AnsweredAssumed Answered

MMFAR & BFAR read

Question asked by guylejeune on Mar 29, 2017
Latest reply on Mar 30, 2017 by guylejeune

Hello,

on a MK22 chip, I am modifying the HardFault Handler to record some specific registers (SHCSR,CFSR,HFSR,MMFAR & BFAR).

 

I have a weird problem: when the code reads the MMFAR & BFAR registers (address 0xE000ED34 & 0xE000ED38), the returned value is their address.  But if I break at that very location, reading with JTAG these registers gives me other values.

This behaviour is not exhibited with other SCB registers (SHCSR, CFSR, HFSR).

 

I first thought of small bug somewhere, but the code (down to assembly) is identical for all SCB register.

 

Here is a portion of the assembly code, exhibiting this behaviour: it reads CFSR & HFSR, calls a backup function, than reads MMFAR & BFAR and calls the same backup function.

   10122:       4b0e            ldr     r3, [pc, #56]   ; (1015c <RegBackup+0xa4>)
   10124:       681b            ldr     r3, [r3, #0]
   10126:       9300            str     r3, [sp, #0]
   10128:       4b0d            ldr     r3, [pc, #52]   ; (10160 <RegBackup+0xa8>)
   1012a:       4668            mov     r0, sp
   1012c:       681b            ldr     r3, [r3, #0]
   1012e:       9301            str     r3, [sp, #4]
   10130:       f243 01d0       movw    r1, #12496      ; 0x30d0
   10134:       2208            movs    r2, #8
   10136:       f7ff fca7       bl      fa88 <supervisor_FlashWrite>
   1013a:       4b0a            ldr     r3, [pc, #40]   ; (10164 <RegBackup+0xac>)
   1013c:       681b            ldr     r3, [r3, #0]
   1013e:       9300            str     r3, [sp, #0]
   10140:       4b09            ldr     r3, [pc, #36]   ; (10168 <RegBackup+0xb0>)
   10142:       4668            mov     r0, sp
   10144:       681b            ldr     r3, [r3, #0]
   10146:       9301            str     r3, [sp, #4]
   10148:       f243 01d8       movw    r1, #12504      ; 0x30d8
   1014c:       2208            movs    r2, #8
   1014e:       f7ff fc9b       bl      fa88 <supervisor_FlashWrite>
   10152:       b002            add     sp, #8
   10154:       bd10            pop     {r4, pc}
   10156:       bf00            nop
   10158:       e000ed24        .word   0xe000ed24
   1015c:       e000ed28        .word   0xe000ed28
   10160:       e000ed2c        .word   0xe000ed2c
   10164:       e000ed34        .word   0xe000ed34
   10168:       e000ed38        .word   0xe000ed38

 

Stepping the instructions, I observe that instruction 0x1013C leaves R3 unmodified with value 0xE000ED34.  The same thing happens @ instruction 0x10144. 

Conversly, @ instructions 0x10124 & 0x1012C, register R3 correctly loads the pointed value.

 

Am I missing anything ?  Can it be that these MMFAR & BFAR register have some particular behaviour that I'm not aware of ?

Outcomes