corruption of load instruction offset

["Chuck Meade" <chuckmeade@mindspring.com>]

Hello,

I am seeing a very interesting/worrisome bug on an RM7965 cpu, which has
an E9000 core.  I am running 2.6.14-rc1.  Please take a look at the
behavior I describe and send me your thoughts.  Thanks.

The error message is immediately below.  Notice that the epc is 8021e28c,
and the BadVA is 87e39681, and register 4 (a0) is 87e38660.

Now scan down below the error message, to the disassembly of move_32bytes.
If you look at the instruction at 8021e28c, it appears harmless enough.  
Nothing to cause an unaligned access or invalid instruction.  But look
about 6 lines above that, and we are loading at offsets from a0.  The
offsets from a0 in those 4 load instructions are 16, 20, 24, and 28.  If
you look at the opcodes in the column to the left, those offsets appear in
the least significant 16 bits of the opcode.

Now look again at the value of a0 in the register dump:  87e38660.  And
at the BadVA value:  87e39681.  The BadVA is offset exactly 0x1021 from
a0.  This indicates that we somehow tried to access memory at offset 
0x1021 from a0.  However, we never should have done that according to
the disassembly.  *But* there are many instructions in the vicinity which
have a least significant 16 bits of 0x1021.  None of them are loads from a0,
but I believe that this is the root of the problem.  Something is happening
here, possibly an interrupt, or a cpu bug(?) that is causing the load from
a0 to use an offset of 0x1021 (the least significant 16-bits of many of
the nearby instructions) rather than the correct offset for the load
instruction, which is found in the least significant 16-bits of the actual
load instructions.

This is not "quickly" reproducible.  I run a TCP blaster/blastee test between
this machine and Linux PC, and at some point during the run (sometimes much
later) this error appears.

Thanks for your ideas,
Chuck

Error message:

Unhandled kernel unaligned access or invalid instruction in arch/mips/kernel/unaligned.c::emulate_load_store_insn, line 487[#1]:
Cpu 0
$ 0   : 00000000 10004ce8 00000000 00000000
$ 4   : 87e38660 000005a8 00000000 00000000
$ 8   : 00000000 00000000 00000020 00000000
$12   : 00000000 80402000 00000001 00000000
$16   : 00000000 87e171a0 000005a8 87c1f060
$20   : 87e380e0 004009e0 10004740 00002ad8
$24   : 00000008 803171c0
$28   : 8120a000 8120bd48 00000000 802deb30
Hi    : 0000000c
Lo    : 000d4bf8
epc   : 8021e28c move_32bytes+0x64/0x88     Not tainted
ra    : 802deb30 tcp_sendmsg+0x460/0xd80
Status: 90018403    KERNEL EXL IE
Cause : 00000010
BadVA : 87e39681
PrId  : 00003422
Modules linked in:
Process blaster (pid: 162, threadinfo=8120a000, task=8050b3f8)
Stack : 8120bdd0 00000000 812fd4a0 8120bdf0 8120bd70 87e18520 00000001 00000000
        8120be40 7fffffff 00000000 8120bf18 8120be14 00000000 000005a8 000005a8
        000032e8 00000001 00000000 90018400 8120be40 00005dc0 10001458 8120bf18
        00000005 004009e0 10011044 10010000 10010fd4 8028e7a8 00000020 ffffffff
        00000001 00000000 00005dc0 10001458 87e18520 00005dc0 812fd4a0 004009e0
        ...
Call Trace:
 [<8028e7a8>] sock_aio_write+0x10c/0x12c
 [<8016bef8>] do_sync_write+0xd0/0x128
 [<801037d4>] do_IRQ+0x24/0x34
 [<804203cc>] init+0xd8/0xe4
 [<8013cf78>] autoremove_wake_function+0x0/0x44
 [<8016c020>] vfs_write+0xd0/0x144
 [<8016c020>] vfs_write+0xd0/0x144
 [<8016c074>] vfs_write+0x124/0x144
 [<8016c150>] sys_write+0x24/0x98
 [<8016c180>] sys_write+0x54/0x98
 [<8016c154>] sys_write+0x28/0x98
 [<801037d4>] do_IRQ+0x24/0x34
 [<8010b260>] stack_done+0x20/0x3c



Disassembly of relevant portion of move_32bytes:

8021e228 <move_32bytes>:
8021e228:       8c880000        lw      t0,0(a0)
8021e22c:       8c890004        lw      t1,4(a0)
8021e230:       8c8b0008        lw      t3,8(a0)
8021e234:       8c8c000c        lw      t4,12(a0)
8021e238:       00481021        addu    v0,v0,t0
8021e23c:       0048182b        sltu    v1,v0,t0
8021e240:       00431021        addu    v0,v0,v1
8021e244:       00491021        addu    v0,v0,t1
8021e248:       0049182b        sltu    v1,v0,t1
8021e24c:       00431021        addu    v0,v0,v1
8021e250:       004b1021        addu    v0,v0,t3
8021e254:       004b182b        sltu    v1,v0,t3
8021e258:       00431021        addu    v0,v0,v1
8021e25c:       004c1021        addu    v0,v0,t4
8021e260:       004c182b        sltu    v1,v0,t4
8021e264:       00431021        addu    v0,v0,v1
8021e268:       8c880010        lw      t0,16(a0)
8021e26c:       8c890014        lw      t1,20(a0)
8021e270:       8c8b0018        lw      t3,24(a0)
8021e274:       8c8c001c        lw      t4,28(a0)
8021e278:       00481021        addu    v0,v0,t0
8021e27c:       0048182b        sltu    v1,v0,t0
8021e280:       00431021        addu    v0,v0,v1
8021e284:       00491021        addu    v0,v0,t1
8021e288:       0049182b        sltu    v1,v0,t1
8021e28c:       00431021        addu    v0,v0,v1
8021e290:       004b1021        addu    v0,v0,t3
8021e294:       004b182b        sltu    v1,v0,t3
8021e298:       00431021        addu    v0,v0,v1
8021e29c:       004c1021        addu    v0,v0,t4
8021e2a0:       004c182b        sltu    v1,v0,t4
8021e2a4:       00431021        addu    v0,v0,v1
8021e2a8:       30b8001c        andi    t8,a1,0x1c
8021e2ac:       24840020        addiu   a0,a0,32