Cortex-M0+ hangs on return

During debugging the Cortex-M0+ (ATSAMR21G18) all of a sudden hangs. Stack looks fine. LR contains the correct return address (odd), which based on the BX instruction description (http://www.keil.com/support/man/docs/armasm/armasm_dom1361289866466.htm) I understand as the processor is in thumb instruction mode.

BX LR is the instruction crashing, LR=0x8e5f. Single stepping through the return makes processor hang.

After processor is unresponsive, from debugger console window gdb shows: "Remote failure reply: EE02000002000000383B00200200000000000000343B002001000000343B0020F3B6EDFFDFBF7FF7F3DEFEEFDB37FCD000000000683A00205F8E00008201000000000061".

Is there a way to dig out from this hex code why the processor is not responding or is there another way to get this information?

Thanks for your time,
Torben

From map file:

We're not out of bounds in stack:

.stack 0x20001ba8 0x2000 load address 0x0000c958
0x20001ba8 . = ALIGN (0x8)
0x20001ba8 _sstack = .
0x20001ba8 __c_stack_limit__ = _sstack
0x20003ba8 . = (. + STACK_SIZE)
*fill* 0x20001ba8 0x2000

and region branched to is valid code:

.text.GetTxFreeSpace
0x00008e38 0x3c .../extcmdTx.c.obj
0x00008e38 GetTxFreeSpace

Arrows (->) indicates the point where I extracted the registers and stack dumps:

UINT16 buffer_free_space = CB_FreeSpace(&TransmitBuffers[TxId]);
443 UINT16 buffer_free_space = CB_FreeSpace(&TransmitBuffers[TxId]);
->00008e58: ldr r0, [pc, #20] ; (0x8e70 <GetTxFreeSpace+56>)
00008e5a: bl 0x180 <CB_FreeSpace>
444 if (buffer_free_space < (UINT16)sizeof(TRANSMIT_BUFFER_HEADER_TYPE))
00008e5e: cmp r0, #13 --- Torben: Never reached!

General Registers General Purpose and FPU Register Group
r0 0
r1 2
r2 536886072
r3 2
r4 0x0 (Hex)
r5 0x20003b34 (Hex)
r6 1
r7 536886068
r8 4293768947
r9 4152344543
r10 4026457843
r11 3506190299
r12 0
sp 0x20003a68
lr 0xf11 (Hex)
pc 0x8e58 <GetTxFreeSpace+32>
xpsr 1627389952
msp 536885864
psp 2675900284
primask 0
basepri 0
faultmask 0
control 0

0x20003b60 : 0x20003B60 <Hex>
Address 0 - 3 4 - 7 8 - B C - F
20003A00 01010101 01010101 01010101 01010101
20003A10 01010101 01010101 01010101 01010101
20003A20 01010101 01010101 01010101 01010101
20003A30 00000000 29360000 01010101 00000000
20003A40 00000000 29360000 00000000 29360000
20003A50 00000000 29360000 00000000 00000000
20003A60 7E3A0020 68140020 00000000 110F0000
20003A70 00000000 29360000 00000000 29360000
20003A80 00000000 00000000 02000000 303B0020
20003A90 AE3A0020 68140020 01000000 10000000
20003AA0 00000000 FE000000 FEFF0000 74140020
20003AB0 01000000 02000000 0E000000 10000000
20003AC0 00000000 CB7E0000 10000000 01000000
20003AD0 00000000 FE000000 FEFF0000 51100000
20003AE0 01000000 00000000 FE000000 FEFF0000
20003AF0 00000000 00000000 01000000 00000000
20003B00 0E930000 05000000 6C060020 00000000
20003B10 FFFFFFFF 1F800000 01000000 00000000
20003B20 FE000000 FEFF0000 00000000 594D0000
20003B30 443B0020 02000000 3C060020 9F800000





UINT16 CB_FreeSpace(const COMMS_BUFFER_TYPE *const BufferPtr)
{
//return BufferPtr->MaxIndex - CB_DataLength(BufferPtr); // == 750
return 750; --- Torben: Hits this breakpoint, but never returns!
}

CB_FreeSpace:
->00000180: ldr r0, [pc, #0] ; (0x184 <CB_FreeSpace+4>)
00000182: bx lr --- Torben: lr = 0x8e5f, so remain-in or switch-to thumb instruction set.


General Registers General Purpose and FPU Register Group
r0 536871232 (0x20000140)
r1 2
r2 536886072
r3 2
r4 0x0 (Hex)
r5 0x20003b34 (Hex)
r6 1
r7 536886068
r8 4293768947
r9 4152344543
r10 4026457843
r11 3506190299
r12 0
sp 0x20003a68
lr 0x8e5f (Hex)
pc 0x180 <CB_FreeSpace>
xpsr 1627389952
msp 536885864
psp 2675900284
primask 0
basepri 0
faultmask 0
control 0

0x20003b60 : 0x20003B60 <Hex>
Address 0 - 3 4 - 7 8 - B C - F
20003A00 01010101 01010101 01010101 01010101
20003A10 01010101 01010101 01010101 01010101
20003A20 01010101 01010101 01010101 01010101
20003A30 00000000 29360000 01010101 00000000
20003A40 00000000 29360000 00000000 29360000
20003A50 00000000 29360000 00000000 00000000
20003A60 7E3A0020 68140020 00000000 110F0000
20003A70 00000000 29360000 00000000 29360000
20003A80 00000000 00000000 02000000 303B0020
20003A90 AE3A0020 68140020 01000000 10000000
20003AA0 00000000 FE000000 FEFF0000 74140020
20003AB0 01000000 02000000 0E000000 10000000
20003AC0 00000000 CB7E0000 10000000 01000000
20003AD0 00000000 FE000000 FEFF0000 51100000
20003AE0 01000000 00000000 FE000000 FEFF0000
20003AF0 00000000 00000000 01000000 00000000
20003B00 0E930000 05000000 6C060020 00000000
20003B10 FFFFFFFF 1F800000 01000000 00000000
20003B20 FE000000 FEFF0000 00000000 594D0000
20003B30 443B0020 02000000 3C060020 9F800000


Hereafter the processor hangs. From GNU debugger window:
Breakpoint 2, GetTxFreeSpace (TxId=TxId@entry=EXTCMD_SPI_SLAVE_TX) at /.../extcmdTx.c:443
443 UINT16 buffer_free_space = CB_FreeSpace(&TransmitBuffers[TxId]);

Breakpoint 12, CB_FreeSpace (BufferPtr=BufferPtr@entry=0x20000140 <TransmitBuffers>) at /home/developer/projects/cdnz-pan-app-20190424/arm/common/extcmd/comms_buffer.c:77
77 }
Remote failure reply: EE02000002000000383B00200200000000000000343B002001000000343B0020F3B6EDFFDFBF7FF7F3DEFEEFDB37FCD000000000683A00205F8E00008201000000000061
Remote failure reply: EE02000002000000383B00200200000000000000343B002001000000343B0020F3B6EDFFDFBF7FF7F3DEFEEFDB37FCD000000000683A00205F8E00008201000000000061
Remote failure reply: EE02000002000000383B00200200000000000000343B002001000000343B0020F3B6EDFFDFBF7FF7F3DEFEEFDB37FCD000000000683A00205F8E00008201000000000061

Parents
No Data
Reply Children
No Data