On Sat, Jun 22, 2019 at 09:21:55AM +1000, Nicholas Piggin wrote:

Yep, from the stack trace, r13 is corrupted. So r13 must have got
corrupted before the machine check and this just happens to have
corrected it.

How does cause_ue work? It or memcpy_mcsafe must be corrupting
r13.

Well, cause_ue() is just my little testcase using inject_mce_ue_on_addr 
from skiboot/external/mambo/mambo_utils.tcl:

static noinline void cause_ue(void)
{
	static const char src[] = "hello";
	char dst[10];
	int rc;

	/* During the pause, break into mambo and run the following */
	pr_info("inject_mce_ue_on_addr 0x%px\n", src);
	pause(10);

	rc = memcpy_mcsafe(dst, src, sizeof(src));
	pr_info("memcpy_mcsafe() returns %d\n", rc);
	if (!rc)
		pr_info("dst=\"%s\"\n", dst);
}

I can't see how memcpy_mcsafe() would be causing it. I tried changing it 
to save/restore r13 where it already does r14-r22, but that didn't make 
a difference. Any ideas?

-- 
Reza Arbab