Other Parts Discussed in Thread: SYSBIOS, , EK-TM4C1294XL
Tool/software: Code Composer Studio
HI,
We started out building a design that reads data from an external device using SPI. The data is written into on-board SRAM from the TM4C129 uC. This has worked flawlessly.
Meanwhile, with help from this forum, got a revised version of this design working that replaces SPI with QSSI, (and removes temporarily a separate task that sent the data to an external host). QSSI data from the external data source is transferred into a uint32_t type (called rcv_data). Running in debug mode, stepping thru the while(1) loop that contains the QSSI read commands (see code below), and watching the rcv_data variable, the correct data is always returned and everything is ok. However, when I remove the breakpoint in that loop and just tell it to run, the design crashes. At this point, the data isn't going any where. The last value is overwritten by the next value (as mentioned above, the task that sent this data to a host was removed to simplify debugging).
I've been reading thru the following doc, Diagnosing Software Faults in Stellaris® Microcontrollers (AN01286–May 2012), and looking at the various ROV and Disassembly and memory views, based on the contents of the PC, LR, PSR, NVIC reg, etc.
The crash appears to happen in the same place with each run.
The crash appears to happen in the same place each time this is run.
The debug session goes kind of as follows:
Stepping thru the startup/init sequence, end up in switchFromBootStack__E. If I don’t step into that, the design commences to run. Stepping in, reach Hwi_switchFromBootStack(), followed by,
/* start first task by way of enter() */
Task_SupportProxy_swap((Ptr)&prevTask->context,
(Ptr)&Task_module->curTask->context);
Stepping into that takes you to the following,
/* swap__E */
xdc_Void ti_sysbios_knl_Task_SupportProxy_swap__E( xdc_Ptr *oldtskContext, xdc_Ptr *newtskContext )
{
ti_sysbios_family_arm_m3_TaskSupport_swap(oldtskContext, newtskContext);
}
From there, jumps to the while(1) loop in CmdH, at line SSIDataPut.
Before crash, afer a couple of xfers, ROV Task – Detailed view:
And ROV Task – Call Stacks:
And HWI – Detailed:
Now tell it to just go.
Note that while(1) loop where the QSSI xfers are done, has a wait() between the two consecutive calls. Without that wait, the crash is almost immediate. With the wait, in the debug environment, but free-running, takes ~10 min to crash.
Crash report in console:
|
[CORTEX_M4_0] baud_rate : 98968 Returned: 0 ti.sysbios.family.arm.m3.Hwi: line 1095: E_hardFault: FORCED ti.sysbios.family.arm.m3.Hwi: line 1172: E_busFault: PRECISERR: Immediate Bus Fault, exact addr known, address: 1ad05c95 Exception occurred in background thread at PC = 0x000058dc. Core 0: Exception occurred in ThreadType_Task. Task name: {unknown-instance-name}, handle: 0x200003a8. Task stack base: 0x200003f8. Task stack size: 0x200. R0 = 0x20001fb8 R8 = 0x00000001 R1 = 0x0000fdc4 R9 = 0x00000064 R2 = 0x00000020 R10 = 0x00000000 R3 = 0x1ad00300 R11 = 0x00000020 R4 = 0x0000ad00 R12 = 0x1b260200 R5 = 0x00005995 SP(R13) = 0x20000548 R6 = 0x20003020 LR(R14) = 0x000082e3 R7 = 0x00000000 PC(R15) = 0x000058dc PSR = 0x81001800 ICSR = 0x00423803 MMFSR = 0x00 BFSR = 0x82 UFSR = 0x0000 HFSR = 0x40000000 DFSR = 0x00000001 MMAR = 0x1ad05c95 BFAR = 0x1ad05c95 AFSR = 0x00000000 Terminating execution... |
Last function called at crash, in exit.c, line 54:
static void loader_exit(void)
Looking at ROV Task – Detailed:
ROV Task – Call Stack:
HWI Detailed:
Crash returned PC:
Crash returned LR in Disassembly:
Memory View showing first portion of NVIC (0xE100_E100 in memory view).
Fault stat value is 0x00008200 – bits (15:8) = Bus Fault = 1000_0010.
Breakdown of bits that may be interesting:
Bit 15 = 1 – valid fault address
Bit 12 = 0 – No fault has occurred on stacking for exception entry.
Bit 11 = 0 – No fault has occurred on unstacking for a return from exception
Bit 9 – 1 - A data bus error has occurred, and the PC value stacked for the exception return points to the instruction that caused the fault.
Page 7 of the diagnosing doc (referenced above) states for this fault value, the Bus Fault Address register contains the exact value of the address that triggered the bus fault. Looking at that address, 0xE000.ED38,
Fault Address I’m assuming is the first 32 bits in the above output, 0x1AD05C95(?). This supposedly is the address of the instruction that caused the hard bus fault; it matches that reported in the crash dump message.
Looking at that addr in the Dissassembly view:
Referring the Memory Model map (p. 109) in the uC UG, any addr in the range 0x300_0000 to 0x1FFF_FFFF is Reserved.
So, I’m kind of lost at this point. I am not connecting the dots here at all. Hoping someone can take a look at this and see where I need to poke next to figure out where the code is failing.
Thank you.






























