[STM32WB5MMG] Client role fails to connect to any server

[BBute.1]

Hello,
I am using a STM32WB5MMG on a custom board for a BLE application. I started the project with the Client profile. The application is able to scan and receive advertisement frames. I use a MAC filter to select on peripheral and try to connect to it. As soon as I try to connect to the server with the function aci_gap_create_connection, the program enters an infinite loop inside hci_cmd_resp_wait. The response of this particular HCI command is never received.
I don't think it is related to bad parameter value such connection interval because I already faced this issue and in this case the function aci_gap_create_connection was returning an accurate error code.

RTC is on LSE, wakeup is activated, IPCC interrupts are enabled, RFWKP is on LSE.
As suggested in another post, I monitore the SR flash register and SRAM2A first register to see if CPU2 entered Hardfault but it does not seem to.

I changed a bit hci_cmd_resp_wait and hci_cmd_resp_release to provide a timeout in case no reply is ever get from CPU2:

void hci_cmd_resp_release(uint32_t flag)
{
  HW_TS_Stop(timeout_ts_ID);
  UTIL_SEQ_SetEvt(1 << CFG_IDLEEVT_HCI_CMD_EVT_RSP_ID);
  return;
}

void hci_cmd_resp_wait(uint32_t timeout)
{
  HW_TS_Start(timeout_ts_ID, MS_TO_TICKS(timeout));
  UTIL_SEQ_WaitEvt(1 << CFG_IDLEEVT_HCI_CMD_EVT_RSP_ID);
  return;
}
static void TimeoutHCI(void)
{
	LOG_WARNING("Timeout");
	/* Affichage de l'état du coeur 2 voir AN5289 rev 18 p 40 s*/
	uint32_t* ptr = SRAM2A_BASE;
	LOG_DEBUG("FLASH_SR  CPU2 Keyword   CPU2 Link Register CPU2 stack pointer");
	LOG_DEBUG("0x%08lX  0x%08lX  0x%08lX  0x%08lX  0x%08lX",FLASH->SR,*ptr, ptr[1],ptr[2],ptr[3]);
	hci_cmd_resp_release(0);
}

 Below is a light trace ouput to show the problem:

Spoiler

[app_entry.c][APPE_SysUserEvtRx][363] Wireless Firmware version 1.20.0

[app_entry.c][APPE_SysUserEvtRx][364] Wireless Firmware build 2

[app_entry.c][APPE_SysUserEvtRx][365] FUS version 1.2.0

[app_entry.c][APPE_SysUserEvtRx][367] >>== SHCI_SUB_EVT_CODE_READY

[app_entry.c][APPE_SysEvtReadyProcessing][453] >>== WIRELESS_FW_RUNNING

[app_entry.c][APPE_SysEvtReadyProcessing][477] >>== DBGMCU_GetRevisionID= 2003

[app_entry.c][APPE_SysEvtReadyProcessing][482] >>== DBGMCU_GetDeviceID= 495

[app_ble.c][APP_BLE_Init][319] Success: SHCI_C2_BLE_Init command

[app_ble.c][Ble_Hci_Gap_Gatt_Init][751] ==>> Start Ble_Hci_Gap_Gatt_Init function

[app_ble.c][Ble_Hci_Gap_Gatt_Init][764] Success: hci_reset command

[app_ble.c][Ble_Hci_Gap_Gatt_Init][778] Success: aci_hal_write_config_data command - CONFIG_DATA_PUBADDR_OFFSET

[app_ble.c][Ble_Hci_Gap_Gatt_Init][779] Public Bluetooth Address: 00:80:e1:27:9c:7c

[app_ble.c][Ble_Hci_Gap_Gatt_Init][792] Success: aci_hal_write_config_data command - CONFIG_DATA_IR_OFFSET

[app_ble.c][Ble_Hci_Gap_Gatt_Init][805] Success: aci_hal_write_config_data command - CONFIG_DATA_ER_OFFSET

[app_ble.c][Ble_Hci_Gap_Gatt_Init][818] Success: aci_hal_set_tx_power_level command

[app_ble.c][Ble_Hci_Gap_Gatt_Init][831] Success: aci_gatt_init command

[app_ble.c][Ble_Hci_Gap_Gatt_Init][867] Success: aci_gap_init command

[app_ble.c][Ble_Hci_Gap_Gatt_Init][906] Success: aci_gap_set_io_capability command

[app_ble.c][Ble_Hci_Gap_Gatt_Init][934] Success: aci_gap_set_authentication_requirement command

[app_ble.c][Ble_Hci_Gap_Gatt_Init][949] Success: aci_gap_configure_whitelist command

[app_ble.c][Ble_Hci_Gap_Gatt_Init][952] ==>> End Ble_Hci_Gap_Gatt_Init function

[app_ble.c][APP_BLE_Init][352] Success: aci_hal_set_radio_activity_mask command

[app_ble.c][APP_BLE_Init][354]

[p2p_client_app.c][P2PC_APP_Init][169] -- P2P CLIENT INITIALIZED

[app_ble.c][Scan_Request][972]
** START GENERAL DISCOVERY (SCAN) **

[...]

[DBG] main:164 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] main:165 >0x00080000 0x20030028 0x20030048 0x20030058 0x20030078]-- GAP GENERAL DISCOVERY PROCEDURE_COMPLETED

** CREATE CONNECTION TO SERVER **

[WARNING] TimeoutHCI:1092 >Timeout]
[DBG] TimeoutHCI:1095 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] TimeoutHCI:1096 >0x00080000 0x20030028 0x20030048 0x20030058 0x20030078]
[WARNING] TimeoutHCI:1092 >Timeout]
[DBG] TimeoutHCI:1095 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] TimeoutHCI:1096 >0x00080000 0x20030028 0x20030048 0x20030058 0x20030078]
[WARNING] TimeoutHCI:1092 >Timeout]
[DBG] TimeoutHCI:1095 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] TimeoutHCI:1096 >0x00080000 0x20030028 0x20030048 0x20030058 0x20030078]
[WARNING] TimeoutHCI:1092 >Timeout]
[DBG] TimeoutHCI:1095 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] TimeoutHCI:1096 >0x00080000 0x20030028 0x20030048 0x20030058 0x20030078]
[WARNING] TimeoutHCI:1092 >Timeout]
[DBG] TimeoutHCI:1095 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] TimeoutHCI:1096 >0x00080000 0x20030028 0x20030048 0x20030058 0x20030078]
[WARNING] TimeoutHCI:1092 >Timeout]
[DBG] TimeoutHCI:1095 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] TimeoutHCI:1096 >0x00080000 0x20030028 0x20030048 0x20030058 0x20030078]

And then below is the full trace with the following debug parameters:

#define TL_HCI_CMD_DBG_EN 1 /* Reports BLE command sent to CPU2 and the command response */

#define TL_HCI_CMD_DBG_RAW_EN 0 /* Reports raw data BLE command sent to CPU2 and the command response */

#define TL_HCI_EVT_DBG_EN 1 /* Reports BLE Asynchronous Events received from CPU2 */

#define TL_HCI_EVT_DBG_RAW_EN 0 /* Reports raw data BLE Asynchronous Events received from CPU2 */


#define TL_MM_DBG_EN 1 /* Reports the information of the buffer released to CPU2 */

Spoiler

[DBG] SVCCTL_App_Notification:634 >Rx adv from 8C:A6:82:E0:00:10]
[tl_mbox.c][OutputDbgTrace][700] mm evt released: 0x3E
[tl_mbox.c][OutputDbgTrace][701] buffer addr: 0x20030238
[tl_mbox.c][OutputDbgTrace][705]

[tl_mbox.c][OutputDbgTrace][758] ble evt: 0x3E
[tl_mbox.c][OutputDbgTrace][761] payload: 02 01 04 01 C8 1D E7 CB 9A 35 00 9F
[tl_mbox.c][OutputDbgTrace][776]

[tl_mbox.c][OutputDbgTrace][700] mm evt released: 0x3E
[tl_mbox.c][OutputDbgTrace][701] buffer addr: 0x20030200
[tl_mbox.c][OutputDbgTrace][705]

[tl_mbox.c][OutputDbgTrace][767] ble evt: 0xFF
[tl_mbox.c][OutputDbgTrace][768] subevtcode: 0x0407
[tl_mbox.c][OutputDbgTrace][771] payload: 02 00 00
[tl_mbox.c][OutputDbgTrace][776]

[app_ble.c][SVCCTL_App_Notification][430] -- GAP GENERAL DISCOVERY PROCEDURE_COMPLETED

[tl_mbox.c][OutputDbgTrace][694] mm evt released: 0xFF
[tl_mbox.c][OutputDbgTrace][695] subevtcode: 0x0407
[tl_mbox.c][OutputDbgTrace][696] buffer addr: 0x20030200
[tl_mbox.c][OutputDbgTrace][705]

[app_ble.c][Connect_Request][995]
** CREATE CONNECTION TO SERVER **

[DBG] Connect_Request:1001 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] Connect_Request:1002 >0x00000000 0x20030028 0x20030048 0x20030058 0x20030078]
[tl_mbox.c][OutputDbgTrace][710] ble cmd: 0xFC9C
[tl_mbox.c][OutputDbgTrace][713] payload: 20 03 20 03 00 10 00 E0 82 A6 8C 00 28 00 50 00 00 00 F4 01 10 00 10 00
[tl_mbox.c][OutputDbgTrace][716]

[WARNING] TimeoutHCI:1096 >Timeout]
[DBG] TimeoutHCI:1099 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] TimeoutHCI:1100 >0x00080000 0x20030028 0x20030048 0x20030058 0x20030078]
[WARNING] TimeoutHCI:1096 >Timeout]
[DBG] TimeoutHCI:1099 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] TimeoutHCI:1100 >0x00080000 0x20030028 0x20030048 0x20030058 0x20030078]
[WARNING] TimeoutHCI:1096 >Timeout]
[DBG] TimeoutHCI:1099 >FLASH_SR CPU2 Keyword CPU2 Link Register CPU2 stack pointer]
[DBG] TimeoutHCI:1100 >0x00080000 0x20030028 0x20030048 0x20030058 0x20030078]

Any help on this subject would be greatly appreciated.