Unhandled Exception in spiStart

[mabl]

Hello,

I just revived one of my projects after having reinstalled my computer with Ubuntu 11.10. The code is supposed to work on Olimex STM32P107 and uses the most recent chibios trunk (I made the mistake of directly updating chibios before trying out the code...).

Unfortunately the code goes into an unhandled exception in dmaStreamAllocate in line 449 when I try to connect to the SD card over SPI 3.

Code: Select all

  /* Putting the stream in a safe state.*/
  dmaStreamDisable(dmastp);
  dmaStreamClearInterrupt(dmastp);  // <---- Segfault here!
  dmastp->channel->CCR = STM32_DMA_CCR_RESET_VALUE;


Code: Select all

10 dmaStreamAllocate() stm32_dma.c:448 0x08020428   
9 spi_lld_start() spi_lld.c:258 0x080212f6   
8 spiStart() spi.c:108 0x0801f034   
7 mmcConnect() mmc_spi.c:312 0x0801f70e   
6 InsertHandler() mmcModule.c:55 0x08008082   
5 chEvtDispatch() chevents.c:272 0x0801da6a   
4 ThreadMMCWorker() mmcModule.c:94 0x0800813e   
3 _port_thread_start() chcore_v7m.c:189 0x0801c0c2   
2 chSchDoReschedule() chschd.c:302 0x0801cd70   
1 <symbol is not available> 0x00000000   

Given that the code base has seen quite extensive changes in the DMA layer, is there anything specific I can look at?

(Too bad that EmbSys does not resolve the cause of a CM3 segfault, I guess I have to dig in the registers in the end...)

[Giovanni]

It is possible there is something in the new DMA handling, you could try single step into dmaStreamAllocate() (it is possible it receives something wrong from the SPI driver) and see exactly where it crashes. I will try this myself in the evening.

Also try to understand which is the unhandled exception (and I should really put some debug code into that handler....).
Giovanni

[mabl]

Hello Giovanni,

thank you for your fast help. As stated before dmaStreamAllocate fails when calling dmaStreamClearInterrupt(dmastp).

This are the parameters passed to dmaStreamAllocate:

Code: Select all

"dmastp"   0x08026b94   
   channel   0x00000000   
   ifcr   0x00000000   
   ishift   0   
   selfindex   0   
   vector   0   

priority = 10
func = 0x8021161 <spi_lld_serve_rx_interrupt>


"(SPIDriver*) param"   0x2000b14c   
   state   SPI_STOP   
   config   0x200010e8   
      end_cb   0x00000000   
      ssport   0x40010800   
         CRL   1216580420   
         CRH   1145324619   
         IDR   24184   
         ODR   65535   
         BSRR   0   
         BRR   0   
         LCKR   0   
      sspad   4   
      cr1   48   
   thread   0x00000000   
   mutex   {...}   
   spi   0x40003c00   
      CR1   0   
      RESERVED0   0   
      CR2   0   
      RESERVED1   0   
      SR   0   
      RESERVED2   0   
      DR   0   
      RESERVED3   0   
      CRCPR   0   
      RESERVED4   0   
      RXCRCR   0   
      RESERVED5   0   
      TXCRCR   0   
      RESERVED6   0   
      I2SCFGR   0   
      RESERVED7   0   
      I2SPR   0   
      RESERVED8   0   
   dmarx   0x08026b94   
      channel   0x00000000   
         CCR   536871936   
         CNDTR   134332113   
         CPAR   134332336   
         CMAR   134332336   
      ifcr   0x00000000   
         *ifcr   536871936   
      ishift   0   
      selfindex   0   
      vector   0   
   dmatx   0x08026ba0   
      channel   0xffffffff   
         CCR   536916300   
         CNDTR   29282592   
         CPAR   29339656   
         CMAR   29339656   
      ifcr   0x48838b44   
         *ifcr   
      ishift   'K'   
      selfindex   'D'   
      vector   'D'   
   rxdmamode   4106   
   txdmamode   4120   


I should really put some debug code into that handler....

I already did that once, but lost it because of a hard disk crash But since I have figured out that gdb can execute python macros I think about writing a nice python script which prints out the state of the CM3.

[mabl]

On exception, the SCB register looks like this:

Code: Select all

"(SCB_Type*)    ...000UL+0x0D00UL)"   0xe000ed00   
   CPUID   1092600369   
   ICSR   67172355   
   VTOR   0   
   AIRCR   4194631680   
   SCR   0   
   CCR   0   
   SHP   0xe000ed18   
   SHCSR   0   
   CFSR   132096   
   HFSR   1073741824   
   DFSR   1   
   MMFAR   3758157304   
   BFAR   3758157304   
   AFSR   0   
   PFR   0xe000ed40   
   DFR   1048576   
   ADR   0   
   MMFR   0xe000ed50   
   ISAR   0xe000ed60   
   RESERVED0   0xe000ed74   
   CPACR   0   

Hence SHCR has no bits set.
The CFSR register has bits 10 (IMPREXISERR) and 17(INVSTATE) set.
HSFR Register is FORCED (so it's an escalated fault).

[Giovanni]

Hi,

It should be fixed in revision 3519, if was an incorrect mapping of DMA streams for SPI3 which ultimately caused an array overflow and access from an incorrect location.

When you have a little time could you confirm?

Giovanni

[mabl]

Unfortunately it still throws an exception at the same location. But now CSFR only has bit 10 (IMPRECISERR) set.

The same debug information as before:

Code: Select all

"dmastp"   0x08026b64   
   channel   0x00000000   
      CCR   536871936   
      CNDTR   134332113   
      CPAR   134332336   
      CMAR   134332336   
   ifcr   0x00000000   
      *ifcr   536871936   
   ishift   0   
   selfindex   0   
   vector   0   

func = 0x8021161 <spi_lld_serve_rx_interrupt>

"(SPIDriver *) param"   0x2000b14c   
   state   SPI_STOP   
   config   0x200010e8   
      end_cb   0x00000000   
      ssport   0x40010800   
      sspad   4   
      cr1   48   
   thread   0x00000000   
   mutex   {...}   
   spi   0x40003c00   
      CR1   0   
      RESERVED0   0   
      CR2   0   
      RESERVED1   0   
      SR   0   
      RESERVED2   0   
      DR   0   
      RESERVED3   0   
      CRCPR   0   
      RESERVED4   0   
      RXCRCR   0   
      RESERVED5   0   
      TXCRCR   0   
      RESERVED6   0   
      I2SCFGR   0   
      RESERVED7   0   
      I2SPR   0   
      RESERVED8   0   
   dmarx   0x08026b64   
      channel   0x00000000   
      ifcr   0x00000000   
      ishift   0   
      selfindex   0   
      vector   0   
   dmatx   0x08026b70   
      channel   0x00009600   
      ifcr   0x40000000   
      ishift   0   
      selfindex   0   
      vector   0   
   rxdmamode   4106   
   txdmamode   4120   


"(SCB_Type*)    ...000UL+0x0D00UL)"   0xe000ed00   
   CPUID   1092600369   
   ICSR   67172355   
   VTOR   0   
   AIRCR   4194631680   
   SCR   0   
   CCR   0   
   SHP   0xe000ed18   
   SHCSR   0   
   CFSR   1024   
   HFSR   1073741824   
   DFSR   1   
   MMFAR   3758157304   
   BFAR   3758157304   
   AFSR   0   
   PFR   0xe000ed40   
   DFR   1048576   
   ADR   0   
   MMFR   0xe000ed50   
   ISAR   0xe000ed60   
   RESERVED0   0xe000ed74   
   CPACR   0   


[Giovanni]

It looks like dmarx and dmatx still do not point inside the _stm32_dma_streams array (stm32_dma.c) for some reason, the exception happens when the NULL pointer contained in field ifcr is dereferenced and the resulting value points to an unmapped location.

I have to prepare a specific test case.

Giovanni

[mabl]

Ok, so I noticed that in stm32_dma.h

Code: Select all

#if STM32_HAS_DMA2 || defined(__DOXYGEN__)
#define STM32_DMA_STREAMS           12
#else
#define STM32_DMA_STREAMS           7
#endif

Sets STM32_DMA_STREAMS to 7 for me (tested with #error in either branch) even though STM32_HAS_DMA2 is set TRUE in hal_lld_f105_f107.h.

Perhaps I forgot to change some settings in mcuconf.h or so... Will check for it

[Giovanni]

Just fixed that, it was an inclusion order problem that made that array with dimension 7 instead of 12.

I wanted to group all inclusions on top of the hal_lld.h file and I got this nice side effect. This proves yet again, if it works don't fix it...

Giovanni

[mabl]

Great! Now it seems to work! I still have some other bugs, but I'll sort them out an other day Thank you for your incredibly fast help.