Guru Meditation Error

[mzimmers]

Hi -

Our product has a fuel gauge connected to the ESP32 via I2C. When on battery power, it runs fine for a few hours, but then I get a Guru Meditation Error.

Code: Select all

Guru Meditation Error: Core  0 panic'ed (LoadProhibited). Exception was unhandled.
Core 0 register dump:
PC      : 0x40113404  PS      : 0x00060830  A0      : 0x800d7ebb  A1      : 0x3ffcfc50
A2      : 0x3ffdd290  A3      : 0x00000000  A4      : 0x3ffbebe8  A5      : 0x0000001f
A6      : 0x00000001  A7      : 0x00000005  A8      : 0x8008e82e  A9      : 0x3ffcfc30
A10     : 0xfefefefe  A11     : 0x0000049e  A12     : 0x3ffcfc20  A13     : 0x0000000c
A14     : 0x00000000  A15     : 0x00000013  SAR     : 0x00000004  EXCCAUSE: 0x0000001c
EXCVADDR: 0xfefeff0e  LBEG    : 0x400014fd  LEND    : 0x4000150d  LCOUNT  : 0xfffffffb

Backtrace: 0x40113404:0x3ffcfc50 0x400d7eb8:0x3ffcfc70 0x400d8079:0x3ffcfca0 0x400d8409:0x3ffcfcd0 0x400d85e9:0x3ffcfd60 0x4008f3cd:0x3ffcfd80

Rebooting...

Since my device isn't connected to the programming port, I can't run make monitor. Is there some other way for me to get more information as to what might be causing this?

Thanks...

[ESP_Angus]

Hi mzimmers,

If you have the ELF file, you can run xtensa-esp32-elf-addr2line (which is what idf_monitor is doing under the hood), the command is documented here:

https://docs.espressif.com/projects/esp ... -addresses

(Near bottom of the section)

Do you have Comprehensive heap poisoning enabled? LoadProhibited with EXCVADDR=0xfefeff0e suggests to me a use-after-free of a pointer, as the "free memory" poisoning pattern is 0xfefefefe . Something has loaded this pointer address (looks like it was held in A10), added 16 which must be the offset of a particular field, and then dereferenced it which caused the crash.

The backtrace should give you more clues (or you can use xtensa-esp32-elf-gdb and "disassemble CRASH_PC" to look at the assembly code up close) .,

[mzimmers]

Thanks Angus - that's a handy tool to know about. It appears that I'm crashing at line 817 of i2c.c, which is returning from esp_isr_free(). I have a routine that reads the i2c using the esp interface:

Code: Select all

    m_i2c_cmd = i2c_cmd_link_create();
    ESP_ERROR_CHECK(i2c_master_start(m_i2c_cmd));
    ESP_ERROR_CHECK(i2c_master_write_byte(m_i2c_cmd, devAddr, true));
    ESP_ERROR_CHECK(i2c_master_write_byte(m_i2c_cmd, regAddr, false));
    ESP_ERROR_CHECK(i2c_master_write(m_i2c_cmd, (uint8_t *)data, len, true));
    ESP_ERROR_CHECK(i2c_master_stop(m_i2c_cmd));
    err = (i2c_master_cmd_begin(I2C_PORT_NBR, m_i2c_cmd, 100));
    if (err == ESP_OK)
    {
        //ESP_LOGI(TAG, "i2cWriteReg(): register 0x%x written as %04x", regAddr, *data);
    }
    else
    {
        ESP_LOGE(TAG, "i2cWriteReg(): error \"%s\" on device 0x%x, register 0x%x.",
                 esp_err_to_name(err),
                 devAddr,
                 regAddr);
        vTaskDelay(100);
    }
    i2c_cmd_link_delete(m_i2c_cmd);

The program works for a few hours, then eventually I get this panic. Is it possible the i2c driver has a bug?

[mzimmers]

I'm still experiencing this problem:

Code: Select all

Guru Meditation Error: Core  0 panic'ed (LoadProhibited). Exception was unhandled.
Core 0 register dump:
PC      : 0x40084c59  PS      : 0x00060031  A0      : 0x80085114  A1      : 0x3ffc05b0
A2      : 0x00000000  A3      : 0x3ffdaa88  A4      : 0x00000000  A5      : 0x3ffe21b0
A6      : 0x00000000  A7      : 0x3fff75c8  A8      : 0xfefefefe  A9      : 0x3ff53054
A10     : 0x00000000  A11     : 0x3ff53000  A12     : 0x00000001  A13     : 0x000000fe
A14     : 0x00000003  A15     : 0x00060423  SAR     : 0x00000012  EXCCAUSE: 0x0000001c
EXCVADDR: 0xfefefeff  LBEG    : 0x4000c46c  LEND    : 0x4000c477  LCOUNT  : 0xffffffff
Core 0 was running in ISR context:
EPC1    : 0x40084c59  EPC2    : 0x00000000  EPC3    : 0x00000000  EPC4    : 0x00000000

Backtrace: 0x40084c59:0x3ffc05b0 0x40085111:0x3ffc05e0 0x400829aa:0x3ffc0610 0x40082b15:0x00000000

Here's the trace:

Code: Select all

$ xtensa-esp32-elf-addr2line -e WifiButton.elf
0x40084c59
C:/esp-idf-v3.1.1/components/driver/i2c.c:817
0x40085111
C:/esp-idf-v3.1.1/components/driver/i2c.c:817
0x400829aa
C:/esp-idf-v3.1.1/components/freertos/xtensa_vectors.S:1105
0x40082b15
C:/esp-idf-v3.1.1/components/heap/heap_caps.c:123

It appears to me that the problem is within the i2c facility. Is anyone aware of a bug or memory leak in this? I need to get this fixed before we can go into production.