On Tue, Jan 15, 2008 at 06:18:12PM +0000, Ralf Baechle wrote: So I sent an NMI to the IP27 and used the POD to extract as much information as I could. Below the disassembly of the code. The addresses are looking a little odd because I had to disassembly at the XKPHYS address even though the code was actually executing in userspace. 1B 000: 0xa80000007bd5f008: 8c658b98 lw a1,0x8b98(v1) 1B 000: 0xa80000007bd5f00c: 24060001 li a2,0x1 1B 000: 0xa80000007bd5f010: 34a50001 ori a1,a1,0x1 1B 000: 0xa80000007bd5f014: 00003821 move a3,zero 1B 000: 0xa80000007bd5f018: 2402108e li v0,0x108e 1B 000: 0xa80000007bd5f01c: 0000000c syscall 1B 000: 0xa80000007bd5f020: 1000ffd3 b 0xa80000007bd5ef70 1B 000: 0xa80000007bd5f024: 00000000 nop 1B 000: 0xa80000007bd5f028: 3c1c0010 lui gp,0x10 1B 000: 0xa80000007bd5f02c: 279ce938 addiu gp,gp,0xffffffe938 1B 000: 0xa80000007bd5f030: 0399e021 addu gp,gp,t9 1B 000: 0xa80000007bd5f034: 27bdffd8 addiu sp,sp,0xffffffffd8 1B 000: 0xa80000007bd5f038: afbf0020 sw ra,0x20(sp) 1B 000: 0xa80000007bd5f03c: afb1001c sw s1,0x1c(sp) 1B 000: 0xa80000007bd5f040: afb00018 sw s0,0x18(sp) 1B 000: 0xa80000007bd5f044: afbc0010 sw gp,0x10(sp) 1B 000: 0xa80000007bd5f048: 7c03e83b op1f v1,zero,0xfffffffff 1B 000: fffe83b 1B 000: 0xa80000007bd5f04c: 8f848018 lw a0,0x8018(gp) EPC is pointing to this lw so the subsequent instruction from the op1f which is rdhwr $29. ErrorEPC is pointing further down so it seems we must have returned from the emulation. 1B 000: 0xa80000007bd5f050: 24718b90 addiu s1,v1,0xffffff8b90 1B 000: 0xa80000007bd5f054: 24901710 addiu s0,a0,0x1710 1B 000: 0xa80000007bd5f058: 8e020008 lw v0,0x8(s0) 1B 000: 0xa80000007bd5f05c: 00000000 nop 1B 000: 0xa80000007bd5f060: 1051000d beq v0,s1,0xa8000000f098 1B 000: 0xa80000007bd5f064: 00001821 move v1,zero 1B 000: 0xa80000007bd5f068: 24020001 li v0,0x1 1B 000: 0xa80000007bd5f06c: c0851710 ll a1,0x1710(a0) 1B 000: 0xa80000007bd5f070: 14a30006 bne a1,v1,0xa8000000f08c 1B 000: 0xa80000007bd5f074: 00003021 move a2,zero 1B 000: 0xa80000007bd5f078: 00403021 move a2,v0 1B 000: 0xa80000007bd5f07c: e0861710 sc a2,0x1710(a0) 1B 000: 0xa80000007bd5f080: 10c0fffa beq a2,zero,0xa800d5f06c And this is where the ErrorEPC is pointing. 1B 000: 0xa80000007bd5f084: 00000000 nop 1B 000: 0xa80000007bd5f088: 0000000f sync 1B 000: 0xa80000007bd5f08c: 10c0000a beq a2,zero,0xa800d5f0b8 1B 000: 0xa80000007bd5f090: 00000000 nop Ralf
