hciuart

rtt:~$ ASSERTION FAIL [0] @ WEST_TOPDIR/zephyr/subsys/bluetooth/controller/ll_sw/nordic/lll/lll_peripheral.c:342
rtt:~$   prepare_cb: Actual EVENT_OVERHEAD_START_US = 3784
rtt:~$ [00:03:07.452,392] <err> os: r0/a1:  0x00000003  r1/a2:  0x00000002  r2/a3:  0x00000001
rtt:~$ [00:03:07.452,392] <err> os: r3/a4:  0x00000003 r12/ip:  0x0000ffda r14/lr:  0x0000f29d
rtt:~$ [00:03:07.452,423] <err> os:  xpsr:  0x01000028
rtt:~$ [00:03:07.452,423] <err> os: Faulting instruction address (r15/pc): 0x0000f2ac
rtt:~$ [00:03:07.452,453] <err> os: >>> ZEPHYR FATAL ERROR 3: Kernel oops on CPU 0
rtt:~$ [00:03:07.452,453] <err> os: Fault during interrupt handling

rtt:~$ [00:03:07.452,484] <err> os: Current thread: 0x20003b68 (idle)
rtt:~$ [00:03:07.921,173] <err> os: Halting system
rtt:~$ 
rtt:~$ *** Booting Zephyr OS build v4.1.0 ***
rtt:~$ [00:00:00.002,166] <inf> bt_hci_raw: Bluetooth enabled in RAW mode

zephyr/subsys/bluetooth/controller/ll_sw/nordic/lll/lll_peripheral.c

#define EVENT_OVERHEAD_PREEMPT_US     0    /* if <= min, then dynamic preempt */
#define EVENT_OVERHEAD_PREEMPT_MIN_US 0
 
#if defined(CONFIG_BT_CTLR_XTAL_ADVANCED) && (EVENT_OVERHEAD_PREEMPT_US <= EVENT_OVERHEAD_PREEMPT_MIN_US)
	uint32_t overhead;
 
	overhead = lll_preempt_calc(ull, (TICKER_ID_CONN_BASE + lll->handle), ticks_at_event);
	/* check if preempt to start has changed */
	if (overhead) {
		LL_ASSERT_OVERHEAD(overhead);
 
		radio_isr_set(lll_isr_abort, lll);
		radio_disable();
 
		return -ECANCELED;
	}
#endif /* CONFIG_BT_CTLR_XTAL_ADVANCED */

zephyr/subsys/bluetooth/controller/hal/debug.h

#if defined(CONFIG_BT_CTLR_ASSERT_OVERHEAD_START)
#define LL_ASSERT_OVERHEAD(overhead) \
	LL_ASSERT_MSG(false, "%s: Actual EVENT_OVERHEAD_START_US = %u", \
		      __func__, HAL_TICKER_TICKS_TO_US(overhead));
#else /* !CONFIG_BT_CTLR_ASSERT_OVERHEAD_START */
#define LL_ASSERT_OVERHEAD(overhead) ARG_UNUSED(overhead)
#endif /* !CONFIG_BT_CTLR_ASSERT_OVERHEAD_START */

zephyr/subsys/bluetooth/controller/Kconfig.ll_sw_split

config BT_CTLR_ASSERT_OVERHEAD_START
	bool "Assert on Prepare Latency"
	default y
	help
	  Assert on increased Radio Event Prepare callback latencies due to
	  CPU usage overheads in the Controller implementation.
 
	  Disabling this option permits the Controller to gracefully skip radio
	  events that are delayed due to CPU usage latencies; as long as the
	  radio event skips are not for every consecutive radio event interval,
	  otherwise leading to remote supervision timeout and possible missing
	  local disconnect events.

Similar reports:

• https://github.com/zephyrproject-rtos/zephyr/issues/67868
• https://github.com/zephyrproject-rtos/zephyr/pull/67725
• https://github.com/zephyrproject-rtos/zephyr/issues/52887
• https://devzone.nordicsemi.com/f/nordic-q-a/108989/nrf52-on-custom-board-can-receive-ble-packets-but-not-send

Workaround / fixes:

• reduce CPU usage:
  • disable packet hexdump to RTT
  • disable BT debug logs
• lower all NRF peripherial IRQ prio to 5 (override.dtsi)
• set radio IRQ priority to 0 (dts)

hci0: Too short H5 packet 
hci0: Out-of-order packet arrived

Default config from samples:

• CONFIG_BT=y
• CONFIG_BT_HCI_RAW=y This option allows to access Bluetooth controller from the application with the RAW HCI protocol.
• CONFIG_BT_HCI_RAW_H4=y This option enables HCI RAW access to work over an H:4 transport, note that it still need to be selected at runtime.
• CONFIG_BT_HCI_RAW_H4_ENABLE=y This option enables use of H:4 transport for HCI RAW access at build time.
• CONFIG_BT_BUF_ACL_RX_SIZE=255 Maximum support ACL size of data packets sent from the Controller to the Host. This value does not include the HCI ACL header.
• CONFIG_BT_BUF_CMD_TX_SIZE=255 Maximum data size for each HCI Command buffer. This value does not include the HCI Command header
• CONFIG_BT_BUF_EVT_DISCARDABLE_SIZE=255 Maximum support discardable HCI event size of buffers in the separate discardable event buffer pool.
  • This value does not include the HCI Event header. The minimum size is set based on the Advertising Report. Setting the buffer size different than BT_BUF_EVT_RX_SIZE can save memory.
• CONFIG_BT_MAX_CONN=16 - it consumes a lot of RAM
• CONFIG_BT_CTLR_DTM_HCI=y Enable support for Direct Test Mode in the Controller.

Additional auto defaults:

• CONFIG_BT_LL_SW_SPLIT=y Use Zephyr software Bluetooth LE Link Layer ULL LLL split implementation.
• CONFIG_BT_LLL_VENDOR_NORDIC=y Use Nordic Lower Link Layer implementation.
• CONFIG_BT_HCI_ACL_FLOW_CONTROL=y Enable support for throttling ACL buffers from the controller to the host.
  • This is particularly useful when the host and controller are on separate cores since it ensures that we do not run out of incoming ACL buffers.
• CONFIG_BT_BUF_ACL_TX_COUNT=7 Number of outgoing ACL data buffers
  • Number of outgoing ACL data buffers sent from the Host to the Controller. This determines the maximum amount of data packets the Host can have queued in the Controller before waiting for the to notify the Host that more packets can be queued with the Number of Completed Packets event. The buffers are shared between all of the connections and the Host determines how to divide the buffers between the connections. The Controller will return this value in the HCI LE Read Buffer Size command response.
• CONFIG_BT_BUF_ACL_TX_SIZE=27 Maximum supported ACL size for outgoing data
  • Maximum supported ACL size of data packets sent from the Host to the Controller. This value does not include the HCI ACL header.

In a combined build this value will be set in both the Host and the Controller.

In a Host-only build the Host will read the maximum ACL size supported by the Controller and use the smallest value supported by both the
Host and the Controller.

The Host supports sending of larger L2CAP PDUs than the ACL size and will fragment L2CAP PDUs into ACL data packets.
The Controller will return this value in the HCI LE Read Buffer Size command response. If this size if greater than effective Link
Layer transmission size then the Controller will perform fragmentation before transmitting the packet(s) on air.
If this value is less than the effective Link Layer transmission size then this will restrict the maximum Link Layer transmission size.

• CONFIG_BT_BUF_ACL_RX_COUNT_EXTRA=16
• CONFIG_BT_BUF_ACL_RX_COUNT=0
• CONFIG_BT_BUF_EVT_RX_SIZE=68
• CONFIG_BT_BUF_EVT_RX_COUNT=10
• CONFIG_BT_HCI_VS=y
• CONFIG_BT_CTLR_DUP_FILTER_LEN=16
• CONFIG_BT_CTLR_RX_BUFFERS=6 Set the number of Rx PDUs to be buffered in the controller. In a 7.5ms connection interval and 2M PHY, maximum 18 packets with L2CAP payload size of 1 byte can be received.

CONFIG_BT_HCI_TX_PRIO=7 # CONFIG_BT_RECV_WORKQ_SYS is not set CONFIG_BT_RECV_WORKQ_BT=y CONFIG_BT_RX_STACK_SIZE=768 CONFIG_BT_RX_PRIO=8 # Hidden option for Co-Operative Rx thread priority CONFIG_BT_DRIVER_RX_HIGH_PRIO=6 # Hidden option for Co-Operative HCI driver RX thread priority

CONFIG_BT_CTLR_DTM_HCI_SUPPORT=y CONFIG_BT_CTLR_DTM=y CONFIG_BT_CTLR_DTM_HCI=y CONFIG_BT_CTLR_DTM_HCI_RX_V3=y CONFIG_BT_CTLR_DTM_HCI_TX_V3=y CONFIG_BT_CTLR_DTM_HCI_TX_V4=y

# # Serial Drivers # CONFIG_UART_NRFX=y CONFIG_UART_NRFX_UART=y CONFIG_UART_0_INTERRUPT_DRIVEN=y # CONFIG_UART_0_NRF_PARITY_BIT is not set CONFIG_UART_0_TX_CACHE_SIZE=8 CONFIG_UART_0_RX_CACHE_SIZE=5 CONFIG_UART_0_A2I_RX_SIZE=64 CONFIG_UART_0_A2I_RX_BUF_COUNT=8

Related options:

• CONFIG_BT_HCI_ACL_FLOW_CONTROL Controller to Host ACL flow control support.
  • Enable support for throttling ACL buffers from the controller to the host. This is particularly useful when the host and controller are on separate cores since it ensures that we do not run out of incoming ACL buffers.

# Enable if building a Host-only build
default y if !HAS_BT_CTLR && !BT_STM32_IPM && !BT_ESP32  && !BT_STM32WBA
# Enable if building a Controller-only build
default y if BT_HCI_RAW
select POLL

# Bluetooth optimizations to allow larger data packets. CONFIG_BT_RX_STACK_SIZE=2048 CONFIG_BT_L2CAP_TX_MTU=512 CONFIG_BT_BUF_ACL_RX_SIZE=502 CONFIG_BT_BUF_ACL_TX_SIZE=502 CONFIG_BT_CTLR_DATA_LENGTH_MAX=251