Precise bus fault in memq_enqueue

[mablabs]

Hi,

We are running Zephyr 2.4 via PlatformIO on a nRF52840 based product. While spamming the nRF with a ton of BLE packets, after about 15 minutes or so we get the following bus fault:

00> [00:13:28.106,445] <err> os: ***** BUS FAULT *****
00> [00:13:28.106,475] <err> os:  Precise data bus error
00> [00:13:28.106,475] <err> os:  BFAR Address: 0x20aa81ae
00> [00:13:28.106,506] <err> os: r0/a1: 0x2000c13c r1/a2: 0x2000cc50 r2/a3: 0x2000d3e8
00> [00:13:28.106,506] <err> os: r3/a4: 0x200009b0 r12/ip: 0x00000000 r14/lr: 0x0002208b
00> [00:13:28.106,506] <err> os: xpsr: 0x21000211
00> [00:13:28.106,536] <err> os: s[ 0]: 0x00000000 s[ 1]: 0x00000000 s[ 2]: 0x00000000 s[ 3]: 0x00000000
00> [00:13:28.106,536] <err> os: s[ 4]: 0x00000000 s[ 5]: 0x00000000 s[ 6]: 0x00000000 s[ 7]: 0x00000000
00> [00:13:28.106,536] <err> os: s[ 8]: 0x00000000 s[ 9]: 0x00000000 s[10]: 0x00000000 s[11]: 0x00000000
00> [00:13:28.106,567] <err> os: s[12]: 0x00000000 s[13]: 0x00000000 s[14]: 0x00000000 s[15]: 0x00000000
00> [00:13:28.106,567] <err> os: fpscr: 0x2000f3b8
00> [00:13:28.106,567] <err> os: Faulting instruction address (r15/pc): 0x0003f34a
00> [00:13:28.106,597] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
00> [00:13:28.106,597] <err> os: Fault during interrupt handling
00>
00> [00:13:28.106,597] <err> os: Current thread: 0x20005510 (unknown)
00> [00:13:28.678,009] <err> os: Halting system

Can you advise on what we could do to overcome this issue?

Thank you,

[Hakon]

Hello,

can you check the failing instruction with addr2line as explained by Alseth in this post?

[mablabs]

Hi Hakon,

We upgraded to a newer version of Zephyr (v.2.7.1) in PlatformIO and are still seeing the same error (the crash happens within ~5 minutes). Here's a deeper call stack:

```

1. memq_enqueue@0x00043bce (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\util\memq.c:95)
2. ull_rx_put@0x00029036 (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\ll_sw\ull.c:1728)
3. lll_conn_isr_rx@0x0002e9c4 (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\ll_sw\nordic\lll\lll_conn.c:369)
4. isr_radio@0x0002ef4a (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\ll_sw\nordic\hal\nrf5\radio\radio.c:79)
5. radio_nrf5_isr_body@0x00045b20 (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\ll_sw\nordic\lll\lll.c:92)
6. radio_nrf5_isr@0x00045b20 (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\ll_sw\nordic\lll\lll.c:86)

```

Please advise

[Hakon]

Can you check which thread id 0x20005510 corresponds to? Or just use CONFIG_THREAD_NAME=y.

[FrankHaptech]

Hey Hakon,

Mo and I are working on the same problem. It looks like it corresponds to idle 00 thread.

00> [00:14:04.793,151] <err> os: ***** BUS FAULT *****
00> [00:14:04.793,151] <err> os:   Precise data bus error
00> [00:14:04.793,151] <err> os:   BFAR Address: 0x205036d9
00> [00:14:04.793,182] <err> os: r0/a1:  0x2000b178  r1/a2:  0x2000bed4  r2/a3:  0x2000c338
00> [00:14:04.793,182] <err> os: r3/a4:  0x00000000 r12/ip:  0xb6a81002 r14/lr:  0x000290cd
00> [00:14:04.793,182] <err> os:  xpsr:  0x41000211
00> [00:14:04.793,212] <err> os: s[ 0]:  0x00000000  s[ 1]:  0x00000000  s[ 2]:  0x00000000  s[ 3]:  0x00000000
00> [00:14:04.793,212] <err> os: s[ 4]:  0x00000000  s[ 5]:  0x00000000  s[ 6]:  0x00000000  s[ 7]:  0x00000000
00> [00:14:04.793,243] <err> os: s[ 8]:  0x00000000  s[ 9]:  0x00000000  s[10]:  0x00000000  s[11]:  0x00000000
00> [00:14:04.793,243] <err> os: s[12]:  0x00000000  s[13]:  0x00000000  s[14]:  0x00000000  s[15]:  0x00000000
00> [00:14:04.793,273] <err> os: fpscr:  0x2000d6c0
00> [00:14:04.793,273] <err> os: Faulting instruction address (r15/pc): 0x00043cee
00> [00:14:04.793,273] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
00> [00:14:04.793,273] <err> os: Fault during interrupt handling
00> 
00> [00:14:04.793,304] <err> os: Current thread: 0x20005770 (idle 00

[Sigurd]

Hi,

mablabs said:

• memq_enqueue@0x00043bce (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\util\memq.c:95)
• ull_rx_put@0x00029036 (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\ll_sw\ull.c:1728)
• lll_conn_isr_rx@0x0002e9c4 (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\ll_sw\nordic\lll\lll_conn.c:369)
• isr_radio@0x0002ef4a (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\ll_sw\nordic\hal\nrf5\radio\radio.c:79)
• radio_nrf5_isr_body@0x00045b20 (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\ll_sw\nordic\lll\lll.c:92)
• radio_nrf5_isr@0x00045b20 (c:\Users\mab\.platformio\packages\framework-zephyr\subsys\bluetooth\controller\ll_sw\nordic\lll\lll.c:86)

Since this seem to be an issue in the Zephyr Bluetooth Controller, I recommend that you post this as a bug report to the Zephyr project: https://github.com/zephyrproject-rtos/zephyr/issues/new/choose