softdevice: Hard Fault / Advertising flash contents on extended advertising

RE: softdevice: Hard Fault / Advertising flash contents on extended advertising

helsing — Fri, 03 Dec 2021 12:36:00 GMT

We can confirm there is a bug in SDC in v1.7.0-rc1 (and v1.7.1 as well). The module that allocates adv buffers seems to have a bug so it returns NULL pointer when it should have not. That module was completely redone in v1.8.0-rc1 and the bug is gone. It is not reproducible in v1.8.0-rc1.

Thank you for reporting this.

RE: softdevice: Hard Fault / Advertising flash contents on extended advertising

JordanYates — Wed, 24 Nov 2021 23:47:20 GMT

I don't believe it's a stack overflow. I can manually trigger a stack overflow with the following function and `CONFIG_STACK_SENTINEL=y`, which outputs logs like:

void stack_overflow(void)
{
	uint8_t *stack_pointer = (uint8_t *)(_current->stack_info.start + _current->stack_info.size / 2);

	/* Write over complete stack */
	while ((uintptr_t)stack_pointer > _current->stack_info.start) {
		(*stack_pointer)++;
		stack_pointer--;
	}
	/* Sleep to force context switch, triggering exception */
	k_sleep(K_MSEC(100));
}

Starting Fault Demo
Bluetooth initialized
[00:00:01.011,932] <err> os: r0/a1:  0x00000002  r1/a2:  0x00008e54  r2/a3:  0xf0f0f0f0
[00:00:01.011,932] <err> os: r3/a4:  0x20004da0 r12/ip:  0x20001af8 r14/lr:  0x0001df5d
[00:00:01.011,932] <err> os:  xpsr:  0x61000000
[00:00:01.011,932] <err> os: Faulting instruction address (r15/pc): 0x0001c886
[00:00:01.011,932] <err> os: >>> ZEPHYR FATAL ERROR 2: Stack overflow on CPU 0
[00:00:01.011,962] <err> os: Current thread: 0x20001e98 (unknown)
[00:00:01.056,732] <err> os: Halting system

Removing the manual stock overflow still outputs the "MPU FAULT" error.

Unless I misunderstand how the SoftDevice asserts are generated, attempting to write to 0x00 in the SoftDevice would still generate an MPU FAULT, not a SoftDevice assert. Unlike the binary blob variant of the Softdevice, I don't think the static library version intercepts the vector table.

Furthermore, more than doubling the stack size of the thread which the assert occurs in with `CONFIG_BT_HCI_TX_STACK_SIZE=4096` does not change the behaviour.

RE: softdevice: Hard Fault / Advertising flash contents on extended advertising

helsing — Wed, 24 Nov 2021 12:54:01 GMT

This seems to be an application thread overflow, it is not a SoftDevice assert. It is an MPU fault.

Please check the thread with address 0x20001f38 as indicated in the log below. You can check the map file (build/zephyr/zephyr.map) or alternatively enable CONFIG_THREAD_NAME=y

[00:00:02.017,028] <err> os: ***** MPU FAULT *****

[00:00:02.017,059] <err> os:   Data Access Violation

[00:00:02.017,059] <err> os:   MMFAR Address: 0x0

[00:00:02.017,059] <err> os: r0/a1:  0x00000000  r1/a2:  0x20008ec1  r2/a3:  0x0000000d

[00:00:02.017,059] <err> os: r3/a4:  0xffffffff r12/ip:  0x00000002 r14/lr:  0x0001a955

[00:00:02.017,059] <err> os:  xpsr:  0x01000000

[00:00:02.017,059] <err> os: Faulting instruction address (r15/pc): 0x000166f2

[00:00:02.017,089] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0

[00:00:02.017,089] <err> os: Current thread: 0x20001f38 (unknown)

The reason for the assert to occur after updating NCS (SoftDevice controller) may have to do with a change in stack usage between versions.

RE: softdevice: Hard Fault / Advertising flash contents on extended advertising

helsing — Fri, 10 Sep 2021 09:16:52 GMT

Hi Jordan, thank you very much for reporting this. I have notified the software team who will look into this issue.

Best regards,

Håkon

RE: softdevice: Hard Fault / Advertising flash contents on extended advertising

JordanYates — Thu, 09 Sep 2021 22:46:55 GMT

Not specifically, but the issue only appeared when updating the softdevice from https://github.com/nrfconnect/sdk-nrfxlib/commit/1a894638c438ce738c101b2c35894c9ffa2beb95 to the v1.7.0-rc1 commit.

If I had to guess I would think its related to the fix for:

* Fixed an issue where an assert may occur when legacy advertiser is used after "HCI LE Clear Advertising Sets" (DRGN-15993).

In https://github.com/nrfconnect/sdk-nrfxlib/commit/f8c4cbb42dbacd2a8b2ac62d7a26b42d0dc32b7c

RE: softdevice: Hard Fault / Advertising flash contents on extended advertising

helsing — Thu, 09 Sep 2021 18:45:45 GMT

Hi Jordan,

Thank you for the detailed description and sorry for the delayed reply.

Have you tried this with nRF Connect SDK v1.6.1?

Best regards,

Håkon