TMS570 Crash "ABORT (PREFETCH) Exception"

Tony,

Looks like your code prefetch to a area without correct ECC.

Do you use flash ECC and RAM ECC? If yes, please fill the area you do not use with '0' or 'F', in the cmd file:

Flash  : origin = 0x00000000   length = 0x00200000   fill =0

If you copy the program into RAM, please initilize the eSRAM after enabling ECC.

or

Add a dummy function after the interrupt service routine, example:

GIO_ISR()

{

.....

}

void GIO_Dummy()

{

}

The dummy function will compile to a 'bx R14' instruction to prevend the prefetch.

Regards,

Haixiao

Hi Haixiao,

To be honest, I don't entirely understand how flash ECC gets set up. As I understand it the flash ECC is not automatically determined by the TMS570 on flash write, rather, the flash ECC has to be determined externally to the processor by some tool (TI nowECC for example) and programmed explicitely (by TI nowFlash) for example. I am using CCS4 IDE and don't know whether this programs flash ECC or not. Perhaps you could clarify the process for me.

To the problem:

We do not enable flash ECC within our application at present. Same with RAM ECC, we don't enable it at present.

We are running our code from flash, not RAM.

However, I followed your suggestion and have filled all unused flash and RAM space with zeros. This has absolutely no impact on my problem I'm afraid.

I have discovered another symptom. In my original posted Overview I said that following a 12V supply power-on and then inducing either a warm reset or power-on reset,  the application performs as expected (no resets). This is not the case. The application will perform a limited number of prefetch exceptions (anything from 1 to something like 10 times) before apparently recovering and continuing with normal operation.

Note that all my exception handlers, including prefetch, just call back into _c_int00() as the application does on reset interrupt.

Regards, Tony.

Tony,

I don't understand why a reset can solve the problem.

The CCS will not program flash ECC into the device.

Could you please publish the assemble code just after the interrupt service routine? like this:

Could you please try the 2nd option? Add a dummy function after the interrupt service routine. Then, after build, the assemble code looks like:

 Once the R4 CPU read the Bx R14, it will stop prefetch. So the problem will be solved if it is generated by the interrupt routine,

Regards,

Haixiao

Hi Haixiao,

I have managed to get a working build and so can now try and isolate the area causing the problem. It seems to do with the actual location of my interrupt service routine. I added some small piece of non-functional (not called) code in the C file linked directly before the C file containing my ISR and the problem went away.

I think it may have something to do with the start or end boundary that the ISR is located at, quire possibly on a 16-byte boundary. From my limited samples, it looks as though ISRs which start on a 16-byte (128-bit, 0x0???0) boundary fail, whilst others are okay. I think that reads from flash are 128-bit for efficiency.

Please find below the asm code for both a working ISR and a failing ISR.

Working Assembly Code - THIS WORKS

Failing Assembly Code - THIS FAILS WITH PREFETCH ABORT EXCEPTION

            Gpt_IsrChannel:
0x000086B0:   E92D57FF STMFD           R13!, {R0, R1, R2, R3, R4, R5, R6, R7, R8, R9, R10, R12, R14}
0x000086B4:   ED2D0B10 FSTMDBD         R13!, {D0-D7}
0x000086B8:   E24DD004 SUB             R13, R13, #4
0x000086BC:   E59F434C LDR             R4, $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
0x000086C0:   E5D45000 LDRB            R5, [R4]
0x000086C4:   E5D40001 LDRB            R0, [R4, #1]
0x000086C8:   E1500005 CMP             R0, R5
0x000086CC:   DA000014 BLE             $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
0x000086D0:   E59F733C LDR             R7, $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
0x000086D4:   E2848004 ADD             R8, R4, #4
0x000086D8:   E3A0A001 MOV             R10, #1
0x000086DC:   E3A09004 MOV             R9, #4
            $C$DW$L$Gpt_IsrChannel$3$B, $C$L1:
0x000086E0:   E1A0651A MOV             R6, R10, LSL R5
0x000086E4:   E597C000 LDR             R12, [R7]
0x000086E8:   E5971008 LDR             R1, [R7, #8]
0x000086EC:   E001C00C AND             R12, R1, R12
0x000086F0:   E11C0006 TST             R12, R6
0x000086F4:   0A000006 BEQ             $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
            $C$DW$L$Gpt_IsrChannel$4$B, $C$DW$L$Gpt_IsrChannel$3$E:
0x000086F8:   E16C0985 SMULBB          R12, R5, R9
0x000086FC:   E798C00C LDR             R12, [R8, R12]
0x00008700:   E35C0000 CMP             R12, #0
0x00008704:   0A000001 BEQ             $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
            $C$DW$L$Gpt_IsrChannel$5$B, $C$DW$L$Gpt_IsrChannel$4$E:
0x00008708:   E12FFF3C BLX             R12
            $C$DW$L$Gpt_IsrChannel$6$B, $C$DW$L$Gpt_IsrChannel$5$E:
0x0000870C:   E5D40001 LDRB            R0, [R4, #1]
            $C$DW$L$Gpt_IsrChannel$7$B, $C$L2, $C$DW$L$Gpt_IsrChannel$6$E:
0x00008710:   E5876008 STR             R6, [R7, #8]
            $C$DW$L$Gpt_IsrChannel$8$B, $C$L3, $C$DW$L$Gpt_IsrChannel$7$E:
0x00008714:   E285C001 ADD             R12, R5, #1
0x00008718:   E6EF507C UXTB            R5, R12, ROR #0
0x0000871C:   E1550000 CMP             R5, R0
0x00008720:   BAFFFFEE BLT             $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
            $C$L4, $C$DW$L$Gpt_IsrChannel$8$E:
0x00008724:   E28DD004 ADD             R13, R13, #4
0x00008728:   ECBD0B10 FMRRD           R0, R13, D0
0x0000872C:   E8BD57FF LDMFD           R13!, {R0, R1, R2, R3, R4, R5, R6, R7, R8, R9, R10, R12, R14}
0x00008730:   E25EF004 SUBS            PC, R14, #4
            Gpt_Init:
0x00008734:   E59FC2D0 LDR             R12, $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
0x00008738:   E3A02000 MOV             R2, #0
0x0000873C:   E58C2000 STR             R2, [R12]
0x00008740:   E58C2004 STR             R2, [R12, #4]

I tried your option of ensuring 'BX R14' follows the ISR, but this had no effect. I still get prefetch exception.

            Gpt_IsrChannel:
0x00007440:   E92D57FF STMFD           R13!, {R0, R1, R2, R3, R4, R5, R6, R7, R8, R9, R10, R12, R14}
0x00007444:   ED2D0B10 FSTMDBD         R13!, {D0-D7}
0x00007448:   E24DD004 SUB             R13, R13, #4
0x0000744C:   E59FC0D0 LDR             R12, $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
0x00007450:   E5DC7000 LDRB            R7, [R12]
0x00007454:   E59F60CC LDR             R6, $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
0x00007458:   E5D6C000 LDRB            R12, [R6]
0x0000745C:   E15C0007 CMP             R12, R7
0x00007460:   DA000014 BLE             $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
0x00007464:   E59F90B0 LDR             R9, $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
0x00007468:   E59F5078 LDR             R5, $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
0x0000746C:   E3A0A001 MOV             R10, #1
0x00007470:   E59F40A8 LDR             R4, $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
            $C$DW$L$Gpt_IsrChannel$3$B, $C$L19:
0x00007474:   E1A0871A MOV             R8, R10, LSL R7
0x00007478:   E599C000 LDR             R12, [R9]
0x0000747C:   E5950000 LDR             R0, [R5]
0x00007480:   E000C00C AND             R12, R0, R12
0x00007484:   E11C0008 TST             R12, R8
0x00007488:   0A000005 BEQ             $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
            $C$DW$L$Gpt_IsrChannel$4$B, $C$DW$L$Gpt_IsrChannel$3$E:
0x0000748C:   E794C107 LDR             R12, [R4, R7, LSL #2]
0x00007490:   E35C0000 CMP             R12, #0
0x00007494:   0A000001 BEQ             $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
            $C$DW$L$Gpt_IsrChannel$5$B, $C$DW$L$Gpt_IsrChannel$4$E:
0x00007498:   E794C107 LDR             R12, [R4, R7, LSL #2]
0x0000749C:   E12FFF3C BLX             R12
            $C$DW$L$Gpt_IsrChannel$6$B, $C$L20, $C$DW$L$Gpt_IsrChannel$5$E:
0x000074A0:   E5858000 STR             R8, [R5]
            $C$DW$L$Gpt_IsrChannel$7$B, $C$L21, $C$DW$L$Gpt_IsrChannel$6$E:
0x000074A4:   E5D6C000 LDRB            R12, [R6]
0x000074A8:   E2870001 ADD             R0, R7, #1
0x000074AC:   E6EF7070 UXTB            R7, R0, ROR #0
0x000074B0:   E15C0007 CMP             R12, R7
0x000074B4:   CAFFFFEE BGT             $../DriverSoftware/MicrocontrollerDrivers/Core.asm:160:175$
            $C$L22, $C$DW$L$Gpt_IsrChannel$7$E:
0x000074B8:   E28DD004 ADD             R13, R13, #4
0x000074BC:   ECBD0B10 FMRRD           R0, R13, D0
0x000074C0:   E8BD57FF LDMFD           R13!, {R0, R1, R2, R3, R4, R5, R6, R7, R8, R9, R10, R12, R14}
0x000074C4:   E25EF004 SUBS            PC, R14, #4
            Gpt_Dummy1:
0x000074C8:   E12FFF1E BX              R14
            Gpt_Dummy2:
0x000074CC:   E12FFF1E BX              R14
            Gpt_Dummy3:
0x000074D0:   E12FFF1E BX              R14
            Gpt_Dummy4:
0x000074D4:   E12FFF1E BX              R14

Way Forward

I'm going to try and get the TI demo project to fail in the same way so that we have a known set of circumstances which can induce the fault on a 'simple' application to facilitate investigation.

Regards, Tony.

Thanks. I am not aware of such a failure mechanism. What is your flash data wait state, address wait state (flash register 0) and HCLK frequency, PLL setting? Hopefully, you can reproduce it in a simple project. So we can look into it.

You can send the simple progject to me once it is ready.

My email: haixiao.weng@ti.com

Regards,

Haixiao

.

One more question, did you serve the phantom interrupt? It looks like your ISR calls some other functions. This means the ISR will take a long time to execute. If some other interrupt occurs during this period, it might not get served. It might turn to a phantom interrupt if the request goes away before it get served. If you do not have a phantom interrupt ISR, the code might go nowhere.

Regards,

Haixiao

Hi Haixiao,

We are running at 160MHz, so have chosen flash settings according to the datasheet wait states, i.e. address waitstates = 1 and data waitstates = 3. So:

    regFlashW.FRDCNTL =  0x00000311U;   /* Flash option control register 
                                           ---- ---- ---- ---- ---- 0011 ---1 ---1              
                                                                    0011           RWAIT = 3    (add 3 wait states to flash read)
                                                                            1      ASW-STEN = 1 (Address setup wait state enabled)
                                                                                 1 ENPIPE = 1   (Pipeline mode is enabled) */