espressif / esp-idf

Espressif IoT Development Framework. Official development framework for Espressif SoCs.
Apache License 2.0
12.56k stars 7.02k forks source link

Crash in BT controller init (malloc fail in function btdm_controller_init) (IDFGH-12675) #13666

Open damiencampanella opened 3 weeks ago

damiencampanella commented 3 weeks ago

Answers checklist.

IDF version.

v5.2-307-g99daa62628

Espressif SoC revision.

ESP32S3

Operating System used.

Windows

How did you build your project?

Command line with idf.py

If you are using Windows, please specify command line type.

CMD

Development Kit.

ESP32-S3-WROOM-1

Power Supply used.

External 5V

What is the expected behavior?

BT was running fine with IDF 4.4.2.

What is the actual behavior?

I migrated to IDF release 5.2 and I am getting a crash during the bluetooth controller initialization. The only change I made (for the BT related code) was to replace _esp_bluedroidinit(); with _esp_bluedroid_config_t bluedroid_cfg = BT_BLUEDROID_INIT_CONFIG_DEFAULT(); esp_bluedroid_init_with_cfg(&bluedroidcfg);

It seems that there is a malloc fail with idf 5.2.

I tried printing memory usage just prior to calling the function esp_bt_controller_init: I added the following lines:

_heap_caps_get_info(&info, MALLOC_CAP_DEFAULT);
heap_caps_check_integrity_all(true);
heap_caps_check_integrity(MALLOC_CAP_DEFAULT, true);
heap_caps_check_integrity_addr((intptr_t)&info, true);
printf("heap_caps_get_total_size: %zu\n", heap_caps_get_total_size(MALLOC_CAP_DEFAULT));
printf("heap_caps_get_free_size: %zu\n", heap_caps_get_free_size(MALLOC_CAP_DEFAULT));
printf("heap_caps_get_minimum_free_size: %zu\n", heap_caps_get_minimum_free_size(MALLOC_CAP_DEFAULT));
printf("heap_caps_get_largest_free_block: %zu\n", heap_caps_get_largest_free_block(MALLOC_CAP_DEFAULT));_

But it seems that there is plenty of heap memory left: it prints

_heap_caps_get_total_size: 8685604 heap_caps_get_free_size: 8490004 heap_caps_get_minimum_free_size: 8489972 heap_caps_get_largest_free_block: 8257536

I noticed that there was a folder components\bt\controller\esp32s3 for IDF 4.4.2 that is missing for IDF 5.2. I can see in the logs that the esp32c3 controller is called, even if I installed the idf tools using the command install.bat esp32s3.

Steps to reproduce.

I guess that using the code: _esp_bt_controller_mem_release(ESP_BT_MODE_BLE); esp_bt_controller_config_t bt_cfg = BT_CONTROLLER_INIT_CONFIG_DEFAULT(); esp_bt_controller_init(&btcfg); on the same HW should reproduce the issue.

Debug Logs.

Logs before the core dump:

btdm: bss start 0x3fcef180, len 36
btdm: data start 0x3fcef174, data start rom 0x40057350, len 12
MAGIC fadebead VERSION 00010007
I (3322) BLE_INIT: BT controller compile version [30b57c4]
MAGIC fadebead VERSION 00010001

Core Dump log:

#0  0x40379d01 in panic_abort (details=0x3fccda90 "assert failed: block_locate_free tlsf.c:566 (block_size(block) >= size)") at C:/Users/damie/OneDrive/Bureau/Workspace/Flowly/Capteur/ESP-IDF/esp-idf/components/esp_system/panic.c:472
#1  0x40384d64 in esp_system_abort (details=0x3fccda90 "assert failed: block_locate_free tlsf.c:566 (block_size(block) >= size)") at C:/Users/damie/OneDrive/Bureau/Workspace/Flowly/Capteur/ESP-IDF/esp-idf/components/esp_system/port/esp_system_chip.c:93
#2  0x4038af4c in __assert_func (file=<optimized out>, line=<optimized out>, func=<optimized out>, expr=<optimized out>) at C:/Users/damie/OneDrive/Bureau/Workspace/Flowly/Capteur/ESP-IDF/esp-idf/components/newlib/assert.c:81
#3  0x4038a64f in block_locate_free (size=<optimized out>, control=<optimized out>) at C:/Users/damie/OneDrive/Bureau/Workspace/Flowly/Capteur/ESP-IDF/esp-idf/components/heap/tlsf/tlsf.c:566
#4  tlsf_malloc (tlsf=<optimized out>, size=<optimized out>) at C:/Users/damie/OneDrive/Bureau/Workspace/Flowly/Capteur/ESP-IDF/esp-idf/components/heap/tlsf/tlsf.c:1005
#5  0x4038a0e2 in multi_heap_malloc_impl (heap=0x3fcef958, size=40) at C:/Users/damie/OneDrive/Bureau/Workspace/Flowly/Capteur/ESP-IDF/esp-idf/components/heap/multi_heap.c:210
#6  0x4037a342 in heap_caps_malloc_base (size=40, caps=6144) at C:/Users/damie/OneDrive/Bureau/Workspace/Flowly/Capteur/ESP-IDF/esp-idf/components/heap/heap_caps.c:179
#7  0x4037a3af in heap_caps_malloc_default (size=40) at C:/Users/damie/OneDrive/Bureau/Workspace/Flowly/Capteur/ESP-IDF/esp-idf/components/heap/heap_caps.c:236
#8  0x4038af5c in malloc (size=40) at C:/Users/damie/OneDrive/Bureau/Workspace/Flowly/Capteur/ESP-IDF/esp-idf/components/newlib/heap.c:24
#9  0x42045235 in btdm_controller_init ()
#10 0x42013878 in esp_bt_controller_init (cfg=0x3fccdd00) at C:/Users/damie/OneDrive/Bureau/Workspace/Flowly/Capteur/ESP-IDF/esp-idf/components/bt/controller/esp32c3/bt.c:1310

More Information.

No response

zhp0406 commented 3 weeks ago

@damiencampanella 1- The controller library location for Esp32-S3 is at esp-idf/components/bt/controller/lib_esp32c3_family/esp32s3/libbtdm_app.a.

2- Based on your description, your issue may have been fixed in the latest IDF. Please test using the latest IDF. Alternatively, please cherry-pick the following commit 0f29b3cef97d406c5887d79da8592308540cdda0

diff --git a/components/bt/controller/esp32c3/bt.c b/components/bt/controller/esp32c3/bt.c
index dadb5c49ac..b9ea92014d 100644
--- a/components/bt/controller/esp32c3/bt.c
+++ b/components/bt/controller/esp32c3/bt.c
@@ -651,7 +651,7 @@ static bool IRAM_ATTR is_in_isr_wrapper(void)

 static void *malloc_internal_wrapper(size_t size)
 {
-    void *p = heap_caps_malloc(size, MALLOC_CAP_DEFAULT|MALLOC_CAP_INTERNAL|MALLOC_CAP_DMA);
+    void *p = heap_caps_malloc(size, MALLOC_CAP_INTERNAL|MALLOC_CAP_DMA);
     if(p == NULL) {
         ESP_LOGE(BT_LOG_TAG, "Malloc failed");
     }
zhp0406 commented 3 weeks ago

@damiencampanella Please let us know the results of your testing. Thank you.

damiencampanella commented 3 weeks ago

I tried using the latest of master (v5.3-dev-2381-g9f4e8eb0cd) but I am still getting the same crash in btdm_controller_init.

I have reinstalled the tools using install.bat esp32s3, then export.bat. I am now seeing the changes described in the commit you mentioned, but it did not solve my issue.

Do you want the code related to BT in my project to help reproduce the issue?

zhp0406 commented 3 weeks ago

@damiencampanella ok Can you provide us with a DEMO replicating the issue using the latest master branch?

damiencampanella commented 2 weeks ago

I am able to reproduce the issue when I disable everything but the BT.

Please find below the code I flashed, reproducing the crash:

#include "nvs_flash.h"
#include "esp_system.h"
#include <esp_log.h>
#include <esp_err.h>

#include "esp_gap_ble_api.h"
#include "esp_gattc_api.h"
#include "esp_gatt_defs.h"
#include "esp_bt.h"
#include "esp_bt_main.h"
#include "esp_bt_device.h"
#include "esp_gap_bt_api.h"
#include "esp_bt_defs.h"

#include <stdio.h>
#include <string>
#include <cstring>
#include "iostream"

#define BT_SCANNER_LOG_EN 1

#if BT_SCANNER_LOG_EN
#define BT_SCANNER_LOGD( format, ... ) ESP_LOGW(__FILENAME__, "%d : " format, __LINE__, ##__VA_ARGS__)
#define BT_SCANNER_LOGI( format, ... ) ESP_LOGE(__FILENAME__, "%d : " format, __LINE__, ##__VA_ARGS__)
#define BT_SCANNER_LOGE( format, ... ) ESP_LOGI(__FILENAME__, "%d : " format, __LINE__, ##__VA_ARGS__)
#define BT_SCANNER_LOGW( format, ... ) ESP_LOGD(__FILENAME__, "%d : " format, __LINE__, ##__VA_ARGS__)
#else
#define BT_SCANNER_LOGD( format, ... )
#define BT_SCANNER_LOGI( format, ... )
#define BT_SCANNER_LOGE( format, ... )
#define BT_SCANNER_LOGW( format, ... )
#endif

typedef struct {
    uint8_t flags[3];
    uint8_t length;
    uint8_t type;
    uint16_t company_id;
    uint16_t beacon_type;
}__attribute__((packed)) esp_ble_ibeacon_head_t;

typedef struct {
    uint8_t proximity_uuid[16];
    uint16_t major;
    uint16_t minor;
    int8_t measured_power;
}__attribute__((packed)) esp_ble_ibeacon_vendor_t;

typedef struct {
    esp_ble_ibeacon_head_t ibeacon_head;
    esp_ble_ibeacon_vendor_t ibeacon_vendor;
}__attribute__((packed)) esp_ble_ibeacon_t;

using namespace std;

static esp_ble_scan_params_t ble_scan_params = {
   .scan_type = BLE_SCAN_TYPE_ACTIVE,
   .own_addr_type = BLE_ADDR_TYPE_PUBLIC,
   .scan_filter_policy = BLE_SCAN_FILTER_ALLOW_ALL,
   .scan_interval = 0x50,
   .scan_window = 0x30,
   .scan_duplicate = BLE_SCAN_DUPLICATE_DISABLE
};

//const uint8_t uuid_zeros[ESP_UUID_LEN_128] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

/* For iBeacon packet format, please refer to Apple "Proximity Beacon Specification" doc */
/* Constant part of iBeacon data */
esp_ble_ibeacon_head_t ibeacon_common_head = {
    .flags = {0x02, 0x01, 0x06},
    .length = 0x1A,
    .type = 0xFF,
    .company_id = 0x004C,
    .beacon_type = 0x1502
};

esp_ble_ibeacon_head_t ibeacon_common_head1 = {
    .flags = {0x02, 0x01, 0x06},
    .length = 0x1A,
    .type = 0xFF,
    .company_id = 0x4C00,
    .beacon_type = 0x1502
};

bool esp_ble_is_ibeacon_packet(uint8_t* adv_data, uint8_t adv_data_len) {
    bool result = false;

    if ((adv_data != NULL) && (adv_data_len == 0x1E)) {

        if (!memcmp(adv_data, (uint8_t*)&ibeacon_common_head, sizeof(ibeacon_common_head))) {
            result = true;
        }
        else if (!memcmp(adv_data, (uint8_t*)&ibeacon_common_head1, sizeof(ibeacon_common_head))) {
            result = true;
        }
    }

    return result;
}

static void process_gap(esp_ble_gap_cb_param_t* scan_result)
{

}

static void esp_ble_gap_cb(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t* param)
{

    esp_err_t err;

    switch (event) {
    case ESP_GAP_BLE_ADV_DATA_RAW_SET_COMPLETE_EVT: {
        //pour être emetteur
        break;
    }
    case ESP_GAP_BLE_SCAN_PARAM_SET_COMPLETE_EVT: {
        //the unit of the duration is second, 0 means scan permanently
        uint32_t duration = 0;
        esp_ble_gap_start_scanning(duration);
        break;
    }
    case ESP_GAP_BLE_SCAN_START_COMPLETE_EVT:
        //scan start complete event to indicate scan start successfully or failed
        if ((err = param->scan_start_cmpl.status) != ESP_BT_STATUS_SUCCESS) {
            BT_SCANNER_LOGE("Scan start failed: %s", esp_err_to_name(err));
        }
        break;
    case ESP_GAP_BLE_ADV_START_COMPLETE_EVT:
        //adv start complete event to indicate adv start successfully or failed
        if ((err = param->adv_start_cmpl.status) != ESP_BT_STATUS_SUCCESS) {
            BT_SCANNER_LOGE("Adv start failed: %s", esp_err_to_name(err));
        }
        break;
    case ESP_GAP_BLE_SCAN_RESULT_EVT: {
        esp_ble_gap_cb_param_t* scan_result = (esp_ble_gap_cb_param_t*)param;
        switch (scan_result->scan_rst.search_evt) {
        case ESP_GAP_SEARCH_INQ_RES_EVT:
            process_gap(scan_result);

            break;
        default:
            break;
        }
        break;
    }

    case ESP_GAP_BLE_SCAN_STOP_COMPLETE_EVT:
        if ((err = param->scan_stop_cmpl.status) != ESP_BT_STATUS_SUCCESS) {
            BT_SCANNER_LOGE("Scan stop failed: %s", esp_err_to_name(err));
        }
        else {
            BT_SCANNER_LOGI("Stop scan successfully");
        }
        break;

    case ESP_GAP_BLE_ADV_STOP_COMPLETE_EVT:
        if ((err = param->adv_stop_cmpl.status) != ESP_BT_STATUS_SUCCESS) {
            BT_SCANNER_LOGE("Adv stop failed: %s", esp_err_to_name(err));
        }
        else {
            BT_SCANNER_LOGI("Stop adv successfully");
        }
        break;

    default:
        BT_SCANNER_LOGW();
        break;
    }
}

extern "C" void app_main(void)
{
    multi_heap_info_t info;
    esp_err_t ret = ESP_OK;
    esp_err_t status;

    vTaskDelay(100 / portTICK_PERIOD_MS);

    heap_caps_get_info(&info, MALLOC_CAP_DEFAULT);
    heap_caps_check_integrity_all(true);
    heap_caps_check_integrity(MALLOC_CAP_DEFAULT, true);
    heap_caps_check_integrity_addr((intptr_t)&info, true);
    printf("heap_caps_get_total_size: %zu\n", heap_caps_get_total_size(MALLOC_CAP_DEFAULT));
    printf("heap_caps_get_free_size: %zu\n", heap_caps_get_free_size(MALLOC_CAP_DEFAULT));
    printf("heap_caps_get_minimum_free_size: %zu\n", heap_caps_get_minimum_free_size(MALLOC_CAP_DEFAULT));
    printf("heap_caps_get_largest_free_block: %zu\n", heap_caps_get_largest_free_block(MALLOC_CAP_DEFAULT));

    ESP_ERROR_CHECK(esp_bt_controller_mem_release(ESP_BT_MODE_BLE));
    esp_bt_controller_config_t bt_cfg = BT_CONTROLLER_INIT_CONFIG_DEFAULT();
    esp_bt_controller_init(&bt_cfg);
    esp_bt_controller_enable(ESP_BT_MODE_BLE);
    esp_bluedroid_config_t bluedroid_cfg = BT_BLUEDROID_INIT_CONFIG_DEFAULT();
    esp_bluedroid_init_with_cfg(&bluedroid_cfg);
    esp_bluedroid_enable();

    //BLE: register the scan callback function to the gap module
    if ((status = esp_ble_gap_register_callback(esp_ble_gap_cb)) != ESP_OK)
    {
        BT_SCANNER_LOGE("BLE gap register error: %s", esp_err_to_name(status));

    }

    esp_ble_gap_set_scan_params(&ble_scan_params);

    BT_SCANNER_LOGI("BLE monitor mode enabled");
    while (true)
    {
        vTaskDelay(1000 / portTICK_PERIOD_MS);
        BT_SCANNER_LOGD("BT Scan run...\n");
    }
    BT_SCANNER_LOGD("BT Scan end loop...\n");
}

with this CMakeLists.txt:

idf_component_register(SRCS "main.cpp"
                    INCLUDE_DIRS "."
                    REQUIRES            bt
                    nvs_flash
                    esp_event)

and no other component.

zhp0406 commented 2 weeks ago

Sure, I will try to reproduce it. Could you provide me with the complete log of your failed attempt?

damiencampanella commented 2 weeks ago

Here are the logs:

€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€€I (157) cpu_start: Multicore app
I (158) octal_psram: vendor id    : 0x0d (AP)
I (158) octal_psram: dev id       : 0x02 (generation 3)
I (158) octal_psram: density      : 0x03 (64 Mbit)
I (158) octal_psram: good-die     : 0x01 (Pass)
I (159) octal_psram: Latency      : 0x01 (Fixed)
I (160) octal_psram: VCC          : 0x01 (3V)
I (160) octal_psram: SRF          : 0x01 (Fast Refresh)
I (161) octal_psram: BurstType    : 0x01 (Hybrid Wrap)
I (162) octal_psram: BurstLen     : 0x01 (32 Byte)
I (162) octal_psram: Readlatency  : 0x02 (10 cycles@Fixed)
I (163) octal_psram: DriveStrength: 0x00 (1/1)
I (164) esp_psram: Found 8MB PSRAM device
I (164) esp_psram: Speed: 40MHz
I (896) esp_psram: SPI SRAM memory test OK
I (905) cpu_start: Pro cpu start user code
I (906) cpu_start: cpu freq: 240000000 Hz
I (906) app_init: Application information:
I (906) app_init: Project name:     Flowly_v2_CPU2
I (907) app_init: App version:      3a94df1-dirty
I (907) app_init: Compile time:     Apr 24 2024 15:53:37
I (908) app_init: ELF file SHA256:  9fd3a4ac58608426...
I (909) app_init: ESP-IDF:          v5.3-dev-2381-g9f4e8eb0cd-dirty
I (910) efuse_init: Min chip rev:     v0.0
I (910) efuse_init: Max chip rev:     v0.99
I (911) efuse_init: Chip rev:         v0.1
I (911) heap_init: Initializing. RAM available for dynamic allocation:
I (912) heap_init: At 3FCA0DD0 len 00048940 (290 KiB): RAM
I (913) heap_init: At 3FCE9710 len 00005724 (21 KiB): RAM
I (914) esp_psram: Adding pool of 8192K of PSRAM memory to heap allocator
I (916) spi_flash: detected chip: generic
I (916) spi_flash: flash io: dio
I (916) esp_core_dump_uart: Init core dump to UART
I (917) coexist: coex firmware version: a709fcdeb
I (964) coexist: coexist rom version e7ae62f
I (964) main_task: Started on CPU0
I (965) esp_psram: Reserving pool of 32K of internal memory for DMA/internal allocations
I (965) main_task: Calling app_main()
heap_caps_get_total_size: 8708196
heap_caps_get_free_size: 8641772
heap_caps_get_minimum_free_size: 8641772
heap_caps_get_largest_free_block: 8257536
btdm: bss start 0x3fcef180, len 36
btdm: data start 0x3fcef174, data start rom 0x40057350, len 12
MAGIC fadebead VERSION 00010007
I (1067) BLE_INIT: BT controller compile version [30b57c4]
MAGIC fadebead VERSION 00010001
Guru Meditation Error: Core  0 panic'ed (LoadProhibited). Exception was unhandled.

Core  0 register dump:
PC      : 0x403881f6  PS      : 0x00060733  A0      : 0x80387ca2  A1      : 0x3fca60a0
A2      : 0x00000014  A3      : 0x3fce02e5  A4      : 0x00000000  A5      : 0x00060723
A6      : 0x00000800  A7      : 0x3fcef990  A8      : 0x3fcef96c  A9      : 0x3fce0385
A10     : 0x1aaf54b8  A11     : 0x00000028  A12     : 0xfffffffc  A13     : 0x00000001
A14     : 0x00000005  A15     : 0x00000000  SAR     : 0x0000001e  EXCCAUSE: 0x0000001c
EXCVADDR: 0x1aaf54bc  LBEG    : 0x40056f5c  LEND    : 0x40056f72  LCOUNT  : 0x00000000

Backtrace: 0x403881f3:0x3fca60a0 0x40387c9f:0x3fca60c0 0x4037a28b:0x3fca60e0 0x4037a2f8:0x3fca6110 0x40388b01:0x3fca6130 0x4204a1f6:0x3fca6150 0x4200aa29:0x3fca61a0 0x4200a15c:0x3fca61e0 0x4206c37b:0x3fca6270 0x40383761:0x3fca62a0

ELF file SHA256: 9fd3a4ac58608426

I (1127) esp_core_dump_uart: Press Enter to print core dump to UART...
I (1128) esp_core_dump_uart: Print core dump to uart...
================= CORE DUMP START =================
hCoAAAIBCQAAAAAAAAAAAAAAAAABAAAA
f0VMRgEBAQAAAAAAAAAAAAQAXgABAAAAAAAAADQAAAAAAAAAAAAAADQAIAAOACgA
AAAAAA==
BAAAAPQBAAAAAAAAAAAAAEAOAABADgAABgAAAAAAAAA=
AQAAADQQAAAIZMo/CGTKP1QBAABUAQAABgAAAAAAAAA=
AQAAAIgRAADgX8o/4F/KPyAEAAAgBAAABgAAAAAAAAA=
AQAAAKgVAABkc8o/ZHPKP1QBAABUAQAABgAAAAAAAAA=
AQAAAPwWAADQcMo/0HDKP4ACAACAAgAABgAAAAAAAAA=
AQAAAHwZAADAgso/wILKP1QBAABUAQAABgAAAAAAAAA=
AQAAANAaAAAwgMo/MIDKP4ACAACAAgAABgAAAAAAAAA=
AQAAAFAdAAA0Lso/NC7KP1QBAABUAQAABgAAAAAAAAA=
AQAAAKQeAABwK8o/cCvKP7ACAACwAgAABgAAAAAAAAA=
AQAAAFQhAADsUMo/7FDKP1QBAABUAQAABgAAAAAAAAA=
AQAAAKgiAABATso/QE7KP6ACAACgAgAABgAAAAAAAAA=
AQAAAEglAACQP8o/kD/KP1QBAABUAQAABgAAAAAAAAA=
AQAAAJwmAADQPMo/0DzKP7ACAACwAgAABgAAAAAAAAA=
BAAAAEwpAAAAAAAAAAAAABwBAAAcAQAABgAAAAAAAAA=
CAAAAEwCAAABAAAA
Q09SRQAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACGTKPwAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9oE4QCMHBgBcbwVAcm8FQAAAAAAeAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKJ8OICgYMo/
FAAAAOUCzj8AAAAAIwcGAAAIAACQ+c4/bPnOP4UDzj+4VK8aKAAAAPz///8BAAAA
BQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAA
CAAAAEwCAAABAAAA
Q09SRQAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZHPKPwAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhA4QCABBgAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPk7AIKQcco/
AAAAAM3NAAA2OjiAUGHKPyMKBgAAAAAAfq0DgmBxyj8AAAAA2BrKPwAAAABkc8o/
MAXKPwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAA
CAAAAEwCAAABAAAA
Q09SRQAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwILKPwAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGhA4QCAHBgAAAAAAAAAAACAHBgAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPk7AILwgMo/
AAAAAAAAAABAPso/ID7KP8ifN0ABAAAAfq0DgsCAyj8AAAAAAAAAACA+yj/Agso/
MAXKPwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAA
CAAAAEwCAAABAAAA
Q09SRQAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANC7KPwAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4FkFQCAABgAAAAAAAAAAAAAAAAAEAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADY6OIAwLMo/
IwAGAAAAAAAgAAYASDACYAgwAmAAMAJgMAAMYAEAAACMssk//////wwSAAMjAAYA
////Ac3NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAA
CAAAAEwCAAABAAAA
Q09SRQAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7FDKPwAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4FkFQCAABgAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADY6OIAAT8o/
IwAGAAAAAAAgAAYAgCzKPwAAAACg+sk/MAAMYAEAAACMssk//////4Asyj8jAAYA
/////83NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAA
CAAAAEwCAAABAAAA
Q09SRQAAAAA=
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkD/KPwAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4FkFQCAABgAAAAAAAAAAAAAAAAAEAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADY6OICQPco/
IwAGAAAAAAAgAAYAUNXOP+RTyj8EAAADNAAMYAEAAACMssk//////wwAAAMjAAYA
5FPKP6urAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAA
oFvKP2UAAACc/ck/nP3JPwhkyj+U/ck/GAAAAAAAAAAAAAAACGTKPwAAAAABAAAA
BFTKP21haW4AAAAAAAAAAAAAAAAAAAAAAGTKPwEAAAAAAAAAAAAAAAAAAAAAAAAA
3BjKP0QZyj+sGco/AAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAnGwAQgAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAA==
776t3vaBOEAzBwYAonw4gKBgyj8UAAAA5QLOPwAAAAAjBwYAAAgAAJD5zj9s+c4/
hQPOP7hUrxooAAAA/P///wEAAAAFAAAAAAAAAB4AAAAcAAAAvFSvGlxvBUBybwVA
AAAAAPz///8BAAAA7LI3QNzuyD8AAAAAAAAAAAAAAAD//z+zAAAAAAAAAAAAAAAA
AAAAAEQZyj9kZMo/cwAAABBhyj/wYMo/BAAAAAEAAQCOojeAwGDKP4QFyz8oAAAA
8GDKPxBhyj9lYMo/ZGDKP/uiN4DgYMo/ABgAAAAAAADEPARAMQAAAAAAAABY+c4/
BIs4gBBhyj8oAAAAAQABABBhyj/wYMo/BAAAAAAAAABwBcs/AAAAAAAAAAAoAAAA
+aEEgjBhyj8oAAAAAAAAAAEAAQALAAAAAQAAACgAAAAsqgCCUGHKP/yKOEBg/84/
4AkAAEwTyz8AAAAAAAAAAF+hAIKgYco/EwAAAAEAAAAgBQYADAAAAAAAAACs/84/
CgABAAAAAAAAAAAAKwQAAFxoBzxmBAg88GHKP9DEBzxc/84/aP/OP5j/zj9Y+c4/
fsMGguBhyj8DAAAAMD4HPOzcgwAAAH4AMGLKPwwAAAB+wwaC4GHKPwMAAAAwPgc8
BNnJPwjZyT8c2ck/8GHKP2Q3OIBwYso/AAAAAAAAAABQYso/MGLKPwwAAAAwPgc8
paVaWiARQAIAEBcAAQoAAAAAHgAAAAABAAAAAAAACQABAAAAAALoAwAAAAAAAAEC
BQAUAAAAAAABAAAA7NyDAMDvAAAAAH4A7NyDADwAAAADAAAAPwAAAAYAAAAAAAAA
/D4HPMUDAAAwPgc8cGLKPwAAAACgYso/qMIGQgAAAACIEwAAAwAAAAEAAAAAAAAA
nP3JPwMAAAAAAAAAMD4HPAAAAADAYso/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0GLKP6WlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
0HDKPwAAAADEgso/iP3JP2Rzyj+A/ck/GQAAAAAAAAAAAAAAZHPKPwAAAAAAAAAA
YGXKP0lETEUwAAAAAAAAAAAAAAAAAAAAUHPKPwAAAAAAAAAAAAAAAAAAAAAAAAAA
3BjKP0QZyj+sGco/AAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAnGwAQgAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAIAAA==
TLM3QBoQOEAwAQYA+TsAgpBxyj8AAAAAzc0AADY6OIBQYco/IwoGAAAAAAB+rQOC
YHHKPwAAAADYGso/AAAAAGRzyj8wBco/AQAAAAAAAAD//wAAAAAAAAAAAAAAAAAA
AAAAAHG2N0Bkc8o/5jo4QCz+yD8AAAAAAAAAAAAAAAD//z+zAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAC8RDhAAAAAAAAAAABPRTiAsHHKPyMABgADAAAA
AAAAAAAAAAAAAAAAAAAAAGQ3OIDQcco/AAAAAHT/yT8BAAAAAAAAACj7yT8o+8k/
AAAAAPBxyj+8RDhAAAAAAPj8yT8U/ck/HP3JPxD9yT8AAAAAEHLKPwAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACByyj+lpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpQ==
MIDKPwAAAACI/ck/aHPKP8CCyj+A/ck/GQAAAAAAAAAAAAAAwILKPwAAAAAAAAAA
vHTKP0lETEUxAAAAAAAAAAAAAAABAAAAsILKPwAAAAAAAAAAAAAAAAAAAAAAAAAA
3BjKP0QZyj+sGco/AAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAnGwAQgAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAIAAA==
TLM3QBoQOEAwBwYA+TsAgvCAyj8AAAAAAAAAAEA+yj8gPso/yJ83QAEAAAB+rQOC
wIDKPwAAAAAAAAAAID7KP8CCyj8wBco/AQAAAAAAAAD//wAAAAAAAAAAAAAAAAAA
IAcGAHG2N0DAgso/5jo4QIwNyT8AAAAAAAAAAAAAAAD//z+zAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAC8RDhAAAAAAAAAAABPRTiAEIHKPyMABgADAAAA
AAAAAAAAAAAAAAAAAAAAAGQ3OIAwgco/AAAAAHT/yT8BAAAAAAAAAEj7yT9I+8k/
AAAAAFCByj+8RDhAAAAAAPj8yT8U/ck/HP3JPxD9yT8AAAAAcIHKPwAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICByj+lpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpQ==
cCvKPwAAAADwUMo/BP3JPzQuyj/8/Mk/AQAAAAAAAAAAAAAANC7KPwAAAAAYAAAA
MB7KP2lwYzAAAAAAAAAAAAAAAAAAAAAAIC7KPxgAAAAAAAAAAAAAAAAAAAAAAAAA
3BjKP0QZyj+sGco/AAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAnGwAQgAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AQAAAA==
TLM3QOBZBUAwAAYANjo4gDAsyj8jAAYAAAAAACAABgBIMAJgCDACYAAwAmAwAAxg
AQAAAIyyyT//////DBIAAyMABgD///8Bzc0AAAQAAAD//wAAAAAAAAAAAAAAAAAA
AAAAAHG2N0AjAAYA5jo4QPy4yD8AAAAAAAAAAAAAAAD//z+zAAAAAAAAAAAAAAAA
AAAAAKWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaVhWDiAQCzKP8SqyT8BAAAA
DKA3gGAsyj//////AAAAAAAAAAB0/8k/AAAAAHT/yT9kNziAgCzKPwAAAACg+sk/
/////4Asyj/Eqsk/dP/JPwAAAADALMo/yJ83QAAAAAAAAAAAcbY3QAAAAADmOjhA
/LjIPwAAAAAAAAAAAAAAAAAAAAD/////qPrJPwAAAAAAAAAA4CzKPwAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAsyj+lpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpQ==
QE7KPwAAAACUP8o/OC7KP+xQyj/8/Mk/AwAAAAAAAAAAAAAA7FDKPwAAAAAWAAAA
6EDKP2VzcF90aW1lcgAAAAAAAAAAAAAA4FDKPxYAAAAAAAAAAAAAAAAAAAAAAAAA
3BjKP0QZyj+sGco/AAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAnGwAQgAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AQAAAA==
TLM3QOBZBUAwAAYANjo4gABPyj8jAAYAAAAAACAABgCALMo/AAAAAKD6yT8wAAxg
AQAAAIyyyT//////gCzKPyMABgD/////zc0AAAAAAAD//wAAAAAAAAAAAAAAAAAA
AAAAAHG2N0AjAAYA5jo4QLzbyD8AAAAAAAAAAAAAAAD//z+zAAAAAAAAAAAAAAAA
AAAAAKWlpaWlpaWlpaWlpUyzN0BcNzhAMAAFAAAAAACHVziAEE/KP8SqyT8BAAAA
wb0DgjBPyj8AAAAAAQAAAAAAAAB0/8k/AAAAAHT/yT9kNziAUE/KPwAAAAAAAAAA
/////4yyyT/Eqsk/dP/JPwAAAACAT8o/sL0DQgAAAAC828g/AAAAAAAAAAAAAAAA
QP/JPzj/yT8BAAAAAAAAAAAAAACgT8o/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsE/KP6WlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
0DzKPwAAAAAE/ck/8FDKP5A/yj/8/Mk/AQAAAAAAAAAAAAAAkD/KPwAAAAAYAAAA
jC/KP2lwYzEAAAAAAAAAAAAAAAABAAAAgD/KPxgAAAAAAAAAAAAAAAAAAAAAAAAA
3BjKP0QZyj+sGco/AAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAnGwAQgAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AQAAAA==
TLM3QOBZBUAwAAYANjo4gJA9yj8jAAYAAAAAACAABgBQ1c4/5FPKPwQAAAM0AAxg
AQAAAIyyyT//////DAAAAyMABgDkU8o/q6sAAAQAAAD//wAAAAAAAAAAAAAAAAAA
AAAAAHG2N0AjAAYA5jo4QFzKyD8AAAAAAAAAAAAAAAD//z+zAAAAAAAAAAAAAAAA
AAAAAKWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaVhWDiAoD3KP8SqyT8BAAAA
DKA3gMA9yj//////AAAAAAAAAAB0/8k/BAAAAHj/yT9kNziA4D3KPwQAAACk+sk/
/////+A9yj/Eqsk/dP/JPwAAAAAgPso/yJ83QAEAAAAAAAAAcbY3QAAAAADmOjhA
XMrIPwAAAAAAAAAAAAAAAAAAAAD/////rPrJPwAAAAAAAAAAQD7KPwAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFA+yj+lpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWlpaWl
paWlpaWlpaWlpaWlpaWlpQ==
FAAAAEgAAABKIAAA
RVNQX0NPUkVfRFVNUF9JTkZPAAA=
AgEJADlmZDNhNGFjNTg2MDg0MjYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EAAAAJgAAAClAgAA
RVNQX0VYVFJBX0lORk8AAA==
CGTKP+gAAAAcAAAA7gAAALxUrxrCAAAAAAAAAMMAAAAAAAAAxAAAAAAAAADFAAAA
AAAAAMYAAAAAAAAAsQAAAG+aAEKyAAAAAAAAALMAAAAAAAAAtAAAAAAAAAC1AAAA
AAAAALYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAA=
iK4j6w==
================= CORE DUMP END =================
Coredump checksum='eb23ae88'
I (1294) esp_core_dump_uart: Core dump has been written to uart.
Rebooting...

Here is my sdkconfig (That I had to rename as sdkconfig.txt)

sdkconfig.txt

I can provide the binary files if needed

zhp0406 commented 2 weeks ago

@damiencampanella ok,thanks

zhp0406 commented 2 weeks ago

@damiencampanella local log when change code

ESP_ERROR_CHECK(esp_bt_controller_mem_release(ESP_BT_MODE_BLE));

to

ESP_ERROR_CHECK(esp_bt_controller_mem_release(ESP_BT_MODE_CLASSIC_BT));
load:0x3fce3810,len:0x179c
load:0x403c9700,len:0x4
load:0x403c9704,len:0xcbc
load:0x403cc700,len:0x2d9c
entry 0x403c9914
I (27) boot: ESP-IDF v5.2.1-485-g9b3ae86417-dirty 2nd stage bootloader
I (27) boot: compile time Apr 28 2024 17:24:59
I (28) boot: Multicore bootloader
I (32) boot: chip revision: v0.2
I (36) boot.esp32s3: Boot SPI Speed : 80MHz
I (40) boot.esp32s3: SPI Mode : DIO
I (45) boot.esp32s3: SPI Flash Size : 2MB
I (50) boot: Enabling RNG early entropy source...
I (55) boot: Partition Table:
I (59) boot: ## Label Usage Type ST Offset Length
I (66) boot: 0 nvs WiFi data 01 02 00009000 00006000
I (74) boot: 1 phy_init RF data 01 01 0000f000 00001000
I (81) boot: 2 factory factory app 00 00 00010000 00100000
I (89) boot: End of partition table
I (93) esp_image: segment 0: paddr=00010020 vaddr=3c080020 size=23e74h (147060) map
I (128) esp_image: segment 1: paddr=00033e9c vaddr=3fc97300 size=03db4h ( 15796) load
I (131) esp_image: segment 2: paddr=00037c58 vaddr=40374000 size=083c0h ( 33728) load
I (141) esp_image: segment 3: paddr=00040020 vaddr=42000020 size=797e0h (497632) map
I (231) esp_image: segment 4: paddr=000b9808 vaddr=4037c3c0 size=0aec0h ( 44736) load
I (249) boot: Loaded app from partition at offset 0x10000
I (249) boot: Disabling RNG early entropy source...
I (261) cpu_start: Multicore app
I (270) cpu_start: Pro cpu start user code
I (270) cpu_start: cpu freq: 160000000 Hz
I (270) cpu_start: Application information:
I (273) cpu_start: Project name: gatt_server_demos
I (279) cpu_start: App version: qa-test-v5.2.2-20240425-dirty
I (286) cpu_start: Compile time: Apr 28 2024 17:24:53
I (292) cpu_start: ELF file SHA256: 3dfbea287...
I (297) cpu_start: ESP-IDF: v5.2.1-485-g9b3ae86417-dirty
I (304) cpu_start: Min chip rev: v0.0
I (309) cpu_start: Max chip rev: v0.99
I (314) cpu_start: Chip rev: v0.2
I (319) heap_init: Initializing. RAM available for dynamic allocation:
I (326) heap_init: At 3FC9F1C8 len 0004A548 (297 KiB): RAM
I (332) heap_init: At 3FCE9710 len 00005724 (21 KiB): RAM
I (338) heap_init: At 3FCF0000 len 00008000 (32 KiB): DRAM
I (344) heap_init: At 600FE010 len 00001FD8 (7 KiB): RTCRAM
I (351) spi_flash: detected chip: gd
I (355) spi_flash: flash io: dio
W (358) spi_flash: Detected size(8192k) larger than the size in the binary image header(2048k). Using the size in the binary image header.
I (372) sleep: Configure to isolate all GPIO pins in sleep state
I (379) sleep: Enable automatic switching of GPIO sleep configuration
I (386) coexist: coex firmware version: d96c1e51f
I (391) coexist: coexist rom version e7ae62f
I (396) main_task: Started on CPU0
I (406) main_task: Calling app_main()
heap_caps_get_total_size: 367684
heap_caps_get_free_size: 345056
heap_caps_get_minimum_free_size: 345056
heap_caps_get_largest_free_block: 278528
I (506) BLE_INIT: BT controller compile version [c23ab4c]
I (506) BLE_INIT: Bluetooth MAC: dc:da:0c:61:e8:fe
I (516) phy_init: phy_version 660,1478a09,Mar 28 2024,16:58:13
E (526) phy_init: esp_phy_load_cal_data_from_nvs: NVS has not been initialized. Call nvs_flash_init before starting WiFi/BT.
W (536) phy_init: failed to load RF calibration data (0x1101), falling back to full calibration
E (606) BT_OSI: config_new: NVS not initialized. Call nvs_flash_init before initializing bluetooth.
W (606) BT_BTC: btc_config_init unable to load config file; starting unconfigured.

E (616) BT_OSI: config_save: NVS not initialized. Call nvs_flash_init before initializing bluetooth.
E (626) BT_OSI: config_save, err_code: 0x2

E (646) BT_OSI: config_save: NVS not initialized. Call nvs_flash_init before initializing bluetooth.
E (646) BT_OSI: config_save, err_code: 0x2

E (646) BT_OSI: config_save: NVS not initialized. Call nvs_flash_init before initializing bluetooth.
E (656) BT_OSI: config_save, err_code: 0x2

E (656) BT_OSI: config_save: NVS not initialized. Call nvs_flash_init before initializing bluetooth.
E (666) BT_OSI: config_save, err_code: 0x2

E (676) BT_OSI: config_save: NVS not initialized. Call nvs_flash_init before initializing bluetooth.
E (686) BT_OSI: config_save, err_code: 0x2

E (696) main.cpp: 213 : BLE monitor mode enabled
W (1696) main.cpp: 217 : BT Scan run...

W (2696) main.cpp: 217 : BT Scan run...

W (3696) main.cpp: 217 : BT Scan run...

W (4696) main.cpp: 217 : BT Scan run...

W (5696) main.cpp: 217 : BT Scan run...
zhp0406 commented 2 weeks ago

It looks like your code is not correct at the moment. ESP32-S3 does not support Classic Bluetooth. If you want to use BLE, : ESP_ERROR_CHECK(esp_bt_controller_mem_release(ESP_BT_MODE_CLASSIC_BT)); see:

/** @brief esp_bt_controller_mem_release
 * release the controller memory as per the mode
 *
 * This function releases the BSS, data and other sections of the controller to heap. The total size is about 70k bytes.
 *
 * esp_bt_controller_mem_release(mode) should be called only before esp_bt_controller_init()
 * or after esp_bt_controller_deinit().
 *
 * Note that once BT controller memory is released, the process cannot be reversed. It means you cannot use the bluetooth
 * mode which you have released by this function.
 *
 * If your firmware will later upgrade the Bluetooth controller mode (BLE -> BT Classic or disabled -> enabled)
 * then do not call this function.
 *
 * If the app calls esp_bt_controller_enable(ESP_BT_MODE_BLE) to use BLE only then it is safe to call
 * esp_bt_controller_mem_release(ESP_BT_MODE_CLASSIC_BT) at initialization time to free unused BT Classic memory.
 *
 * If the mode is ESP_BT_MODE_BTDM, then it may be useful to call API esp_bt_mem_release(ESP_BT_MODE_BTDM) instead,
 * which internally calls esp_bt_controller_mem_release(ESP_BT_MODE_BTDM) and additionally releases the BSS and data
 * consumed by the BT/BLE host stack to heap. For more details about usage please refer to the documentation of
 * esp_bt_mem_release() function
 *
 * @param mode : the mode want to release memory
 * @return ESP_OK - success, other - failed
 */
esp_err_t esp_bt_controller_mem_release(esp_bt_mode_t mode);
damiencampanella commented 4 days ago

I don't really understand why I would need to free memory for Classic BT but with this modification, I do not have the crash anymore.

Thanks a lot!