This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Instruction fetch exception errors

Expert 2985 points

Hi TI experts,

My situation: C6670, SYS/BIOS v6.33.6.50, IPC v1.24.4.32, XDC v3.23.4.60.

I meet a probelm about Instruction fetch exception.

In my project, all the cores use the same project and the same .cfg and the same .out.

I load the .out into Core0~Core2 successively. And the Core0~Core2 run well as showed in the pic below

But then I load the .out into Core3,  the errors come out showed in pic below

The error codes are below

A0=0x0 A1=0x55
A2=0x1 A3=0x10606
A4=0xc04ddf8 A5=0x28
A6=0x0 A7=0xc04ddf8
A8=0x2 A9=0x8d85f8
A10=0x8d6bb0 A11=0xffffffff
A12=0x0 A13=0x0
A14=0x0 A15=0x0
A16=0x3 A17=0x2001
A18=0x2900d00 A19=0x2000
A20=0x2000 A21=0x300
A22=0x0 A23=0x0
A24=0x0 A25=0x2
A26=0x0 A27=0x0
A28=0x108b3d10 A29=0x134
A30=0x300 A31=0xc10d928
B0=0x1 B1=0x0
B2=0x0 B3=0xc0de4a4
B4=0xc04f710 B5=0xc04f710
B6=0x0 B7=0x1
B8=0x8d6a64 B9=0xc10d964
B10=0xc04ddd0 B11=0xc04ddd0
B12=0x0 B13=0x0
B14=0x8fc224 B15=0x861fb8
B16=0x28 B17=0x6
B18=0x20 B19=0x0
B20=0x0 B21=0x2e6
B22=0xf B23=0x0
B24=0x0 B25=0x3000
B26=0x3000 B27=0x0
B28=0x60 B29=0x0
B30=0x6 B31=0x821f04
NTSR=0x1020f
ITSR=0x420d
IRP=0xc08f618
SSR=0x0
AMR=0x0
RILC=0x8
ILC=0x0
Exception at 0x10604
EFR=0x2 NRP=0x10604
Internal exception: IERR=0x1
Instruction fetch exception
ti.sysbios.family.c64p.Exception: line 248: E_exceptionMin: pc = 0x00010604, sp = 0x00861fb8.
To see more exception detail, use ROV or set 'ti.sysbios.family.c64p.Exception.enablePrint = true;'
xdc.runtime.Error.raise: terminating execution

The ROV shows the error below

And the Disassembly window shows the codes at 0xc0de4a4(B3's value)

Maybe the information I offer is not enough to fix the bug.

But could anyone guide me how to find the bug?

Regards,

Feng

  • Feng,

    The disassembly window shows the area of the crash.  The register dump shows A3 contains 0x10606, and the instruction fetch exception shows 0x10604 (which is 0x10606 rounded down to a 32-bit instruction boundary).  Register B3 is consistent with this - the code is calling a function via the A3 register, and part of the function call sets up B3 with 0x0c0de4a4 as the return pointer.

    The function being called is *rcvfunction (which you can *barely* see from source code at the top of the disassembly window).  That doesn't look like SYS/BIOS or IPC code (not in the coding style used by those).  Since it's a function pointer from memory, someone might have overwritten the intended function pointer.  Can you trace the code backwards to see a way that *rcvfunction can get corrupted?

    It appears that all cores are sharing a common code image in MSMC memory, and using local L2 SRAM for stack/data.  There might be some interaction with CCS going on here, such as a S/W breakpoint for one core messing up other cores (since S/W breakpoints involve actually overwriting assembly code and restoring the original code later).  Things can get complicated when cores share code.

    Regards,

    - Rob

     

  • Hi Robert,

    1. According to what you guide me, I want to make things clear firstly.

    Do my codes call a function (address=value of A3) and return to address (value 0f B3)?

    But A3 is a invalid address, so the codes dump! Am I right?

    2. Rcvfunction is my processing code. I will try to analysis the function rcvfunction to find the bug!

     

    3. Yes. In my project, the .text is put into MSMCSRAM and the stack and data are put into L2SRAM because the stack and data per core consume almost 600KB. 

    If I put the stack and data of all 4 cores into MSMCSRAM, they will consume almost 4*600KB but the MSMCSRAM is not enough.

    I use one project with the same .cfg file and all the 4 cores use the same codes. I load the same .out file into per core.

    Is my memory configuration(put .text into MSMCSRAM and put .stack/data into L2SRAM) OK?

    Or could you suggest me a better way to configure these sections?

    My .map file is 6763.myproject.map.txt

    Thank you!

    Regards,

    Feng

  • Feng Jin said:

    1. According to what you guide me, I want to make things clear firstly.

    Do my codes call a function (address=value of A3) and return to address (value 0f B3)?

    But A3 is a invalid address, so the codes dump! Am I right?

    Yes, your source code calls (*rcvfunction), and since it is a function pointer the compiler chooses to use register A3 for the branch to the function (i.e., A3 represents the function pointer variable 'rcvfunction').  On the C6x architecture, B3 is used for the function return address.  Since A3 is somehow loaded with a bad address, the "codes dump" when executing the assembly instruction:
        B.S2X     A3

    Feng Jin said:

    2. Rcvfunction is my processing code. I will try to analysis the function rcvfunction to find the bug!

    Yes, you should analyze the code that is assigning rcvfunction.

    Feng Jin said:

    3. Yes. In my project, the .text is put into MSMCSRAM and the stack and data are put into L2SRAM because the stack and data per core consume almost 600KB. 

    If I put the stack and data of all 4 cores into MSMCSRAM, they will consume almost 4*600KB but the MSMCSRAM is not enough.

    I use one project with the same .cfg file and all the 4 cores use the same codes. I load the same .out file into per core.

    Is my memory configuration(put .text into MSMCSRAM and put .stack/data into L2SRAM) OK?

    Or could you suggest me a better way to configure these sections?

    The way you're doing is a good way.  If data/stack were to be put in MSMC then you wouldn't be able to use the some .out file for all cores.

    I mentioned the MSMC common code and CCS since I wasn't sure that a CCS operation on one core might affect the other cores.  The systems and applications I usually work with have separate code for each core (although it might be a common .out file, but separately loaded into per-core L2), so if CCS modifies the code to set a core's breakpoint it can't affect other cores.  But with common code in MSMC, if you set a breakpoint for one core then it will be set for all the cores (that is for a S/W BP, a H/W BP is not shared this way).  Often CCS is configured to automatically "run to main()" when you load a program, and that is accomplished by CCS automatically putting a S/W breakpoint on main().  With common code all cores will have this BP.

    Regards,

    - Rob

  • Hi Robert,

    Thanks for your so detailed information!

    Actually,  when I set the S/W breakpoint at one core, the other cores will beak at this point simultaneously! That is because I put the .text into MSMC as you mentioned.

    Regards,

    Feng