Zephyr fatal error decoder
Paste the console output of a Zephyr fatal error, add zephyr.elf, and see what happened, why, and where: the reason code by name, every fault bit explained, and each frame of the call trace as a function and line.
What it reads
***** USAGE FAULT *****,BUS FAULT,MPU FAULT,HARD FAULTandSECURE FAULT, with the detail lines.>>> ZEPHYR FATAL ERROR n: the reason by name, including the ARM ones Zephyr prints as "Unknown error".- The register dump,
CFSR,HFSR,MMFARandBFAR, or the olderMMFSR, BFSR, UFSRline. - The
call traceofCONFIG_EXCEPTION_STACK_TRACE, or the faulting PC and LR when there is none.
Functions and lines come from the ELF's symbol table and DWARF line table, as arm-zephyr-eabi-addr2line gives them. Nothing is uploaded. How to read a fatal error yourself.
The fault status bits
| Bit | Fault | Usually means |
|---|---|---|
DACCVIOL | MemManage | A read or write the MPU forbids: a NULL pointer (MMFAR near 0) or a stack overflow into the guard. |
IACCVIOL | MemManage | Code run from a region that may not execute: a jump through a bad function pointer. |
MSTKERR, STKERR | MemManage, BusFault | The registers could not be saved on exception entry: a stack overflow. |
PRECISERR | BusFault | The instruction at PC touched an address with nothing behind it; BFAR says which. |
IMPRECISERR | BusFault | A buffered write failed; the culprit is a few instructions before PC. Often a peripheral with its clock off. |
UNDEFINSTR | UsageFault | Bytes that are not an instruction: a corrupt pointer or return address, or __builtin_trap(). |
INVSTATE | UsageFault | A branch to an even address: a call through a NULL or uninitialised function pointer. |
NOCP | UsageFault | A floating-point instruction with the FPU off. |
UNALIGNED, DIVBYZERO | UsageFault | An unaligned access or an integer division by zero, when trapping is on. |
FORCED (HFSR) | HardFault | One of the above escalated to HardFault; read the CFSR bits. |
VECTTBL (HFSR) | HardFault | The vector table could not be read: an image linked for the wrong address, often behind a bootloader. |
For devices in the field
Pinscope's Zephyr module keeps a fatal error across the reboot, sends it on the next connection and decodes it with the ELF of that build.
Try it
Three devices are free, and no card is needed. Create an account, or read the guide for your platform: ESP32, Zephyr, Raspberry Pi Pico, Linux, ESP8266.
More
- Remote access to an ESP32 without TLS: what it measured and what it costs
- Serial monitor in the browser for ESP32 and Zephyr, with crash decoding
- Pinscope now runs on Zephyr, Raspberry Pi Pico, Linux and ESP8266
- Zephyr devices in the field: logs, crashes and OTA over the internet
- Reading a Zephyr fatal error: fault, reason, CFSR and call trace
- MCUboot: are your images signed with the public development key?
- Cortex-M HardFault decoder
- MCUboot image inspector
- UF2 converter and inspector
- Zephyr flash partition checker
- Memfault vs Pinscope: which one fits
- Golioth vs Pinscope: which one fits
- nRF Cloud vs Pinscope: which one fits
- Memfault, Golioth, nRF Cloud and Pinscope compared