Debugging Zephyr RTOS MCUmgr SMP on ESP32: stack overflow and illegal instruction in Bluetooth thread

Question

My application using Zephyr RTOS v4.1.0 on ESP32-WROVER-IE and ESP32-S3-WROOM-1 to implement MCUmgr over Bluetooth (SMP transport) based on the smp_svr sample builds successfully, but flashing results in a fatal CPU exception in the mcumgr smp thread:

[00:00:14.935,000] <err> os: ** FATAL EXCEPTION
[00:00:14.936,000] <err> os: ** CPU 0 EXCCAUSE 0 (illegal instruction)
[00:00:14.936,000] <err> os: ** VADDR 0 Invalid SP 0x3fcae368
[00:00:14.936,000] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
[00:00:14.936,000] <err> os: Current thread: 0x3fcc6bb0 (mcumgr smp)

Switching to ESP32-S3 gave the same error. To debug I enabled CONFIG_STACK_SENTINEL=y, rebuilt and flashed, revealing a stack overflow in the Bluetooth long workqueue:

[00:00:00.281,000] <err> os: >>> ZEPHYR FATAL ERROR 2: Stack overflow on CPU 0
[00:00:00.281,000] <err> os: Current thread: 0x3fcc8a20 (BT LW WQ)

Bluetooth initialization code from bluetooth.c:

#include <zephyr/bluetooth/bluetooth.h>
#include <zephyr/bluetooth/conn.h>
#include <zephyr/mgmt/mcumgr/transport/smp_bt.h>

static struct k_work advertise_work;

static const struct bt_data ad[] = {
    BT_DATA_BYTES(BT_DATA_FLAGS, (BT_LE_AD_GENERAL | BT_LE_AD_NO_BREDR)),
    BT_DATA_BYTES(BT_DATA_UUID128_ALL, SMP_BT_SVC_UUID_VAL),
};

static void advertise(struct k_work *work) {
    int rc = bt_le_adv_start(BT_LE_ADV_CONN_FAST_1, ad, ARRAY_SIZE(ad), NULL, 0);
    if (rc) {
        // Handle error
    }
}

void start_smp_bluetooth_adverts(void) {
    k_work_init(&advertise_work, advertise);
    int rc = bt_enable(NULL);
    if (rc) {
        // Handle error
    }
    k_work_submit(&advertise_work);
}

CONFIG_BT_LONG_WQ_STACK_SIZE was fixed at 1300 in menuconfig. How can I increase it?

Despite now included code it seems to be a Zephyr configuration issue (not programming related specifically). — user4157124
– user4157124, Commented Aug 18 at 11:25

user4157124 · Accepted Answer · 2025-08-18 11:14:45Z

I changed zephyr/subsys/bluetooth/host/Kconfig BT_LONG_WQ_STACK_SIZE to 8196 and ran west update which gave:

[00:00:14.935,000] <err> os:  ** FATAL EXCEPTION
[00:00:14.936,000] <err> os:  ** CPU 0 EXCCAUSE 0 (illegal instruction)
[00:00:14.936,000] <err> os:  ** VADDR 0 Invalid SP 0x3fcae368
[00:00:14.936,000] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
[00:00:14.936,000] <err> os: Current thread: 0x3fcc6bb0 (mcumgr smp)
[00:00:14.973,000] <err> os: Halting system

I changed CONFIG_MCUMGR_TRANSPORT_WORKQUEUE_STACK_SIZE to 4096 in prj.conf file and it worked. Full config:

# Enable MCUmgr and dependencies.
CONFIG_NET_BUF=y
CONFIG_ZCBOR=y
CONFIG_CRC=y
CONFIG_MCUMGR=y
CONFIG_STREAM_FLASH=y
CONFIG_FLASH_MAP=y
CONFIG_BOOT_BANNER=y

# Some command handlers require a large stack.
CONFIG_MAIN_STACK_SIZE=6144
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=6144
CONFIG_SHELL_STACK_SIZE=6144

# Ensure an MCUboot-compatible binary is generated.
# ./esptool.py --chip esp32 --port /dev/ttyUSB0 write_flash 0x1000 build/bootloader/zephyr/zephyr.bin
# For use mcuboot
CONFIG_BOOTLOADER_MCUBOOT=y
# Enable flash operations.
CONFIG_FLASH=y

# Required by the `taskstat` command.
CONFIG_THREAD_MONITOR=y

# Support for taskstat command
CONFIG_MCUMGR_GRP_OS_TASKSTAT=y

# Enable statistics and statistic names.
CONFIG_STATS=y
CONFIG_STATS_NAMES=y

CONFIG_THREAD_ANALYZER=y

# Enable most core commands.
CONFIG_FLASH=y
CONFIG_IMG_MANAGER=y
CONFIG_MCUMGR_GRP_IMG=y
CONFIG_MCUMGR_GRP_OS=y
CONFIG_MCUMGR_GRP_STAT=y

# Enable logging
CONFIG_LOG=y

# For writing
CONFIG_CONSOLE=y
CONFIG_UART_CONSOLE=y
CONFIG_PRINTK=y
CONFIG_LOG=y

CONFIG_LOG_BUFFER_SIZE=4096

# Disable debug logging
CONFIG_LOG_MAX_LEVEL=3

# Bluetooth Side
CONFIG_BT=y
CONFIG_BT_DEVICE_NAME="Zephyr"
CONFIG_BT_PERIPHERAL=y

# Fix for Bluetooth connection parameters.
CONFIG_BT_BUF_ACL_TX_COUNT=12
CONFIG_BT_BUF_EVT_RX_COUNT=13
CONFIG_BT_CONN_TX_MAX=12
CONFIG_BT_MAX_CONN=1
CONFIG_BT_L2CAP_TX_BUF_COUNT=32
CONFIG_BT_CREATE_CONN_TIMEOUT=10
CONFIG_BT_GATT_DYNAMIC_DB=y
# Enable the long workqueue for Bluetooth.
CONFIG_BT_LONG_WQ=y

# MCUMGR and dependencies
CONFIG_MCUMGR_TRANSPORT_BT=y
CONFIG_MCUMGR_GRP_OS=y
CONFIG_MCUMGR_GRP_STAT=y
CONFIG_MCUMGR_TRANSPORT_SHELL=y
CONFIG_BASE64=y
CONFIG_SHELL=y

# Disable pairing/encryption
CONFIG_BT_PRIVACY=n
CONFIG_BT_SMP=n

# Config size for Bluetooth stacks and workqueues.
CONFIG_BT_RX_STACK_SIZE=4096
CONFIG_MCUMGR_TRANSPORT_WORKQUEUE_STACK_SIZE=4096
CONFIG_MCUMGR_TRANSPORT_NETBUF_COUNT=16
# If you want to change BT_HCI_TX_STACK_SIZE you should do it from the menuconfig.

# Allow for large Bluetooth data packets.
CONFIG_BT_L2CAP_TX_MTU=247
CONFIG_BT_BUF_ACL_RX_SIZE=512
CONFIG_BT_BUF_ACL_TX_SIZE=512

# For debugging purposes.
# CONFIG_ASSERT=y
# CONFIG_STACK_SENTINEL=y
# CONFIG_DEBUG_OPTIMIZATIONS=y

# Enable the Bluetooth mcumgr transport (unauthenticated).
CONFIG_MCUMGR_TRANSPORT_BT=y
CONFIG_MCUMGR_TRANSPORT_BT_CONN_PARAM_CONTROL=y

# Enable the Bluetooth mcumgr transport.
CONFIG_LOG_MODE_DEFERRED=y
CONFIG_BT_BONDABLE=n

Collectives™ on Stack Overflow

Debugging Zephyr RTOS MCUmgr SMP on ESP32: stack overflow and illegal instruction in Bluetooth thread

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related