usage of i2c diver causes StoreProhibited exception (IDFGH-13589)

[Andrew-Exeter]

Answers checklist.

• I have read the documentation ESP-IDF Programming Guide and the issue is not addressed there.
• I have updated my IDF branch (master or release) to the latest version and checked that the issue is present there.
• I have searched the issue tracker for a similar issue and not found a similar issue.

IDF version.

v5.2.2-639-g43098fc4de, v5.3-383-g0bbd728196, v5.4-dev-2596-g6e5414b6c4

Espressif SoC revision.

ESP32-D0WDQ6 (revision v1.0)

Operating System used.

Windows

How did you build your project?

VS Code IDE

If you are using Windows, please specify command line type.

None

Development Kit.

NodeMCU-ESP32 ESP32 DEVKITV1

Power Supply used.

USB

What is the expected behavior?

i2c_master_transmit_receive function should return error code on i2c transaction failure.

What is the actual behavior?

StoreProhibited exception is thrown by accessing to null ptr in function i2c_ll_read_rxfifo.

Steps to reproduce.

1. Create new project from "template-app" template.
2. Copy and paste provided main/main.c and main/CMakeLists.txt files.
3. Update i2c device address and register address. (I was reading status register of QMC5883 magnetometer.)
4. Simulate i2c device malfunction or bus interference.

• main/main.c

#include <stdio.h>
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"
#include "driver/i2c_master.h"

void app_main(void)
{
  i2c_master_bus_config_t i2c_mst_config = {
    .i2c_port = I2C_NUM_1,
    .sda_io_num = GPIO_NUM_19,
    .scl_io_num = GPIO_NUM_18,
    .clk_source = I2C_CLK_SRC_DEFAULT,
    .glitch_ignore_cnt = 7,
    .intr_priority = 0,
    .trans_queue_depth = 0,
    .flags = {
      .enable_internal_pullup = true,
    }
  };

  i2c_master_bus_handle_t bus = NULL;
  if (i2c_new_master_bus(&i2c_mst_config, &bus) == ESP_OK)
  {
    printf("bus installed\n");

    i2c_device_config_t i2c_device_cfg = {
      .dev_addr_length = I2C_ADDR_BIT_LEN_7,
      .device_address = 0x0D, // QMC5883 address
      .scl_speed_hz = 400000,
      .scl_wait_us = 0,
      .flags = {
        .disable_ack_check = false,
      }
    };

    i2c_master_dev_handle_t device = NULL;
    if (i2c_master_bus_add_device(bus, &i2c_device_cfg, &device) == ESP_OK)
    {
      printf("device added\n");

      unsigned char txBuff[1] = { 0x06 }; // QMC5883 status register address
      unsigned char rxBuff[1];
      while (true)
      {
        i2c_master_transmit_receive(device, txBuff, 1, rxBuff, 1, 100);
        vTaskDelay(1);
      }
    }
  }

  while (true)
  {
    vTaskDelay(1000/portTICK_PERIOD_MS);
  }
}

• main/CMakeLists.txt

idf_component_register(SRCS "main.c"
                    INCLUDE_DIRS "."
                    PRIV_REQUIRES driver)

Debug Logs.

PS C:\Users\Andrew_Exeter\espressif_projects\i2c_test> & set IDF_PATH='c:\Users\Andrew_Exeter\esp\v5_3'
PS C:\Users\Andrew_Exeter\espressif_projects\i2c_test> & 'c:\Users\Andrew_Exeter\.espressif\v5_3\Espressif\python_env\idf5.3_py3.11_env\Scripts\python.exe' 'c:\Users\Andrew_Exeter\esp\v5_3\tools\idf_monitor.py' -p COM8 -b 115200 --toolchain-prefix xtensa-esp32-elf- --target esp32 'c:\Users\Andrew_Exeter\espressif_projects\i2c_test\build\i2c_test.elf'
--- WARNING: GDB cannot open serial ports accessed as COMx
--- Using \\.\COM8 instead...
--- esp-idf-monitor 1.4.0 on \\.\COM8 115200 ---
--- Quit: Ctrl+] | Menu: Ctrl+T | Help: Ctrl+T followed by Ctrl+H ---
ets Jun  8 2016 00:22:57

rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:2
load:0x3fff0030,len:7176
load:0x40078000,len:15564
ho 0 tail 12 room 4
load:0x40080400,len:4
0x40080400: _init at ??:?

load:0x40080404,len:3904
entry 0x40080640
I (30) boot: ESP-IDF v5.3-383-g0bbd728196 2nd stage bootloader
I (30) boot: compile time Aug 31 2024 16:10:37
I (32) boot: Multicore bootloader
I (36) boot: chip revision: v1.0
I (39) boot.esp32: SPI Speed      : 40MHz
I (44) boot.esp32: SPI Mode       : DIO
I (49) boot.esp32: SPI Flash Size : 2MB
I (53) boot: Enabling RNG early entropy source...
I (59) boot: Partition Table:
I (62) boot: ## Label            Usage          Type ST Offset   Length
I (69) boot:  0 nvs              WiFi data        01 02 00009000 00006000
I (77) boot:  1 phy_init         RF data          01 01 0000f000 00001000
I (84) boot:  2 factory          factory app      00 00 00010000 00100000
I (92) boot: End of partition table
I (96) esp_image: segment 0: paddr=00010020 vaddr=3f400020 size=0b48ch ( 46220) map
I (120) esp_image: segment 1: paddr=0001b4b4 vaddr=3ffb0000 size=02384h (  9092) load
I (124) esp_image: segment 2: paddr=0001d840 vaddr=40080000 size=027d8h ( 10200) load
I (130) esp_image: segment 3: paddr=00020020 vaddr=400d0020 size=1bdbch (114108) map
I (174) esp_image: segment 4: paddr=0003bde4 vaddr=400827d8 size=0a968h ( 43368) load
I (198) boot: Loaded app from partition at offset 0x10000
I (198) boot: Disabling RNG early entropy source...
I (210) cpu_start: Multicore app
I (218) cpu_start: Pro cpu start user code
I (218) cpu_start: cpu freq: 160000000 Hz
I (218) app_init: Application information:
I (221) app_init: Project name:     i2c_test
I (226) app_init: App version:      1
I (231) app_init: Compile time:     Aug 31 2024 16:10:13
I (237) app_init: ELF file SHA256:  feb9b66c4...
I (242) app_init: ESP-IDF:          v5.3-383-g0bbd728196
I (248) efuse_init: Min chip rev:     v0.0
I (253) efuse_init: Max chip rev:     v3.99 
I (258) efuse_init: Chip rev:         v1.0
I (263) heap_init: Initializing. RAM available for dynamic allocation:
I (270) heap_init: At 3FFAE6E0 len 00001920 (6 KiB): DRAM
I (276) heap_init: At 3FFB3250 len 0002CDB0 (179 KiB): DRAM
I (282) heap_init: At 3FFE0440 len 00003AE0 (14 KiB): D/IRAM
I (288) heap_init: At 3FFE4350 len 0001BCB0 (111 KiB): D/IRAM
I (295) heap_init: At 4008D140 len 00012EC0 (75 KiB): IRAM
I (302) spi_flash: detected chip: winbond
I (305) spi_flash: flash io: dio
W (309) spi_flash: Detected size(4096k) larger than the size in the binary image header(2048k). Using the size in the binary image header.
I (323) main_task: Started on CPU0
I (333) main_task: Calling app_main()
I (333) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (333) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
bus installed
device added
E (443) i2c.master: I2C hardware NACK detected
E (443) i2c.master: I2C transaction unexpected nack detected
E (443) i2c.master: s_i2c_synchronous_transaction(872): I2C transaction failed
I (443) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (453) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
E (463) i2c.master: i2c_master_transmit_receive(1097): I2C transaction failed
E (573) i2c.master: I2C hardware NACK detected
E (573) i2c.master: I2C transaction unexpected nack detected
E (573) i2c.master: s_i2c_synchronous_transaction(872): I2C transaction failed
I (573) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
I (583) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
E (593) i2c.master: i2c_master_transmit_receive(1097): I2C transaction failed
E (703) i2c.master: I2C hardware NACK detected
E (803) i2c.master: I2C hardware NACK detected
E (803) i2c.master: I2C transaction unexpected nack detected
E (803) i2c.master: s_i2c_synchronous_transaction(872): I2C transaction failed
I (803) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (813) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
E (823) i2c.master: i2c_master_transmit_receive(1097): I2C transaction failed

*
*
*

I (63353) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (63353) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
I (63353) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
I (63363) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
E (63373) i2c.master: I2C hardware timeout detected
E (63383) i2c.master: s_i2c_synchronous_transaction(872): I2C transaction failed
I (63393) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (63403) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
E (63403) i2c.master: i2c_master_transmit_receive(1097): I2C transaction failed
I (63513) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (63513) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
Guru Meditation Error: Core  0 panic'ed (StoreProhibited). Exception was unhandled.

Core  0 register dump:
PC      : 0x400842c3  PS      : 0x00060033  A0      : 0x800843d9  A1      : 0x3ffb0f60  
0x400842c3: i2c_ll_read_rxfifo at C:/Users/Andrew_Exeter/esp/v5_3/components/hal/esp32/include/hal/i2c_ll.h:576
 (inlined by) i2c_isr_receive_handler at C:/Users/Andrew_Exeter/esp/v5_3/components/esp_driver_i2c/i2c_master.c:609

A2      : 0x3ffb520c  A3      : 0x3ffb521c  A4      : 0x3ffb0f90  A5      : 0x00000000
A6      : 0x3ffaffa4  A7      : 0x3ffb5280  A8      : 0x00000000  A9      : 0x00000000
A10     : 0x00000000  A11     : 0x00000001  A12     : 0x00000000  A13     : 0x00000000  
A14     : 0x3ff67000  A15     : 0x0000cdcd  SAR     : 0x00000020  EXCCAUSE: 0x0000001d
EXCVADDR: 0x00000000  LBEG    : 0x4000c46c  LEND    : 0x4000c477  LCOUNT  : 0x00000000
0x4000c46c: memset in ROM
0x4000c477: memset in ROM



Backtrace: 0x400842c0:0x3ffb0f60 0x400843d6:0x3ffb0f90 0x400822e5:0x3ffb0fd0 0x40082db1:0x3ffb0ff0 0x4000bfed:0x3ffb4340 0x40086787:0x3ffb4350 0x400da977:0x3ffb4370 0x400db127:0x3ffb43c0 0x400db2c0:0x3ffb43f0 0x400db395:0x3ffb4420 0x400dbe01:0x3ffb4450 0x400d7a2a:0x3ffb44e0 0x400eb358:0x3ffb4540 0x400863e5:0x3ffb4570
0x400842c0: i2c_ll_read_rxfifo at C:/Users/Andrew_Exeter/esp/v5_3/components/hal/esp32/include/hal/i2c_ll.h:576
 (inlined by) i2c_isr_receive_handler at C:/Users/Andrew_Exeter/esp/v5_3/components/esp_driver_i2c/i2c_master.c:609
0x400843d6: i2c_master_isr_handler_default at C:/Users/Andrew_Exeter/esp/v5_3/components/esp_driver_i2c/i2c_master.c:667
0x400822e5: shared_intr_isr at C:/Users/Andrew_Exeter/esp/v5_3/components/esp_hw_support/intr_alloc.c:445
0x40082db1: _xt_lowint1 at C:/Users/Andrew_Exeter/esp/v5_3/components/xtensa/xtensa_vectors.S:1240
0x4000bfed: _xtos_set_intlevel in ROM
0x40086787: vPortClearInterruptMaskFromISR at C:/Users/Andrew_Exeter/esp/v5_3/components/freertos/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
 (inlined by) vPortExitCritical at C:/Users/Andrew_Exeter/esp/v5_3/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:505
0x400da977: vPortExitCriticalSafe at C:/Users/Andrew_Exeter/esp/v5_3/components/freertos/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:596
 (inlined by) s_i2c_start_end_command at C:/Users/Andrew_Exeter/esp/v5_3/components/esp_driver_i2c/i2c_master.c:339
0x400db127: s_i2c_send_commands at C:/Users/Andrew_Exeter/esp/v5_3/components/esp_driver_i2c/i2c_master.c:461
0x400db2c0: s_i2c_transaction_start at C:/Users/Andrew_Exeter/esp/v5_3/components/esp_driver_i2c/i2c_master.c:584
0x400db395: s_i2c_synchronous_transaction at C:/Users/Andrew_Exeter/esp/v5_3/components/esp_driver_i2c/i2c_master.c:872
0x400dbe01: i2c_master_transmit_receive at C:/Users/Andrew_Exeter/esp/v5_3/components/esp_driver_i2c/i2c_master.c:1097
0x400d7a2a: app_main at C:/Users/Andrew_Exeter/espressif_projects/i2c_test/main/main.c:48
0x400eb358: main_task at C:/Users/Andrew_Exeter/esp/v5_3/components/freertos/app_startup.c:208
0x400863e5: vPortTaskWrapper at C:/Users/Andrew_Exeter/esp/v5_3/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:134

More Information.

My project crashed time by time and always with same exception/backtrace.
To exclude posibilities that problem is related to other project specific code or configuration I created new project as described in "Steps to reproduce" section, but with same behavior.
Clean installations of esp-idf and tools didn't help. (I tried versions v5.2, v5.3, master)
I tried /examples/peripherals/i2c/i2c_tools example too. During i2c device register reading ("i2cget" command) occurs exactly same exception.

This problem araised mostly (almost exclusively) with QMC5883 sensor in comparison to other i2c devices.

It looks that i2c_isr_receive_handler function tries to write some data to user read/write buffer (data member of i2c_operation_t) which is not assigned to i2c operation of type I2C_LL_CMD_STOP, but I could be wrong.

I am attaching backtrace, states of lacal variables and states of same other i2c driver related objects acquired using GDB debugger:

gdb-backtrace.txt
gdb-i2c_master_bus_t-related.txt
gdb-locals.txt

[mythbuster5]

No it shouldn't be this case It looks that i2c_isr_receive_handler function tries to write some data to user read/write buffer (data member of i2c_operation_t) which is not assigned to i2c operation of type I2C_LL_CMD_STOP, but I could be wrong. Umm, could you please try that in the latest master, setting .scl_wait_us = 0, with larger value like 20*1000, and see if there is anything wrong.

Secondly, what about slowing down scl frequency

As for QMC5883 is the exclusive sensor that causes this error, interesting and I'm going to got one for further debugging.

[mythbuster5]

By the way, are you sure 0x0D is correct in your case? I think I2C hardware NACK detected thought the address is wrong. Even this is not the root cause of this bug

[Andrew-Exeter]

Thank you for your reply.

I tried following combinations of configuration changes and always was able to reproduce the same exception/backtrace:

• .scl_speed_hz = 50000
• .scl_wait_us = 20000
• .scl_speed_hz = 50000, .scl_wait_us = 20000
• .scl_speed_hz = 10000, .scl_wait_us = 20000
• .scl_speed_hz = 10000, .scl_wait_us = 40000
• .scl_speed_hz = 10000, .scl_wait_us = 40000, .i2c_port = I2C_NUM_0
• .scl_speed_hz = 10000, .scl_wait_us = 40000, .intr_priority = 3
• .scl_speed_hz = 10000, .scl_wait_us = 40000, .glitch_ignore_cnt = 14
• .scl_speed_hz = 10000, .scl_wait_us = 40000, .glitch_ignore_cnt = 28
• .scl_speed_hz = 10000, .scl_wait_us = 40000, .glitch_ignore_cnt = 56

Tests has been done with esp-idf repository updated to v5.4-dev-2620-g6673376297 version.

Addresses of QMC5883 and status register should be valid, they are taken over from library, which was able to read the sensor properly, and values matches with register map in datasheet. To be sure, I tested it using /examples/peripherals/i2c/i2c_tools:

i2c-tools> i2cconfig --port=1 --freq=400000 --sda=19 --scl=18
I (165256) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (165256) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
i2c-tools> i2cdetect
     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00: -- -- -- -- -- -- -- -- -- -- -- -- -- 0d -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
i2c-tools> i2cget -c 0x0D -r 0x06
0x00 
i2c-tools> i2cset -c 0x0D -r 0x09 0x01
I (510556) cmd_i2ctools: Write OK
i2c-tools> i2cget -c 0x0D -r 0x06
0x05 

(After sensor is switched to continuous mode by MODE field in "Control Register 1" (0x09), DRDY and DOR flags in "Status Register" (0x06) indicates operation.)

Some I2C hardware NACK detected are in the debug log because circuit is on a breadboard, not ideal connections ...

[mythbuster5]

I tried following combinations of configuration changes and always was able to reproduce the same exception/backtrace:

Strange, anyway, my sensor is on the way, I will try to reproduce that locally and see what is exactly happening..

[mythbuster5]

I got a QMC5883 but regretfully didn't reproduce the same issue. But anyway, I go through the gdb log again, It seems that it really want to receive data in STOP command as you described. I don't know why this happened excactly.. still debugging.

Because you can reproduce easily, may you please try add a line https://github.com/espressif/esp-idf/blob/master/components/esp_driver_i2c/i2c_master.c#L430 here i2c_master->contains_read = false; and see if this will happen once more? Thanks @Andrew-Exeter

[mythbuster5]

But..

From the gdb log, the interrupt has been triggered in a very strange place, it shouldn't be theoretical. So, do you use multi core to run i2c or enable some special configs?

[Andrew-Exeter]

After adding i2c_master->contains_read = false; exceptions kept appearing.
I tried to append printf("///---///\n"); after the line 430 to see when the code is reached, maybe it could be useful:

///---///
///---///
///---///
///---///
///---///
///---///
///---///
///---///
///---///
///---///
E (12719) i2c.master: I2C hardware timeout detected
E (12729) i2c.master: s_i2c_synchronous_transaction(896): I2C transaction failed
I (12729) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (12739) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
E (12749) i2c.master: i2c_master_transmit_receive(1169): I2C transaction failed
I (12859) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (12859) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
I (12869) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (12869) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
E (12879) i2c.master: I2C hardware timeout detected
E (12889) i2c.master: s_i2c_synchronous_transaction(896): I2C transaction failed
I (12899) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (12909) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
E (12909) i2c.master: i2c_master_transmit_receive(1169): I2C transaction failed
I (13019) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (13019) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
E (13039) i2c.master: I2C software timeout
E (13039) i2c.master: s_i2c_synchronous_transaction(896): I2C transaction failed
I (13039) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0
I (13049) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
E (13059) i2c.master: i2c_master_transmit_receive(1169): I2C transaction failed
I (13169) gpio: GPIO[19]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
I (13169) gpio: GPIO[18]| InputEn: 1| OutputEn: 1| OpenDrain: 1| Pullup: 1| Pulldown: 0| Intr:0 
Guru Meditation Error: Core  0 panic'ed (StoreProhibited). Exception was unhandled.

Core  0 register dump:
PC      : 0x40084437  PS      : 0x00060033  A0      : 0x8008454d  A1      : 0x3ffb0f40  
0x40084437: i2c_ll_read_rxfifo at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/hal/esp32/include/hal/i2c_ll.h:576
 (inlined by) i2c_isr_receive_handler at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/esp_driver_i2c/i2c_master.c:633

A2      : 0x3ffb4bfc  A3      : 0x3ffb4c0c  A4      : 0x3ffb0f70  A5      : 0x00000000
A6      : 0x3ffb4ed0  A7      : 0x3ffb4c70  A8      : 0x00000000  A9      : 0x00000000  
A10     : 0x00000000  A11     : 0x00000001  A12     : 0x00000000  A13     : 0x00000000
A14     : 0x3ff67000  A15     : 0x0000cdcd  SAR     : 0x00000020  EXCCAUSE: 0x0000001d
EXCVADDR: 0x00000000  LBEG    : 0x4000c46c  LEND    : 0x4000c477  LCOUNT  : 0x00000000
0x4000c46c: memset in ROM
0x4000c477: memset in ROM



Backtrace: 0x40084434:0x3ffb0f40 0x4008454a:0x3ffb0f70 0x4008238d:0x3ffb0fb0 0x40082e0d:0x3ffb0fd0 0x4000bfed:0x3ffb3d30 0x400868c6:0x3ffb3d40 0x400d96e7:0x3ffb3d60 0x400d9ea3:0x3ffb3db0 0x400da051:0x3ffb3de0 0x400da125:0x3ffb3e10 0x400dab95:0x3ffb3e40 0x400d6761:0x3ffb3ed0 0x400e6b98:0x3ffb3f30 0x40086515:0x3ffb3f60
0x40084434: i2c_ll_read_rxfifo at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/hal/esp32/include/hal/i2c_ll.h:576
 (inlined by) i2c_isr_receive_handler at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/esp_driver_i2c/i2c_master.c:633
0x4008454a: i2c_master_isr_handler_default at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/esp_driver_i2c/i2c_master.c:691
0x4008238d: shared_intr_isr at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/esp_hw_support/intr_alloc.c:445
0x40082e0d: _xt_lowint1 at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/xtensa/xtensa_vectors.S:1240
0x4000bfed: _xtos_set_intlevel in ROM
0x400868c6: vPortClearInterruptMaskFromISR at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/freertos/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:560
 (inlined by) vPortExitCritical at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:509
0x400d96e7: vPortExitCriticalSafe at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/freertos/FreeRTOS-Kernel/portable/xtensa/include/freertos/portmacro.h:596
 (inlined by) s_i2c_start_end_command at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/esp_driver_i2c/i2c_master.c:364
0x400d9ea3: s_i2c_send_commands at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/esp_driver_i2c/i2c_master.c:488
0x400da051: s_i2c_transaction_start at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/esp_driver_i2c/i2c_master.c:608
0x400da125: s_i2c_synchronous_transaction at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/esp_driver_i2c/i2c_master.c:896
0x400dab95: i2c_master_transmit_receive at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/esp_driver_i2c/i2c_master.c:1169
0x400d6761: app_main at C:/Users/Andrew_Exeter/espressif_projects/i2c_test/main/main.c:45
0x400e6b98: main_task at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/freertos/app_startup.c:208
0x40086515: vPortTaskWrapper at C:/Users/Andrew_Exeter/esp/master/esp-idf/components/freertos/FreeRTOS-Kernel/portable/xtensa/port.c:134

So, do you use multi core to run i2c or enable some special configs?

I'am not sure if I understood question properly, but driver API is called always from single task. I use code provided in "Steps to reproduce." section for all tests. I don't know whether it is related, but compiling project with sdkconfig option FREERTOS_UNICORE doesn't change behavior.

I tried delete sdkconfig file to recovery default settings, again with same results. Are there some another configurations, which I should check?

[mythbuster5]

no more need to check. I tried several scenario like nack or timeout, no produce anyway... i will continue going through. But a suggestion for you might to decline the error report like nack or timeout in order that try not to disturb the state machine..

[mythbuster5]

Well, I tried QMC5883 with esp32 in your code and can't reproduce issue. So... If no further update, I will close this issue.

[Andrew-Exeter]

I plan to look at bus and try to find some anomaly occuring before crash. Would it be possible to reopen this issue, if I find more specific method to reproduce crash?

Thank you for your help.
I appreciate the time and effort you put into this issue.