[GitHub] [mynewt-mcumgr] t3zeng commented on issue #161: SMP notifications corrupted on apollo3
t3zeng commented on issue #161: URL: https://github.com/apache/mynewt-mcumgr/issues/161#issuecomment-1143052658 Hey guys, you can reproduce this by running the bleprph app and then try to perform an image read. Repro steps: 1. Load bleprph app onto apollo3 evb and boot up 2. On your phone, go to nRF Connect Device Manager and look for the evb 3. Go to the `Image` tab at the bottom and then go to the top right and press `Advanced` 4. A new `Images` section will pop up. Press read 5. At this point there will be BLE comms with the apollo3 evb but the image data will fail to be retrieved What I observe is that in `/apache-mynewt-core/mgmt/smp/transport/ble/src/smp_ble.c`, if you print out the contents of `om` in `smp_ble_out` that gets put onto the mqueue, it will not match the contents when you get the mbuff back in `smp_ble_event_data_in` even though the address of the mbuf is the same. I set a watchpoint on the address of the corrupted mbuf and was able to get the following backtrace: ``` #0 smp_tx_rsp (ns=, rsp=0x100025a4 , arg=0x10002f80 ) at repos/apache-mynewt-core/mgmt/smp/src/smp.c:226 #1 0x0001c418 in smp_process_request_packet (streamer=streamer@entry=0x10002f80 , req=0x10004408 ) at repos/apache-mynewt-mcumgr/smp/src/smp.c:365 #2 0x00016e50 in smp_process_packet (st=0x10002f80 ) at repos/apache-mynewt-core/mgmt/smp/src/smp.c:265 #3 0x00016e78 in smp_event_data_in (ev=) at repos/apache-mynewt-core/mgmt/smp/src/smp.c:293 #4 0x00015526 in os_eventq_run (evq=) at repos/apache-mynewt-core/kernel/os/src/os_eventq.c:196 #5 0x00014aea in main () at apps/bleprph/src/main.c:356 ``` What seems to happen is that in this line of code the mbuf returned is the same address as the one used to store the notify data so the mbuf gets corrupted [`apache-mynewt-mcumgr/smp/src/smp.c`, ](https://github.com/apache/mynewt-mcumgr/blob/a4dfaad8136c43e6b72c228535abf8fe644aab29/smp/src/smp.c#L347) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: commits-unsubscr...@mynewt.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [mynewt-mcumgr] simonratner commented on issue #161: SMP notifications corrupted on apollo3
simonratner commented on issue #161: URL: https://github.com/apache/mynewt-mcumgr/issues/161#issuecomment-1143015680 cc @t3zeng -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: commits-unsubscr...@mynewt.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [mynewt-mcumgr] simonratner opened a new issue, #161: SMP notifications corrupted on apollo3
simonratner opened a new issue, #161:
URL: https://github.com/apache/mynewt-mcumgr/issues/161
SMP notifications used to deliver SMP responses over BLE transport are
corrupted on the
[apollo3_evb](https://github.com/apache/mynewt-core/tree/master/hw/bsp/apollo3_evb).
Below is a sample log from nRF Connect app attempting an `image list`
command (as part of the DFU process). You can see the response being fragmented
over two notifications, with the second notification corrupted. As a result,
the concatenated CBOR is not decodable. The response does not need to be
corrupted - the issue exists even for single-packet responses.
This is reproducible with stock
[bleprph](https://github.com/apache/mynewt-nimble/tree/master/apps/bleprph) on
[apollo3_evb](https://github.com/apache/mynewt-core/tree/master/hw/bsp/apollo3_evb).
This is NOT reproducible with the same app on
[nordic_pca10056](https://github.com/apache/mynewt-core/tree/master/hw/bsp/nordic_pca10056).
Error can be observed with the nRF Connect app or the nRF Device Manager app
for Android/iOS (CBOR Error).
```
V17:20:50.573Connecting to 66:77:88:23:BB:EF...
D17:20:50.573gatt = device.connectGatt(autoConnect = false,
TRANSPORT_LE, preferred PHY = LE 1M)
D17:20:56.145[Callback] Connection state changed with status: 133
and new state: DISCONNECTED (0)
E17:20:56.150Error 133 (0x85): GATT ERROR
I17:20:56.150Disconnected
D17:20:58.707gatt.close()
D17:20:58.709wait(200)
V17:20:58.910Connecting to 66:77:88:23:BB:EF...
D17:20:58.910gatt = device.connectGatt(autoConnect = false,
TRANSPORT_LE, preferred PHY = LE 1M)
D17:21:02.715[Callback] Connection state changed with status: 0 and
new state: CONNECTED (2)
I17:21:02.715Connected to 66:77:88:23:BB:EF
V17:21:02.715Requesting new MTU...
D17:21:02.715gatt.requestMtu(517)
I17:21:03.159Connection parameters updated (interval: 7.5ms,
latency: 0, timeout: 5000ms)
I17:21:03.391MTU changed to: 256
V17:21:03.398Discovering services...
D17:21:03.398gatt.discoverServices()
D17:21:03.404[Callback] Services discovered with status: 0
I17:21:03.404Services discovered
V17:21:03.406Generic Access (0x1800)
- Device Name [R] (0x2A00)
- Appearance [R] (0x2A01)
Device Information (0x180A)
- Model Number String [R] (0x2A24)
- Serial Number String [R] (0x2A25)
- Firmware Revision String [R] (0x2A26)
- Manufacturer Name String [R] (0x2A29)
SMP Service (8d53dc1d-1db7-4cd3-868b-8a527460aa84)
- SMP Characteristic [N WNR] (da2e7828-fbce-4e01-ae9e-261174997c48)
Client Characteristic Configuration (0x2902)
I17:21:03.474Connection parameters updated (interval: 45.0ms,
latency: 0, timeout: 5000ms)
V17:21:08.902[McuMgr] Connecting...
D17:21:08.905[McuMgr] gatt = device.connectGatt(autoConnect = false,
TRANSPORT_LE, LE 1M)
D17:21:08.953[McuMgr] [Callback] Connection state changed with
status: 0 and new state: 2 (CONNECTED)
I17:21:08.958[McuMgr] Connected to 66:77:88:23:BB:EF
D17:21:08.962[McuMgr] wait(300)
I17:21:08.966[McuMgr] MTU changed to: 256
V17:21:09.266[McuMgr] Discovering services...
D17:21:09.271[McuMgr] gatt.discoverServices()
I17:21:09.276[McuMgr] Services discovered
V17:21:09.286[McuMgr] Primary service found
V17:21:09.290[McuMgr] Requesting new MTU...
D17:21:09.292[McuMgr] gatt.requestMtu(498)
I17:21:09.370[McuMgr] MTU changed to: 256
D17:21:09.374[McuMgr]
gatt.setCharacteristicNotification(da2e7828-fbce-4e01-ae9e-261174997c48, true)
V17:21:09.378[McuMgr] Enabling notifications for
da2e7828-fbce-4e01-ae9e-261174997c48
D17:21:09.381[McuMgr]
gatt.writeDescriptor(2902--1000-8000-00805f9b34fb, value=0x01-00)
I17:21:09.459[McuMgr] Data written to descr.
2902--1000-8000-00805f9b34fb, value: (0x) 01-00
I17:21:09.464[McuMgr] Notifications enabled
A17:21:09.470[McuMgr] Sending (10 bytes) Header (Op: 0, Flags: 0,
Len: 2, Group: 1, Seq: 0, Command: 0) CBOR {}
V17:21:09.480[McuMgr] Writing characteristic
da2e7828-fbce-4e01-ae9e-261174997c48 (WRITE COMMAND)
D17:21:09.484[McuMgr]
gatt.writeCharacteristic(da2e7828-fbce-4e01-ae9e-261174997c48)
I17:21:09.489[McuMgr] Data written to
da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x) 00-00-00-02-00-01-00-00-BF-FF
I17:21:09.648[McuMgr] Notification received from
da2e7828-fbce-4e01-ae9e-261174997c48, value: (0x)
01-00-00-FC-00-01-00-00-BF-66-69-6D-61-67-65-73-9F-BF-64-73-6C-6F-74-00-67-76-65-72-73-69-6F-6E-69-31-2E-30-2E-30-2E-34-37-39-64-68-61-73-68-58-20-B2-27-75-77-F3-C1-C3-BF-E5-AA-26-64-7C-DF-77-AD-26-27-C8-EC-58-E
[GitHub] [mynewt-nimble] apache-mynewt-bot commented on pull request #1271: L2CAP COC: added buffers for incoming SDU
apache-mynewt-bot commented on PR #1271:
URL: https://github.com/apache/mynewt-nimble/pull/1271#issuecomment-1142433422
## Style check summary
### Our coding style is
[here!](https://github.com/apache/mynewt-core/blob/master/CODING_STANDARDS.md)
nimble/host/src/ble_l2cap_coc.c
```diff
@@ -193,7 +193,7 @@
BLE_HS_DBG_ASSERT(rx != NULL);
rx_sdu = rx->sdu[current_sdu];
-//rx->sdu[current_sdu] = rx_sdu;
+/*rx->sdu[current_sdu] = rx_sdu; */
DFLT_LOG_CRITICAL("current_sdu: %d\n", current_sdu);
@@ -235,7 +235,7 @@
BLE_HS_LOG(DEBUG, "sdu_len=%d, received LE frame=%d, credits=%d\n",
sdu_len, om_total, rx->credits);
-os_mbuf_adj(*om , BLE_L2CAP_SDU_SIZE);
+os_mbuf_adj(*om, BLE_L2CAP_SDU_SIZE);
rc = os_mbuf_appendfrom(rx_sdu, *om, 0, om_total -
BLE_L2CAP_SDU_SIZE);
if (rc != 0) {
@@ -261,7 +261,7 @@
ble_l2cap_disconnect(chan);
return BLE_HS_EBADDATA;
}
-rc = os_mbuf_appendfrom(rx_sdu, *om, 0, om_total);
+rc = os_mbuf_appendfrom(rx_sdu, *om, 0, om_total);
if (rc != 0) {
/* FIXME: need to handle it better */
BLE_HS_LOG(DEBUG, "Could not append data rc=%d\n", rc);
@@ -287,7 +287,7 @@
} else {
current_sdu = 0;
}
-//rx_sdu = rx_sdu_list[current_sdu];
+/*rx_sdu = rx_sdu_list[current_sdu]; */
rx->data_offset = 0;
ble_l2cap_event_coc_received_data(chan, sdu_rx);
@@ -345,12 +345,12 @@
chan->rx_fn = ble_l2cap_coc_rx_fn;
chan->coc_rx.mtu = mtu;
rx_sdu_list[0] = sdu_rx;
-for(int i = 1; i < BLE_L2CAP_SDU_BUFF_CNT; i++) {
+for (int i = 1; i < BLE_L2CAP_SDU_BUFF_CNT; i++) {
rx_sdu_list[i] = NULL;
}
chan->coc_rx.sdu = rx_sdu_list;
chan->coc_tx.sdu = tx_sdu_list;
-//chan->coc_rx.sdu = sdu_rx;
+/*chan->coc_rx.sdu = sdu_rx; */
/* Number of credits should allow to send full SDU with on given
@@ -617,8 +617,10 @@
break;
}
}
-//assert(chan->coc_rx.sdu[0] || chan->coc_rx.sdu[1]);
-//chan->coc_rx.sdu = sdu_rx;
+/*
+ assert(chan->coc_rx.sdu[0] || chan->coc_rx.sdu[1]);
+ chan->coc_rx.sdu = sdu_rx;
+ */
ble_hs_lock();
conn = ble_hs_conn_find_assert(chan->conn_handle);
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscr...@mynewt.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
[GitHub] [mynewt-nimble] jrotkiewicz opened a new pull request, #1271: L2CAP COC: added buffers for incoming SDU
jrotkiewicz opened a new pull request, #1271: URL: https://github.com/apache/mynewt-nimble/pull/1271 This allows to process more data while receiving another. @sjanc -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: commits-unsubscr...@mynewt.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
[GitHub] [mynewt-newtmgr] niclas-ats opened a new pull request, #191: nmp decode: allow registration of custom response handlers
niclas-ats opened a new pull request, #191: URL: https://github.com/apache/mynewt-newtmgr/pull/191 This PR allows the to use custom smp commands (e.g. using the peruser group). The implementation of the commands is not part of this PR since Go allowed me to extend the the library without forking the repo. The only thing that must be changed is the possibility to register the custom response handlers. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: commits-unsubscr...@mynewt.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
