You can find the corresponding address in the (*.S) file and add printing to locate the problem. Fatal exception (28): epc1=0x4025bfa6, epc2=0x00000000, epc3=0x00000000, excvaddr=0x0000000f, depc=0x00000000 For example, if user1.bin is used, you can find the address 0x4025bfa6 in user1.S and check out the corresponding function.