• Maciej W. Rozycki's avatar
    MIPS: math-emu: Correctly handle NOP emulation · e4553573
    Maciej W. Rozycki authored
    Fix an issue introduced with commit 9ab4471c ("MIPS: math-emu:
    Correct delay-slot exception propagation") where the emulation of a NOP
    instruction signals the need to terminate the emulation loop.  This in
    turn, if the PC has not changed from the entry to the loop, will cause
    the kernel to terminate the program with SIGILL.
    
    Consider this program:
    
    static double div(double d)
    {
    	do
    		d /= 2.0;
    	while (d > .5);
    	return d;
    }
    
    int main(int argc, char **argv)
    {
    	return div(argc);
    }
    
    which gets compiled to the following binary code:
    
    00400490 <main>:
      400490:	44840000 	mtc1	a0,$f0
      400494:	3c020040 	lui	v0,0x40
      400498:	d44207f8 	ldc1	$f2,2040(v0)
      40049c:	46800021 	cvt.d.w	$f0,$f0
      4004a0:	46220002 	mul.d	$f0,$f0,$f2
      4004a4:	4620103c 	c.lt.d	$f2,$f0
      4004a8:	4501fffd 	bc1t	4004a0 <main+0x10>
      4004ac:	00000000 	nop
      4004b0:	4620000d 	trunc.w.d	$f0,$f0
      4004b4:	03e00008 	jr	ra
      4004b8:	44020000 	mfc1	v0,$f0
      4004bc:	00000000 	nop
    
    Where the FPU emulator is used, depending on the number of command-line
    arguments this code will either run to completion or terminate with
    SIGILL.
    
    If no arguments are specified, then BC1T will not be taken, NOP will not
    be emulated and code will complete successfully.
    
    If one argument is specified, then BC1T will be taken once and NOP will
    be emulated.  At this point the entry PC value will be 0x400498 and the
    new PC value, set by `mips_dsemul' will be 0x4004a0, the target of BC1T.
    The emulation loop will terminate, but SIGILL will not be issued,
    because the PC has changed.  The FPU emulator will be entered again and
    on the second execution BC1T will not be taken, NOP will not be emulated
    and code will complete successfully.
    
    If two or more arguments are specified, then the first execution of BC1T
    will proceed as above.  Upon reentering the FPU emulator the emulation
    loop will continue to BC1T, at which point the branch will be taken and
    NOP emulated again.  At this point however the entry PC value will be
    0x4004a0, the same as the target of BC1T.  This will make the emulator
    conclude that execution has not advanced and therefore an unsupported
    FPU instruction has been encountered, and SIGILL will be sent to the
    process.
    
    Fix the problem by extending the internal API of `mips_dsemul', making
    it return -1 if no delay slot emulation frame has been made, the
    instruction has been handled and execution of the emulation loop needs
    to continue as if nothing happened.  Remove code from `mips_dsemul' to
    reproduce steps made by the emulation loop at the conclusion of each
    iteration, as those will be reached normally now.  Adjust call sites
    accordingly.  Document the API.
    Signed-off-by: default avatarMaciej W. Rozycki <macro@imgtec.com>
    Cc: Aurelien Jarno <aurelien@aurel32.net>
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/12172/Signed-off-by: default avatarRalf Baechle <ralf@linux-mips.org>
    e4553573
cp1emu.c 61.5 KB