kern/85257: [boot] BTX boot loader fails on USB CDROM (HP DL145 Opteron)

[Dimitry Andric]

The following reply was made to PR kern/85257; it has been noted by GNATS.

From: Dimitry Andric <dimitry at andric.com>
To: bug-followup at FreeBSD.org, cwf-ml at arcor.de
Cc:  
Subject: Re: kern/85257: [boot] BTX boot loader fails on USB CDROM (HP DL145 Opteron)
Date: Mon, 26 Sep 2005 01:08:17 +0200

 ------------2B83CD3BE2EF07
 Content-Type: text/plain; charset=us-ascii
 Content-Transfer-Encoding: quoted-printable
 
 I get the same kind of error here, using an external USB DVD-RW on a
 ThinkPad X41.  Usually, I also get the endless scrolling exception
 messages, making it impossible to read them.
 
 However, in some cases, it displays exactly ONE exception message,
 hangs for a few seconds, and then reboots the machine.  In one of
 those cases I had my cam ready, resulting in this output:
 
 CD Loader 1.2
 int=3D0000000d  err=3D0000001a  efl=3D00030246  eip=3D00001a46
 eax=3D220050d7  ebx=3D00000002  ecx=3D00001000  edx=3D000040f7
 esi=3D0000061c  edi=3D00000000  ebp=3D0000061c  esp=3D00000614
 cs=3D0e01  ds=3Ddcf1  es=3Dffff    fs=3D0010  gs=3D0000  ss=3Ddcf1
 cs:eip=3Dcc 7c bd 8b 45 d8 66 8b-78 30 e9 30 ff ff ff 8d
        76 00 31 c0 8d 65 f4 5b-5e 5f c9 c3 b8 ab aa aa
 ss:esp=3D50 94 e7 e2 46 02 36 a2-18 00 40 0c 34 00 00 dc
        00 10 00 00 ff ff 8b 5b-21 00 00 00 00 00 01 00
 BTX halted
 
 Looking at the produced code, it seems to be getting an exception
 somewhere at the end of elf32_obj_reloc_ptr:
 
 00005968 <elf32_obj_reloc_ptr>:
     5968:       55                      push   %ebp
     5969:       89 e5                   mov    %esp,%ebp
     ...
     5a47:       85 c0                   test   %eax,%eax
     5a49:       75 1f                   jne    5a6a <elf32_obj_reloc_ptr+0x=
 102>
     5a4b:       ff 45 cc                incl   0xffffffcc(%ebp)
     5a4e:       8b 4d c8                mov    0xffffffc8(%ebp),%ecx
     5a51:       83 c7 08                add    $0x8,%edi
 --> 5a54:       39 4d cc                cmp    %ecx,0xffffffcc(%ebp)
     5a57:       7c bd                   jl     5a16 <elf32_obj_reloc_ptr+0x=
 ae>
     5a59:       8b 45 d8                mov    0xffffffd8(%ebp),%eax
     5a5c:       66 8b 78 30             mov    0x30(%eax),%di
     5a60:       e9 30 ff ff ff          jmp    5995 <elf32_obj_reloc_ptr+0x=
 2d>
     5a65:       8d 76 00                lea    0x0(%esi),%esi
     5a68:       31 c0                   xor    %eax,%eax
     5a6a:       8d 65 f4                lea    0xfffffff4(%ebp),%esp
     5a6d:       5b                      pop    %ebx
     5a6e:       5e                      pop    %esi
     5a6f:       5f                      pop    %edi
     5a70:       c9                      leave
     5a71:       c3                      ret
 
 This seems to be somewhere in this part:
 
     for (n =3D 0; n < ef->relasz / sizeof(a); n++) {
         COPYOUT(ef->rela + n, &a, sizeof(a));
 
         error =3D __elfN(reloc)(ef, __elfN(symaddr), &a, ELF_RELOC_RELA,
             ef->off, p, val, len);
         if (error !=3D 0)
             return (error);
     }
 
 OTOH, as I look at cs:eip, it seems to be excepting in the middle of
 the cmp instruction??  And how a cmp can generate a general protection
 fault is beyond me, really. :)
 
 ------------2B83CD3BE2EF07
 Content-Type: application/pgp-signature
 
 -----BEGIN PGP MESSAGE-----
 Version: GnuPG v1.4.1 (MingW32)
 
 iD8DBQFDNy3hsF6jCi4glqMRAs+xAKD2V0zG/2jmYPYHYyRBlorY5/KO9ACgkpA6
 rgnhmu3w77LXB+YwiPRqRPE=
 =l+An
 -----END PGP MESSAGE-----
 
 ------------2B83CD3BE2EF07--