Getting the fault instruction address using MCSRR0

[jaejynshin]

Hello experts

I am testing MPU(Memory Protection Unit) using my MPC5777C device.

After accessing the protected memory area, I found that IP was jumped into the Machine Check Exception.

And then, I checked the MCSRR0 to get the instruction address which I coded to inject memory fault, but it was wrong.

The a few steps following address was written at the MCSRR0.

That is,

0x00960000: *(pValue) = 0x12121212; // MPU Error Injection Code

0x00960004: bla bla bla code ;

0x00960008: bla bla bla bla code ;

0x0096000C: bla bla bla bla bla code ;

I hoped that 0x0096000 is in the MCSRR0 after running 0x00960000, but 0x0096000C was written in the MCSRR0.

Someone said that it is due to the pipeline and 10-steps... but I couldn't understand his advice. (I am novice)

Is there someone who know the cause of it and especially can solve this problem ?

I want to get 0x0096000 address in the MCSRR0.

Thank you

[davidtosenovjan]

Hi, It’ll be probably caused by store buffer. It means that several instructions are executed before sub-system reports it is impossible to write to final destination and core generates machine check exception. During machine check content of MCSRR0 is following (according Table 7-12 in e200z759CRM):

“On a best-effort basis e200z759n3 sets this to the address of some instruction that was executing or about to be executing when the machine check condition occurred.”

You can disable store buffer in core register HDBCR0.

Or you could add instruction msync after your instruction at address 0x00960000.

I am not fully sure but also setting flash memory’s MMU attribute to „guarded“ and „cache-inhibited“ could solve the issue.

[jaejynshin]

Dear Expert.

I find that SRR0 has same problem.

At the time of ERM Interrupt, sometimes SRR0 has address of some steps next instruction.

But in the e200z759CRM Table 7-8, I did not find the similar limitation to the MCSSR0.

Is it possible that SRR0 has the similar symptom to MCSRR0 ?

Thank you!

[davidtosenovjan]

I am not sure if I understand you. Table 7-8 describes Critical Input interrupt thus it points to CSRRx registers not SRRx registers. If you mentions ERM Interrupt, how it is related to MPU?

[jaejynshin]

After disable the Store Buffer, I checked that MCSRR0 and SRR0 are written correct instruction address.

But I am not sure other side-effects(ex:performance) from disabling this register.

Could you let me know what is "Store Buffer" ??

Thank you

Jaejyn

[davidtosenovjan]

Store buffer is basically 8-entry FIFO that is placed on CPU to internal bus interface (actually it is part of cache memory but it is active even in case cache memory is inactive). If there is CPU data write via XBAR (for instance to SRAM), this written data will be placed to store buffer at first and core can execute further instructions (it does not wait for acknowledge from SRAM controller). It means real write can be delayed as well as transfer error aknowledge may be delayed and it is probably what you are facing.

[jaejynshin]

Thank you very much for your explain!

I have one more short question. The StoreBuffer affect only to MCSSR0?

After disabling StoreBuffer, SRR0 sometimes have the same problem.

It can be affected by side-effect of other codes. But I want to know clearly.

[davidtosenovjan]

When you are reading SRR0 register? In case IVOR1 (machine check) you are only interested in MCSSRx registers. In case ERM interrupt you are only interested in error reporting module's register as ERM_EARn.

[jaejynshin]

I get the instruction address using SRR0 when ERM interrupt occurs.

If it is incorrect way, isn't there a way to get the instruction address when ERM occurs?

[davidtosenovjan]

SRR0 contains address of instruction that was being executed when interrupt occurs, but it does not necessary need to be instruction causing the interrupt. It can be but it can several instruction behind this point.

ERM module collects reporting of ECC errors. If there is an ECC error in certain instruction opcode and there is attempt to execute such instruction, machine check exception will be invoked.

But there may be other situations, for instance ECC error is cached during eDMA transfer, in this case SRR0 (as ERM interrupt is invoked over IVOR4) still will contains address of instruction currently being executed even though it has nothing to do with core at all.

[jaejynshin]

Dear expert

Then, isn't there a way to get a exact faulting instruction address?

[jaejynshin]

Ah... sorry for giving you confusion

This is another test.

The original test is MPU test and to get the inst address using MCSRR0.

And this test is ERM test and to get the inst address using SRR0.

I used EIM(Error Injection Module) to test Ram Fault

And catch the exception at the ERM(Error Report Module) Interrupt to record the registers(ERM_EAR0/ERM_SYN0/ERM_EAR1/ERM_SYN1/SRR0/SRR1).

But sometimes the SRR0 has same problem(not 100%).

And the exact Table number related to SRR0 is "Table 7-13. Data Storage Interrupt—register settings"

("Table 7-8" was my mistake)

Thank you

[jaejynshin]

Thank you for your comment

I set the MMU attribute to "guarded" and "cache-inhibited", but it doesn't solve the problem in my device.

And I can not use HDBCR0 because according to the description in 11.20, it doesn't looks intended for normal use.

In my test I can use msync, but I can't apply msync in the real application which will be applied over my system.

If I cannot solve it with MachineCheck, I will try to search other ways. 

Thank you for your advice!