A program that consistently crashes linux/axp - more info...

Harvey J. Stein (abel@netvision.net.il)
Sun, 26 Oct 1997 19:46:31 +0200


A little followup on the crash I'm seeing.

When instruction stepping in the debugger it fails to happen.
Instead, I get an "Instruction fault 0". This occurs the second time
the program hits this instruction:

0x120006240 <l_write+208>: a6090000 ldq a0,0(s0)

The first time the instruction is hit, "info reg" shows:

a0 0x12013e164 4833141092
s0 0x120141010 4833153040

and the second time it shows:

a0 0x37393237363934 15544011556534580
s0 0x120141014 4833153044

Evidentally the load is occurring off of an 8 byte boundary, which is
causing an instruction fault.

So, there's probably a bug in either f2c or gcc (for producing this
unaligned load), but isn't this also a kernel bug? Shouldn't this
cause an unaligned trap instead of this Instruction fault?

For reference, here's how gdb disassembles the whole function:

Dump of assembler code for function l_write:
0x120006170 <l_write>: 27bb0014 ldah gp,20(t12)
0x120006174 <l_write+4>: 23bd1998 lda gp,6552(gp)
0x120006178 <l_write+8>: 23deffc0 lda sp,-64(sp)
0x12000617c <l_write+12>: b75e0000 stq ra,0(sp)
0x120006180 <l_write+16>: b53e0008 stq s0,8(sp)
0x120006184 <l_write+20>: b55e0010 stq s1,16(sp)
0x120006188 <l_write+24>: b57e0018 stq s2,24(sp)
0x12000618c <l_write+28>: b59e0020 stq s3,32(sp)
0x120006190 <l_write+32>: b5be0028 stq s4,40(sp)
0x120006194 <l_write+36>: b5de0030 stq s5,48(sp)
0x120006198 <l_write+40>: 4610040d mov a0,s4
0x12000619c <l_write+44>: 46310409 mov a1,s0
0x1200061a0 <l_write+48>: a42d0000 ldq t0,0(s4)
0x1200061a4 <l_write+52>: 4652040b mov a2,s2
0x1200061a8 <l_write+56>: 4673040e mov a3,s5
0x1200061ac <l_write+60>: 43e109a1 cmplt zero,t0,t0
0x1200061b0 <l_write+64>: 47ff040c clr s3
0x1200061b4 <l_write+68>: e4200043 beq t0,0x1200062c4 <l_write+340>
0x1200061b8 <l_write+72>: 4221140a addq a1,0x8,s1
0x1200061bc <l_write+76>: 47ff041f nop
0x1200061c0 <l_write+80>: 41c05521 subq s5,0x2,t0
0x1200061c4 <l_write+84>: 4821f622 zapnot t0,0xf,t1
0x1200061c8 <l_write+88>: 404177a1 cmpule t1,0xb,t0
0x1200061cc <l_write+92>: e4200008 beq t0,0x1200061f0 <l_write+128>
0x1200061d0 <l_write+96>: a43d8748 ldq t0,-30904(gp)
0x1200061d4 <l_write+100>: 40410441 s4addq t1,t0,t0
0x1200061d8 <l_write+104>: a0210000 ldl t0,0(t0)
0x1200061dc <l_write+108>: 403d0402 addq t0,gp,t1
0x1200061e0 <l_write+112>: 6be2002b jmp zero,(t1),0x120006290 <l_write+288>
0x1200061e4 <l_write+116>: 47ff041f nop
0x1200061e8 <l_write+120>: 47ff041f nop
0x1200061ec <l_write+124>: 47ff041f nop
0x1200061f0 <l_write+128>: a63d8750 ldq a1,-30896(gp)
0x1200061f4 <l_write+132>: 47f99410 mov 0xcc,a0
0x1200061f8 <l_write+136>: a77d81c8 ldq t12,-32312(gp)
0x1200061fc <l_write+140>: 6b5b6b8a jsr ra,(t12),0x120001028 <f__fatal>
0x120006200 <l_write+144>: 27ba0014 ldah gp,20(ra)
0x120006204 <l_write+148>: 23bd1908 lda gp,6408(gp)
0x120006208 <l_write+152>: 2c290000 ldq_u t0,0(s0)
0x12000620c <l_write+156>: 482900c1 extbl t0,s0,t0
0x120006210 <l_write+160>: 48271721 sll t0,0x38,t0
0x120006214 <l_write+164>: 48271790 sra t0,0x38,a0
0x120006218 <l_write+168>: c3e0000a br 0x120006244 <l_write+212>
0x12000621c <l_write+172>: 47ff041f nop
0x120006220 <l_write+176>: 4520d101 andnot s0,0x6,t0
0x120006224 <l_write+180>: a4210000 ldq t0,0(t0)
0x120006228 <l_write+184>: 45203102 andnot s0,0x1,t1
0x12000622c <l_write+188>: 482202c1 extwl t0,t1,t0
0x120006230 <l_write+192>: 48261721 sll t0,0x30,t0
0x120006234 <l_write+196>: 48261790 sra t0,0x30,a0
0x120006238 <l_write+200>: c3e00002 br 0x120006244 <l_write+212>
0x12000623c <l_write+204>: 47ff041f nop
0x120006240 <l_write+208>: a6090000 ldq a0,0(s0)
0x120006244 <l_write+212>: d35ffd8c bsr ra,0x120005878 <lwrt_I+8>
0x120006248 <l_write+216>: c3e00018 br 0x1200062ac <l_write+316>
0x12000624c <l_write+220>: 47ff041f nop
0x120006250 <l_write+224>: 8a090000 lds $f16,0(s0)
0x120006254 <l_write+228>: c3e00003 br 0x120006264 <l_write+244>
0x120006258 <l_write+232>: 47ff041f nop
0x12000625c <l_write+236>: 47ff041f nop
0x120006260 <l_write+240>: 8e090000 ldt $f16,0(s0)
0x120006264 <l_write+244>: d35fff38 bsr ra,0x120005f48 <lwrt_F+8>
0x120006268 <l_write+248>: c3e00010 br 0x1200062ac <l_write+316>
0x12000626c <l_write+252>: 47ff041f nop
0x120006270 <l_write+256>: 8a090000 lds $f16,0(s0)
0x120006274 <l_write+260>: 8a2afffc lds $f17,-4(s1)
0x120006278 <l_write+264>: c3e00003 br 0x120006288 <l_write+280>
0x12000627c <l_write+268>: 47ff041f nop
0x120006280 <l_write+272>: 8e090000 ldt $f16,0(s0)
0x120006284 <l_write+276>: 8e2a0000 ldt $f17,0(s1)
0x120006288 <l_write+280>: d35fff43 bsr ra,0x120005f98 <lwrt_C+8>
0x12000628c <l_write+284>: c3e00007 br 0x1200062ac <l_write+316>
0x120006290 <l_write+288>: a6090000 ldq a0,0(s0)
0x120006294 <l_write+292>: 456b0411 mov s2,a1
0x120006298 <l_write+296>: d35ffdab bsr ra,0x120005948 <lwrt_L+8>
0x12000629c <l_write+300>: c3e00003 br 0x1200062ac <l_write+316>
0x1200062a0 <l_write+304>: 45290410 mov s0,a0
0x1200062a4 <l_write+308>: 456b0411 mov s2,a1
0x1200062a8 <l_write+312>: d35ffdc1 bsr ra,0x1200059b0 <lwrt_A+8>
0x1200062ac <l_write+316>: a42d0000 ldq t0,0(s4)
0x1200062b0 <l_write+320>: 4180300c addl s3,0x1,s3
0x1200062b4 <l_write+324>: 414b040a addq s1,s2,s1
0x1200062b8 <l_write+328>: 418109a1 cmplt s3,t0,t0
0x1200062bc <l_write+332>: 412b0409 addq s0,s2,s0
0x1200062c0 <l_write+336>: f43fffbf bne t0,0x1200061c0 <l_write+80>
0x1200062c4 <l_write+340>: 47ff0400 clr v0
0x1200062c8 <l_write+344>: a75e0000 ldq ra,0(sp)
0x1200062cc <l_write+348>: a53e0008 ldq s0,8(sp)
0x1200062d0 <l_write+352>: a55e0010 ldq s1,16(sp)
0x1200062d4 <l_write+356>: a57e0018 ldq s2,24(sp)
0x1200062d8 <l_write+360>: a59e0020 ldq s3,32(sp)
0x1200062dc <l_write+364>: a5be0028 ldq s4,40(sp)
0x1200062e0 <l_write+368>: a5de0030 ldq s5,48(sp)
0x1200062e4 <l_write+372>: 43c8141e addq sp,0x40,sp
0x1200062e8 <l_write+376>: 6bfa8001 ret zero,(ra),0x1

Thanks,

-- 
Harvey J. Stein
Berger Financial Research
hjstein@bfr.co.il