OK, here is this morning’s fault:
CM4 FAULT!!
SCB->CFSR = 0x00008200
Bus Fault!
Fault address = 0x30303032
r0 = 0x00000000
r1 = 0xffffffff
r2 = 0x08045a18
r3 = 0x7fd7fbeb
r12 = 0x100aa23f
lr = 0x100aaf30
pc = 0x81010000
psr = 0x3e025e8c
(This does seem to be happening with some regularity on overnight runs. Maybe I need to print out the time. )
The call stack, such as it is according to GDB:
0 Cy_SysLib_ProcessingFault() main_cm4.c 401 0x10088B5A (All)
1 Cy_SysLib_FaultHandler(const uint32_t * faultStackAddr = <optimized out>) Generated_Source\PSoC6\pdl\drivers/peripheral/syslib/cy_syslib.c 444 0x10082DB8 (All)
2 UsageFault_Handler() gcc/startup_psoc6_01_cm4.S 455 0x1008034E (All)
3 <signal handler called>() ?????? ?????? 0xFFFFFFED (All)
4 prvPortStartFirstTask() ..\FreeRTOS\FreeRTOS\Source\portable\GCC\ARM_CM4F/port.c 267 0x100869E4 (All)
5 xPortStartScheduler() ..\FreeRTOS\FreeRTOS\Source\portable\GCC\ARM_CM4F/port.c 379 0x1008B24E (All)
Registers in Cy_SysLib_ProcessingFault: r0=,0x00000000,r1=,0x90000000,r2=,0x00000000,r3=,0x08026B18,r4=,0x080278A8,r5=,0x08026B20,r6=,0x00000001,r7=,0x080477CC, r8=,0x6E85E9E1,r9=,0xBFEBB995,r10=,0x00000001,r11=,0x00000000,r12=,0xFFFFFFFF,sp=,0x080477CC,lr=,0x1009F433,pc=,0x10088B5A, xpsr=,0x01010005,msp=,0x080477CC,psp=,0x0803F618,
sp=,0x080477CC,
is a location in SRAM:
|0x0804776c|00|00|00|00|b0|f8|03|08|........|
|---|---|---|---|---|---|---|---|---|---|
|0x08047774|df|df|df|da|00|00|00|80|........|
|0x0804777c|d1|4b|c0|3f|00|00|00|80|.K.?....|
|0x08047784|d1|4b|c0|3f|a8|78|02|08|.K.?.x..|
|0x0804778c|20|6b|02|08|01|00|00|00| k......|
|0x08047794|cc|77|04|08|e1|e9|85|6e|.w.....n|
|0x0804779c|95|b9|eb|bf|01|00|00|00|........|
|0x080477a4|74|6e|02|08|20|6b|02|08|tn.. k..|
|0x080477ac|01|00|00|00|cc|77|04|08|.....w..|
|0x080477b4|e1|e9|85|6e|01|f4|09|10|...n....|
|0x080477bc|18|6b|02|08|a8|78|02|08|.k...x..|
|0x080477c4|20|6b|02|08|59|8b|08|10| k..Y...|
|0x080477cc|d4|77|04|08|b9|2d|08|10|.w...-..| <------- SP
|0x080477d4|04|00|00|00|4f|03|08|10|....O...|
|0x080477dc|ed|ff|ff|ff|00|00|00|00|........|
|0x080477e4|00|00|f0|00|34|ef|00|e0|....4...|
|0x080477ec|00|00|00|c0|f0|02|00|00|........|
|0x080477f4|4f|b2|08|10|e4|69|08|10|O....i..|
|0x080477fc|00|00|0f|61|00|00|00|00|...a....|
|0x08047804|00|00|00|a0|06|01|00|00|........|
|0x0804780c|00|0e|00|14|10|04|00|08|........|
|0x08047814|c6|6d|aa|dc|fd|10|64|8e|.m....d.|
|0x0804781c|98|60|07|ac|ac|ea|7d|05|.`....}.|
|0x08047824|ff|1e|81|77|1e|77|af|f7|...w.w..|
|0x0804782c|c4|b3|c7|0d|8e|ae|54|4c|......TL|
or
|0x0804778c|08026b20|00000001|080477cc|6e85e9e1| k.......w.....n|
|---|---|---|---|---|---|
|0x0804779c|bfebb995|00000001|08026e74|08026b20|........tn.. k..|
|0x080477ac|00000001|080477cc|6e85e9e1|1009f401|.....w.....n....|
|0x080477bc|08026b18|080278a8|08026b20|10088b59|.k...x.. k..Y...|
|0x080477cc|080477d4|10082db9|00000004|1008034f|.w...-......O...| <----SP
|0x080477dc|ffffffed|00000000|00f00000|e000ef34|............4...|
|0x080477ec|c0000000|000002f0|1008b24f|100869e4|........O....i..|
|0x080477fc|610f0000|00000000|a0000000|00000106|...a............|
|0x0804780c|14000e00|08000410|dcaa6dc6|8e6410fd|.........m....d.|
|0x0804781c|ac076098|057deaac|77811eff|f7af771e|.`....}....w.w..|
|0x0804782c|0dc7b3c4|4c54ae8e|50dd3780|67a06567|......TL.7.Pge.g|
If I subtract 32 from SP, I see 10088b59, which is in here?
401: while(1);
0x10088B5A E7FE b.n 10088b5a <Cy_SysLib_ProcessingFault+0x7e>
lr=,0x1009F433,
points to around here:
0x1009F42E F000FB37 bl 1009faa0 <__retarget_lock_release_recursive>
0x1009F432 4628 mov r0, r5
0x1009F434 BD38 pop {r3, r4, r5, pc}
0x1009F436 BF00 nop
If I look at psp=,0x0803F618,
, that should be in SRAM:
|0x0803f558|100aad91|100aad89|0803f5b4|0803f5b0|................|
|---|---|---|---|---|---|
|0x0803f568|0803b3f8|08045ac0|a0000000|3fc05b06|.....Z.......[.?|
|0x0803f578|a0000000|3fc05b06|0000001a|00000000|.....[.?........|
|0x0803f588|00000006|00000001|00000000|00000001|................|
|0x0803f598|00000000|00000001|00000005|08045aa0|.............Z..|
|0x0803f5a8|000003fc|20000000|3fc02dd7|000003fe|....... .-.?....|
|0x0803f5b8|80000000|fffffffd|00000016|80000000|................|
|0x0803f5c8|3fc04bd1|3fc04bd1|3fc04bd1|ffffffed|.K.?.K.?.K.?....|
|0x0803f5d8|0803f8b0|dadfdfdf|80000000|3fc04bd1|.............K.?|
|0x0803f5e8|80000000|3fc04bd1|fecf5fff|facfffff|.....K.?._......|
|0x0803f5f8|fe5ffff7|ffdfdf57|fefbd7fe|ffde5ff3|.._.W........_..|
|0x0803f608|bedfdff7|feddd5f7|fed7f5ff|bedfdff7|................|
|0x0803f618|30303032|00000000|ffffffff|08045a18|2000.........Z..| <--PSP
|0x0803f628|7fd7fbeb|100aa23f|100aaf30|81010000|....?...0.......|
|0x0803f638|3e025e8c|dffff7a7|fd57f7ee|fadf55f7|.^.>......W..U..|
|0x0803f648|bedbd5b9|367fffff|f7dff7b7|fa5fd9b7|.......6......_.|
|0x0803f658|fccfd7c7|fedbd7f6|7edfd7f2|ffdfc7bf|...........~....|
|0x0803f668|368753a9|3d2531a0|80000000|3fc04bd1|.S.6.1%=.....K.?|
|0x0803f678|00000010|00000001|08026b20|08045aa0|........ k...Z..|
|0x0803f688|00000001|100aa23f|0803f6e4|0803f6e0|....?...........|
|0x0803f698|00000005|08045be0|80000000|3fc04bd1|.....[.......K.?|
|0x0803f6a8|80000000|3fc04bd1|00000018|ffffffff|.....K.?........|
|0x0803f6b8|00000004|00000001|00000000|00000001|................|
|0x0803f6c8|00000000|ffffffed|00000003|dadfdfdf|................|
I’ve been reading this: https://interrupt.memfault.com/blog/cortex-m-rtos-context-switching to try to educate myself about how this works. I found this tidbit there:
WARNING: Over the years I’ve seen a lot of nasty stack overflows arise here which can be tricky to track down. As soon as an FPU instruction is used an additional 132 bytes will be pushed on the stack, which can lead to unexpected overflows of small embedded stacks
So, I guess a lot of what I’m looking at there is floating point registers?
I need to back up 132+32 bytes (0xA4) to find the preious PSP? 0x0803f618 - 0xA4 is 0x0803F574:
0x0803f4c8 08039e50 0803fa00 0000000b 0803f4e0 P...............
|0x08039dd0|08039598|20454c42|6b736154|00000000|....BLE Task....|
|---|---|---|---|---|---|
|0x08039de0|00000000|00000008|00000000|00000013|................|
|0x08039df0|00000000|00000000|00000000|00000000|................|
|0x08039e00|00000000|00000000|00016e57|00000000|........Wn......|
|0x08039e10|00000000|00000000|00000000|80000010|................|
|0x08039e20|08039e30|00000000|00000000|80000020|0........... ...|
|0x08039e30|00000003|08026728|08039ea8|01dacc00|....(g..........|
|0x08039e40|00000000|00000000|00000000|80000058|............X...|
|0x08039e50|00000000|08039e50|00000000|00000000|....P...........|
|0x08039e60|00000000|08039e68|ffffffff|08039e68|....h.......h...|
|0x08039e70|08039e68|00000000|08039e7c|ffffffff|h.......|.......|
|0x08039e80|08039e7c|08039e7c|00000001|00000001||...|...........|
|0x08039e90|00000000|0000ffff|00000000|00000004|................|
|0x08039ea0|00000000|800004a8|1009b951|1009ba6d|........Q...m...|
I think I need to do some more reading.