Cortex-R5F core unexpected fetch reserve address

Hi *，

We meet a problem about R5F core, it fetch instruction from an unexpected reserved address, as shown in the figure below, The correct order of instruction fetching should be 0x860 -> 0x880 -> 0x89B -> 0x8c8, But what actually happens is 0x860 -> 0x880 -> 0x89B -> 0x001c18a0 -> 0x8c8. The address 0x001c18a0 is reserved, i.e the disassembled code generated by the software shows that address 0x001C18A0 is never referenced or used, either as a target address or as a location for stored data(kindly refer to the attached file example.s ).

And the ARPROTM0[2:0] = 5 shows the read 0x001c18a0 is a fetch instruction action.

By the way, the RDATAM0 of read from 0x001C18A0 is 0xFFFFFFFF_FFFFFFFF, this suggests that the processor core should transition into the illegal instruction exception handler. But in fact, the core did not enter the exception handler and instead continued executing normally.

We would like to ask two questions:

1. Why does the core unexpectedly access address 0x001C18A0? Is it doing prefetch?

2. If it is prefetch, is there a way to disable this prefetch behavior in the core? Because the unexpected access to the reserved address causes errors in the system's error monitoring module.

0 Martin Weidmann 1 month ago

For this type of question, you might want to also raise a query with the Arm support team - https://support.developer.arm.com/

jiahua_gong jiahua_gong said:
1. Why does the core unexpectedly access address 0x001C18A0? Is it doing prefetch?

Some combination of prefetching/branch prediction seems like a likely explanation.

jiahua_gong jiahua_gong said:
2. If it is prefetch, is there a way to disable this prefetch behavior in the core?

Software controls fetching via the execution never permission (XN). Marking a region as XN means that the processor cannot fetch from that region. You need to ensure that only regions that can be safely prefetched from have the execution permission.

Do you have the MPU enabled?

If no, then the processor is using the default region set (https://developer.arm.com/documentation/ddi0363/g/Memory-Protection-Unit/About-the-MPU?lang=en). That might be a problem for you as the default region set marks 0x0-0x7FFFFFFF as executable.

If yes, can you review which regions are defined and what their attributes are?
Cancel
Vote up 0 Vote down

Reply

Accept answer

Reject answer

Cancel