete (0x0e) plen 10                 #6 [hci0] 9.735873
+          Build: 1219
+< HCI Command: Read BD ADDR (0x04|0x0009) plen 0            #5 [hci0] 24.887911
+> HCI Event: Command Complete (0x0e) plen 10                #6 [hci0] 24.889315

-        Name: BCM4345C0 Sony Loire UART 37.4 MHz BT 4.2 cfg121-0121
+        Name: BCM43455 37.4MHz Raspberry 3

-< HCI Command: Read Local Extended... (0x04|0x0004) plen 1  #61 [hci0] 9.766850
+< HCI Command: Read Local Extended.. (0x04|0x0004) plen 1  #60 [hci0] 26.964199
         Page: 2
-> HCI Event: Command Complete (0x0e) plen 14                #62 [hci0] 9.767760
+> HCI Event: Command Complete (0x0e) plen 14               #61 [hci0] 26.964702
       Read Local Extended Features (0x04|0x0004) ncmd 1
         Status: Success (0x00)
         Page: 2/2
-        Features: 0x7f 0x0b 0x00 0x00 0x00 0x00 0x00 0x00
+        Features: 0x33 0x0b 0x00 0x00 0x00 0x00 0x00 0x00
           Connectionless Slave Broadcast - Master
           Connectionless Slave Broadcast - Slave
-          Synchronization Train
-          Synchronization Scan
           Inquiry Response Notification Event
           Generalized interlaced scan
-          Coarse Clock Adjustment
           Secure Connections (Controller Support)
           Ping
           Train nudging

Maybe the lack of synchronization train/scan? Not that familiar with the spec to know for sure, but that is now the main difference between the working firmware and broken one.

pelwell commented 5 years ago

Cypress are sceptical that you are running the updated firmware - sorry. Can you post the full log to convince them?

pelwell commented 5 years ago

And now there's another firmware to test, with all page 2 extended features enabled.

ricardosalveti commented 5 years ago

Still unable to find my devices, but now I can confirm the firmware is reporting the same set of features when comparing with the one used by sony, really weird.

Full btmon logs: with_ping.txt with_ping_more_le.txt sony.txt

ricardosalveti commented 5 years ago

Diff from latest and the one from sony:

$ diff -Naur with_ping_more_le.txt sony.txt
--- with_ping_more_le.txt   2018-12-20 20:10:53.000000000 -0200
+++ sony.txt    2018-12-20 20:10:53.000000000 -0200
@@ -64,11 +64,11 @@
 > HCI Event: Command Complete (0x0e) plen 12                #4
       Read Local Version Information (0x04|0x0001) ncmd 1
         Status: Success (0x00)
-        HCI version: Bluetooth 4.2 (0x08) - Revision 1220 (0x04c4)
+        HCI version: Bluetooth 4.2 (0x08) - Revision 181 (0x00b5)
         LMP version: Bluetooth 4.2 (0x08) - Subversion 24857 (0x6119)
         Manufacturer: Broadcom Corporation (15)
           Firmware: 003.001.025
-          Build: 1220
+          Build: 0181
 < HCI Command: Read BD ADDR (0x04|0x0009) plen 0            #5
 > HCI Event: Command Complete (0x0e) plen 10                #6
       Read BD ADDR (0x04|0x0009) ncmd 1
@@ -91,7 +91,7 @@
 > HCI Event: Command Complete (0x0e) plen 252              #12
       Read Local Name (0x03|0x0014) ncmd 1
         Status: Success (0x00)
-        Name: BCM43455 37.4MHz Raspberry Pi 3+-0141
+        Name: BCM4345C0 Sony Loire UART 37.4 MHz BT 4.2 cfg121-0121
 < HCI Command: Read Voice Setting (0x03|0x0025) plen 0     #13
 > HCI Event: Command Complete (0x0e) plen 6                #14
       Read Voice Setting (0x03|0x0025) ncmd 1
@@ -724,11 +724,11 @@
 > HCI Event: Command Complete (0x0e) plen 12               #78
       Read Local Version Information (0x04|0x0001) ncmd 1
         Status: Success (0x00)
-        HCI version: Bluetooth 4.2 (0x08) - Revision 1220 (0x04c4)
+        HCI version: Bluetooth 4.2 (0x08) - Revision 181 (0x00b5)
         LMP version: Bluetooth 4.2 (0x08) - Subversion 24857 (0x6119)
         Manufacturer: Broadcom Corporation (15)
           Firmware: 003.001.025
-          Build: 1220
+          Build: 0181
 < HCI Command: Read BD ADDR (0x04|0x0009) plen 0           #79
 > HCI Event: Command Complete (0x0e) plen 10               #80
       Read BD ADDR (0x04|0x0009) ncmd 1
@@ -751,7 +751,7 @@
 > HCI Event: Command Complete (0x0e) plen 252              #86
       Read Local Name (0x03|0x0014) ncmd 1
         Status: Success (0x00)
-        Name: BCM43455 37.4MHz Raspberry Pi 3+-0141
+        Name: BCM4345C0 Sony Loire UART 37.4 MHz BT 4.2 cfg121-0121
 < HCI Command: Read Voice Setting (0x03|0x0025) plen 0     #87
 > HCI Event: Command Complete (0x0e) plen 6                #88
       Read Voice Setting (0x03|0x0025) ncmd 1
@@ -1352,7 +1352,7 @@
         Company: Apple, Inc. (76)
           Type: Unknown (16)
           Data: 0b08
-        RSSI: -56 dBm (0xc8)
+        RSSI: -60 dBm (0xc4)
 > HCI Event: LE Meta Event (0x3e) plen 12                 #154
       LE Advertising Report (0x02)
         Num reports: 1
@@ -1360,81 +1360,146 @@
         Address type: Public (0x00)
         Address: F0:18:98:0C:0A:A0 (Apple, Inc.)
         Data length: 0
-        RSSI: -56 dBm (0xc8)
-> HCI Event: LE Meta Event (0x3e) plen 26                 #155
+        RSSI: -61 dBm (0xc3)
+> HCI Event: LE Meta Event (0x3e) plen 19                 #155
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Connectable undirected - ADV_IND (0x00)
         Address type: Random (0x01)
-        Address: 4A:5A:CB:8E:5B:4B (Resolvable)
-        Data length: 14
-        Flags: 0x1a
+        Address: D4:E7:DD:8A:B3:86 (Static)
+        Data length: 7
+        Flags: 0x06
           LE General Discoverable Mode
-          Simultaneous LE and BR/EDR (Controller)
-          Simultaneous LE and BR/EDR (Host)
-        Company: Apple, Inc. (76)
-          Type: Unknown (16)
-          Data: 0118c88c62
-        RSSI: -45 dBm (0xd3)
-> HCI Event: LE Meta Event (0x3e) plen 12                 #156
+          BR/EDR Not Supported
+        16-bit Service UUIDs (complete): 1 entry
+          Internet Protocol Support (0x1820)
+        RSSI: -57 dBm (0xc7)
+> HCI Event: LE Meta Event (0x3e) plen 27                 #156
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Scan response - SCAN_RSP (0x04)
         Address type: Random (0x01)
-        Address: 4A:5A:CB:8E:5B:4B (Resolvable)
-        Data length: 0
-        RSSI: -43 dBm (0xd5)
-> HCI Event: LE Meta Event (0x3e) plen 26                 #157
+        Address: D4:E7:DD:8A:B3:86 (Static)
+        Data length: 15
+        Name (complete): ZMP IPSP node
+        RSSI: -56 dBm (0xc8)
+> HCI Event: LE Meta Event (0x3e) plen 35                 #157
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Connectable undirected - ADV_IND (0x00)
         Address type: Random (0x01)
-        Address: 5C:D2:73:84:C0:D5 (Resolvable)
-        Data length: 14
-        Flags: 0x1a
+        Address: 6A:50:5C:93:60:5A (Resolvable)
+        Data length: 23
+        Flags: 0x06
           LE General Discoverable Mode
-          Simultaneous LE and BR/EDR (Controller)
-          Simultaneous LE and BR/EDR (Host)
+          BR/EDR Not Supported
         Company: Apple, Inc. (76)
-          Type: Unknown (16)
-          Data: 0b1c982bdb
-        RSSI: -80 dBm (0xb0)
+          Type: Unknown (12)
+          Data: 08371f26a116d7f4cb2eec142564
+        RSSI: -60 dBm (0xc4)
 > HCI Event: LE Meta Event (0x3e) plen 12                 #158
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Scan response - SCAN_RSP (0x04)
         Address type: Random (0x01)
-        Address: 5C:D2:73:84:C0:D5 (Resolvable)
+        Address: 6A:50:5C:93:60:5A (Resolvable)
         Data length: 0
-        RSSI: -80 dBm (0xb0)
-> HCI Event: LE Meta Event (0x3e) plen 35                 #159
+        RSSI: -61 dBm (0xc3)
+> HCI Event: LE Meta Event (0x3e) plen 19                 #159
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Connectable undirected - ADV_IND (0x00)
         Address type: Random (0x01)
-        Address: 6A:50:5C:93:60:5A (Resolvable)
-        Data length: 23
+        Address: D4:E7:25:CB:93:63 (Static)
+        Data length: 7
         Flags: 0x06
           LE General Discoverable Mode
           BR/EDR Not Supported
-        Company: Apple, Inc. (76)
-          Type: Unknown (12)
-          Data: 082c1fc2f94c59ad573a049361dd
+        16-bit Service UUIDs (complete): 1 entry
+          Internet Protocol Support (0x1820)
         RSSI: -62 dBm (0xc2)
-> HCI Event: LE Meta Event (0x3e) plen 12                 #160
+> HCI Event: LE Meta Event (0x3e) plen 27                 #160
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Scan response - SCAN_RSP (0x04)
         Address type: Random (0x01)
-        Address: 6A:50:5C:93:60:5A (Resolvable)
+        Address: D4:E7:25:CB:93:63 (Static)
+        Data length: 15
+        Name (complete): ZMP IPSP node
+        RSSI: -64 dBm (0xc0)
+> HCI Event: LE Meta Event (0x3e) plen 19                 #161
+      LE Advertising Report (0x02)
+        Num reports: 1
+        Event type: Connectable undirected - ADV_IND (0x00)
+        Address type: Random (0x01)
+        Address: D4:E7:F9:59:DE:77 (Static)
+        Data length: 7
+        Flags: 0x06
+          LE General Discoverable Mode
+          BR/EDR Not Supported
+        16-bit Service UUIDs (complete): 1 entry
+          Internet Protocol Support (0x1820)
+        RSSI: -54 dBm (0xca)
+> HCI Event: LE Meta Event (0x3e) plen 27                 #162
+      LE Advertising Report (0x02)
+        Num reports: 1
+        Event type: Scan response - SCAN_RSP (0x04)
+        Address type: Random (0x01)
+        Address: D4:E7:F9:59:DE:77 (Static)
+        Data length: 15
+        Name (complete): ZMP IPSP node
+        RSSI: -56 dBm (0xc8)
+> HCI Event: LE Meta Event (0x3e) plen 19                 #163
+      LE Advertising Report (0x02)
+        Num reports: 1
+        Event type: Connectable undirected - ADV_IND (0x00)
+        Address type: Random (0x01)
+        Address: D4:E7:21:D0:C8:D0 (Static)
+        Data length: 7
+        Flags: 0x06
+          LE General Discoverable Mode
+          BR/EDR Not Supported
+        16-bit Service UUIDs (complete): 1 entry
+          Internet Protocol Support (0x1820)
+        RSSI: -57 dBm (0xc7)
+> HCI Event: LE Meta Event (0x3e) plen 27                 #164
+      LE Advertising Report (0x02)
+        Num reports: 1
+        Event type: Scan response - SCAN_RSP (0x04)
+        Address type: Random (0x01)
+        Address: D4:E7:21:D0:C8:D0 (Static)
+        Data length: 15
+        Name (complete): ZMP IPSP node
+        RSSI: -58 dBm (0xc6)
+> HCI Event: LE Meta Event (0x3e) plen 26                 #165
+      LE Advertising Report (0x02)
+        Num reports: 1
+        Event type: Connectable undirected - ADV_IND (0x00)
+        Address type: Random (0x01)
+        Address: 4A:5A:CB:8E:5B:4B (Resolvable)
+        Data length: 14
+        Flags: 0x1a
+          LE General Discoverable Mode
+          Simultaneous LE and BR/EDR (Controller)
+          Simultaneous LE and BR/EDR (Host)
+        Company: Apple, Inc. (76)
+          Type: Unknown (16)
+          Data: 0118c88c62
+        RSSI: -45 dBm (0xd3)
+> HCI Event: LE Meta Event (0x3e) plen 12                 #166
+      LE Advertising Report (0x02)
+        Num reports: 1
+        Event type: Scan response - SCAN_RSP (0x04)
+        Address type: Random (0x01)
+        Address: 4A:5A:CB:8E:5B:4B (Resolvable)
         Data length: 0
-        RSSI: -62 dBm (0xc2)
-> HCI Event: LE Meta Event (0x3e) plen 26                 #161
+        RSSI: -43 dBm (0xd5)
+> HCI Event: LE Meta Event (0x3e) plen 26                 #167
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Connectable undirected - ADV_IND (0x00)
         Address type: Random (0x01)
-        Address: 6C:8D:C9:AF:57:6A (Resolvable)
+        Address: 47:59:F2:C7:69:C1 (Resolvable)
         Data length: 14
         Flags: 0x1a
           LE General Discoverable Mode
@@ -1442,17 +1507,17 @@
           Simultaneous LE and BR/EDR (Host)
         Company: Apple, Inc. (76)
           Type: Unknown (16)
-          Data: 01183ef9e9
-        RSSI: -86 dBm (0xaa)
-> HCI Event: LE Meta Event (0x3e) plen 12                 #162
+          Data: 031c5698ef
+        RSSI: -58 dBm (0xc6)
+> HCI Event: LE Meta Event (0x3e) plen 12                 #168
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Scan response - SCAN_RSP (0x04)
         Address type: Random (0x01)
-        Address: 6C:8D:C9:AF:57:6A (Resolvable)
+        Address: 47:59:F2:C7:69:C1 (Resolvable)
         Data length: 0
-        RSSI: -86 dBm (0xaa)
-> HCI Event: LE Meta Event (0x3e) plen 40                 #163
+        RSSI: -60 dBm (0xc4)
+> HCI Event: LE Meta Event (0x3e) plen 40                 #169
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Connectable undirected - ADV_IND (0x00)
@@ -1468,10 +1533,10 @@
           Google Inc. (0xfe26)
           Unknown (0xfe03)
         Company: not assigned (2305)
-          Data: 5112dc5b9819b20c0aa0
+          Data: 5112ea69d225660c0aa0
         TX power: -10 dBm
-        RSSI: -66 dBm (0xbe)
-> HCI Event: LE Meta Event (0x3e) plen 28                 #164
+        RSSI: -57 dBm (0xc7)
+> HCI Event: LE Meta Event (0x3e) plen 28                 #170
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Scan response - SCAN_RSP (0x04)
@@ -1479,22 +1544,34 @@
         Address: 28:11:A5:45:24:37 (Bose Corporation)
         Data length: 16
         Name (complete): LE-Sonic Tooth
-        RSSI: -65 dBm (0xbf)
-> HCI Event: LE Meta Event (0x3e) plen 43                 #165
+        RSSI: -57 dBm (0xc7)
+> HCI Event: LE Meta Event (0x3e) plen 27                 #171
       LE Advertising Report (0x02)
         Num reports: 1
-        Event type: Non connectable undirected - ADV_NONCONN_IND (0x03)
-        Address type: Random (0x01)
-        Address: D8:49:27:2F:52:6C (Static)
-        Data length: 31
-        Flags: 0x06
+        Event type: Connectable undirected - ADV_IND (0x00)
+        Address type: Public (0x00)
+        Address: 2C:41:A1:25:AC:73 (Bose Corporation)
+        Data length: 15
+        Flags: 0x1a
           LE General Discoverable Mode
-          BR/EDR Not Supported
+          Simultaneous LE and BR/EDR (Controller)
+          Simultaneous LE and BR/EDR (Host)
         16-bit Service UUIDs (complete): 1 entry
-          Google (0xfeaa)
-        Service Data (UUID 0xfeaa): 10f9037275752e76692f234248415a414d5a7747
-        RSSI: -62 dBm (0xc2)
-> HCI Event: LE Meta Event (0x3e) plen 26                 #166
+          Bose Corporation (0xfebe)
+        Company: SGL Italia S.r.l. (784)
+          Data: 40110130
+        RSSI: -74 dBm (0xb6)
+> HCI Event: LE Meta Event (0x3e) plen 43                 #172
+      LE Advertising Report (0x02)
+        Num reports: 1
+        Event type: Scan response - SCAN_RSP (0x04)
+        Address type: Public (0x00)
+        Address: 2C:41:A1:25:AC:73 (Bose Corporation)
+        Data length: 31
+        TX power: 10 dBm
+        Name (complete): LE-Domo Revolve+ SoundLink
+        RSSI: -74 dBm (0xb6)
+> HCI Event: LE Meta Event (0x3e) plen 26                 #173
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Connectable undirected - ADV_IND (0x00)
@@ -1508,21 +1585,35 @@
         Company: Apple, Inc. (76)
           Type: Unknown (16)
           Data: 031851354f
-        RSSI: -82 dBm (0xae)
-> HCI Event: LE Meta Event (0x3e) plen 12                 #167
+        RSSI: -71 dBm (0xb9)
+> HCI Event: LE Meta Event (0x3e) plen 12                 #174
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Scan response - SCAN_RSP (0x04)
         Address type: Random (0x01)
         Address: 7C:12:93:4F:31:25 (Resolvable)
         Data length: 0
-        RSSI: -82 dBm (0xae)
-> HCI Event: LE Meta Event (0x3e) plen 26                 #168
+        RSSI: -71 dBm (0xb9)
+> HCI Event: LE Meta Event (0x3e) plen 43                 #175
+      LE Advertising Report (0x02)
+        Num reports: 1
+        Event type: Non connectable undirected - ADV_NONCONN_IND (0x03)
+        Address type: Random (0x01)
+        Address: D8:49:27:2F:52:6C (Static)
+        Data length: 31
+        Flags: 0x06
+          LE General Discoverable Mode
+          BR/EDR Not Supported
+        16-bit Service UUIDs (complete): 1 entry
+          Google (0xfeaa)
+        Service Data (UUID 0xfeaa): 10f9037275752e76692f234248415a414d5a7747
+        RSSI: -73 dBm (0xb7)
+> HCI Event: LE Meta Event (0x3e) plen 26                 #176
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Connectable undirected - ADV_IND (0x00)
         Address type: Random (0x01)
-        Address: 47:59:F2:C7:69:C1 (Resolvable)
+        Address: 6C:8D:C9:AF:57:6A (Resolvable)
         Data length: 14
         Flags: 0x1a
           LE General Discoverable Mode
@@ -1530,46 +1621,43 @@
           Simultaneous LE and BR/EDR (Host)
         Company: Apple, Inc. (76)
           Type: Unknown (16)
-          Data: 031c5698ef
-        RSSI: -49 dBm (0xcf)
-> HCI Event: LE Meta Event (0x3e) plen 12                 #169
+          Data: 01183ef9e9
+        RSSI: -86 dBm (0xaa)
+> HCI Event: LE Meta Event (0x3e) plen 12                 #177
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Scan response - SCAN_RSP (0x04)
         Address type: Random (0x01)
-        Address: 47:59:F2:C7:69:C1 (Resolvable)
+        Address: 6C:8D:C9:AF:57:6A (Resolvable)
         Data length: 0
-        RSSI: -48 dBm (0xd0)
-> HCI Event: LE Meta Event (0x3e) plen 27                 #170
+        RSSI: -87 dBm (0xa9)
+> HCI Event: LE Meta Event (0x3e) plen 26                 #178
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Connectable undirected - ADV_IND (0x00)
-        Address type: Public (0x00)
-        Address: 2C:41:A1:25:AC:73 (Bose Corporation)
-        Data length: 15
+        Address type: Random (0x01)
+        Address: 5C:D2:73:84:C0:D5 (Resolvable)
+        Data length: 14
         Flags: 0x1a
           LE General Discoverable Mode
           Simultaneous LE and BR/EDR (Controller)
           Simultaneous LE and BR/EDR (Host)
-        16-bit Service UUIDs (complete): 1 entry
-          Bose Corporation (0xfebe)
-        Company: SGL Italia S.r.l. (784)
-          Data: 40110130
-        RSSI: -72 dBm (0xb8)
-> HCI Event: LE Meta Event (0x3e) plen 43                 #171
+        Company: Apple, Inc. (76)
+          Type: Unknown (16)
+          Data: 0b1c982bdb
+        RSSI: -81 dBm (0xaf)
+> HCI Event: LE Meta Event (0x3e) plen 12                 #179
       LE Advertising Report (0x02)
         Num reports: 1
         Event type: Scan response - SCAN_RSP (0x04)
-        Address type: Public (0x00)
-        Address: 2C:41:A1:25:AC:73 (Bose Corporation)
-        Data length: 31
-        TX power: 10 dBm
-        Name (complete): LE-Domo Revolve+ SoundLink
-        RSSI: -72 dBm (0xb8)
-< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2    #172
+        Address type: Random (0x01)
+        Address: 5C:D2:73:84:C0:D5 (Resolvable)
+        Data length: 0
+        RSSI: -81 dBm (0xaf)
+< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2    #180
         Scanning: Disabled (0x00)
         Filter duplicates: Enabled (0x01)
-> HCI Event: Command Complete (0x0e) plen 4               #173
+> HCI Event: Command Complete (0x0e) plen 4               #181
       LE Set Scan Enable (0x08|0x000c) ncmd 1
         Status: Success (0x00)

pelwell commented 5 years ago

All conveyed. Hopefully Cypress will have enough information now.

pelwell commented 5 years ago

Cypress are interested in that Sony firmware you are using, and how much the specific customisations it contains are making a difference. There is a "generic" Sony firmware (albeit an older one) here - if you can try it then perhaps the results will give them a clue.

[ I'm surprised, given the initial speedy turnaround, that this problem is proving so difficult, but at least you have something that works for now. ]

ricardosalveti commented 5 years ago

Sorry for the delay, back from vacations.

The "generic" sony firmware works fine as well, similar to the one that I was using before. Both reports the same set of functionalities as well.

pelwell commented 5 years ago

Thanks for the response. Let's hope that gives Cypress a clue.

pelwell commented 5 years ago

After some back-and-forth we now have a release candidate which should be a Pi-tuned version of the first test firmware posted above. Hopefully we can then close this issue, but let me know how you get on.

ricardosalveti commented 5 years ago

After some back-and-forth we now have a release candidate which should be a Pi-tuned version of the first test firmware posted above. Hopefully we can then close this issue, but let me know how you get on.

Awesome, this one is also working fine on my setup, so +1!

Just curious, if something that can be shared, do you know what caused the issue?

pelwell commented 5 years ago

I don't know what caused the issue, and I'm not sure Cypress knows either, but I would guess that somewhere in the process of producing the last release one of the many required options was dropped. As for why this wasn't clear from the source - your guess is as good as mine.

pelwell commented 5 years ago

Cypress managed a quick turnaround and now we have the final firmware release - download it here. I'd be grateful if you could kick the tyres a bit.

Thank you for your patience and cooperation.

ricardosalveti commented 5 years ago

Cypress managed a quick turnaround and now we have the final firmware release - download it here. I'd be grateful if you could kick the tyres a bit.

Great, tested for a few hours and so far so good, let you know if I see any issue with it.

Thanks a lot as well for working with Cypress to solve this issue!

RPi-Distro / bluez-firmware

Unable to find zephyr-based LE devices with updated BCM4345C0.hcd #4