Call to sd_ble_gatts_value_set() does not return - S113

RE: Call to sd_ble_gatts_value_set() does not return - S113

underpickled — Tue, 01 Feb 2022 18:59:31 GMT

Hi Sigurd,

I found the problem. I was calling this from a TWI manager callback with the interrupt priority configured HIGH. I switched it to LOW and it seems to work now, though oddly enough some blocking transactions had to be switched to LOW_MID to work.

I eventually stumbled across this issue, which gave me the clue.

If you have any parting wisdom related to something like this, I'd be interested to hear it.

Best,

Dylan

RE: Call to sd_ble_gatts_value_set() does not return - S113

underpickled — Fri, 28 Jan 2022 18:07:26 GMT

Sure, here's the beginning of the function up to the call, including the payload data (the pointer being fed to the SD call is to a static variable).

static sensor_payload_t m_payload = {0};

void ble_man_sensor_update(sensor_payload_t *payload)
{
    memcpy(&m_payload, payload, sizeof(sensor_payload_t));
    cap_value_update(&m_cus, m_payload);
}

uint32_t cap_value_update(ble_cus_t *p_cus, sensor_payload_t custom_value) {
    if (p_cus == NULL) {
        return NRF_ERROR_NULL;
    }

    uint32_t err_code = NRF_SUCCESS;
    ble_gatts_value_t gatts_value;

    memset(&gatts_value, 0, sizeof(gatts_value));

    gatts_value.len = sizeof(sensor_payload_t);
    gatts_value.offset = 0;
    gatts_value.p_value = (uint8_t * ) & custom_value;

    NRF_LOG_INFO("about to set gatts value")
    err_code = sd_ble_gatts_value_set(p_cus->conn_handle, p_cus->cap_value_handles.value_handle, &gatts_value);
    NRF_LOG_INFO("ble gatts value set return: %u", err_code)
    if (err_code != NRF_SUCCESS) {
        return err_code;
    }

The connection handle is assigned on connection (which occurs without any issues, as you can see in the initial post). I added another print right before this to collect the arguments going into the call:

<info> app: conn handle: 0, value handle: 19, gatts value addr: 537001568

Here is the new sensor payload:

typedef struct {
    uint32_t timestamp;
    uint32_t cap1;
    uint32_t cap2;
    uint32_t cap3;
    uint32_t cap4;
    uint32_t cap5;
    uint32_t cap6;
    uint32_t cap7;
    uint32_t cap8;
    uint32_t cap9;
    uint32_t cap10;
    uint32_t cap11;
    uint32_t cap12;
    uint32_t cap13;
    uint32_t cap14;
    uint32_t cap15;
    uint32_t cap16;
    int16_t acc_x;
    int16_t acc_y;
    int16_t acc_z;
} sensor_payload_t;

This is the old one:

typedef struct {
    uint16_t timestamp;
    uint32_t cap1;
    uint32_t cap2;
    uint32_t cap3;
    uint32_t cap4;
    uint32_t cap5;
    uint32_t cap6;
    uint32_t cap7;
    uint32_t cap8;
    int16_t acc_x;
    int16_t acc_y;
    int16_t acc_z;
    int16_t gyro_x;
    int16_t gyro_y;
    int16_t gyro_z;
    int16_t mag_x;
    int16_t mag_y;
    int16_t mag_z;
} cap_value_t;

In sdk_config.h I have the following settings

#define NRF_SDH_BLE_GAP_DATA_LENGTH 74 // 16 channels @ 4 bytes each, 3 accel axes @ 2 bytes each, 4 byte timestamp = 74
#define NRF_SDH_BLE_GAP_EVENT_LENGTH 32
#define NRF_SDH_BLE_GATT_MAX_MTU_SIZE 240
#define NRF_SDH_BLE_GATTS_ATTR_TAB_SIZE 1408

RE: Call to sd_ble_gatts_value_set() does not return - S113

Sigurd — Fri, 28 Jan 2022 12:03:54 GMT

Hi,

Could you post some code that shows how you use sd_ble_gatts_value_set() ?

What is the value of conn_handle, handle and *p_value?

Is *p_value a valid address?

[quote user=""]I recently migrated to S113 from S140, and changed the data format of what was being set in the attribute.[/quote]

What changes to the data format did you do?

RE: Call to sd_ble_gatts_value_set() does not return - S113

underpickled — Thu, 27 Jan 2022 17:24:05 GMT

Hi Sigurd,

I get $(SDK_ROOT)/components/softdevice/s113/headers/ble_gatts.h:547 when I run it on the .out file. This points to

SVCALL(SD_BLE_GATTS_VALUE_SET, uint32_t, sd_ble_gatts_value_set(uint16_t conn_handle, uint16_t handle, ble_gatts_value_t *p_value));

RE: Call to sd_ble_gatts_value_set() does not return - S113

Sigurd — Thu, 27 Jan 2022 12:06:07 GMT

What did you get when you called this?

arm-none-eabi-addr2line 0x0002345E -e your_app.elf

RE: Call to sd_ble_gatts_value_set() does not return - S113

underpickled — Thu, 27 Jan 2022 11:38:59 GMT

Hi Sigurd,

Thanks, but I have a couple of clarifying questions.

1. Should I interpret PC as the address the hard fault occurred at? Otherwise there doesn't seem to be a PC parameter specified

2. Is it not otherwise clear that the hard fault is occuring within the soft device call? That won't point me to anything I can use as far as I can tell.

Thanks,

Dylan

RE: Call to sd_ble_gatts_value_set() does not return - S113

Sigurd — Thu, 27 Jan 2022 08:40:20 GMT

Hi,

The value of the pc parameter will contain the address of the instruction that executed the invalid memory access, or the address of the instruction following the violation. To find out the filename and line number within your application source code that correspond to the pc you can use the appropriate tool provided with your toolchain. For example if your linker outputs files in the ELF format you can use the addr2line tool which is part of the GNU ARM Embedded toolchain for this purpose.

// Syntax
arm-none-eabi-addr2line <pc> -e application.elf
 
// Example, pc=0x01da6a
$ arm-none-eabi-addr2line 0x01da6a -e app_beacon.elf
C:\dev\app_beacon\src\main.c:34

RE: Call to sd_ble_gatts_value_set() does not return - S113

underpickled — Wed, 26 Jan 2022 19:36:50 GMT

Thanks for that extra info. I had already enabled it in the SDK, but I was missing the preprocessor definition. Here's what that turns up:

<info> app: about to set gatts value
<error> hardfault: HARD FAULT at 0x0002345E
<error> hardfault:   R0:  0x00000000  R1:  0x00000013  R2:  0x2001FE50  R3:  0x00000099
<error> hardfault:   R12: 0x00000000  LR:  0x0002365F  PSR: 0x61000013

[Update]: From the .map file, the fault seems to occur from an address shortly after that of sd_ble_gatts_value_set()

 .text.sd_ble_gatts_value_set
                0x000000000002345c        0x4 _build/nrf52833/ble_drg_custom_service.c.o
 .text.sd_ble_gatts_hvx
                0x0000000000023460        0x4 _build/nrf52833/ble_drg_custom_service.c.o

RE: Call to sd_ble_gatts_value_set() does not return - S113

Sigurd — Wed, 26 Jan 2022 19:29:10 GMT

[quote user="geode"]It looks like it ends up in a hard fault handler. [/quote]

Make sure that the hardfault library is used.

Add these to your projects:

$(SDK_ROOT)/components/libraries/hardfault/hardfault_implementation.c
$(SDK_ROOT)/components/libraries/hardfault/nrf52/handler/hardfault_handler_gcc.c

And set HARDFAULT_HANDLER_ENABLED to 1 in sdk_config.h, and add DEBUG_NRF in your preprocessor definitions

RE: Call to sd_ble_gatts_value_set() does not return - S113

underpickled — Wed, 26 Jan 2022 19:05:59 GMT

It looks like it ends up in a hard fault handler. If I set a breakpoint at the functiona call I can step through a handful of assembly instructions, and then it hits the hard fault.

Here's the call stack:

Here are the different chunks of disassembly (a new pic each time it jumps)

It looks like it goes to the fault once I step through that "bx r3" instruction at address 0x1ae86.

And here's after it hits the fault:

RE: Call to sd_ble_gatts_value_set() does not return - S113

Sigurd — Wed, 26 Jan 2022 14:28:41 GMT

How does the callstack look like? and the disassembly? What is the value of the PC(program counter)? Does the PC change when this occurs?

RE: Call to sd_ble_gatts_value_set() does not return - S113

underpickled — Wed, 26 Jan 2022 13:16:30 GMT

Hi Sigurd, I've already got that in there. That's how I know it doesn't return. Sorry, I probably should have specified that more explicitly.

RE: Call to sd_ble_gatts_value_set() does not return - S113

Sigurd — Wed, 26 Jan 2022 11:53:14 GMT

Hi,

[quote userid="103271" url="~/f/nordic-q-a/84064/call-to-sd_ble_gatts_value_set-does-not-return---s113"](the last info print is the line before the function call):[/quote]

Try adding a print line after as well. Snippet:

err_code = sd_ble_gatts_value_set();
NRF_LOG_INFO("sd_ble_gatts_value_set() returned %d",err_code);
APP_ERROR_CHECK(err_code);

and set NRF_LOG_DEFERRED to 0 in sdk_config.h