adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

Hung Bui — Mon, 02 Mar 2026 20:31:09 GMT

Hi Sam,
I haven't looked deep into the function but you can find the documentation in nrfx_spim.h file in \modules\nrfx\drivers\include in our SDK. The source code is in src\nrfx_spim.c .

My understanding is that the function will do both reading and writing at the same time as SPI can do full duplex.

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Fri, 27 Feb 2026 15:53:28 GMT

ok, I am now at the spot where I think I have to implement this.. the buffer and link time placement is easy..

usage is not so much

they are using

#if NRFX_SPIM_ENABLED
		nrf_spim_enable(spi->type.spim.p_reg);

		const nrfx_spim_xfer_desc_t xfer_desc = { xfer->tx_buf, xfer->tx_size, xfer->rx_buf,
							  xfer->rx_size };
		result = nrfx_spim_xfer(&spi->type.spim, &xfer_desc, xfer->flags);
#else

I don't find any doc on this.(nrfx_spim_xfer) . my assumption is this could be write then read, (depending on flags)
so I set the spim_buffer I created as write from, and copy the write data there, set the read buffer same place, and copy the read data from there to the address specified by caller

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Fri, 13 Feb 2026 14:31:10 GMT

no answer from Qorvo.. ill add the manual workaround..

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Wed, 14 Jan 2026 23:55:35 GMT

I have asked Qorvo if they NEED spim3..

waiting

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

Hung Bui — Tue, 13 Jan 2026 09:17:39 GMT

Hi Sam,
The sample I provided is the workaround for the issue that the default workaround for Anomaly 198 will cause a crash when using with softdevice. You need to define a dedicated RAM block for SPIM3 that doesn't overlap the RAM reserved by the softdevice.

Can you try to implement the memory configuration similar to what showed in the example ?

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Mon, 12 Jan 2026 15:07:18 GMT

not my firmware, so I don't know..

they have another package on this card that uses the same build model and mostly source, but with SoftDevice and the setting is off.

#define NRFX_SPIM3_NRF52840_ANOMALY_198_WORKAROUND_ENABLED 0

the spim_buffer (from your link map) is not defined in either build, on the same 52840.

so I don't know if that is a bug in their code or ...

and its the old SDK 17

oh, they use SD 113 (perf only), I use 140 (as I need central too)

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

Hung Bui — Mon, 12 Jan 2026 11:58:17 GMT

Hi Sam,

You mentioned earlier "if I comment out the 198 anomaly test it hardfaults in the nrfx_spim, irq_handler,"
Could you explain what has been changed ?
My understanding now is that you have it working both BLE and SPIM3 ?

Is there any option to use other SPIM instead of SPIM3 ? So that we can avoid errata 198. Please find this note in the SDK's release note (Known issue):
- The workaround for Anomaly 198 for nRF52840 SPIM3 peripheral
that has been implemented in nrfx_spim cannot be used with a SoftDevice.
Flag NRFX_SPIM3_NRF52840_ANOMALY_198_WORKAROUND_ENABLED must be set to zero.
The workaround based on a dedicated RAM block for SPIM3 must be used instead.

If SPIM3 is a must, then you will have to use the solution to use dedicated RAM block for SPIM3.

One my coworkers have made an example a few years back. I attached the project (SDK v17.1.0) and the instruction here:
=========
devzone.nordicsemi.com/.../ble_5F00_app_5F00_beacon_5F00_spim.zip

Look at the flash placement file:

To see how this reserves one RAM block for the SPI, and then in main.c how it allocates the spim buffer to be within this block.

Then you should use this buffer for your SPI when you initialize it. The softdevice will not touch the allocated ram block.

Give it a go, and let me know how it works in your application. Please note that you can see where this RAM block ends up (this is dynamic). If the application grows too big, then it will go into ram block 8, and things may start to get messy with the callstack and so on. You should see this after compiling:

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Fri, 09 Jan 2026 16:49:28 GMT

I went thru all the code, found one place setting power state, only used for SPI, not SPIM, also not loaded in binary

I put a stop of the code that fails,

using the table link above

R0 = 0x4002F000

which says SPIM3

if I run from there, another stop at the same place, like the interrupt is not cleared.

if I disable the stop, I get a hard fault.

so, added more debug info.. i save the spim object address and as the interrupts are redirected to a common interrupt handler I save the spim number all prior to the code causing the fault.

the number is 3 (spim3)

and the saved spim pointer is the same as above , in LSB format 00 F0 02 40

anyhow.. still confused.. and in the latest fault it was saving the spim pointer address that faulted..

interesting.. directly before the fault location is this in nrfx_spim.c

```

#if NRFX_CHECK(NRFX_SPIM3_NRF52840_ANOMALY_198_WORKAROUND_ENABLED)

if (p_spim == NRF_SPIM3)

{

anomaly_198_disable();

}

#endif

```

I commented it out.. and now no fault.. I can run my BLE operations..

devzone.nordicsemi.com/.../enabling-workaround-for-anomaly-198-crashes-softdevice

I have changed the define in sdk_config.h to 0 instead of 1

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

Hung Bui — Thu, 08 Jan 2026 12:40:09 GMT

Hi Sam,
I'm looking at this

app_error_fault_handler id=1001, pc=75B0C, info =1

Error ID=1001 means NRF_FAULT_ID_APP_MEMACC. Here is the description for this error:

Application invalid memory access. The info parameter will contain 0x00000000,
in case of SoftDevice RAM access violation. In case of SoftDevice peripheral
register violation the info parameter will contain the sub-region number of
PREGION[0], on whose address range the disallowed write access caused the
memory access fault.

The info = 1 so it match with bit number 0 in the table: https://docs.nordicsemi.com/bundle/ps_nrf52840/page/memory.html#topic

I suspect it either CLOCK control or POWER control. You can try to disable the protection of the subregion to see it's actually the cause of the fault :

NRF_MWU->PREGION[0].SUBS &= ~(MWU_PREGION_SUBS_SR0_Include << MWU_PREGION_SUBS_SR0_Pos);
__DSB(); // barrier to ensure register is set before accessing NVMC or ACL.

Both CLOCK and POWER is restricted access when the softdevice is active (see 7.1 in the softdevice SDS .pdf file) . You may want to check if you have SOFTDEVICE_PRESENT defined in your preprocessor definitions.

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Tue, 06 Jan 2026 23:22:47 GMT

this IS one of the functions I called out before as having code optimization problems however

this line of code generated a pointer of 2 for p_cb

spim_control_block_t * p_cb = &m_cb[p_instance->drv_inst_idx];

I have to change it like this

spim_control_block_t * p_cb = m_cb+p_instance->drv_inst_idx;

I reported this in Qorvo forums,

p_instance->drv_inst_idx = 2

rfx_err_t nrfx_spim_xfer(nrfx_spim_t const * const p_instance,
nrfx_spim_xfer_desc_t const * p_xfer_desc,
uint32_t flags)
{
spim_control_block_t * p_cb = &m_cb[p_instance->drv_inst_idx]; <---- this sets the p_cb pointer to 2!!

change to

spim_control_block_t * p_cb = m_cb+p_instance->drv_inst_idx;

https://forum.qorvo.com/t/dw3-qm33-sdk-bug-and-some-code-optimization-questions/24569

I have fixed all of those m_cb pointers in nrfx_spim.c, but same value in r3 at fault time
and its repeatable, across buils, so its not a random value.

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Tue, 06 Jan 2026 17:46:39 GMT

thanks..

the config data looks like 20035CC0

10 11 17 14 00 03 FF 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 01

sck = 10

mosi = 11

miso = 17

ss_pin = 14

ss_active_high = 00

irq_priority = 03, which matches the define used, CONFIG_SPI_UWB_IRQ_PRIORITY=3

fill char = FF

the hard fault is a write access fault at 75B0C , app_error_fault_handler id=1001, pc=75B0C, info =1

from the link map that is

irq_handler

0x0000000000075aec 0x5c Nordic/libSDK.a(nrfx_spim.c.obj) <----- here

.text.SPIM0_SPIS0_TWIM0_TWIS0_SPI0_TWI0_IRQHandler

0x0000000000075b48 0x10 Nordic/libSDK.a(nrfx_spim.c.obj)

disassembly window

00075AFE MOV.W R3, #0
anomaly_198_disable();
static void anomaly_198_disable(void)
*((volatile uint32_t *)0x40000E00) = m_anomaly_198_preserved_value;
00075B02 IT EQ
00075B04 STREQ.W R3, [R2, #0x0E00]
nrf_spim_event_clear(p_spim, NRF_SPIM_EVENT_END);
__STATIC_INLINE void nrf_spim_event_clear(NRF_SPIM_Type * p_reg,
*((volatile uint32_t *)((uint8_t *)p_reg + (uint32_t)event)) = 0x0UL;
00075B08 STR.W R3, [R0, #0x0118]
volatile uint32_t dummy = *((volatile uint32_t *)((uint8_t *)p_reg + (uint32_t)event));
00075B0C LDR.W R3, [R0, #0x0118] <--------------------- here
00075B10 LDRB R0, [R1, #31]
00075B12 STR R3, [SP, #4]
(void)dummy;

r3 at the time is 0x00047335, which is in the flash section of the image

```

RAM 0x0000000020013000 0x000000000002d000 xrw

FLASH 0x0000000000027000 0x000000000007b000 xrw <----- here

CALIB_SHA 0x00000000000fc000 0x0000000000001000 rw

CALIB 0x00000000000fd000 0x0000000000001000 rw

*default* 0x0000000000000000 0xffffffffffffffff

```

I added a call to log entry to this function

static enum qerr spi_config_master(struct qspi *const spi, const struct qspi_config *config)

{

nrfx_err_t r = NRFX_ERROR_INVALID_PARAM;

QLOGD("spi_config_master.");

but don't see that in the ozone terminal window
in the disassembly window that function is not present in memory, but the one following it is

here are the IRQ priorities as defined in one of the make files
./Projects/DW3_QM33_SDK/FreeRTOS/Type2AB_EVB-new/ProjectDefinition/uwb_stack_llhw.cmake: NRFX_CLOCK_CONFIG_IRQ_PRIORITY=6
./Projects/DW3_QM33_SDK/FreeRTOS/Type2AB_EVB-new/ProjectDefinition/uwb_stack_llhw.cmake: CLOCK_CONFIG_IRQ_PRIORITY=6
./Projects/DW3_QM33_SDK/FreeRTOS/Type2AB_EVB-new/ProjectDefinition/uwb_stack_llhw.cmake: TIMER_DEFAULT_CONFIG_IRQ_PRIORITY=7
./Projects/DW3_QM33_SDK/FreeRTOS/Type2AB_EVB-new/ProjectDefinition/uwb_stack_llhw.cmake: NRFX_TIMER_DEFAULT_CONFIG_IRQ_PRIORITY=7
./Projects/DW3_QM33_SDK/FreeRTOS/Type2AB_EVB-new/ProjectDefinition/uwb_stack_llhw.cmake: NRFX_RTC_DEFAULT_CONFIG_IRQ_PRIORITY=7
./Projects/DW3_QM33_SDK/FreeRTOS/Type2AB_EVB-new/ProjectDefinition/uwb_stack_llhw.cmake: RTC_DEFAULT_CONFIG_IRQ_PRIORITY=7
./Projects/DW3_QM33_SDK/FreeRTOS/Type2AB_EVB-new/ProjectDefinition/uwb_stack_llhw.cmake: WDT_CONFIG_IRQ_PRIORITY=7
./Projects/DW3_QM33_SDK/FreeRTOS/Type2AB_EVB-new/ProjectDefinition/uwb_stack_llhw.cmake: NRFX_WDT_CONFIG_IRQ_PRIORITY=7
./Projects/DW3_QM33_SDK/FreeRTOS/Type2AB_EVB-new/ProjectDefinition/uwb_stack_llhw.cmake: NRFX_USBD_CONFIG_IRQ_PRIORITY=5
./Projects/DW3_QM33_SDK/FreeRTOS/Type2AB_EVB-new/ProjectDefinition/uwb_stack_llhw.cmake: USBD_CONFIG_IRQ_PRIORITY=5

the sdk_config.h only has IRQ priority 6 or 7 as selected
none of those appear to conflict with SD

the code before SD inclusion used timer0, but that was changed to timer1 as timer0 is used by SD.

here is the macros at the end of the ld for overflow checking, etc

.heap 0x0000000020038480 0x0

0x0000000020038480 __HeapBase = .

0x0000000020038480 __end__ = .

0x0000000020038480 PROVIDE (end = .)

*(.heap*)

.heap 0x0000000020038480 0x0 Nordic/libSDK.a(gcc_startup_nrf52840.S.obj)

0x0000000020038480 __HeapLimit = .

.stack_dummy 0x0000000020038480 0x4000

*(.stack*)

.stack 0x0000000020038480 0x4000 Nordic/libSDK.a(gcc_startup_nrf52840.S.obj)

0x0000000020040000 __StackTop = (ORIGIN (RAM) + LENGTH (RAM))

0x000000002003c000 __StackLimit = (__StackTop - SIZEOF (.stack_dummy))

0x0000000020040000 PROVIDE (__stack = __StackTop)

0x0000000000000001 ASSERT ((__StackLimit >= __HeapLimit), region RAM overflowed with stack)

0x0000000000000fb0 DataInitFlashUsed = (__bss_start__ - __data_start__)

0x0000000000067ba4 CodeFlashUsed = (__etext - ORIGIN (FLASH))

0x0000000000068b54 TotalFlashUsed = (CodeFlashUsed + DataInitFlashUsed)

0x0000000000000001 ASSERT ((TotalFlashUsed <= LENGTH (FLASH)), region FLASH overflowed with .data and user data)

0x0000000000000020 CONFIG_SECURE_PARTITIONS_UWB_L1_CONFIG_SHA256_SIZE = 0x20

0x0000000000001000 CONFIG_SECURE_PARTITIONS_UWB_L1_CONFIG_SIZE = 0x1000

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

Hung Bui — Tue, 06 Jan 2026 09:18:38 GMT

Hi Sam,

Could you let me know more about "but I can't tell which interrupt invoked the handler." ?

Have you checked how the interrupt for SPIM is enabled ?

It's in this struct when nrfx_spim_init() is called:

typedef struct
{
    uint8_t sck_pin;      ///< SCK pin number.
    uint8_t mosi_pin;     ///< MOSI pin number (optional).
                          /**< Set to @ref NRFX_SPIM_PIN_NOT_USED
                           *   if this signal is not needed. */
    uint8_t miso_pin;     ///< MISO pin number (optional).
                          /**< Set to @ref NRFX_SPIM_PIN_NOT_USED
                           *   if this signal is not needed. */
    uint8_t ss_pin;       ///< Slave Select pin number (optional).
                          /**< Set to @ref NRFX_SPIM_PIN_NOT_USED
                           *   if this signal is not needed. */
    bool ss_active_high;  ///< Polarity of the Slave Select pin during transmission.
    uint8_t irq_priority; ///< Interrupt priority.
    uint8_t orc;          ///< Overrun character.
                          /**< This character is used when all bytes from the TX buffer are sent,
                               but the transfer continues due to RX. */
    nrf_spim_frequency_t frequency; ///< SPIM frequency.
    nrf_spim_mode_t      mode;      ///< SPIM mode.
    nrf_spim_bit_order_t bit_order; ///< SPIM bit order.
#if NRFX_CHECK(NRFX_SPIM_EXTENDED_ENABLED) || defined(__NRFX_DOXYGEN__)
    uint8_t              dcx_pin;     ///< D/CX pin number (optional).
    uint8_t              rx_delay;    ///< Sample delay for input serial data on MISO.
                                      /**< The value specifies the delay, in number of 64 MHz clock cycles
                                       *   (15.625 ns), from the the sampling edge of SCK (leading edge for
                                       *   CONFIG.CPHA = 0, trailing edge for CONFIG.CPHA = 1) until
                                       *   the input serial data is sampled. */
    bool                 use_hw_ss;   ///< Indication to use software or hardware controlled Slave Select pin.
    uint8_t              ss_duration; ///< Slave Select duration before and after transmission.
                                      /**< Minimum duration between the edge of CSN and the edge of SCK and minimum
                                       *   duration of CSN must stay inactive between transactions.
                                       *   The value is specified in number of 64 MHz clock cycles (15.625 ns).
                                       *   Supported only for hardware-controlled Slave Select. */
#endif
} nrfx_spim_config_t;

Have you narrowed it down to exactly SPIM interrupt handling causing the crash ? You mentioned "I get an access fault trying to write to the flash in code space" what is it about ? Is it the internal flash or external flash ?

Regarding the interrupt priority check, please note that the softdevice crash most likely not because of the new interrupt handler added but more likely of the ones that already configured (but violate the softdevice requirement) so you may want to post the whole list of interrupt priority configuration here.

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Sun, 04 Jan 2026 17:19:38 GMT

so, more investigation

i'm pretty sure this is an interrupt priority problem, but I can't find id.

if U run the routine that fails after SD init, BEFORE Sd init, it starts, no problem.

when I get to the next step on using the backend chip

I still get the same nrf_spim_event_clear write protection crash.

in the nrfx_spim.c , in the irq_handler

the call stack in Ozone doesn't tell me where the code was before.. I can see it thru the pc address

but I can't tell which interrupt invoked the handler.

init_log: Backends initialized
create_log_processing_task: init_log completed
create_log_processing_task: Stack allocated
create_log_processing_task: Task created
TEST RTT OUTPUT
board_interface_init: START
board_interface_init: About to init BLE
Role: RoleController
WARNING: UWB MAC initialization skipped - incompatible with SoftDevice
Calling ble_stack_manager_init...

[BLE] === SCANNING ALL INTERRUPTS FOR CONFLICTS ===
[BLE] IRQ 0: priority=6, enabled=1
[BLE] IRQ 9: priority=7, enabled=1

[Fira Init] qplatform_init ok <--- this is the code that failed AFTER sd was started
[Fira Init] l1_config_init ok
[Fira Init] llhw_init ok
[Fira Init] done rc=0

[BLE] ble_stack_manager_init: 1-nrf_sdh_enable_request
[BLE] ble_stack_manager_init: 2-Configuring SoftDevice for concurrent connections
[BLE] nrf_sdh_ble_default_cfg_set returned: 0, ram_start=0x20013000
[BLE] sd_ble_cfg_set(CONN_CFG_GAP) returned: 0, ram_start=0x20013000 (conn_count=8)
[BLE] ble_stack_manager_init: 3-nrf_sdh_ble_enable
[BLE] Enabling central role: 1 peripheral + 7 central = 8 total connections
[BLE] sd_ble_cfg_set(ROLE_COUNT) returned: 0, ram_start=0x20013000
[BLE] nrf_sdh_ble_enable returned: 0 (0x0)
[BLE] gap_params_init: COMPLETE
[BLE] BLE stack initialized successfully - observer priority=3
ble_stack_manager_init returned: TRUE
BLE init SUCCESS - starting advertising
[BLE] Using manual advertising data encoding...
[BLE] *** BUILDING SCAN RESPONSE: role=1, name='CN_Controller', len=13 ***
[BLE] Advertising data: 3 bytes, Scan response: 15 bytes (type=0x09, name='CN_Controller')
[BLE] sd_ble_gap_adv_start returned: 0 (handle=0x00)
[BLE] BLE advertising started successfully!

advertising_start called <--- I can see the BLE device in nrf_connect app

now start up the UWB device

Initializing UCI BLE commands...
[UCI_BLE] uci_ble_commands_init() CALLED
[UCI_BLE] CONTROLLER: Creating UCI manager task...
[UCI_BLE] CONTROLLER: UCI manager task created successfully
UCI BLE commands initialized successfully
=== BLE Init Complete ===
[CTRL_TASK] *** TASK STARTED ***
[CTRL_TASK] Mutex initialized
[CTRL_TASK] Entering main loop, signal=2002C510
[TASK_UCI] calling uci_open_backends
in open_backends
in open_backends uwbmac init ok
in open_backends uci_init ok
in open_backends init coordinator

[00:00:00.021,847] <debug> nrf_sdh: State request: 0x00000000
[00:00:00.021,854] <debug> nrf_sdh: State change: 0x00000000
[00:00:00.279,301] <debug> nrf_sdh: State change: 0x00000001

if the app_error_handler goes all the way thru

[00:01:01.659,109] <error> app: Fatal error

if I don't execute that open_backends

I see this from SD (and can connect thru NRF_Connect)

[CTRL_TASK] Entering main loop, signal=2002C4C0
[TASK UCI] on entry
[UCI_BLE] *** UCI MANAGER TASK STARTED (CONTROLLER MODE) ***
[UCI_BLE] Performing late initialization in UCI manager task...
[UCI_BLE] Late initialization: Creating UCI BLE queues and tasks...
[UCI_BLE] Notification task started
[UCI_BLE] Ranging continuation task created successfully
[UCI_BLE] Ranging queue and task initialization complete
[UCI_BLE] Ranging continuation task started - will process queued ranging requests
log_processing_task: Started
[UCI_BLE] Beacon notification semaphore created
[UCI_BLE] UCI execution queue created successfully at 20030E58
[UCI_BLE] CONTROLLER: UCI execution task already running (created in init)
[UCI_BLE] Task handle: 2002BE30
[UCI_BLE] Free heap: 14704 bytes
[UCI_BLE] ***** UCI execution queue initialization COMPLETE *****
[UCI_BLE] Late initialization complete - queue=20030E58
[UCI_BLE] *** UCI_EXEC task ready to process messages from queue ***
[UCI_BLE] Delaying 50ms before entering main loop...
[UCI_BLE] *** ENTERING MAIN LOOP - will check queue and flags every 100ms ***
[BLE] scan_evt_handler called! evt_id=6
[BLE] QWR module assigned to connection handle 0x0007
[BLE] BEACON: Initializing system attributes (for QWR)
[BLE] BEACON: System attributes initialized successfully
[BLE] CONTROLLER: Connection accepted from phone app
[BLE] Conn handle: 0x0007, Peer address: 7B:D3:06:09:B6:4E (type 2)
[BLE] Connection allowed - waiting for commands from phone
[BLE] WRITE EVENT: handle=0x000D, op=1, len=2
[BLE] Command char value=0x0010, CCCD=0x0011

so, SD is up and running, and the IRQ setup BEFORE sd worked.
but turning it on , causes the fault in spim.

I added an u=interrupt enabled checker before and after the one call

```

for (int irq = 0; irq < 48; irq++) { // nRF52840 has 48 interrupts

uint32_t priority = NVIC_GetPriority((IRQn_Type)irq);

uint32_t enabled1 = NVIC_GetEnableIRQ((IRQn_Type)irq);

// Only report enabled interrupts or those with problematic priorities

if (enabled1){ //} (priority == 0 || priority == 1 || priority == 4)) {

SEGGER_RTT_printf(0,"IRQ %d: priority=%d, enabled=%d %s\r\n",

//QLOGD("IRQ %d: priority=%d, enabled=%d %s",

irq, priority, enabled1,

(priority == 0 || priority == 1 || priority == 4) ? "*** CONFLICT ***" : "");

}

```

[BLE] before 1 === SCANNING ALL INTERRUPTS FOR CONFLICTS ===
IRQ 0: priority=6, enabled=1
IRQ 9: priority=7, enabled=1

[Fira Init] qplatform_init ok
[Fira Init] l1_config_init ok
[Fira Init] llhw_init ok
[Fira Init] done rc=0

[BLE] after === SCANNING ALL INTERRUPTS FOR CONFLICTS ===
IRQ 0: priority=6, enabled=1

IRQ 9: priority=7, enabled=1

all these are newly enabled, but very low priority

IRQ 6: priority=7, enabled=1

IRQ 10: priority=7, enabled=1

IRQ 27: priority=7, enabled=1
IRQ 36: priority=7, enabled=1
IRQ 39: priority=5, enabled=1

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Tue, 30 Dec 2025 14:24:44 GMT

BLE thru softdevice works great. Pair w phone, scan and connect downstream peripherals, send/receive data, notifications

now I want to execute other code, unchanged from the Qorvo distribution. have found two code optimization problems, and this crash in the interrupt handler looks similar , if I stop in ozone there the pointer looks good,

course sd is unhappy with the delay

if I don’t stop I get an access fault trying to write to the flash in code space. Makes no sense. Tried different compiler versions, optimization settings. Weird

also, if I do this setup BEFORE SD init, then SD fails, BUT the other code does NOT..

I don't see any shared resources.. interrupts, levels, ...

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

Hung Bui — Tue, 30 Dec 2025 09:04:13 GMT

Hi Sam,
Let's us know if you find out something wrong with the SPIM interrupt handler. Again, check the interrupt priority level and check if there is anything not expected calling inside that handler.

To narrow down the root cause I would suggest to try turning off SPIM to see if you can start the softdevice and do BLE correctly first.

Happy holidays !

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Fri, 19 Dec 2025 14:15:31 GMT

after thinking about it overnight, I don't think FDS is involved.. I am debugging again now.. I think there might be another address optimization problem.. cause we fault in the SPIM interrupt handler

I WILL need FDS and have adjusted the ld file to reserve the space when I get there..

and I understand about using the fstorage api and letting the backend handle it..

happy holidays.

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

Hung Bui — Fri, 19 Dec 2025 13:45:57 GMT

Hi Sam,
Could you explain more why SPIM related to flash ? Maybe check the interrupt priority of SPI interrupt?

Note that the requirement is only about internal flash. The reason I mentioned that is that I noticed "nrfx_nvmc_page_erase " call in your log.

Note that FDS uses fstorage under the hood and you can choose between fstorage and fstorage_sd when you use it without or with Softdevice.

I will be a away for vacation until the end of the year. So there will be delay in the answer unfortunately.
Wish you a Merry Xmas !

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Thu, 18 Dec 2025 19:11:12 GMT

the title is more correct..

oh, spim relates to flash.. ??

I can only assume that the project I built on does not have FDS enabled, and checking the sdk_config.h that is true.

a lot of knowledge needed.

they have a project that has SD peripheral mode, and put the FDS segments at 7D000-800000

but that is in the middle of the large 52840 flash space..

on the non-SD project, they don't have any space for FDS so I'll have to figure out all that and how to indicate to use the SD apis for it. part of my extensions need small amount of persistent storage

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

Hung Bui — Thu, 18 Dec 2025 13:18:34 GMT

Hi Sam,
So it seems that it didn't crash in nrfx_gpiote_is_init() ?
But it has something with the SPI transfer/IRQ handler instead ?
Could you check what's the context (interrupt priority) when this function is called ?
Also could you check how flash is handled in the code ? Note that when the softdevice is enabled, flash operation has to be handled by Softdevice's flash API

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Wed, 17 Dec 2025 13:24:46 GMT

if I comment out the 198 anomaly test

it hardfaults in the nrfx_spim, irq_handler,

if (nrf_spim_event_check(p_spim, NRF_SPIM_EVENT_END))
__STATIC_INLINE bool nrf_spim_event_check(NRF_SPIM_Type * p_reg,
return (bool)*(volatile uint32_t *)((uint8_t *)p_reg + (uint32_t)event);
00079E94 F8D0 3118 LDR.W R3, [R0, #0x0118]
00079E98 2B00 CMP R3, #0
00079E9A D03A BEQ 0x00079F12 ; <irq_handler>+0x7E
00079E9C B500 PUSH {LR}
00079E9E B083 SUB SP, SP, #12
if (p_spim == NRF_SPIM3)
00079EA0 4B1C LDR R3, =0x4002F000 ; [PC, #112] [0x00079F14]
00079EA2 4298 CMP R0, R3
00079EA4 D022 BEQ 0x00079EEC ; <irq_handler>+0x58
nrf_spim_event_clear(p_spim, NRF_SPIM_EVENT_END);
__STATIC_INLINE void nrf_spim_event_clear(NRF_SPIM_Type * p_reg,
*((volatile uint32_t *)((uint8_t *)p_reg + (uint32_t)event)) = 0x0UL;
00079EA6 2300 MOVS R3, #0
00079EA8 F8C0 3118 STR.W R3, [R0, #0x0118] <-------- hardfault here

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Tue, 16 Dec 2025 22:29:37 GMT

redoing the code for * p_cb like this

spim_control_block_t * p_cb = m_cb+p_instance->drv_inst_idx; // array +type increment vs [index]

if I step thru I get a hardfault from SD, id=1

if I don't step thru, I get the memory access error again, pc 7a34c

still in

from the map

.text.nrfx_spim_xfer

0x0007a294 0x204 Nordic/libSDK.a(nrfx_spim.c.obj)

0x0007a294 nrfx_spim_xfer

from the code disassembly window at the pc of the fault

{
anomaly_198_enable(p_xfer_desc->p_tx_buffer, p_xfer_desc->tx_length);
0007A3C0 LDR.W R5, [LR]
0007A3C4 LDR.W R1, [LR, #4]

source

```

#if NRFX_CHECK(NRFX_SPIM3_NRF52840_ANOMALY_198_WORKAROUND_ENABLED)

if (p_spim == NRF_SPIM3)

{

anomaly_198_enable(p_xfer_desc->p_tx_buffer, p_xfer_desc->tx_length); <---- fault here

}

#endif

```

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Tue, 16 Dec 2025 15:55:57 GMT

I moved the code around, memset the whole buffer, then copied in the data, didnt increment the pointer as its not used after that
and got all the way to qplatform qspi_transceive

and nrfx_spim_xfer(&spi->type.spim, &xfer_desc, xfer->flags);

which faults, per the above item 1. the send and receive buffers are valid.

if I step in more

NRFX_ASSERT(p_cb->state != NRFX_DRV_STATE_UNINITIALIZED);
NRFX_ASSERT(p_xfer_desc->p_tx_buffer != NULL || p_xfer_desc->tx_length == 0);
NRFX_ASSERT(p_xfer_desc->p_rx_buffer != NULL || p_xfer_desc->rx_length == 0);
NRFX_ASSERT(SPIM_LENGTH_VALIDATE(p_instance->drv_inst_idx,
p_xfer_desc->rx_length,
p_xfer_desc->tx_length));

nrfx_err_t err_code = NRFX_SUCCESS;

if (p_cb->transfer_in_progress) <---- p_cb = 0x00000002
{
err_code = NRFX_ERROR_BUSY;
NRFX_LOG_WARNING("Function: %s, error code: %s.",
__func__,
NRFX_LOG_ERROR_STRING_GET(err_code));
return err_code;
}
else
{
if (p_cb->handler && !(flags & (NRFX_SPIM_FLAG_REPEATED_XFER |
NRFX_SPIM_FLAG_NO_XFER_EVT_HANDLER)))
{
p_cb->transfer_in_progress = true; // this faults... setting low memory.(0x00000002).
}
}

I see in the popup, its m_cb[2].. so it saw drv_inst_idx

but p_cb ends up being 2?????

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Tue, 16 Dec 2025 15:16:43 GMT

Qorvo doesn't provide support for single startup developers like me..

i have two different results from debugging

so, if I stop in the weak app_error_fault_handler
id = 0x1001 = NRF_FAULT_ID_APP_MEMACC
and the PC s 8093a , which is about halfway thru nrfx_spim_xfer

the info value is 1

from the build link map

```text

.text.nrfx_spim_uninit

0x00000000000807b8 0xc8 Nordic/libSDK.a(nrfx_spim.c.obj)

0x00000000000807b8 nrfx_spim_uninit

.text.nrfx_spim_xfer

0x0000000000080880 0x218 Nordic/libSDK.a(nrfx_spim.c.obj)

0x0000000000080880 nrfx_spim_xfer <------- after 80880

.text.nrfx_nvmc_page_erase

0x0000000000080a98 0x38 Nordic/libSDK.a(nrfx_nvmc.c.obj)

0x0000000000080a98 nrfx_nvmc_page_erase <----- before here

.text.nrfx_nvmc_words_write

```

```

interesting.. but
2.
I step thru the code and get to this routine.
```

static int32_t qplatform_uwb_spi_read(uint16_t header_length, uint8_t *header_buffer,

uint16_t read_length, uint8_t *read_buffer)

{

/* Read always bring header length on return. */

uint32_t rxtx_size = read_length + header_length;

uint8_t *temp_buf = temp_tx_buf;

enum qerr r;

if (rxtx_size > DATA_BUFFER_SIZE)

return QERR_ENOMEM;

memcpy(temp_buf, header_buffer, header_length);

temp_buf += header_length;

memset(temp_buf, 0x00, read_length); <-------------------------------------

r = qplatform_uwb_spi_transfer(rxtx_size, temp_tx_buf, rxtx_size, temp_rx_buf);

if (r)

return r;

temp_buf = temp_rx_buf + header_length;

/* Remove received address character. */

memcpy(read_buffer, temp_buf, read_length);

return QERR_SUCCESS;

}
```

on entry, header_length=1, read_length=4
at the if (rxtx_size , rxtx_size = 4 ????? say what , should be 5???
at the memcpy(temp_buf, header_buffer, temp_buf points to the variable temp_tx_buf , found in the link map at

```

.bss.temp_tx_buf

0x00000000200271e4 0xc8 qplatform/libqplatform.a(qplatform.c.obj)

```

```
at the memset(temp_buf, 0x00, temp_buf is 0x00000001!!!!!! <--------===========
and causes a memory access fault.

EVERY SINGLE TIME...
I cannot stop at the temp_buf+=, so I think this is a code optimization problem. I changed build def to -o1 from -o3, but no change in results..

I just updated my gcc from 10.3 to 14.3.. no change

as these variables are on the stack, I increased this FREETOS stack size to 7k from 6, no change

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

Hung Bui — Tue, 16 Dec 2025 11:50:31 GMT

Hi Sam, th
As showed in the documentation there are some requirement on how interrupt handling should be implemented when using softdevice. You would need to check if there is any other interrupt that may violate the requirement.

Please try to step the code or use log to see what exactly cause the problem. Have you checked the hardfault handling instruction that I pointed to ?
I would suggest to get Qorvo support involved as they should have sample that has Softdevice included.

RE: adding Softdevice BLE (S140) with GPIO attached coprocessor to project without softdevice. hardfault calling existing code after Softdevice active

rexxdad — Mon, 15 Dec 2025 20:11:42 GMT

I don't know, not my code.. it is the Qorvo UWB handling code which works..
another implementation has BLE Softdevice using S113 sd.. uses a different approach to interrupt setup, but that source is not provided..