MPU Fault when attempting to subscribe to BLE notifications

RE: MPU Fault when attempting to subscribe to BLE notifications

teover — Tue, 29 Nov 2022 09:29:54 GMT

Takk Vidar!

This helped me trace the faulting code, which was an incorrectly defined exchange_mtu function.

RE: MPU Fault when attempting to subscribe to BLE notifications

Vidar Berg — Tue, 22 Nov 2022 17:59:40 GMT

Hi Tor Egil,

Thanks for confirming and for providing the additional information. 0x20005fb8 is pointing to the idle thread's stack if I'm reading the map file correctly, which doesn't make much sense, or not to me, at least. I guess was expecting a more "random" address.

To troubleshoot this further, I would suggest that you re-build the project with CONFIG_ARM_MPU=n. This will allow code execution from RAM without triggering the MPU fault you saw earlier. You should then be able to place a breakpoint at the faulting RAM address and (hopefully) find out exactly where the branch to this invalid address occurred in the first place.

How to set a breakpoint at an arbitrary address in VS code

[quote user="teover"]I would also like to note that the BT RX thread is usually at up to 80%-99% CPU in the thread analyze before the MPU fault, but was not in first picture i posted. [/quote]

It seems a bit high, but I haven't tried to profile the CPU usage in this scenario, so I'm not sure if it is to be expected or not.

RE: MPU Fault when attempting to subscribe to BLE notifications

teover — Tue, 22 Nov 2022 14:03:41 GMT

Hi Vidar,

In my zephyr.map(address at line 15):

 .noinit."WEST_TOPDIR/zephyr/subsys/bluetooth/host/long_wq.c".0
                0x0000000020003550      0x518 zephyr/subsys/bluetooth/host/libsubsys__bluetooth__host.a(long_wq.c.obj)
                0x0000000020003550                bt_lw_stack_area
 .noinit."WEST_TOPDIR/zephyr/subsys/bluetooth/host/hci_core.c".0
                0x0000000020003a68     0x1000 zephyr/subsys/bluetooth/host/libsubsys__bluetooth__host.a(hci_core.c.obj)
 .noinit."WEST_TOPDIR/zephyr/subsys/bluetooth/host/hci_core.c".1
                0x0000000020004a68      0x400 zephyr/subsys/bluetooth/host/libsubsys__bluetooth__host.a(hci_core.c.obj)
 .noinit."WEST_TOPDIR/zephyr/subsys/bluetooth/host/att.c".k_mem_slab_buf_chan_slab
                0x0000000020004e68      0x150 zephyr/subsys/bluetooth/host/libsubsys__bluetooth__host.a(att.c.obj)
                0x0000000020004e68                _k_mem_slab_buf_chan_slab
 .noinit."WEST_TOPDIR/zephyr/kernel/init.c".0
                0x0000000020004fb8     0x1000 zephyr/kernel/libkernel.a(init.c.obj)
                0x0000000020004fb8                z_main_stack
 .noinit."WEST_TOPDIR/zephyr/kernel/init.c".1
                0x0000000020005fb8      0x140 zephyr/kernel/libkernel.a(init.c.obj)
 .noinit."WEST_TOPDIR/zephyr/kernel/init.c".2
                0x00000000200060f8      0x800 zephyr/kernel/libkernel.a(init.c.obj)
                0x00000000200060f8                z_interrupt_stacks
 .noinit."WEST_TOPDIR/zephyr/kernel/system_work_q.c".0
                0x00000000200068f8      0x800 zephyr/kernel/libkernel.a(system_work_q.c.obj)
 .noinit."WEST_TOPDIR/zephyr/kernel/mempool.c".kheap_buf__system_heap
                0x00000000200070f8      0x800 zephyr/kernel/libkernel.a(mempool.c.obj)
                0x00000000200070f8                kheap__system_heap
 .noinit."WEST_TOPDIR/zephyr/subsys/bluetooth/host/buf.c".0

subscribe_params is initialized to zero and passed to bt_gatt_subscribe as the second screenshot:

I would also like to note that the BT RX thread is usually at up to 80%-99% CPU in the thread analyze before the MPU fault, but was not in first picture i posted.

RE: MPU Fault when attempting to subscribe to BLE notifications

Vidar Berg — Tue, 22 Nov 2022 12:09:28 GMT

Hello,

If there were a stack overflow, it should have been caught by the stack limit checker (in HW) before your program had a chance to try executing code from RAM and trigger the MPU fault. Could you please try to look up the faulting address (0x20005fb8) in your *.map file to see what variable you have in that address range?

Also, just to confirm, is the subscribe_params struct initialized to zero?

Best regards,

Vidar