I think I found a I2C bug in the original 2.3.4 I2C error handling.
When read through write to a non-exisiting I2C node, my system crashed into a "lockup after double fault".
When stepping through the code, I ended up at chevents.c (/os/kernel/src/) on line 244 (elp = esp->es_next;) comming fron the i2c_serve_error_interrupt()
elp becomes NULL, but the elp->el_listner and elp->el_mask are valid pointers.
When stepping into the chEvtSignalFlagsI() the chDbgCheck doesn't assert, but within the /* Test on the AND/OR conditions wait states.*/ the system crashes.
All the tp->* seems to be valid but when I try to fold open the variable tp, OpenOCD gives me the following error:
- Code: Select all
target halted due to breakpoint, current mode: Thread
xPSR: 0x01000000 pc: 0x08006ba0 msp: 0x20000400
Error: JTAG-DP STICKY ERROR
Error: MEM_AP_CSW 0x23000052, MEM_AP_TAR 0x4f491c4c
Error: JTAG-DP STICKY ERROR
Error: MEM_AP_CSW 0x23000052, MEM_AP_TAR 0x4f491c4c
Warn : Block read error address 0x4f491c48, count 0x2
This is the content of tp at the moment of crash:
- Code: Select all
tp 0x08006ba1
p_next 0x844c20b6
p_prev 0x4f8809f3
p_prio 2214855408
p_ctx {...}
p_newer 0x038f6ff3
p_older 0x1bfe54f0
p_name 0x4f491c48
p_stklimit 0xff3255f0
p_state 247
p_flags 214
p_refs 255
p_time 1330190152
p_u {...}
p_waiting {...}
p_msgqueue {...}
p_msg 82904160
p_epending 82904324
p_mtxlist 0x9c4b1605
p_realprio 366212674
p_mpool 0x4f491648
Can anyone reproduce this problem?