HARDFAULTS从阅读/写作到未对齐的地址?

14个帖子/ 0新
Last post
布莱恩
Offline
Last seen:6年3个月前
专家 掌握
Joined:2014-10-16 18:10
HARDFAULTS从阅读/写作到未对齐的地址?

我注意到,Cortex Generic用户指南指出硬盘可以出现如下:

an attempted load or store to an unaligned address

Is this true for the DA14580? If so, what is considered aligned? 8 bits? 16 bits? 32 bits?

If one has 16 bit alignment do I need to be careful how I define structs or does the compiler properly pad for me?

How could I invoke such an error using C- code that the compiler won't protect? memcpy, pointers?

PY_Dialog
Offline
Last seen:2年11个月前
Staff
Joined:2014-08-25 09:59
嗨Brian,

嗨Brian,

我认为如果您使用了C代码,则不应对齐问题,因为C编译器将进行更正。如果您不需要进行对齐,但不应导致内存问题可能会有笨拙。

问候!
PY

布莱恩
Offline
Last seen:6年3个月前
专家 掌握
Joined:2014-10-16 18:10
但我可以一直导致

但我可以一直导致the error by removing an element in a structure that is deleclared and implemented (but not used). The fault is triggered by the STRH instruction. The map shows that the structure (mds_data) is placed just before some arch_main code as shown below:

rwip_rf 0x0008071c Data 0 rom_symdef.txt ABSOLUTE
mds_data 0x00080768数据248 app.o(.bss)
cs_area$$Base 0x00080860 Number 0 arch_main.o(cs_area)
cs_table 0x00080860 Data 546 arch_main.o(cs_area)

Playing with unused elements of that structure will trigger the error on the STRH instruction. Interestingly, none of the code I have access to (except arch_main) is executed. I can place a break point in the arch_main while loop and step through that loop but the place in the application code that normally gets hot first (app_init() in app.c) never gets hit. It can take up to 10 seconds or so before the hard fault appears.

vesan.
Offline
Last seen:5年7个月前
格鲁鲁 掌握
Joined:2014-06-26 08:49
Hello brian,

Hello brian,

你能共享结构定义吗?

布莱恩
Offline
Last seen:6年3个月前
专家 掌握
Joined:2014-10-16 18:10
是这里

是这里
struct mds_data_tag.
{
unsigned char systemid [8];
unsigned char mapryername [32];
unsigned char modelnumber [32];
unsigned char serialnumber [32];
unsigned char firmwarerevision [32];
unsigned char hardwareRevision[32];
unsigned char softwareRevision[32];
unsigned char pnpid [8];
unsigned char continuaMajorVersion;
unsigned char continuaMinorVersion;
unsigned char numberofcertications;
无符号短*证书;
unsigned short regStatus;
未签名的Char Batteryvel;
无符号char longeoftimedata;
unsigned char agentcurrentime [8];
毫无符号的长度;
unsigned short timeSyncMethod;
unsigned char ahdCurrentTime[8];
unsigned short ahdAccuracy;
unsigned short ahdtimesyncmethod;
};

Only the strings at the start of the struct are currently used in code. However, I never get to app_init() so that is a moot point. The error is generated by removing certain elements after char pnpId[8] and keeping the set of 'strings' the same. An example that caused the behavior is

struct mds_data_tag.
{
unsigned char systemid [8];
unsigned char mapryername [32];
unsigned char modelnumber [32];
unsigned char serialnumber [32];
unsigned char firmwarerevision [32];
unsigned char hardwareRevision[32];
unsigned char softwareRevision[32];
unsigned char pnpid [8];
unsigned char continuaMajorVersion;
};

gcblair
Offline
Last seen:4年10个月前
掌握
Joined:2014-09-08 10:21
Brian,

Brian,

我会有兴趣听到你是否找到了这个解决方案。这一周似乎对话有点慢

布莱恩
Offline
Last seen:6年3个月前
专家 掌握
Joined:2014-10-16 18:10
I have not found solution

I have not found solution but I have found that there tends to be trouble (hard faults) whenever an array is placed before something system-critical (like one of the system heaps). I have viewed this in the map. I have seen this rather consistently for several array cases. A problem may be that I am running at the highest optimization level and am on the verge of running out of system space to the point that I have to run in the optimized modes. If I can play in such a way that these arrays are not next to one of these heaps or other areas of system data, the crash goes away. There is another array that we were working with that was placed right before the non-retention heap when it was larger than 100 bytes. At that point we got that error. At 100 bytes the map shifted significantly and the code ran. We still can't figure it out as the buffer is used only in one area and it's pretty simple. The down side is one has no control over how things are placed in memory at that detail (...and I wouldn't want to have to either).

Yutaka
Offline
Last seen:3年4个月前
Joined:2016-08-02 09:29.
我们有一些类似的问题。

我们有一些类似的问题。
Do you have any progress about this issue?

MT_dialog
Offline
Last seen:3个月22小时前
Staff
Joined:2015-06-08 11:34
嗨yutaka,

嗨yutaka,

对Cortex-M0处理器上的未对准访问没有支持。任何尝试执行未对齐的内存访问操作会导致硬故障异常。

以下链接可以找到更多信息。

http://infocenter.arm.com/help/index.jsp?主题= / com.arm.doc.dui0497a / bab ...

Thanks MT_dialog

Yutaka
Offline
Last seen:3年4个月前
Joined:2016-08-02 09:29.
But in the case of our

But in the case of our product, Hard fault occurred in rwip_schedule().
Does Hard fault occurred by wrong parameters?

MT_dialog
Offline
Last seen:3个月22小时前
Staff
Joined:2015-06-08 11:34
嗨yutaka,

嗨yutaka,

有很多原因可能会发生硬断层。

How do you know that the hard fault occurs during the rwip_schedule() ? Have you checked the PC, and the address before the proccessor stalls (in the hardfault handler debugging implementation) coresponds to the rwip_schedule() function in the map file ? To what parameters are you refering to ? The rwip_schedule() is scheduling the messages that are received by the stack or by your application and invokes the corresponding handler, its a bit unlikely that this is the function that causes the Hardfault_handler() to occur.

Thanks MT_dialog

Yutaka
Offline
Last seen:3年4个月前
Joined:2016-08-02 09:29.
我在不断步检查n.

我在不断步检查n.
我检查了堆栈内存。
我发现发生了细节的地址。

Address: 0x324CC
LDRH R3,[R1,R3]

R1:0x00000003
R3:0x0003E350

来自非法地址的CPU负载。

from MAP file.
> ke_queue_extract 0x00032441 Thumb Code 0 rom_symdef.txt ABSOLUTE
> ke_queue_insert 0x0003247f Thumb Code 0 rom_symdef.txt ABSOLUTE
> ke_task_init 0x0003256D thumb代码0 rom_symdef.txt绝对

地址(0x324cc)在Ke_queue_insert中。
ke_queue_insert是否使用了哪个参数?
我可以替换这种功能进行调试吗?

Attachment:
Yutaka
Offline
Last seen:3年4个月前
Joined:2016-08-02 09:29.
我分析了堆栈内存。

我分析了堆栈内存。
The address (0x324CC) isn't ke_queue_insert.
May be this address is sub routine of ke_task_handler_get.

堆栈内存
00000000 R0.
00000003 R1
00007C6A R2.
0003E350 R3
00081004 R12
0003274D LR.
000324CC
01000000
20006378 R4.
0003274D LR.ke_task_handler_get
00000000
00000000 R0.
00000000 R1
000817A8 R4
00000000 R5.
50000020 R6
00000004 R7
200055F3 LR patched_gapm_adv_op_sanity
000805E4 R4
00000000 R5.
50000020 R6
00032181 LR ke_event_schedule
50000000 R4.
00032DD9 LR RWIP_Schedule.
50000000 R4.
20000671 lr main_func.
00000000
00000000
20006B1C.
20005C01

备注(从映射文件)
ke_event_schedule 0x0003213d Thumb Code 0 rom_symdef.txt ABSOLUTE
ke_task_handler_get 0x000326EB Thumb代码0 rom_symdef.txt绝对
rwip_schedule 0x00032dc9 Thumb Code 0 rom_symdef.txt ABSOLUTE
main_func 0x2000058b Thumb Code 592 arch_main.o(.text)

MT_dialog
Offline
Last seen:3个月22小时前
Staff
Joined:2015-06-08 11:34
嗨yutaka,

嗨yutaka,

我从你上传的图片中看到你一直通过堆栈追踪函数。当在硬盘或NMI中时,SDK存储在两个不同地址中的寄存器的最后值为0x81800和0x81850一个用于硬盘驱动器,另一个用于NMI。从那里,您可以找到代码点击硬盘的地址,而不会努力从堆栈中追踪。现在,据我所知,它追溯到系统不断使用的函数,以便安排事件。这种情况发生的最可能原因是数据损坏,也许是无效的处理程序指针或类似的东西。此外,如果您可以弄清楚发生这种情况时的任何条件,您可以找到导致应用程序中这种行为的原因,尝试查找此错误是否发生在某些特定模式中,或者在应用程序中执行特定操作时发生此错误。

Thanks MT_dialog