FreeRTOS crash due to incorrect pxReadyTasksLists contents

I’m getting FreeRTOS crash in my program which is actually the “wifi_setup” example imported from MCUXpresso SDK with small changes.
Here’s a tail of the debugging session output:

[New Thread 3]
[New Thread 9]
[New Thread 1610631818]
[New Thread 5]
[New Thread 6]
[New Thread 4]
[New Thread 8]
[New Thread 7]
[New Thread 10]

Thread 
2 received signal SIGSTOP, Stopped (signal).
[Switching to Thread 3]
Reset_Handler () at C:/tmp/mcux_sdk_release_25_06_00/mcuxsdk/devices/RT/RT1060/MIMXRT1062/gcc\startup_MIMXRT1062.S:446
446	    b DefaultISR

The debugger shows the state of the threads. The top of the current thread call stack is:

"Tmr Svc": Stopped
Reset_Handler@0x60002524
<signal handler called>@0xfffffffd

If I look at pxReadyTasksLists array in the debugger, it shows that its 2nd element has uxNumberOfItems == 1 but pxIndex points to xListEnd. At the same time, xListEndpxNext and pxPrevious point to “tcp/ip” task. I’ve attached a screenshot.

My setup:

  • MIMXRT1060-EVKB board (Cortex-M7 CPU architecture)
  • I’m using Visual Studio Code with MCUXpresso for VS Code extension
  • I’ve also made a wrapper for LwIP’s tcpip_input function to print something to the debug console. The crash happens after the wrapper is called a few times, from 1 to 15.

My wrapper function looks as:

err_t wifi_tcpip_input_wrapper(struct pbuf *p, struct netif *netif)
{
    PRINTF("In wrapper\r\n");
    const err_t result = tcpip_input(p, netif);
    return result;
}

So there’s nothing criminal there, just calling the original function. The crash happens after “In wrapper” is printed to the console, when the software should switch to “tcp/ip” task inside tcpip_input.

There’s a similar post on this forum: Incorrect pxReadyTasksLists state causes fault (sorry, I can’t post links yet but hopefully you can find it by name), only in my case pxCurrentTCB is correct, pointing to “Tmr Svc” task.

The solution to that topic was an incorrect interrupt priority. I tried setting all NVIC->IPRn registers to 0xF0 at the beginning of the program to set all priorities to the lowest possible level but that didn’t help. I also checked the stacks – they are fine. I can attach my project or upload it anywhere if that helps. I can also post additional information you may need to help.

My FreeRTOSConfig.h:

/*
FreeRTOS Kernel V10.3.0
Copyright (C) 2017 Amazon.com, Inc. or its affiliates.  All Rights Reserved.

Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

 http://aws.amazon.com/freertos
 http://www.FreeRTOS.org
*/

#ifndef FREERTOS_CONFIG_H
#define FREERTOS_CONFIG_H

/*-----------------------------------------------------------
 * Application specific definitions.
 *
 * These definitions should be adjusted for your particular hardware and
 * application requirements.
 *
 * THESE PARAMETERS ARE DESCRIBED WITHIN THE 'CONFIGURATION' SECTION OF THE
 * FreeRTOS API DOCUMENTATION AVAILABLE ON THE FreeRTOS.org WEB SITE.
 *
 * See http://www.freertos.org/a00110.html.
 *----------------------------------------------------------*/

#define configUSE_PREEMPTION                    1
#define configUSE_TICKLESS_IDLE                 0
#define configCPU_CLOCK_HZ                      (SystemCoreClock)
#define configTICK_RATE_HZ                      ((TickType_t)1000)
#define configMAX_PRIORITIES                    5
#define configMINIMAL_STACK_SIZE                ((unsigned short)128)
#define configMAX_TASK_NAME_LEN                 20
#define configUSE_16_BIT_TICKS                  0
#define configIDLE_SHOULD_YIELD                 1
#define configUSE_TASK_NOTIFICATIONS            1
#define configUSE_MUTEXES                       1
#define configUSE_RECURSIVE_MUTEXES             1
#define configUSE_COUNTING_SEMAPHORES           1
#define configUSE_ALTERNATIVE_API               0 /* Deprecated! */
#define configQUEUE_REGISTRY_SIZE               8
#define configUSE_QUEUE_SETS                    0
#define configUSE_TIME_SLICING                  0
#define configUSE_NEWLIB_REENTRANT              0
#define configENABLE_BACKWARD_COMPATIBILITY     1
#define configNUM_THREAD_LOCAL_STORAGE_POINTERS 5
#define configUSE_APPLICATION_TASK_TAG          0

/* Used memory allocation (heap_x.c) */
#define configFRTOS_MEMORY_SCHEME 4
/* Tasks.c additions (e.g. Thread Aware Debug capability) */
#define configINCLUDE_FREERTOS_TASK_C_ADDITIONS_H 1

/* Memory allocation related definitions. */
#define configSUPPORT_STATIC_ALLOCATION  0
#define configSUPPORT_DYNAMIC_ALLOCATION 1
#define configTOTAL_HEAP_SIZE            ((size_t)(60 * 1024))
#define configAPPLICATION_ALLOCATED_HEAP 0

/* Hook function related definitions. */
#define configUSE_IDLE_HOOK                0
#define configUSE_TICK_HOOK                0
#define configCHECK_FOR_STACK_OVERFLOW     0
#define configUSE_MALLOC_FAILED_HOOK       0
#define configUSE_DAEMON_TASK_STARTUP_HOOK 0

/* Run time and task stats gathering related definitions. */
#define configGENERATE_RUN_TIME_STATS        0
#define configUSE_TRACE_FACILITY             1
#define configUSE_STATS_FORMATTING_FUNCTIONS 1

/* Co-routine related definitions. */
#define configUSE_CO_ROUTINES           0
#define configMAX_CO_ROUTINE_PRIORITIES 2

/* Software timer related definitions. */
#define configUSE_TIMERS             1
#define configTIMER_TASK_PRIORITY    4
#define configTIMER_QUEUE_LENGTH     5
#define configTIMER_TASK_STACK_DEPTH (configMINIMAL_STACK_SIZE)

/* Define to trap errors during development. */
#define configASSERT(x)           \
    if ((x) == 0)                 \
    {                             \
        taskDISABLE_INTERRUPTS(); \
        for (;;)                  \
            ;                     \
    }

/* Optional functions - most linkers will remove unused functions anyway. */
#define INCLUDE_vTaskPrioritySet            1
#define INCLUDE_uxTaskPriorityGet           1
#define INCLUDE_vTaskDelete                 1
#define INCLUDE_vTaskSuspend                1
#define INCLUDE_vTaskDelayUntil             1
#define INCLUDE_vTaskDelay                  1
#define INCLUDE_xTaskGetSchedulerState      1
#define INCLUDE_xTaskGetCurrentTaskHandle   1
#define INCLUDE_uxTaskGetStackHighWaterMark 0
#define INCLUDE_xTaskGetIdleTaskHandle      0
#define INCLUDE_eTaskGetState               0
#define INCLUDE_xTimerPendFunctionCall      1
#define INCLUDE_xTaskAbortDelay             0
#define INCLUDE_xTaskGetHandle              0
#define INCLUDE_xTaskResumeFromISR          1

/****************** Macro definitions ***************/

#include "FreeRTOSConfigBoard.h"

#endif /* FREERTOS_CONFIG_H */

My FreeRTOSConfigBoard.h:

/*
 * FreeRTOS Kernel V10.0.1
 * Copyright (C) 2017 Amazon.com, Inc. or its affiliates.  All Rights Reserved.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy of
 * this software and associated documentation files (the "Software"), to deal in
 * the Software without restriction, including without limitation the rights to
 * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
 * the Software, and to permit persons to whom the Software is furnished to do so,
 * subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in all
 * copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
 * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
 * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 *
 * http://aws.amazon.com/freertos
 * http://www.FreeRTOS.org
 */


#ifndef FREERTOS_CONFIG_BOARD_H
#define FREERTOS_CONFIG_BOARD_H
/*${macro:start}*/

#if defined(__ICCARM__)||defined(__CC_ARM)||defined(__GNUC__)
    /* Clock manager provides in this variable system core clock frequency */
    #include <stdint.h>
    extern uint32_t SystemCoreClock;
#endif

/* Interrupt nesting behaviour configuration. Cortex-M specific. */
#ifdef __NVIC_PRIO_BITS
/* __BVIC_PRIO_BITS will be specified when CMSIS is being used. */
#define configPRIO_BITS __NVIC_PRIO_BITS
#else
#define configPRIO_BITS 4 /* 15 priority levels */
#endif

/* The lowest interrupt priority that can be used in a call to a "set priority"
function. */
#define configLIBRARY_LOWEST_INTERRUPT_PRIORITY ((1U << (configPRIO_BITS)) - 1)

/* The highest interrupt priority that can be used by any interrupt service
routine that makes calls to interrupt safe FreeRTOS API functions.  DO NOT CALL
INTERRUPT SAFE FREERTOS API FUNCTIONS FROM ANY INTERRUPT THAT HAS A HIGHER
PRIORITY THAN THIS! (higher priorities are lower numeric values. */
#define configLIBRARY_MAX_SYSCALL_INTERRUPT_PRIORITY 2

/* Interrupt priorities used by the kernel port layer itself.  These are generic
to all Cortex-M ports, and do not rely on any particular library functions. */
#define configKERNEL_INTERRUPT_PRIORITY (configLIBRARY_LOWEST_INTERRUPT_PRIORITY << (8 - configPRIO_BITS))
/* !!!! configMAX_SYSCALL_INTERRUPT_PRIORITY must not be set to zero !!!!
See http://www.FreeRTOS.org/RTOS-Cortex-M3-M4.html. */
#define configMAX_SYSCALL_INTERRUPT_PRIORITY (configLIBRARY_MAX_SYSCALL_INTERRUPT_PRIORITY << (8 - configPRIO_BITS))

/* Definitions that map the FreeRTOS port interrupt handlers to their CMSIS
standard names. */
#define vPortSVCHandler SVC_Handler
#define xPortPendSVHandler PendSV_Handler
#define xPortSysTickHandler SysTick_Handler
/*${macro:end}*/
#endif /* FREERTOS_CONFIG_BOARD_H */

you may need to adjust this. Simply resetting the priorities of all your isrs to lowest may not solve the problem if the priority of one of them is boosted afterwards.

Aside from that, you are looking at a fairly generic corruption which can be caused by all kinds of errenuous code fragments.

It seems they are not boosted. I checked the values of NVIC->IPRn registers when the execution hits the fault handler at DefaultISR, and they all are still 0xF0 except IPR83 == 0x20 and IPR110 == 0x50. But these priorities are not higher than configLIBRARY_MAX_SYSCALL_INTERRUPT_PRIORITY

I tried running the software in MCUXpresso IDE, and the execution hits MemManage_Handler instead. I defined this function in MCUXpresso for VSCode, and the execution also stops there. So what do I do next?

xPSR == 0x81000004.

if the crash predictably affects the same memory locations, an invaluable debugging strategy is to set a hardware breakpoint that will break into the debugger at the exact time of the crash. Other than that, we would need to see your full code (preferrably after you stripped it down tomthe bare minimum needed to repro the issue).

I’m sorry, the issue was with the stack size of FreeRTOS timer thread. I didn’t check it initially as I had the impression it was properly configured in the NXP example that my code was based on. But it was working in the release build only and was crashing in debug.

The stack size was defined as #define configTIMER_TASK_STACK_DEPTH (configMINIMAL_STACK_SIZE), being equal to 128. When I doubled it, the issue went away in the debug build as well.

Thank you for sharing your solution!