HSL Model Error

RE: HSL Model Error

Hung Bui — Wed, 28 Jul 2021 14:12:28 GMT

Hi Zolu,
Have you managed to correct the functions ?
I have got more instruction from our team:
===============

This is worth to read CONTAINER_OF macro documentation :
https://github.com/zephyrproject-rtos/zephyr/blob/main/include/sys/util.h#L111

This macro is used to get a pointer on the parent structure if you know pointer to the one of a member of a structure.

How do we use it in our app?

We have app structure:

struct lightness_ctx {
	struct bt_mesh_lightness_srv lightness_srv;
	struct k_work_delayable per_work;
	uint16_t target_lvl;
	uint16_t current_lvl;
	uint32_t time_per;
	uint16_t rem_time;
};

This structure has `lightness_srv` that we initialize and use to handle the Light Lightness model states via registered callbacks like `light_set()`.

When `light_set()` is called, the fist argument is pointer to `lightness_srv`. Using `CONTAINER_OF ` we get pointer to `struct lightness_ctx` global context variable and etc etc ect.

How does customer use it?

Customer has app structure:

struct lightness_ctx {
        struct bt_mesh_lightness_srv light_cb;
	struct bt_mesh_light_hue_srv hue_cb;
        struct bt_mesh_light_sat_srv sat_cb;
	struct k_delayed_work per_work;
	uint16_t target_lvl;
	uint16_t current_lvl;
        uint16_t target_hue;
        uint16_t current_hue;
        uint16_t target_sat;
        uint16_t current_sat;
	uint32_t time_per;
	uint16_t rem_time;
};

It does not have any servers. Customer uses HSL server. According to spec HSL server has 3 `light_lightness servers` (1 itsown and 2 belong Hue and Saturation servers). Callbacks that customer register via `BT_MESH_LIGHT_HSL_SRV_INIT` belongs `light_lightness server` to HSL server. Looking at structure we can see:

/**/** * Light HSL Server instance. */
struct bt_mesh_light_hsl_srv {
 /** Light Hue Server instance. */ 
struct bt_mesh_light_hue_srv hue; 
/** Light Saturation Server instance. */
 struct bt_mesh_light_sat_srv sat;
 
 /** Lightness Server instance. */
 struct bt_mesh_lightness_srv lightness;   <------------------- here
 
 
 /** Model entry. */
 struct bt_mesh_model *model;
 /** Publish parameters. */
 struct bt_mesh_model_pub pub;
 /** Publish message buffer */
 struct net_buf_simple buf;
 /** Publish message buffer data */
 uint8_t pub_data[BT_MESH_MODEL_BUF_LEN( BT_MESH_LIGHT_HSL_OP_STATUS, BT_MESH_LIGHT_HSL_MSG_MAXLEN_STATUS)];
 /** A publication is pending, and any calls to
  *  @ref bt_mesh_light_hsl_srv_pub will return successfully without
  *  sending a message.  */
 bool pub_pending;
 /** Transaction ID tracker for the set messages. */
 struct bt_mesh_tid_ctx prev_transaction;
};

light_lightness server is located here.

Why customer does such actions this:

void light_set(struct bt_mesh_lightness_srv *srv,
		      struct bt_mesh_msg_ctx *ctx,
		      const struct bt_mesh_lightness_set *set,
		      struct bt_mesh_lightness_status *rsp)
{
        struct lightness_ctx *l_ctx =
		CONTAINER_OF(srv, struct lightness_ctx, light_cb);//	start_new_light_trans(set, l_ctx);
	rsp->current = l_ctx->current_lvl;
	rsp->target = l_ctx->target_lvl;
	rsp->remaining_time = set->transition->time + set->transition->delay;
}

Gets pointer on server from `struct bt_mesh_light_hsl_srv` but interprets it as `struct lightness_ctx`.

The same for hue and saturation callbacks.

This is obvious access to the wrong addresses that will cause memory faults.

To get correct behavior customer needs to use the correct data structure.

================

Hope this helps.

RE: HSL Model Error

Zolu — Fri, 23 Jul 2021 06:58:50 GMT

Hi Hung,

Thanks for your reply.

We are a team working on BLE Mesh project. We took light_ctrl as the base and started building RGB on top of that.

Is there any sample which we can take as reference?

Regards,

Zolu

RE: HSL Model Error

Hung Bui — Thu, 22 Jul 2021 14:31:15 GMT

Hi Zolu,

I got the code reviewed by our R&D and they suspect that the use of
struct lightness_ctx *l_ctx = CONTAINER_OF(srv, struct lightness_ctx, hue_cb);

struct lightness_ctx *l_ctx =CONTAINER_OF(srv, struct lightness_ctx, sat_cb);

was wrong. If you comment out start_new_hue_trans() and start_new_sat_trans() it would work fine. At least for provisioning and configuration (of course hue_set and sat set won't work as it should).

From where did you get the code from ?

Here is the quote from our R&D:
It is not possible to provide an occasional pointer to calculate the offset of the structure field. He performs to wrong addresses access after provisioning when models set initial values that causes hardfaults.

RE: HSL Model Error

Hung Bui — Tue, 20 Jul 2021 14:18:59 GMT

Hi Zolu,

I have reproduced the issue here. I'm checking internally to figure out what could be wrong.
It seems to me it has something to do with the usage of memory. It somehow trying to execute code in RAM.
How did you implement the model ? Have you got at any step that it was working and when you added some code it crashed ?

RE: HSL Model Error

Zolu — Tue, 20 Jul 2021 07:28:24 GMT

devzone.nordicsemi.com/.../rgb_5F00_folder.zip

Hi Hung,

I have attached the .zip file with basic implementation. This is not the final implementation though.

Regards,

Zolu

RE: HSL Model Error

Hung Bui — Fri, 16 Jul 2021 11:59:51 GMT

Hi Zolu,

Could you provide a minimal example that can reproduce the issue so we can test here ?

I assume in the prj.conf you have CONFIG_BT_LL_SW_SPLIT=y (so that the Zephyr BLE controller will be used).

RE: HSL Model Error

Zolu — Fri, 16 Jul 2021 05:19:25 GMT

Hi Hung,

- No such issue is seen while testing other mesh sample.

- After provisioning

- nRF52832

I have used the light_ctrl sample code from NCS v1.5.0 as a reference and tried to build RGB on top of that. On the SDK release selection I have not selected Zephyr Base.

RE: HSL Model Error

Hung Bui — Thu, 15 Jul 2021 14:43:20 GMT

Hi Zolu,
Could you give some more information:

- Do you see the same issue if you test on other mesh sample ?

- When do you see the error as on the SES screenshot ? Is it right after booting or after provisioning ?

- Which chip are you running ?

- Have you flashed the Zephyr BLE controller or it's the Softdevice BLE controller ?