Can't unwind through dispatch_illegal_op_fault

Can't unwind through dispatch_illegal_op_fault

[Bob Montgomery]

I accidentally discovered that another good way for my buncho crash test
module to oops the system is to mov from ar.bspstore without zeroing the
mode bits on ar.rsc.  The resulting illegal op doesn't unwind past 
dispatch_illegal_op_fault.

I'm testing on a 2.6.10 based system (with other patches), and get the
following oops message, stopping at dispatch_illegal_op_fault.  Is this
a quick question for the ivt.S folks, or should I prepare a test module
for a stock kernel?

Thanks,
Bob Montgomery, HP

--
buncho about to read ar.bspstore with wrong rsc on CPU 0
bunchotest[1710]: IA-64 Illegal operation fault 0 [1]
Modules linked in: buncho buncho1 buncho2 buncho3 buncho4 buncho5
buncho6 buncho7 buncho8 buncho_utils ipv6 dump_blockdev dump_gzip
zlib_deflate dump

Pid: 1710, CPU 0, comm:           bunchotest
psr : 0000101008026018 ifs : 8000000000000185 ip  : [<a0000002000f8a40>]
Not tainted
ip is at buncho_going_to_illegal_op+0x40/0xa0 [buncho]
unat: 0000000000000000 pfs : 0000000000000185 rsc : 0000000000000003
rnat: 0009804c0270033f bsps: 00000000000003e8 pr  : 0a40000000166965
ldrs: 0000000000000000 ccv : 0000000000000000 fpsr: 0009804c0270033f
csd : 0000000000000000 ssd : 0000000000000000
b0  : a0000002000f8a30 b6  : a000000100002d70 b7  : a0000001000cad20
f6  : 1003e8080808080808081 f7  : 1003e0000000000000080
f8  : 1003e0000000000001200 f9  : 1003e00000000000023dc
f10 : 1003e000000000e580000 f11 : 1003e00000000356f424c
r1  : a0000002002f8000 r2  : 0000000000004000 r3  : 0000000000004000
r8  : 000000000000003b r9  : a000000100687bb0 r10 : a000000100687bb0
r11 : 0000000000000100 r12 : e0000040fdd1fe20 r13 : e0000040fdd18000
r14 : 00000000000000fd r15 : a000000100687bb0 r16 : 0000000000000000
r17 : e0000040fe1cfde8 r18 : 00000000000000fd r19 : 0000000000000001
r20 : a00000010079fdc0 r21 : a0000001007841c8 r22 : a00000010079fdc0
r23 : 0000000000000004 r24 : 0000000000000000 r25 : 0000000000000000
r26 : 0000000000000000 r27 : 0000000000000000 r28 : 0000000000000000
r29 : 0000000000000004 r30 : e0000040ffe08d50 r31 : 0000000000000000

Call Trace:
 [<a000000100012940>] show_stack+0x80/0xa0
                                spà000040fdd1f8d0 bspà000040fdd18fb8
 [<a0000001000131c0>] show_regs+0x800/0x820
                                spà000040fdd1faa0 bspà000040fdd18f60
    r32 : e0000040fdd1fc60 r33 : 0000000000000000 r34 : e0000040fdd1fd18
    r35 : e0000040fdd1fcd8 r36 : e0000040fdd1fcf0 r37 : e0000040fdd1fcb0
    r38 : e0000040fdd1fca0 r39 : 00000fffffffbfff r40 : a000000100036b50
    r41 : 000000000000040e r42 : e00000417dd1fbde
 [<a000000100036b50>] die+0x150/0x2c0
                                spà000040fdd1fab0 bspà000040fdd18f20
    r32 : e0000040fdd1fbe0 r33 : e0000040fdd1fc60 r34 : 0000000000000000
    r35 : a00000010067a1b8 r36 : a00000010067a1bc r37 : a000000100036d00
    r38 : 0000000000000309 r39 : a000000100570bc0
 [<a000000100036d00>] die_if_kernel+0x40/0x60
                                spà000040fdd1fb30 bspà000040fdd18ef0
    r32 : e0000040fdd1fbe0 r33 : e0000040fdd1fc60 r34 : 0000000000000000
    r35 : a0000001000376c0 r36 : 000000000000048c r37 : e0000040fdd1fde0
 [<a0000001000376c0>] ia64_illegal_op_fault+0x60/0x160
                                spà000040fdd1fb30 bspà000040fdd18ea8
    r32 : e0000040fdd1fb60 r33 : 0000000000000000 r34 : e0000040fdd1fbe0
    r35 : a000000100974450 r36 : e0000040fdd18000 r37 : 0000000000000015
    r38 : a000000100003f20 r39 : 0000000000000001 r40 : e0000040fdd1fde0
 [<a000000100003f20>] dispatch_illegal_op_fault+0x300/0x800
                                spà000040fdd1fc50 bspà000040fdd18ea8

Re: Can't unwind through dispatch_illegal_op_fault

[David Mosberger]

>>>>> On Fri, 25 Mar 2005 18:49:51 -0700, Bob Montgomery <bob.montgomery@hp.com> said:

  Bob> I accidentally discovered that another good way for my buncho
  Bob> crash test module to oops the system is to mov from ar.bspstore
  Bob> without zeroing the mode bits on ar.rsc.  The resulting illegal
  Bob> op doesn't unwind past dispatch_illegal_op_fault.

  Bob> I'm testing on a 2.6.10 based system (with other patches), and
  Bob> get the following oops message, stopping at
  Bob> dispatch_illegal_op_fault.  Is this a quick question for the
  Bob> ivt.S folks, or should I prepare a test module for a stock
  Bob> kernel?

Ah, dispatch_illegal_op_fault() is an oddball since after calling
ia64_illegal_op_fault() it does some other work and returns to
ia64_leave_kernel only at that point.  Because of that, it
needs to have unwind info.  Hopefully all that it needs is
a PT_REGS_UNWIND_INFO(0) after SAVE_REST.

	--david

Re: Can't unwind through dispatch_illegal_op_fault

[Bob Montgomery]

On Sat, 2005-03-26 at 00:38 -0800, David Mosberger wrote:
> >>>>> On Fri, 25 Mar 2005 18:49:51 -0700, Bob Montgomery <bob.montgomery@hp.com> said:
> 
>   Bob> I accidentally discovered that another good way for my buncho
>   Bob> crash test module to oops the system is to mov from ar.bspstore
>   Bob> without zeroing the mode bits on ar.rsc.  The resulting illegal
>   Bob> op doesn't unwind past dispatch_illegal_op_fault.
...
> 
> Ah, dispatch_illegal_op_fault() is an oddball since after calling
> ia64_illegal_op_fault() it does some other work and returns to
> ia64_leave_kernel only at that point.  Because of that, it
> needs to have unwind info.  Hopefully all that it needs is
> a PT_REGS_UNWIND_INFO(0) after SAVE_REST.

That does make it unwind (see below), but at the expense of this message
in the make log:

ERROR: dispatch_illegal_op_fault: 156 slots, total region length = 16

Is it a reasonable patch?

Thanks,
Bob M.
----------------------

Call Trace:
 [<a000000100012940>] show_stack+0x80/0xa0
                                spà00000100fdf8d0 bspà00000100fd8fb8
 [<a0000001000131c0>] show_regs+0x800/0x820
                                spà00000100fdfaa0 bspà00000100fd8f60
    r32 : e000000100fdfc60 r33 : 0000000000000000 r34 : e000000100fdfd18
    r35 : e000000100fdfcd8 r36 : e000000100fdfcf0 r37 : e000000100fdfcb0
    r38 : e000000100fdfca0 r39 : 00000fffffffbfff r40 : a000000100036b50
    r41 : 000000000000040e r42 : e000000180fdfbde
 [<a000000100036b50>] die+0x150/0x2c0
                                spà00000100fdfab0 bspà00000100fd8f20
    r32 : e000000100fdfbe0 r33 : e000000100fdfc60 r34 : 0000000000000000
    r35 : a00000010067a1b8 r36 : a00000010067a1bc r37 : a000000100036d00
    r38 : 0000000000000309 r39 : a000000100570c08
 [<a000000100036d00>] die_if_kernel+0x40/0x60
                                spà00000100fdfb30 bspà00000100fd8ef0
    r32 : e000000100fdfbe0 r33 : e000000100fdfc60 r34 : 0000000000000000
    r35 : a0000001000376c0 r36 : 000000000000048c r37 : e000000100fdfde0
 [<a0000001000376c0>] ia64_illegal_op_fault+0x60/0x160
                                spà00000100fdfb30 bspà00000100fd8ea8
    r32 : e000000100fdfb60 r33 : 0000000000000000 r34 : e000000100fdfbe0
    r35 : a000000100974450 r36 : e000000100fd8000 r37 : 0000000000000015
    r38 : a000000100003f20 r39 : 0000000000000001 r40 : e000000100fdfde0
 [<a000000100003f20>] dispatch_illegal_op_fault+0x300/0x800
                                spà00000100fdfc50 bspà00000100fd8ea8
 [<a0000002000f8a40>] buncho_going_to_illegal_op+0x40/0xa0 [buncho]
                                spà00000100fdfe20 bspà00000100fd8e80
    r32 : a0000002000f8eb0 r33 : 0000000000000389 r34 : a0000002002f8000
    r35 : a0000002000f9940 r36 : 0000000000000000
 [<a0000002000f8eb0>] buncho_ioctl+0x410/0x420 [buncho]
                                spà00000100fdfe20 bspà00000100fd8e48
    r32 : e00000000567c158 r33 : e0000001015a4a00 r34 : 0000000000000072
    r35 : 0000000000000000 r36 : a000000100157fc0 r37 : 0000000000000895
    r38 : a0000002002f8000
 [<a000000100157fc0>] sys_ioctl+0x240/0x6c0
                                spà00000100fdfe20 bspà00000100fd8db8
    r32 : 0000000000000003 r33 : 0000000000000072 r34 : 0000000000000000
    r35 : 0000000000000002 r36 : 60000fffffffb9d8 r37 : 4000000000002780
    r38 : 4000000000002770 r39 : 200000000003a660 r40 : 0000000000000072
    r41 : a0000002000f8aa0 r42 : ffffffffffffffe7 r43 : e0000001015a4a00
    r44 : a0000002000fb000 r45 : a00000010000aba0 r46 : 0000000000000008
    r47 : a000000100974450 r48 : 0000000000168359
 [<a00000010000aba0>] ia64_ret_from_syscall+0x0/0x20
                                spà00000100fdfe30 bspà00000100fd8db8