prevent I2C from hanging on lost interrupt (#1657)

This addresses #1631 by adding a (long) timeout whenever we wait for an interrupt from the I2C controller. This timeout shouldn't ever fire: if it does, something seriously is amiss, so we record more or less everything we can out of the I2C controller and explicitly panic.
oxidecomputer · Mar 15, 2024 · 97a635f · 97a635f
1 parent f1c7898
commit 97a635f
Show file tree

Hide file tree

Showing 12 changed files with 153 additions and 41 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/app/demo-stm32h7-nucleo/app-h743.toml b/app/demo-stm32h7-nucleo/app-h743.toml
@@ -34,6 +34,7 @@ task-slots = ["jefe"]
 
 [tasks.i2c_driver]
 name = "drv-stm32xx-i2c-server"
+stacksize = 1048
 features = ["h743"]
 priority = 2
 max-sizes = {flash = 16384, ram = 4096}

diff --git a/app/demo-stm32h7-nucleo/app-h753.toml b/app/demo-stm32h7-nucleo/app-h753.toml
@@ -34,6 +34,7 @@ task-slots = ["jefe"]
 
 [tasks.i2c_driver]
 name = "drv-stm32xx-i2c-server"
+stacksize = 1048
 features = ["h753"]
 priority = 2
 max-sizes = {flash = 16384, ram = 4096}

diff --git a/app/gemini-bu/app.toml b/app/gemini-bu/app.toml
@@ -32,6 +32,7 @@ task-slots = ["jefe"]
 
 [tasks.i2c_driver]
 name = "drv-stm32xx-i2c-server"
+stacksize = 1048
 features = ["h753"]
 priority = 2
 max-sizes = {flash = 16384, ram = 4096}

diff --git a/app/gimlet/base.toml b/app/gimlet/base.toml
@@ -71,6 +71,7 @@ notifications = ["spi-irq"]
 
 [tasks.i2c_driver]
 name = "drv-stm32xx-i2c-server"
+stacksize = 1048
 features = ["h753"]
 priority = 3
 max-sizes = {flash = 16384, ram = 4096}
@@ -125,7 +126,7 @@ name = "task-power"
 features = ["gimlet"]
 priority = 6
 max-sizes = {flash = 65536, ram = 16384 }
-stacksize = 2504
+stacksize = 2800
 start = true
 task-slots = ["i2c_driver", "sensor", "gimlet_seq"]
 notifications = ["timer"]
@@ -135,7 +136,7 @@ name = "task-hiffy"
 features = ["h753", "stm32h7", "i2c", "gpio", "spi", "qspi", "hash", "sprot"]
 priority = 5
 max-sizes = {flash = 32768, ram = 32768 }
-stacksize = 1024
+stacksize = 1200
 start = true
 task-slots = ["sys", "hf", "i2c_driver", "hash_driver", "update_server", "sprot"]
 

diff --git a/app/gimletlet/base-gimletlet2.toml b/app/gimletlet/base-gimletlet2.toml
@@ -33,6 +33,7 @@ task-slots = ["jefe"]
 
 [tasks.i2c_driver]
 name = "drv-stm32xx-i2c-server"
+stacksize = 1048
 features = ["h753"]
 priority = 2
 max-sizes = {flash = 16384, ram = 4096}

diff --git a/app/psc/base.toml b/app/psc/base.toml
@@ -43,6 +43,7 @@ task-slots = ["jefe"]
 
 [tasks.i2c_driver]
 name = "drv-stm32xx-i2c-server"
+stacksize = 1048
 features = ["h753"]
 priority = 2
 max-sizes = {flash = 16384, ram = 4096}
@@ -88,7 +89,7 @@ name = "task-hiffy"
 features = ["h753", "stm32h7", "i2c", "gpio", "sprot"]
 priority = 5
 max-sizes = {flash = 32768, ram = 16384 }
-stacksize = 1024
+stacksize = 1200
 start = true
 task-slots = ["sys", "i2c_driver", "sprot"]
 
@@ -207,7 +208,7 @@ notifications = ["timer"]
 name = "task-power"
 priority = 4
 max-sizes = {flash = 32768, ram = 4096}
-stacksize = 1504
+stacksize = 2504
 start = true
 task-slots = ["i2c_driver", "sensor", "sys"]
 features = ["psc"]

diff --git a/app/sidecar/base.toml b/app/sidecar/base.toml
@@ -150,6 +150,7 @@ interrupts = {"spi2.irq" = "spi-irq"}
 
 [tasks.i2c_driver]
 name = "drv-stm32xx-i2c-server"
+stacksize = 1048
 features = ["h753"]
 priority = 2
 max-sizes = {flash = 16384, ram = 4096}
@@ -173,7 +174,7 @@ name = "task-hiffy"
 features = ["h753", "stm32h7", "i2c", "gpio", "sprot"]
 priority = 5
 max-sizes = {flash = 32768, ram = 32768 }
-stacksize = 1024
+stacksize = 1200
 start = true
 task-slots = ["sys", "i2c_driver", "sprot"]
 
@@ -264,7 +265,7 @@ name = "task-power"
 features = ["sidecar"]
 priority = 6
 max-sizes = {flash = 32768, ram = 8192 }
-stacksize = 2048
+stacksize = 2800
 start = true
 task-slots = ["i2c_driver", "sensor", "sequencer"]
 notifications = ["timer"]

diff --git a/drv/stm32xx-i2c-server/src/main.rs b/drv/stm32xx-i2c-server/src/main.rs
@@ -240,7 +240,7 @@ enum Trace {
     None,
 }
 
-ringbuf!(Trace, 174, Trace::None);
+ringbuf!(Trace, 160, Trace::None);
 
 fn reset(
     controller: &I2cController<'_>,
@@ -340,8 +340,25 @@ fn main() -> ! {
         enable: |notification| {
             sys_irq_control(notification, true);
         },
-        wfi: |notification| {
-            let _ = sys_recv_closed(&mut [], notification, TaskId::KERNEL);
+        wfi: |notification, timeout| {
+            const TIMER_NOTIFICATION: u32 = 1 << 31;
+
+            let dead = sys_get_timer().now.checked_add(timeout.0).unwrap_lite();
+            sys_set_timer(Some(dead), TIMER_NOTIFICATION);
+
+            let m = sys_recv_closed(
+                &mut [],
+                notification | TIMER_NOTIFICATION,
+                TaskId::KERNEL,
+            )
+            .unwrap_lite();
+
+            if m.operation == TIMER_NOTIFICATION {
+                I2cControlResult::TimedOut
+            } else {
+                sys_set_timer(None, TIMER_NOTIFICATION);
+                I2cControlResult::Interrupted
+            }
         },
     };
 

diff --git a/drv/stm32xx-i2c/Cargo.toml b/drv/stm32xx-i2c/Cargo.toml
@@ -14,6 +14,7 @@ zerocopy = { workspace = true }
 drv-i2c-api = { path = "../i2c-api" }
 drv-stm32xx-sys-api = { path = "../stm32xx-sys-api" }
 ringbuf = { path = "../../lib/ringbuf" }
+counters = { path = "../../lib/counters" }
 userlib = { path = "../../sys/userlib" }
 
 [features]