BLE: Sending any ATB command other than ATBp or ATBc causes Hard Fault in module

[hmmkay]

BACKGROUND

I'm wanting to make use of the bluetooth capabilities in a Wio Terminal that includes a RTL8720DN Wifi/Bluetooth module.

I compiled and loaded the firmware from this repo onto the RTL8720DN without problem, and am running the example script from tools/rtl8720dm_usi_spi/rtl8720dm_usi_spi.ino on the main processor of the Wio Terminal, with a small modification to enable the debug messages from the RTL module coming in on the Logging serial port to be displayed - ie: Enable the Log UART with the following line at the end of the init() function: RTL8720D.begin(115200); ... and the following code in the body to print to the user terminal any debug information coming in over the Log UART from the WiFi module:

while (RTL8720D.available()) {
    Serial.print(char(RTL8720D.read()));
  }

Below is my terminal output from the .ino application running on the main Wio Terminal CPU showing the module starts okay ...:

Begin SPI:

Connecting Ready! Enter some AT commands No ACK, R00 AT_READ ERR -1 calibration_ok:[2:19:11]

interface 0 is initialized

interface 1 is initialized

Initializing WIFI ...

WIFI initialized

init_thread(60), Available heap 0x25460

ready

Enter auto receive mode

[0D[0A ready[0D[0A

The Wifi module is running the newly compiled firmware 2.2.0.2 to allow managing BLE via AT commands: AT+GMR output:

Trans 7B AT version:2.2.0.2(0 - Jul 15 2020 23:06:21)[0D[0A SDK version:v6.2c[0D[0A compile time (0):2020/07/15-23:04:41[0D[0A Bin version:1.0.0(RTL8720DM)[0D[0A OK[0D[0A

Starting the Bluetoothstack with ATBp=1 works fine ATBp=1 output:

Trans 7B

BT BUILD Date: 2020/07/15-23:04:41

BT ADDRESS: 2c:f7:f1:1b:48:ed

WRITE physical FLATK=tx_flatk=1000

BT Reset...

physical efuse: has data hci_tp_phy_efuse[1]= 9e

hci_tp_phy_efuse[0]=0,

bt_iqk_dump: DUMP,

the IQK_xx data is 0xf6,

the IQK_yy data is 0x1,

the QDAC data is 0x1c,

the IDAC data is 0x1f,

hci_tp_config:BT INIT success 7

Start upperStack

[BLE peripheral] GAP stack ready

GAP adv start

At this point I can see the device from an app on my phone, I can pair with the device, and I can read attributes, so looking good!

=== THE PROBLEM === Once the bluetooth stack is running with ATBp=1 (and also ATBc=1), if I then try any other ATB-prefixed command such as ATBS=1,0 to start a bluetooth scan, or ATBC=P,XXXXXXXXXXXX to connect to another device, or ATBI to get information about connected devices, etc the module crashes with a Hard Fault Patch error and endlessly displays AT_READ ERR per the example below.

These crashes mean I am completely unable to do anything with BLE, rendering it useless - ie: I regard the bug as severe. I've tried different initialization sequences in case there's something else I'm supposed to configure on the module to have it work without any luck so far, but am open to this being a user error on my side, in which case I'd appreciate a quick example on how to use the AT commands to pair with another device and read/write Characteristics!

ATBS=1,0 output

Hard Fault Patch (Non-secure)

Usage Fault:

Secure State: 0

Stacked:

R0 = 0x1002444c

R1 = 0x10059cf8

R2 = 0x10059d40

R3 = 0x10059d40

R12 = 0x10059d70

LR = 0x0e00b495

PC = 0x0e012eca

PSR = 0x61000000

CurrenAT_READ ERR -1190 AT_READ ERR -1190 AT_READ ERR -1190 AT_READ ERR -1190 AT_READ ERR -1190 AT_READ ERR -1190 AT_READ ERR -1190

Thanks for providing the library, and I look forward to being able to use it soon! In the meanwhile I'll squint at the datasheets and see if I can't work out from the register/stack dump what is causing the error ...

[hmmkay]

Using the PC and LR register variables to track down in which function the crash occurs and what the calling function were respectively; and using the target_img2.asm disassembly file I was able to track the problem down to when the ble_peripheral_app_handle_at_cmd method calls parse_param. Interestingly from what I can determine the crash happens right at the beginning of parse_param method when the stack pointer gets decremented by 1600 (for the incoming parameters I think). This 1600 value comes from the LOG_SERVICE_BUFLEN constant, which in the platform_opts.h file has a comment saying this constant can't be larger than UART_LOG_CMD_BUFLEN (which is set to 127). So setting LOG_SERVICE_BUFLEN to 100 resolved the crashing problem for me, but I'm not 100% sure why!

I'll create a pull request for my request for this plus one or two other tiny changes.

Now to figure out how to get/set attribute characteristics using AT commands with the module in peripheral mode, since those functions don't seem to be implemented yet!

[shmrymbd]

good job @hmmkay cant wait the implemnetation.