Crash when writing > 20 bytes (from Android)

[Roger Clark]

Hi,

I'm trying to write more than 20 bytes to a custom characteristic, from Android (Cordova BLE Central), but this completely crashes my App

APP_ERROR:ERROR:Fatal

I'm using SDK 12.1 App Template, plus the LED & Button example service LBS

I set the LED (Write) characteristic to have a max size of 256 like this

   attr_md.vloc       = BLE_GATTS_VLOC_STACK;
    attr_md.rd_auth    = 0;
    attr_md.wr_auth    = 0;
    attr_md.vlen       = 0;// variable length set to false (disabled)
    
    memset(&attr_char_value, 0, sizeof(attr_char_value));

    attr_char_value.p_uuid       = &ble_uuid;
    attr_char_value.p_attr_md    = &attr_md;
    attr_char_value.init_len     = sizeof(uint8_t);
    attr_char_value.init_offs    = 0;
    attr_char_value.max_len      = 256;//sizeof(uint16_t);
    attr_char_value.p_value      = NULL;

Do I need to increase some buffer size so I can send more than 20 bytes.

BTW. I am using the nRF51822QFAA (16k) and have the IRAM setting at 0x20001FE8

But perhaps I need to give the SD more RAM ??

[Roger Clark]

@run_ar

Sorry I should have made it clear that the firmware on the nRf51 crashes and starts.

Cordova is working Ok.

I referred to the firmware as the application as I have gone back to using the official Application Template in SDK 12.1.0, plus the example LED Button custom service.

I will try building the Heart Rate example ( or one of the others) and modify my Codova App to try writing 21 bytes to one of Nordics examples and see if it still crashes, and report back.

[Roger Clark]

Just to update on my continued testing.

I tried using the proximity example, and I'm writing 21 bytes to the Link Loss service (even though its length is listed as 2 bytes)

But it doesn't crash like the LBS example code does.

So I'll need to find what the difference is between these two firmwares is. Because the issue may be in the error handing or lack of it in main, rather than the LBS service its self

One thing I have noticed however, is that the examples don't seem to have an inactivity timeout.

IMHO all devices with services should implement in inactivity timeout, otherwise a DOS style attack could be mounted against BLE devices by writing an Android application, which connects but does not disconnect, thus locking the BLE device to further communications and flattening its battery.

[run_ar]

Which error code do you get from sd_ble_user_mem_reply in the failing case
case BLE_EVT_USER_MEM_REQUEST:
err_code = sd_ble_user_mem_reply(p_ble_evt->evt.gattc_evt.conn_handle, NULL);
APP_ERROR_CHECK(err_code);

[Roger Clark]

The code seems to reboot when it gets this error, and I dont know where the error actually occurs.

It only seems to happen with my custom service in my ble_app_template code.

I tried writing too many bytes to the Link Loss service write characteristic example and it was fine.

So my next step is to use the LLS in my code instead of my custom service, and determine if this is an issue with my main code or my custom service.

[run_ar]

Your code probably ends up in the fault handler which will reset the device by default (app_error_fault_handler). Try to add a DEBUG define to avoid this and you should be able to see where the error happens.