Page 1 of 1

ESP32蓝牙栈触发Guru Meditation Error与重启

Posted: Tue Apr 16, 2024 6:24 am
by u_ding
如题,ESP-IDF5.1版本,在对avdt层报文进行修改向外发送时,触发Guru Meditation Error以及重启,根据Backtrace来看应该是hci层出了问题。

使用的example:a2dp_source
被修改的代码,esp-idf/components/bt/host/bluedroid/stack/avdt/avdt_ad.c
  1. UINT8 avdt_ad_write_req(UINT8 type, tAVDT_CCB *p_ccb, tAVDT_SCB *p_scb, BT_HDR *p_buf)
  2. {
  3.     UINT8   tcid;
  4.  
  5.     /* get tcid from type, scb */
  6.     tcid = avdt_ad_type_to_tcid(type, p_scb);
  7.  
  8.     srand(time(NULL));
  9.     // p_buf[0].event = (uint16_t)rand();
  10.  
  11.     if(type == AVDT_CHAN_MEDIA){
  12.         p_buf->event = (uint16_t)rand();
  13.         p_buf->len = (uint16_t)rand() % 255;
  14.         p_buf->offset = (uint16_t)rand();
  15.         p_buf->layer_specific = (uint16_t)rand();
  16.         for(int i = 0; i < p_buf->len; ++i) p_buf->data[i] = (uint16_t)rand();
  17.     }
  18.    
  19.     static int dk_cnt = 0;
  20.     if(++dk_cnt % 1000 == 0){
  21.         dk_cnt = 0, printf("\n\n avdt_ad_write_req \n");    
  22.         printf("%" PRIu16 " ", p_buf->event);
  23.         printf("%" PRIu16 " ", p_buf->len);
  24.         printf("%" PRIu16 " ", p_buf->offset);
  25.         printf("%" PRIu16 " \n", p_buf->layer_specific);
  26.         for(int i = 0; i < p_buf->len; ++i) printf("%" PRIu16 " ", p_buf->data[i]);
  27.         printf("\n\n");
  28.     }
  29.  
  30.     return L2CA_DataWrite(avdt_cb.ad.rt_tbl[avdt_ccb_to_idx(p_ccb)][tcid].lcid, p_buf);
  31. }
  1. Guru Meditation Error: Core  0 panic'ed (StoreProhibited). Exception was unhandled.
  2.  
  3. Core  0 register dump:
  4. PC      : 0x40093232  PS      : 0x00060333  A0      : 0x80092e87  A1      : 0x3ffd0350  
  5. 0x40093232: remove_free_block at /root/esp/esp-idf/components/heap/tlsf/tlsf.c:332
  6. (inlined by) block_remove at /root/esp/esp-idf/components/heap/tlsf/tlsf.c:380
  7. (inlined by) block_merge_next at /root/esp/esp-idf/components/heap/tlsf/tlsf.c:486
  8. (inlined by) tlsf_free at /root/esp/esp-idf/components/heap/tlsf/tlsf.c:1123
  9.  
  10. A2      : 0x3ffcc144  A3      : 0x3ffd7838  A4      : 0x3ffd7830  A5      : 0x3ffc0042  
  11. A6      : 0x00000028  A7      : 0x00000058  A8      : 0x00000018  A9      : 0x3ffd8844  
  12. A10     : 0x3ffd8844  A11     : 0x00000000  A12     : 0x0099009d  A13     : 0x00000004  
  13. A14     : 0xb33fffff  A15     : 0xb33fffff  SAR     : 0x0000001c  EXCCAUSE: 0x0000001d  
  14. EXCVADDR: 0x009900a9  LBEG    : 0x4000c2e0  LEND    : 0x4000c2f6  LCOUNT  : 0xffffffff  
  15. 0x4000c2e0: memcpy in ROM
  16. 0x4000c2f6: memcpy in ROM
  17.  
  18.  
  19.  
  20. Backtrace: 0x4009322f:0x3ffd0350 0x40092e84:0x3ffd0370 0x40082362:0x3ffd0390 0x4009406d:0x3ffd03b0 0x400de242:0x3ffd03d0 0x400df122:0x3ffd03f0 0x400de459:0x3ffd0410 0x4010c2fa:0x3ffd0430 0x400de4b5:0x3ffd0450 0x4010d2ce:0x3ffd0470 0x4010d19a:0x3ffd0490 0x40090ad5:0x3ffd04c0
  21. 0x4009322f: remove_free_block at /root/esp/esp-idf/components/heap/tlsf/tlsf.c:331
  22. (inlined by) block_remove at /root/esp/esp-idf/components/heap/tlsf/tlsf.c:380
  23. (inlined by) block_merge_next at /root/esp/esp-idf/components/heap/tlsf/tlsf.c:486
  24. (inlined by) tlsf_free at /root/esp/esp-idf/components/heap/tlsf/tlsf.c:1123
  25. 0x40092e84: multi_heap_free_impl at /root/esp/esp-idf/components/heap/multi_heap.c:231
  26. 0x40082362: heap_caps_free at /root/esp/esp-idf/components/heap/heap_caps.c:388
  27. 0x4009406d: free at /root/esp/esp-idf/components/newlib/heap.c:39
  28. 0x400de242: transmit_fragment at /root/esp/esp-idf/components/bt/host/bluedroid/hci/hci_layer.c:350
  29. 0x400df122: fragment_and_dispatch at /root/esp/esp-idf/components/bt/host/bluedroid/hci/packet_fragmenter.c:132
  30. 0x400de459: event_packet_ready at /root/esp/esp-idf/components/bt/host/bluedroid/hci/hci_layer.c:338
  31. 0x4010c2fa: fixed_queue_process at /root/esp/esp-idf/components/bt/common/osi/fixed_queue.c:254
  32. 0x400de4b5: hci_downstream_data_handler at /root/esp/esp-idf/components/bt/host/bluedroid/hci/hci_layer.c:238
  33. 0x4010d2ce: osi_thread_generic_event_handler at /root/esp/esp-idf/components/bt/common/osi/thread.c:425
  34. 0x4010d19a: osi_thread_run at /root/esp/esp-idf/components/bt/common/osi/thread.c:165 (discriminator 1)
  35. 0x40090ad5: vPortTaskWrapper at /root/esp/esp-idf/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:162
  36.  
  37.  
  38.  
  39.  
  40.  
  41. ELF file SHA256: fb53a7e2e55ccb03
  42.  
  43. Rebooting...
  44. ets Jul 29 2019 12:21:46