TMS320F28335: SYSBIOS-1052 C28 Dispatcher alignment issue

The issue is located in /family/c28/Hwi_disp_asm.s28. There's some code like this:

 movz    ar0,@sp

    .if (.TMS320C2800_FPU32 == 1)
       subb    xar0, #13       ; point to IER on stack
    .else
        subb    xar0, #11       ; point to IER on stack
    .endif
                                ; Note: if we change order of items
                                ;       pushed on stack, double check
                                ;       the value here.

        mov     *xar0, ier      ; IER value may have changed by
                                ; the user till this time
                                ; this need to be corrected in
                                ; the stack where value of IER
                                ; have been saved as hardware
                                ; context and will be restored
                                ; as a part of iret instruction

Here's the description of the bug:

It is writing current IER register value (possibly modified within HWI) to the location relative to the current stack pointer, where IER is restored from by the HW as part of the IRET sequence. Therefore, the intent is to preserve the current IER value at the end of an interrupt.

Here is the problem. 32-bit register pairs written to the stack are aligned at even addresses, while alignment of the stack pointer itself is unchanged (SP is unconditionally incremented first to avoid overwrite). The exact sequence is documented in “3.4 Standard Operation for Maskable Interrupts” section of the “TMS320C28x CPU and Instruction Set” manual. The way it works, depending on the initial (odd or even) value of the SP register when an interrupt is triggered, the offset between the final SP value and IER restore location may be either 10 or 11 words (12 or 13 with FPU) at the moment the code above executes. The code assumes a fixed value of 11 (13 with FPU), which is wrong when an interrupt is triggered with initially odd-aligned SP. As a result, a data page (DP) register is getting overwritten with IER value. This causes a code running after the interrupt to read from or write to a wrong memory location.

Whitney

Hello Whitney,

Thank you for your quick response, which is very helpful. 

Confusingly, the comment at the start of dispatchMain that describes the content of the stack after the interrupt context switch is wrong:

; At this point, the following registers have already been saved:
; ** Automatic interrupt context save (see SPRU513C) **
; ST0, T, AL, AH, PL, PH, AR0, AR1, DP, ST1, DBGSTAT, PC, and IER.

The order is actually

; ST0, T, AL, AH, PL, PH, AR0, AR1, ST1, DP, IER, DBGSTAT, PC

which makes more sense of the bug description because DP is adjacent to IER.

Thanks again.

Robert