nrf52840: BLE Connection resets if sent data lenght is bigger than MTU size

[wlamprecht]

Description

Tagret: Nordic nRF52840
Toolchain: mbed cli 1.7.5, arm-gcc

Source code changes:
in mbed-os/features/FEATURE_BLE/ble/services/UARTService.h:
change BLE_UART_SERVICE_MAX_DATA_LEN to 40
static const unsigned BLE_UART_SERVICE_MAX_DATA_LEN = 40;

How to reproduce:
Flash Nordic BLE UART Service (https://os.mbed.com/teams/Bluetooth-Low-Energy/wiki/UART-access-over-BLE) to nrf52840
Connect to BLE UART service with nrfConnect Android App
Send a packet bigger than MTU sixe (23) and smaller than BLE_UART_SERVICE_MAX_DATA_LEN (40) to the device (RX Characteristic)

Outcome on mesage GATT_EVENT_WRITE_AUTHORIZATION_REQ:

In file mbed-os/features/FEATURE_BLE/targets/TARGET_NORDIC/TARGET_NRF52/source/nRF5xGattServer.cpp
int characteristicIndex = resolveValueHandleToCharIndex(handle_value); is -1
this causes a target reset in line
uint16_t write_authorization = p_characteristics[characteristicIndex]->authorizeWrite(&cbParams);

Issue request type

[ ] Question
[ ] Enhancement
[x] Bug

[ciarmcom]

Internal Jira reference: https://jira.arm.com/browse/MBOCUSTRIA-108

[desmond-blue]

Because the default MTU size for nRF52840 is 23, so you need to change mbed_lib.json in the target softdevice folder(It should be TARGET_SOFTDEVICE_S140_FULL for nRF52840).
Changing NRF_SDK_BLE_GATT_MAX_MTU_SIZE should be able to resolve your problem.
{
"name": "softdevice",
"macros": [
...
"NRF_SDH_BLE_GATT_MAX_MTU_SIZE=40",
...
}

[welaZat]

Hi
If I set the NRF_SDK_BLE_GATT_MAX_MTU_SIZE to 40 and send a packet (>40Bytes) from the nrfConnect app to the device i still get thesame Error.
The target still resets after executing this line:
uint16_t write_authorization = p_characteristics[characteristicIndex]->authorizeWrite(&cbParams);
from file mbed-os/features/FEATURE_BLE/targets/TARGET_NORDIC/TARGET_NRF52/source/nRF5xGattServer.cpp because the characteristicIndex] is -1 in any case, when the sent packet is bigger than the MTU size.

[desmond-blue]

You are correct, if Master sends a packet exceeding NRF_SDK_BLE_GATT_MAX_MTU_SIZE, the same error occurs.
First, I think nrfConnect should be able to prevent sending this kind packet because the peer already told it the max MTU size.
Second, the event and the index value returned from Nordic SoftDevice are wrong, the event should be GATT_EVENT_DATA_WRITTEN, the stack is messed up by the illegal packet so even if we handle this case, I believe there would exist other issues.

The current SoftDevice is a little bit old, I would suggest that we verify this issue until SofDevice getting updated, before that, Master should follow the parameters negotiated.

[wlamprecht]

According to the Bluetooth specs it is possible to send messages bigger than the MTU size. If the sent packet is bigger than the MTU size, the BLE stack splits the message into multiple packets and sends them with a "Prepare Write Request".
I sniffed the packets with wireshark. It seems, that everything works fine until the last packet segment is sent. The only missing transmitted packet is the "Rcvd Execute Write Request" as shown in the following picture.

If I comment out following line:
uint16_t write_authorization = p_characteristics[characteristicIndex]->authorizeWrite(&cbParams);
from file mbed-os/features/FEATURE_BLE/targets/TARGET_NORDIC/TARGET_NRF52/source/nRF5xGattServer.cpp everything works as expected and the Master also sends the "Rcvd Execute Write Request".

[desmond-blue]

Thank you for the sniffer trace, now I get it.
There is no handle value of Execute Write Request, so the handle value from the request would be incorrect, the handle value should be parsed from the previous received packets.

[wlamprecht]

Will this be fixed or do I have to implement my own solution?
Thanks

[desmond-blue]

This should be fixed.
If you already have a solution, you are welcome to contribute to this project!

[desmond-blue]

@wlamprecht It's a little bit late, this issue is fixed in #9143 , would you mind checking if this solve your problem? Thanks!