[Linux-ia64] Intermittent errors on mov rr

[Linux-ia64] Intermittent errors on mov rr

[Keith Owens]

BigSur dual B3.  Kernel 2.4.1 + ia64-010131 + kdb (no switch_stack
changes).  Cross compiled with gcc version 2.96-ia64-000717 snap
001117.

I get intermittent errors in copy_mm+0x6b0, where it is setting the new
region registers.  This only happens under high load, like compiling
gcc.  I cannot see why IA64 is complaining here, any ideas?

sh[8767]: General Exception: IA-64 Reserved Register/Field fault (data access) 2199023255600

psr : 0000121008026018 ifs : 8000000000000996 ip  : [<e000000000565491>]
unat: 0000000000000000 pfs : 0000000000000996 rsc : 0000000000000003
rnat: 0000000000000000 bsps: e000000000aa2d40 pr  : 0000000015950253
ldrs: 0000000000000000 ccv : 0000000000000000 fpsr: 0009804c0270033f
b0  : e000000000565250 b6  : e000000000502f60 b7  : e0000000005210a0
f6  : 1003e000000000004b2f8 f7	: 1003eaaaaaaaaaaaaaaab
f8  : 1003e000000000000002f f9	: 10004d400000000000000
r1  : e000000000aa2d40 r2  : 0000000000000000 r3  : 8000100000000000
r8  : 0000000000000000 r9  : 0000000000000996 r10 : 0000000000000000
r11 : 0000000000000287 r12 : e00000002750fbf0 r13 : e000000027508000
r14 : 0000000004000039 r15 : 0000000000200000 r16 : 0000000000000000
r17 : 0000000004000139 r18 : 0000000004000239 r19 : 0000000004000339
r20 : 0000000004000439 r21 : e000000000a6e540 r22 : e00000003f176c2c
r23 : e00000003f0c1800 r24 : e00000003f176c18 r25 : e00000003f176c2c
r26 : e00000003f176c20 r27 : e000000026ab0180 r28 : e000000026ab0198
r29 : 0000000000000001 r30 : 0000000000000008 r31 : 0000000000000027
r32 : 0000000000000000 r33 : 0000000000000000 r34 : 0000000000000000
r35 : 0000000000000000 r36 : 0000000000000000 r37 : 0000000000000000
r38 : 0000000000000000 r39 : 0000000000000000 r40 : 0000000000000000
r41 : 0000000000000000 r42 : 0000000000000000 r43 : 0000000000000000
r44 : 0000000000000000 r45 : 0000000000000000 r46 : 0000000000000000
r47 : 0000000000000000 r48 : 0000000000000000 r49 : 0000000000000000
r50 : 0000000000000000 r51 : 0000000000000000 r52 : 0000000000000000
r53 : 0000000000000000

Call Trace: [<e000000000527020>] sp=0xe00000002750f770 bsp=0xe000000027509198
[<e0000000005277b0>] sp=0xe00000002750f930 bsp=0xe000000027509148
[<e000000000532510>] sp=0xe00000002750f950 bsp=0xe000000027509120
[<e000000000533ca0>] sp=0xe00000002750f950 bsp=0xe0000000275090e8
[<e000000000521740>] sp=0xe00000002750fa50 bsp=0xe0000000275090e8
[<e000000000565490>] sp=0xe00000002750fbf0 bsp=0xe000000027509038
[<e000000000566cc0>] sp=0xe00000002750fbf0 bsp=0xe000000027508fa0
[<e0000000005210d0>] sp=0xe00000002750fc30 bsp=0xe000000027508f80
[<e000000000521720>] sp=0xe00000002750fe60 bsp=0xe000000027508f80

Entering kdb (current=0xe000000027508000, pid 8767) on processor 0 Panic: <NULL>
due to panic @ 0xe000000000565491
 psr: 0x0000121008026018   ifs: 0x8000000000000996    ip: 0xe000000000565490
unat: 0x0000000000000000   pfs: 0x0000000000000996   rsc: 0x0000000000000003
rnat: 0x0000000000000000  bsps: 0xe000000000aa2d40    pr: 0x0000000015950253
ldrs: 0x0000000000000000   ccv: 0x0000000000000000  fpsr: 0x0009804c0270033f
  b0: 0xe000000000565250    b6: 0xe000000000502f60    b7: 0xe0000000005210a0
  r1: 0xe000000000aa2d40    r2: 0x0000000000000000    r3: 0x8000100000000000
  r8: 0x0000000000000000    r9: 0x0000000000000996   r10: 0x0000000000000000
 r11: 0x0000000000000287   r12: 0xe00000002750fbf0   r13: 0xe000000027508000
 r14: 0x0000000004000039   r15: 0x0000000000200000   r16: 0x0000000000000000
 r17: 0x0000000004000139   r18: 0x0000000004000239   r19: 0x0000000004000339
 r20: 0x0000000004000439   r21: 0xe000000000a6e540   r22: 0xe00000003f176c2c
 r23: 0xe00000003f0c1800   r24: 0xe00000003f176c18   r25: 0xe00000003f176c2c
 r26: 0xe00000003f176c20   r27: 0xe000000026ab0180   r28: 0xe000000026ab0198
 r29: 0x0000000000000001   r30: 0x0000000000000008   r31: 0x0000000000000027
&regs = e00000002750fa60
[0]kdb> bt
0xe000000000565490 copy_mm+0x6b0
	args (0xe000000000a6c094, 0xe000000026ab0098, 0xe000000000a6c090, 0xe00000003a8e5c30, 0xe000000000a1d640)
	kernel .text 0xe000000000500000 0xe000000000564de0 0xe000000000565680
0xe000000000566cc0 do_fork+0xbc0
	args (0x11, 0x0, 0xe00000002750fe70, 0x0, 0xe000000026ab0000)
	kernel .text 0xe000000000500000 0xe000000000566100 0xe000000000567380
0xe0000000005210d0 sys_clone+0x50
	args (0x11, 0x0, 0xe000000000521720, 0x2)
	kernel .text 0xe000000000500000 0xe000000000521080 0xe000000000521100
0xe000000000521720 ia64_ret_from_syscall
	args (0x11, 0x0)
	kernel .text 0xe000000000500000 0xe000000000521720 0xe000000000521740
[0]kdb> id 0xe000000000565480
0xe000000000565480 copy_mm+0x6a0 [MII]	     adds r17%6,r14
0xe000000000565486 copy_mm+0x6a6	     adds r18Q2,r14
0xe00000000056548c copy_mm+0x6ac	     adds r19v8,r14

0xe000000000565490 copy_mm+0x6b0 [MMI]	     adds r20\x1024,r14
0xe000000000565496 copy_mm+0x6b6	     mov rr[r16]=r14
0xe00000000056549c copy_mm+0x6bc	     nop.i 0x0

0xe0000000005654a0 copy_mm+0x6c0 [MLX]	     nop.m 0x0
0xe0000000005654a6 copy_mm+0x6c6	     movl r15=0x2000000000000000;;

0xe0000000005654b0 copy_mm+0x6d0 [MLX]	     mov rr[r15]=r17
0xe0000000005654b6 copy_mm+0x6d6	     movl r14=0x4000000000000000;;

0xe0000000005654c0 copy_mm+0x6e0 [MLX]	     mov rr[r14]=r18
0xe0000000005654c6 copy_mm+0x6e6	     movl r15=0x6000000000000000;;

0xe0000000005654d0 copy_mm+0x6f0 [MLX]	     mov rr[r15]=r19
0xe0000000005654d6 copy_mm+0x6f6	     movl r14=0x8000000000000000;;

0xe0000000005654e0 copy_mm+0x700 [MMI]	     mov rr[r14]=r20;;
0xe0000000005654e6 copy_mm+0x706	     srlz.i
0xe0000000005654ec copy_mm+0x70c	     nop.i 0x0;;

0xe0000000005654f0 copy_mm+0x710 [MMI]	     mov r34=r37
0xe0000000005654f6 copy_mm+0x716	     mf
0xe0000000005654fc copy_mm+0x71c	     nop.i 0x0

RE: [Linux-ia64] Intermittent errors on mov rr

[Jim Hull]

Keith:

> I get intermittent errors in copy_mm+0x6b0, where it is setting the new
> region registers.  This only happens under high load, like compiling
> gcc.  I cannot see why IA64 is complaining here, any ideas?

The Reserved Register/Field fault occured on this instruction:

> 0xe000000000565496 copy_mm+0x6b6	     mov rr[r16]=r14

with:
r16 = 0
r14 = 0x04000039

There's no problem with r16.  Decoding r14, according to the Region
Register format, gives us:

rv     0
rid    0x040000
ps     14 (16K)
rv     0
ve     1

The fault happens because you are attempting to use a rid value which
requires 19 bits, but Itanium only supports 18-bit rids (the minimum
required by the architecture).  The implemented rid size is returned by
PAL_VM_SUMMARY, which you can examine with:

  cat /proc/pal/cpu0/vm_info | grep RR.rid

I know nothing about how IA-64 Linux manages rid values, whether it makes
use of the rid size field returned by PAL_VM_SUMMARY, etc., so I can't help
you any more than this.  Probably David Mosberger can track down the root
cause of this problem.

 -- Jim

RE: [Linux-ia64] Intermittent errors on mov rr

[David Mosberger]

>>>>> On Fri, 16 Feb 2001 11:12:16 -0800, "Jim Hull" <jim_hull@hp.com> said:

  Jim> The fault happens because you are attempting to use a rid value which
  Jim> requires 19 bits, but Itanium only supports 18-bit rids (the minimum
  Jim> required by the architecture).  The implemented rid size is returned by
  Jim> PAL_VM_SUMMARY, which you can examine with:

  Jim> cat /proc/pal/cpu0/vm_info | grep RR.rid

  Jim> I know nothing about how IA-64 Linux manages rid values,
  Jim> whether it makes use of the rid size field returned by
  Jim> PAL_VM_SUMMARY, etc., so I can't help you any more than this.
  Jim> Probably David Mosberger can track down the root cause of this
  Jim> problem.

Linux reads PAL_VM_SUMMARY and sets the limit accordingly.  On
Itanium, the limit should be 0x8000-1 (18-3 bits) and that's what I
see:

	kdb> md ia64_ctx
	e000000000abe6e8: 00000000 00006a02 00008000 00007fff  .....j.........
						     ^^^^^^^^

Keith, can you verify that you get the right value here as well?

	--david

Re: [Linux-ia64] Intermittent errors on mov rr

[Keith Owens]

On Fri, 16 Feb 2001 11:48:52 -0800,
David Mosberger <davidm@hpl.hp.com> wrote:
>Linux reads PAL_VM_SUMMARY and sets the limit accordingly.  On
>Itanium, the limit should be 0x8000-1 (18-3 bits) and that's what I
>see:
>
>	kdb> md ia64_ctx
>	e000000000abe6e8: 00000000 00006a02 00008000 00007fff  .....j.........
>						     ^^^^^^^^
>
>Keith, can you verify that you get the right value here as well?

[0]kdb> md ia64_ctx
0xe000000000a6c090 00000000 00000fdb 00007fff 001fffff

=> /proc/pal/cpu0/version_info <=
PAL_vendor : 0xff (min=0xff)
PAL_A      : 2.2.13 (min=2.2.13)
PAL_B      : 2.2.13 (min=2.0.0)

=> /proc/pal/cpu0/vm_info <=
Physical Address Space         : 44 bits
Virtual Address Space          : 51 bits
Protection Key Registers(PKR)  : 16
Implemented bits in PKR.key    : 24
Hash Tag ID                    : 0x1
Size of RR.rid                 : 24

Time to upgrade PAL.