BT HCI Core fault disappears when I set log level to debug.

RE: BT HCI Core fault disappears when I set log level to debug.

Priyanka — Mon, 01 Sep 2025 09:53:58 GMT

Hi Ethan,

Would you be able to provide a bit more details:

UART Baud rate in use?
Is CTS/RTS lines in use (hardware flow control)?
Both Host stack firmware and the Controller (hci_uart) firmware use CONFIG_BT_HCI_ACL_FLOW_CONTROL=y ?
What are the values of (both in Host firmware and Controller firmware):
1. CONFIG_BT_BUF_CMD_TX_COUNT
2. CONFIG_BT_BUF_EVT_RX_COUNT
3. CONFIG_BT_BUF_ACL_TX_COUNT
4. CONFIG_BT_BUF_ACL_RX_COUNT
5. CONFIG_BT_BUF_ACL_RX_COUNT_EXTRA

RE: BT HCI Core fault disappears when I set log level to debug.

Ethan Barry — Mon, 14 Jul 2025 14:19:20 GMT

Hello Priyanka,

I *am* using the HCI UART sample, actually. That's what's programmed to the netcore's flash. I'm also building under NCS 2.9.1, not 3.0. Here's the config for that HCI UART application. Do you think increasing the size of some buffer would fix this? Thanks!

CONFIG_CONSOLE=n
CONFIG_STDOUT_CONSOLE=n
CONFIG_UART_CONSOLE=n
CONFIG_GPIO=y
CONFIG_LOG=y
CONFIG_RTT_CONSOLE=y
CONFIG_USE_SEGGER_RTT=y
CONFIG_LOG_BACKEND_RTT=y
CONFIG_SERIAL=y
CONFIG_UART_INTERRUPT_DRIVEN=y
CONFIG_BT=y
CONFIG_BT_HCI_RAW=y
CONFIG_BT_HCI_RAW_H4=y
CONFIG_BT_HCI_RAW_H4_ENABLE=y
CONFIG_BT_BUF_ACL_RX_SIZE=255
CONFIG_BT_BUF_CMD_TX_SIZE=255
CONFIG_BT_BUF_EVT_DISCARDABLE_SIZE=255
CONFIG_BT_CTLR_ASSERT_HANDLER=y
CONFIG_BT_MAX_CONN=16
CONFIG_BT_TINYCRYPT_ECC=n
CONFIG_BT_CTLR_DTM_HCI=y

CONFIG_BT_BUF_ACL_TX_SIZE=255
CONFIG_BT_EXT_ADV=y
CONFIG_BT_PER_ADV=y
CONFIG_BT_PER_ADV_SYNC_TRANSFER_SENDER=y
CONFIG_BT_PER_ADV_RSP=y

CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=512

# Workaround: Unable to allocate command buffer when using K_NO_WAIT since
# Host number of completed commands does not follow normal flow control.
CONFIG_BT_BUF_CMD_TX_COUNT=10

RE: BT HCI Core fault disappears when I set log level to debug.

Priyanka — Mon, 23 Jun 2025 06:21:36 GMT

Hi Ethan,

Apologies for the delay as it took some time to spot the issue.

Starting with NCS 3.0.0 this sample is deprecated.

Could the same be seen with the normal HCI UART sample? https://docs.nordicsemi.com/bundle/ncs-latest/page/zephyr/samples/bluetooth/hci_uart/README.html
(or HCI UART acyns https://docs.nordicsemi.com/bundle/ncs-latest/page/zephyr/samples/bluetooth/hci_uart_async/README.html)

-Priyanka

RE: BT HCI Core fault disappears when I set log level to debug.

Ethan Barry — Tue, 03 Jun 2025 12:00:05 GMT

Thank you, Priyanka!

RE: BT HCI Core fault disappears when I set log level to debug.

Priyanka — Tue, 03 Jun 2025 06:55:33 GMT

Hi Ethan,

I am checking this internally to see if this is a known issue and will get back to you.

-Priyanka

RE: BT HCI Core fault disappears when I set log level to debug.

Ethan Barry — Mon, 02 Jun 2025 14:05:14 GMT

I was able to make it crash with debug logging enabled by connecting and disconnecting a few times in a row. Again, the number of times I can disconnect and reconnect (with or without debug logging) before getting an assertion fail and kernel panic varies. Sometimes it is just one time; sometimes it's five or more. Here are the relevant lines of the crash with debugging enabled.

Let me know if I can test anything for you, or provide any more information.

00> [00:00:31.059,143] <dbg> bt_hci_core: bt_recv_unsafe: buf 0x2001e974 len 6[0m
00> [00:00:31.059,173] <dbg> bt_hci_core: hci_disconn_complete_prio: status 0x00  handle 15 reason 0x08
00> [00:00:31.059,204] <dbg> bt_hci_core: bt_tx_irq_raise: kick TX
00> [00:00:31.059,265] <dbg> bt_hci_core: rx_work_handler: Getting net_buf from queue
00> [00:00:31.059,265] <dbg> bt_hci_core: rx_work_handler: buf 0x2001e974 type 1 len 6
00> [00:00:31.059,295] <dbg> bt_hci_core: hci_event: event 0x05
00> [00:00:31.059,326] <dbg> bt_hci_core: hci_disconn_complete: status 0x00  handle 15 reason 0x08
00> [00:00:31.059,387] <dbg> bt_hci_core: tx_processor: TX process start
00> [00:00:31.059,539] <err> tracing: Disconnected, reason 0x08 
00> 
00> [00:00:31.059,570] <dbg> bt_adv: bt_le_adv_resume: No valid legacy adv
00> [00:00:31.059,631] <dbg> bt_hci_core: bt_hci_cmd_create: opcode 0x2039 param_len 6
00> [00:00:31.059,661] <dbg> bt_hci_core: bt_hci_cmd_create: buf 0x2001f560
00> [00:00:31.059,692] <dbg> bt_hci_core: bt_hci_cmd_send_sync: buf 0x2001f560 opcode 0x2039 len 9
00> [00:00:31.059,692] <dbg> bt_hci_core: bt_tx_irq_raise: kick TX
00> [00:00:31.059,722] <dbg> bt_hci_core: bt_hci_cmd_send_sync: process cmd 0x2001f560 want 0x2001f560
00> [00:00:31.059,753] <dbg> bt_hci_core: hci_core_send_cmd: fetch cmd
00> [00:00:31.059,753] <dbg> bt_hci_core: hci_core_send_cmd: Sending command 0x2039 (buf 0x2001f560) to driver
00> [00:00:31.059,783] <dbg> bt_hci_core: bt_send: buf 0x2001f560 len 9 type 0
00> ASSERTION FAIL [err == 0] @ WEST_TOPDIR/zephyr/subsys/bluetooth/host/hci_core.c:430
00>   Controller unresponsive, command opcode 0x2039 timeout with err -11
00> [00:00:51.059,936] <err> os: r0/a1:  0x00000003  r1/a2:  0x00000000  r2/a3:  0x00000019
00> [00:00:51.059,967] <err> os: r3/a4:  0x00000003 r12/ip:  0x00000010 r14/lr:  0x0000f82b[0m
00> [00:00:51.059,967] <err> os:  xpsr:  0x21000000
00> [00:00:51.059,997] <err> os: s[ 0]:  0x2001dd98  s[ 1]:  0x2001dd98  s[ 2]:  0x00000000  s[ 3]:  0x00000001
00> [00:00:51.059,997] <err> os: s[ 4]:  0x2001dda8  s[ 5]:  0x2001dda8  s[ 6]:  0x2000f4b0  s[ 7]:  0x2001de34
00> [00:00:51.060,028] <err> os: s[ 8]:  0x2001f56c  s[ 9]:  0x2001f560  s[10]:  0x00000001  s[11]:  0x2000f4a0
00> [00:00:51.060,028] <err> os: s[12]:  0xffffffff  s[13]:  0x00000000  s[14]:  0x00000000  s[15]:  0x0002a391
00> [00:00:51.060,058] <err> os: fpscr:  0x00000001
00> [00:00:51.060,058] <err> os: Faulting instruction address (r15/pc): 0x0000f83a
00> [00:00:51.060,089] <err> os: >>> ZEPHYR FATAL ERROR 3: Kernel oops on CPU 0
00> [00:00:51.060,119] <err> os: Current thread: 0x20010638 (sysworkq)
00> [00:00:54.587,921] <err> os: Halting system

RE: BT HCI Core fault disappears when I set log level to debug.

Priyanka — Mon, 02 Jun 2025 11:27:08 GMT

Hi Ethan,

Thank you for your input. I have conveyed this to the team and will get back to you with updates.

Regards,

Priyanka