Hard Fault during mg_send

[paolopepe00]

I'm using a STM32H743VIT board and I have a TCP client that continuously sends messages in a loop to a remote host. The issue is that, after a few successful iterations where messages are correctly received by the remote device, the system अचानक triggers a HardFault inside the mg_send function, specifically at this point:

bool mg_send(struct mg_connection *c, const void *buf, size_t len) {
  struct mg_tcpip_if *ifp = c->mgr->ifp;

While debugging, I observed that the ifp pointer appears to reference a memory region that is not accessible or valid. However, I do not understand why the HardFault does not occur immediately, but only after several successful transmissions.

[scaprile]

This is not a Mongoose issue, this is your issue using Mongoose. Moved to Q&A
I can't tell without debugging your code. Our code is CI/CD and hardware tested.
Please follow your HardFault, see where that memory area is, see why your code ends up pointing there, fix it. Mongoose just allocs 4 buffers where you tell it to do it; assuming you are using our TCP/IP stack, thing you don't say (you didn't fill the template when you opened your issue, btw), something in your code may be trashing your memory, or you may not be using Mongoose properly, or with a small stack/heap on an RTOS (another unknown).

Please see our documentation, and follow the guidelines in our tutorials.
Check memory placement guidelines here: https://mongoose.ws/documentation/tutorials/hardware/#memory-placement-and-caches
; not all memory is available for the ETH in those microcontrollers, and if you're using Cube (another unknown) it surely is allocated without concern.

[paolopepe00]

@scaprile Sorry for missing some information.
Yes, I am using the TCP/IP stack and Cube. Below, I am sharing the mongoose_config.h configuration file:

#define MG_ARCH MG_ARCH_NEWLIB
#define MG_ENABLE_MIP 1
#define MG_ENABLE_TCPIP 1
#define MG_ENABLE_CUSTOM_MILLIS 1
#define MG_ENABLE_DRIVER_STM32H 1
#define MG_ENABLE_PRINT_DEBUG_STATS 1

#define MG_TCPIP_IP MG_IPV4(xxxxxx)
#define MG_TCPIP_GW MG_IPV4(xxxxxx)

#define MG_TCPIP_MASK MG_IPV4(xxxxxx)

For the rest, I left everything with the default values automatically generated by the IDE.
I’m also sharing a part of main.c. Keep in mind that what I want to do is:

• Read the signal using ADC + DMA
• When a certain condition occurs, send a signal via Modbus TCP (I build the packet myself in the correct format)
• Meanwhile, I also open another listening connection, which I need for other tasks.

static void send_modbus_write_multiple(struct mg_connection *conn,
                                       uint16_t transaction_id,
                                       uint16_t start_addr,
                                       uint16_t *values,
                                       uint16_t quantity) {
  uint8_t pkt[13 + 10];  // 13 byte header+PDU base + 10 byte dati (5 registri)
  uint8_t i;

  uint8_t byte_count = quantity * 2;
  uint8_t length = 7 + byte_count;
  // UnitID(1) + Function(1) + Addr(2) + Qty(2) + ByteCount(1) + Data(N)

  // --- MBAP HEADER ---
  pkt[0] = transaction_id >> 8;
  pkt[1] = transaction_id & 0xFF;
  pkt[2] = 0x00;  // Protocol ID
  pkt[3] = 0x00;
  pkt[4] = length >> 8;
  pkt[5] = length & 0xFF;
  pkt[6] = 0x01;  // Unit ID

  // --- PDU ---
  pkt[7]  = 0x10;                   // Function code
  pkt[8]  = start_addr >> 8;        // Start address
  pkt[9]  = start_addr & 0xFF;
  pkt[10] = quantity >> 8;          // Quantity
  pkt[11] = quantity & 0xFF;
  pkt[12] = byte_count;             // Byte count

  for (i = 0; i < quantity; i++) {
    pkt[13 + i*2]     = values[i] >> 8;
    pkt[13 + i*2 + 1] = values[i] & 0xFF;
  }

  mg_send(conn, pkt, 13 + byte_count);
}




int main(void)
{

  /* USER CODE BEGIN 1 */

  /* USER CODE END 1 */

  /* MPU Configuration--------------------------------------------------------*/
  MPU_Config();

  /* MCU Configuration--------------------------------------------------------*/

  /* Reset of all peripherals, Initializes the Flash interface and the Systick. */
  HAL_Init();

  /* USER CODE BEGIN Init */

  /* USER CODE END Init */

  /* Configure the system clock */
  SystemClock_Config();

  /* USER CODE BEGIN SysInit */

  /* USER CODE END SysInit */

  /* Initialize all configured peripherals */
  MX_GPIO_Init();
  MX_DMA_Init();
  MX_ETH_Init();
  MX_ADC1_Init();
  MX_TIM8_Init();
  /* USER CODE BEGIN 2 */

  mg_mgr_init(&mgr);
  mg_log_set(MG_LL_DEBUG);



  HAL_ADCEx_Calibration_Start(&hadc1, ADC_CALIB_OFFSET, ADC_SINGLE_ENDED);
  HAL_TIM_Base_Start_IT(&htim8);
  HAL_ADC_Start_DMA(&hadc1, (uint32_t*) adcData, ADC_CHANNELS * DMA_BLOCK_SIZE);



    static uint16_t tx_id = 1;
  /* USER CODE END 2 */

  /* Infinite loop */
  /* USER CODE BEGIN WHILE */
    //conn_tcp = mg_listen(&mgr, "tcp://0.0.0.0:80", tcp_ev_handler, NULL);

  while (1)
  {
	  mg_mgr_poll(&mgr, 100);

		if (dma_half_ready)
		{
			dma_half_ready = 0;
			compute_stats(0, DMA_HALF_BLOCK_SIZE);


		    if(system_state == START_CALIBRATION && local_count == LOCAL_BUFFER_SIZE)
		    {
		    		system_state = CALIBRATION;
		    		tcp_ready_to_send = true;
		    }


		}


		if (dma_full_ready)
		{
			dma_full_ready = 0;
			compute_stats(DMA_HALF_BLOCK_SIZE, DMA_HALF_BLOCK_SIZE);

		    if(system_state == START_CALIBRATION && local_count == LOCAL_BUFFER_SIZE)
		    {
		    		system_state = CALIBRATION;
		    		tcp_ready_to_send = true;
		    }

		}

		  if (conn == NULL) {
			if (mgr.ifp->state == MG_TCPIP_STATE_READY && connected == 0) {
			  conn = mg_connect(&mgr, "tcp://xxxxx:502", NULL, NULL);

			  connected = 1;
			  continue;
			}
		  }
		  if (conn != NULL)
		  {
			      send_modbus_write_multiple(conn, tx_id++, 0x9C54, signals_to_send, 5);
			      registers_need_update = false;

		  }

    /* USER CODE END WHILE */

    /* USER CODE BEGIN 3 */
  }
  /* USER CODE END 3 */
}

[scaprile]

Please read the documentation I linked you to.
You are not using Mongoose properly. We never call mg_send out of an event handler.
If for some reason, your connection fails, you see it as NULL, you create a new connection, then the following line, because you don't use an else clause, picks that up and tries to send. That connection is still trying to see where to send a TCP SYN and you are calling mg_send. We never do something like that in any of our tutorials or examples.
Please read the documentation I linked you to.
You have examples on how to do TCP clients and servers, we already have Modbus support, we tell you how to handle errors, etc. etc. etc.
If you are a paying customer, please contact us at Support as per your contract.

[zzambia]

@scaprile there is no else clause but there is the continue. The mg_send is anyway called into a main loop, not via any event handler. That's not perfect code, but not faulty by default. There should be something else IMHO.

[scaprile]

I didn't see the continue, my fault, but, what I described will happen in the next iteration.
Calling mg_connect just creates the connection structure and tries to send a SYN, the rest will happen once the other end answers. You have a good value for 'conn', but its contents may not be valid yet. They start to be valid once you receive this event:

mongoose/tutorials/tcp/tcp/main.c

Lines 16 to 21 in eefec28

	static void cfn(struct mg_connection *c, int ev, void *ev_data) {
	int *i = &((struct c_res_s *) c->fn_data)->i;
	if (ev == MG_EV_OPEN) {
	MG_INFO(("CLIENT has been initialized"));
	} else if (ev == MG_EV_CONNECT) {
	MG_INFO(("CLIENT connected"));

But you don't have an event handler, like the tutorial shows.
Your connection may also be closing or just closed, hence 'conn' is still valid, and you're still pushing stuff to the buffer.
Also, when using our TCP/IP stack, the second parameter to mg_mgr_poll() is bogus, so nothing slows that loop down, except internal processing.

This is one thing I saw, and I linked you folks to memory placement rules, after describing why. Have you read and tried that ? That is another possibility.
What is the faulty address ? Which memory area does it belong to ?
I can't check all your code, unless you folks are a paying customer and you arrange that by writing to Support.
If I were in your collective shoes, I would check memory placement; then, I would answer my questions; then, I would see how to follow based on those answers.

If you have specific questions based on your debugging, we'll be happy to answer them here.