Fault when building with mbed-os master

[AGlass0fMilk]

@pan-
I'm not sure what's going on here, this repo works when I build it with the mbed-os-6.9.0 tag. But when I build it with the current master (84e5f1e03eed2227d91937c38ab862297ee9c2d6) it results in the following trace output:

[DBG ][MCUb]: flash area 0 open count: 1 (+)
[DBG ][MCUb]: initializing flash area 0...
[DBG ][MCUb]: flash area 0 open count: 0 (-)
[DBG ][MCUb]: deinitializing flash area block device 0...
[DBG ][MCUb]: flash area 0 open count: 1 (+)
[DBG ][MCUb]: initializing flash area 0...
[DBG ][MCUb]: flash area 0 open count: 0 (-)
[DBG ][MCUb]: deinitializing flash area block device 0...
[ERR ][MAIN]: failed to confirm boot: 4
[DBG ][QSPIF]: QSPIFBlockDevice csel: 17
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x9fh, addr: 18446744073709551615, tx length: 0, rx length: 3
[DBG ][QSPIF]: Vendor device ID = 0xc2 0x28 0x17
[DBG ][QSPIF]: Applying quirks for macronix
[DBG ][SFDP]: Verified SFDP Signature and version successfully
[DBG ][SFDP]: Number of parameter headers: 3
[DBG ][SFDP]: Parameter header: JEDEC Basic Flash - Revision 1.6
[DBG ][SFDP]: Parameter header: unknown JEDEC header. Parameter ID LSB: 0xC2; MSB: 0xFF
[INFO][SFDP]: Parameter header: 4-byte Address Instruction
[INFO][SFDP]: Density bits: 67108863 , device size: 8388608 bytes
[DBG ][SFDP]: Detected Page Size: 256
[DBG ][QSPIF]: Inst: 0x66h, addr: 18446744073709551615, tx length: 0, rx length: 0
[DBG ][QSPIF]: Inst: 0x99h, addr: 18446744073709551615, tx length: 0, rx length: 0
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][SFDP]: Erase Type(A) 1 - Inst: 0xffffffffh, Size: 4096
[DBG ][SFDP]: Erase Type 1 - Inst: 0x20h, Size: 4096
[DBG ][SFDP]: Erase Type(A) 2 - Inst: 0xffffffffh, Size: 32768
[DBG ][SFDP]: Erase Type 2 - Inst: 0x52h, Size: 32768
[DBG ][SFDP]: Erase Type(A) 3 - Inst: 0xffffffffh, Size: 65536
[DBG ][SFDP]: Erase Type 3 - Inst: 0xd8h, Size: 65536
[DBG ][SFDP]: Erase Type(A) 4 - Inst: 0xffffffffh, Size: 1
[DBG ][SFDP]: Erase Type 4 - Inst: 0xffffffffh, Size: 1
[DBG ][QSPIF]: Read Bus Mode set to 1-4-4, Instruction: 0xebh
[DBG ][QSPIF]: enabling fast mode
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Reading Status Register 1 Success: value = 0x40
[DBG ][QSPIF]: Inst: 0x15h, addr: 18446744073709551615, tx length: 0, rx length: 2
[DBG ][QSPIF]: Reading Status Register 2 Success: value = 0x0
[DBG ][QSPIF]: Reading Register 3 Success: value = 0x0
[DBG ][QSPIF]: Reading Config Register Success: value = 0x0
[DBG ][QSPIF]: Inst: 0x6h, addr: 18446744073709551615, tx length: 0, rx length: 0
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x6h, addr: 18446744073709551615, tx length: 0, rx length: 0
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x1h, addr: 18446744073709551615, tx length: 3, rx length: 0
[DBG ][QSPIF]: Writing Status Registers Success: reg 1 value = 0x40, reg 2 value = 0x0
[DBG ][QSPIF]: Writing Register 3 Success: value = 0x2
[DBG ][QSPIF]: fast mode enable - Writing Config Register Success: value = 0x2
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Reading Status Register 1 Success: value = 0x40
[DBG ][QSPIF]: Inst: 0x15h, addr: 18446744073709551615, tx length: 0, rx length: 2
[DBG ][QSPIF]: Reading Status Register 2 Success: value = 0x0
[DBG ][QSPIF]: Reading Register 3 Success: value = 0x2
[DBG ][QSPIF]: Verifying Register Success: status = 0x40 config 1 = 0x0 config 2 = 0x2
[DBG ][QSPIF]: Init - Setting Quad Enable
[DBG ][QSPIF]: Setting QE Bit, Bit 6 of Status Reg 1
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Reading Status Register 1 Success: value = 0x40
[DBG ][QSPIF]: Inst: 0x15h, addr: 18446744073709551615, tx length: 0, rx length: 2
[DBG ][QSPIF]: Reading Status Register 2 Success: value = 0x0
[DBG ][QSPIF]: Reading Register 3 Success: value = 0x2
[DBG ][QSPIF]: Inst: 0x6h, addr: 18446744073709551615, tx length: 0, rx length: 0
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x1h, addr: 18446744073709551615, tx length: 3, rx length: 0
[DBG ][QSPIF]: Writing Status Registers Success: reg 1 value = 0x40, reg 2 value = 0x0
[DBG ][QSPIF]: Writing Register 3 Success: value = 0x2
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Reading Status Register 1 Success: value = 0x40
[DBG ][QSPIF]: Inst: 0x15h, addr: 18446744073709551615, tx length: 0, rx length: 2
[DBG ][QSPIF]: Reading Status Register 2 Success: value = 0x0
[DBG ][QSPIF]: Reading Register 3 Success: value = 0x2
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][SFDP]: No Sector Map Table
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Clearing block protection via status register protection bits
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Reading Status Register 1 Success: value = 0x40
[DBG ][QSPIF]: Inst: 0x15h, addr: 18446744073709551615, tx length: 0, rx length: 2
[DBG ][QSPIF]: Reading Status Register 2 Success: value = 0x0
[DBG ][QSPIF]: Reading Register 3 Success: value = 0x2
[DBG ][QSPIF]: Inst: 0x6h, addr: 18446744073709551615, tx length: 0, rx length: 0
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[DBG ][QSPIF]: Inst: 0x1h, addr: 18446744073709551615, tx length: 3, rx length: 0
[DBG ][QSPIF]: Writing Status Registers Success: reg 1 value = 0x40, reg 2 value = 0x0
[DBG ][QSPIF]: Writing Register 3 Success: value = 0x2
[DBG ][QSPIF]: Inst: 0x5h, addr: 18446744073709551615, tx length: 0, rx length: 1
[INFO][BLCO]: WSF Cordio tracing enabled
[INFO][BLE ]: Allocated 8192 bytes for Cordio
[INFO][BLE ]: BLE features enabled: EXTENDED_ADVERTISING GATT_CLIENT GATT_SERVER PERIODIC_ADVERTISING PHY_MANAGEMENT PRIVACY SECURE_CONNECTIONS SECURITY SIGNING WHITELIST
[INFO][BLE ]: BLE roles enabled: PERIPHERAL CENTRAL
[INFO][BLE ]: Initialising Cordio host stack
[DBG ][BLE ]: HCI handler id: 0
[DBG ][BLE ]: DM handler id: 1
[DBG ][BLE ]: L2C slave handler id: 2
[DBG ][BLE ]: ATT handler id: 3
[DBG ][BLE ]: SMP handler id: 4
[DBG ][BLE ]: stack handler id: 5
[INFO][BLE ]: Initialising BLE instance
[INFO][BLHC]: CordioHCIDriver initializing
[DBG ][BLE ]: Cordio HCI reset started
[DBG ][BLE ]: Reset sequence command complete: 0c03
[DBG ][BLE ]: Reset sequence command complete: 0c01
[DBG ][BLE ]: Reset sequence command complete: 2001
[DBG ][BLE ]: Reset sequence command complete: 0c63
[DBG ][BLE ]: Reset sequence command complete: 1009
[INFO][BLPR]: Initialize privacy PAL
[INFO][BLDM]: Set random address - address=46:bf:c3:70:67:f5
[DBG ][BLE ]: Reset sequence command complete: 2005
[DBG ][BLE ]: Reset sequence command complete: 2002
[DBG ][BLE ]: Reset sequence command complete: 201c
[DBG ][BLE ]: Reset sequence command complete: 200f
[DBG ][BLE ]: Reset sequence command complete: 2003
[DBG ][BLE ]: Reset sequence command complete: 202a
[DBG ][BLE ]: Reset sequence command complete: 202f
[DBG ][BLE ]: Reset sequence command complete: 2024
[DBG ][BLE ]: Reset sequence command complete: 1001
[DBG ][BLE ]: Reset sequence command complete: 203a
[DBG ][BLE ]: Reset sequence command complete: 203b
[DBG ][BLE ]: Reset sequence command complete: 204a
[DBG ][BLE ]: Reset sequence command complete: 2018
[DBG ][BLE ]: Reset sequence command complete: 2018
[DBG ][BLE ]: Reset sequence command complete: 2018
[DBG ][BLE ]: Reset sequence command complete: 2018
[DBG ][BLHC]: Signal cordio HCI reset sequence done
[DBG ][BLE ]: stack_handler received 20
[INFO][BLE ]: Reset sequence complete. Controller supported features:
[INFO][BLE ]: ff:7f:00:00
[INFO][BLE ]: Initialising extended features
[INFO][BLE ]: DmExtAdvInit
[INFO][BLE ]: DmExtScanInit
[INFO][BLE ]: DmExtConnMasterInit
[INFO][BLE ]: DmExtConnSlaveInit
[INFO][BLGS]: Initialize GattServer
[INFO][BLGS]: Add Generic Access Service to the Gatt Server: handle=1
[INFO][BLGS]: Add Device Name characteristic: handle=3
[INFO][BLGS]: Add Appearance characteristic: handle=5
[INFO][BLGS]: Add Peripheral Preferred Connection characteristic: handle=7
[INFO][BLGS]: Add Generic Attribute Service to the Gatt Server: handle=8
[INFO][BLGS]: Add Service Changed characteristic: handle=10
[INFO][BLGS]: Add service with UUID=53880000-65FD-4651-BA8E-91527F06C887 and 5 characteristic(s) to the Gatt Server
[INFO][BLGS]: Insert characteristic 53880001-65FD-4651-BA8E-91527F06C887 - valuePtr=0x2000d240, lenMax=197, len=2, hasVariableLength=true, read_security=NONE, write_security=NONE, properties=[ WRITE_WIT0
[INFO][BLGS]: Insert declaration attribute in characteristic 53880001-65FD-4651-BA8E-91527F06C887
[INFO][BLGS]: Insert value attribute in characteristic 53880001-65FD-4651-BA8E-91527F06C887
[INFO][BLGS]: Successfully inserted characteristic 53880001-65FD-4651-BA8E-91527F06C887: handle=13
[INFO][BLGS]: Insert characteristic 53880002-65FD-4651-BA8E-91527F06C887 - valuePtr=0x2000d305, lenMax=8, len=1, hasVariableLength=true, read_security=NONE, write_security=NONE, properties=[ WRITE ], de0
[INFO][BLGS]: Insert declaration attribute in characteristic 53880002-65FD-4651-BA8E-91527F06C887
[INFO][BLGS]: Insert value attribute in characteristic 53880002-65FD-4651-BA8E-91527F06C887
[INFO][BLGS]: Successfully inserted characteristic 53880002-65FD-4651-BA8E-91527F06C887: handle=15
[INFO][BLGS]: Insert characteristic 53880003-65FD-4651-BA8E-91527F06C887 - valuePtr=0x2000d30d, lenMax=8, len=1, hasVariableLength=true, read_security=NONE, write_security=NONE, properties=[ READ NOTIFY0
[INFO][BLGS]: Insert declaration attribute in characteristic 53880003-65FD-4651-BA8E-91527F06C887
[INFO][BLGS]: Insert value attribute in characteristic 53880003-65FD-4651-BA8E-91527F06C887
[ERR ][BLGS]: Authorisation characteristic count cannot be greater than 20
[ERR ][BLGS]: Failed to insert value attribute
[ERR ][BLGS]: Failed to insert characteristic
[ERR ][FOTA]: error occurred when registering FOTA Service: 7
[INFO][BLGP]: Advertising set 0: set advertising parameters - _advType=CONNECTABLE_UNDIRECTED, _minInterval=100ms, _maxInterval=1280ms, _peerAddressType=PUBLIC, _ownAddressType=RANDOM, _policy=NO_FILTERe
[INFO][BLGP]: Advertising set 0: set extended advertising parameters - _advType=CONNECTABLE_UNDIRECTED, _minInterval=100ms, _maxInterval=1280ms, _peerAddressType=PUBLIC, _ownAddressType=RANDOM, _policy=e
[INFO][BLDM]: Legacy PDU w/undirected advertising event
[INFO][BLDM]: Advertising set 0: update direct advertising parameters - advertising_type=0, peer_address=00:00:00:00:00:00, peer_address_type=PUBLIC
[INFO][BLGP]: Advertising set 0: set advertising data - payload=02:01:06:03:19:00:00:09:09:46:4f:54:41:44:65:6d:6f, minimiseFragmentation=true, scan_response=false
[INFO][BLGP]: Advertising set 0: start advertising - maxDuration=0ms, maxEvents=0
[INFO][BLDM]: Set random address - address=46:bf:c3:70:67:f5
[INFO][BLDM]: Advertising set 0: set random address - address=46:bf:c3:70:67:f5
[INFO][BLDM]: Extended advertising enable - enable=true, number_of_sets=1
[INFO][MAIN]: Device advertising, please connect
[DBG ][BLE ]: stack_handler received 7a
[DBG ][BLE ]: stack_handler received 7a
[DBG ][BLE ]: stack_handler received 7a
[DBG ][BLE ]: stack_handler received 7a
[DBG ][BLE ]: stack_handler received 47
[INFO][BLGP]: Advertising set started - handles=00
[DBG ][BLE ]: Connection 1 - Initialise CCC table
[DBG ][BLE ]: stack_handler received 27
[DBG ][BLGP]: GAP event of type CONNECTION_COMPLETE received
[INFO][BLGP]: Connection 1 successfully completed - role=PERIPHERAL, peer_address_type=RANDOM peer_address=da:e8:90:c7:24:5c, connection_interval=24, connection_latency=0, supervision_timeout=72, local_0
[INFO][BLDM]: Advertising enable - enable=false
[INFO][MAIN]: Client connected, you may now subscribe to updates
[INFO][BLSM]: Connection 1 - Request authentication
[ERR ][BLSM]: Failure, DB not initialized
[DBG ][BLE ]: stack_handler received 48
[INFO][BLGP]: Advertising set 0 on connection 0 terminated - status=SUCCESS, number_of_completed_extended_advertising_events=0 
[DBG ][BLE ]: stack_handler received 41
[INFO][MAIN]: data length change - connection: 0x00000001
[INFO][MAIN]: tx_size: 204, rx_size: 204
[DBG ][BLE ]: stack_handler received 46
[INFO][MAIN]: phy update complete - status: 0x00
[INFO][MAIN]: tx_phy: 2, rx_phy: 2
[DBG ][BLE ]: stack_handler received 41
[INFO][MAIN]: data length change - connection: 0x00000001
[INFO][MAIN]: tx_size: 204, rx_size: 204
[DBG ][BLAT]: ATT event: 16 status: 00
[INFO][BLGS]: Connection 1: Att MTU changed, new MTU size is 200 bytes

++ MbedOS Fault Handler ++

FaultType: HardFault

Context:
R0   : 36342D44
R1   : 00000002
R2   : 200027B1
R3   : 200027B1
R4   : 36342D44
R5   : 20002388
R6   : 0000FFFF
R7   : 2000D0D0
R8   : 00000002
R9   : 0000FFFF
R10  : 200027B1
R11  : 00000002
R12  : 00000001
SP   : 2000D088
LR   : 00044EBB
PC   : 0004494A
xPSR : 810F0000
PSP  : 2000D020
MSP  : 2003FFC0
CPUID: 410FC241
HFSR : 40000000
MMFSR: 00000000
BFSR : 00000082
UFSR : 00000000
DFSR : 00000000
AFSR : 00000000
BFAR : 36342D52
Mode : Thread
Priv : Privileged
Stack: PSP

-- MbedOS Fault Handler --



++ MbedOS Error Info ++
Error Status: 0x80FF013D Code: 317 Module: 255
Error Message: Fault exception
Location: 0x4494A
Error Value: 0x20000100
Current Thread: main Id: 0x20001680 Entry: 0x24347 StackSize: 0x8000 StackMem: 0x20005558 SP: 0x2000D088 
For more info, visit: https://mbed.com/s/error?error=0x80FF013D&tgt=NRF52840_DK
-- MbedOS Error Info --

= System will be rebooted due to a fatal error =
= Reboot count(=1) reached maximum, system will halt after rebooting =

I've tried to reproduce the issue using the BLE_GattServer_Experimental example in mbed-os-example-ble by building it with similar configuration, enabling mbed-trace, and using the latest mbed-os master branch (commit hash as above). For some reason that example application works whereas this one does not.

I'm thinking there may be some issue with the (very nice to have) BLE traces. Perhaps it is related to the fact that this FOTAService uses 128-bit UUIDs? I couldn't pinpoint what was going on and it stumped me for several hours....

I will write up a guide on how to build, sign, and test this tomorrow. It requires the use of the mbed-mcuboot-demo bootloader (see my repositories) and the build steps are similar to what's in that README.

I haven't tested anything beyond starting a FOTA session (and the subsequent erasure of the update BD). The PeriodicBlockDeviceEraser in this repository breaks up a large erase operation into many small ones so as not to block the BLE process for too long.

[pan-]

Indeed, it is quite nice to have the traces!

[ERR ][BLGS]: Authorisation characteristic count cannot be greater than 20
[ERR ][BLGS]: Failed to insert value attribute
[ERR ][BLGS]: Failed to insert characteristic
[ERR ][FOTA]: error occurred when registering FOTA Service: 7

Seems suspicious. have you tried to change the max-characteristic-authorisation-count setting ?

[ERR ][BLSM]: Failure, DB not initialized

Is probably unrelated.

[AGlass0fMilk]

Yes, I have tried to change that setting. It doesn't really help. I've set it to 40, and up to 64. Even if the service is added successfully, the application always crashes when a connection is made.

I'm not sure how adding a single service with 5 characteristics could exceed the default maximum of 20 characteristics with authorization. None of the FOTA characteristics have authorization specified by default.

You would know better than me, but my guess is maybe the CCCD for notifiable characteristics might have authorization by default?

I'm not sure why this happens for the FOTA Service on master and not the LinkLoss or CurrentTime services, the only difference I see is that the FOTA service uses long-format UUIDs.

Are long-format UUIDs tested in the automated BLE integration tests?

[AGlass0fMilk]

@pan- I have a working example and update python script.

You can flash OUTPUTS/bootloader.hex and OUTPUTS/signed-v0.1.0.hex and then run the test_fota.py script in the scripts subdirectory.

I have a few ideas for how we can streamline the build/update process. I will write these up before my vacation begins tomorrow.

[pan-]

Awesome, what was the Mbed issue ?

[AGlass0fMilk]

Awesome, what was the Mbed issue ?

The solution was to build with mbed-os-6.9.0, master is still broken 😅

[AGlass0fMilk]

Also, those binaries are for the nRF52840_DK target.

EDIT: @pan- You might be able to recreate the issue here with a simpler example (that doesn't require all the signing and bootloader complexity) by simply building the FOTA service integration test with mbed-os master.