mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-24 21:24:00 +08:00
13769ebad0
Terminate FPU emulation immediately whenever an ISA mode switch has been observed. This is so that we do not interpret machine code in the wrong mode, for example when a regular MIPS FPU instruction has been placed in a delay slot of a jump that switches into the MIPS16 mode, as with the following code (taken from a GCC test suite case): 00400650 <set_fast_math>: 400650: 3c020100 lui v0,0x100 400654: 03e00008 jr ra 400658: 44c2f800 ctc1 v0,c1_fcsr 40065c: 00000000 nop [...] 004012d0 <__libc_csu_init>: 4012d0: f000 6a02 li v0,2 4012d4: f150 0b1c la v1,3f9430 <_DYNAMIC-0x6df0> 4012d8: f400 3240 sll v0,16 4012dc: e269 addu v0,v1 4012de: 659a move gp,v0 4012e0: f00c 64f6 save a0-a2,48,ra,s0-s1 4012e4: 673c move s1,gp 4012e6: f010 9978 lw v1,-32744(s1) 4012ea: d204 sw v0,16(sp) 4012ec: eb40 jalr v1 4012ee: 653b move t9,v1 4012f0: f010 997c lw v1,-32740(s1) 4012f4: f030 9920 lw s1,-32736(s1) 4012f8: e32f subu v1,s1 4012fa: 326b sra v0,v1,2 4012fc: d206 sw v0,24(sp) 4012fe: 220c beqz v0,401318 <__libc_csu_init+0x48> 401300: 6800 li s0,0 401302: 99e0 lw a3,0(s1) 401304: 4801 addiu s0,1 401306: 960e lw a2,56(sp) 401308: 4904 addiu s1,4 40130a: 950d lw a1,52(sp) 40130c: 940c lw a0,48(sp) 40130e: ef40 jalr a3 401310: 653f move t9,a3 401312: 9206 lw v0,24(sp) 401314: ea0a cmp v0,s0 401316: 61f5 btnez 401302 <__libc_csu_init+0x32> 401318: 6476 restore 48,ra,s0-s1 40131a: e8a0 jrc ra Here `set_fast_math' is called from `40130e' (`40130f' with the ISA bit) and emulation triggers for the CTC1 instruction. As it is in a jump delay slot emulation continues from `401312' (`401313' with the ISA bit). However we have no path to handle MIPS16 FPU code emulation, because there are no MIPS16 FPU instructions. So the default emulation path is taken, interpreting a 32-bit word fetched by `get_user' from `401313' as a regular MIPS instruction, which is: 401313: f5ea0a92 sdc1 $f10,2706(t7) This makes the FPU emulator proceed with the supposed SDC1 instruction and consequently makes the program considered here terminate with SIGSEGV. A similar although less severe issue exists with pure-microMIPS processors in the case where similarly an FPU instruction is emulated in a delay slot of a register jump that (incorrectly) switches into the regular MIPS mode. A subsequent instruction fetch from the jump's target is supposed to cause an Address Error exception, however instead we proceed with regular MIPS FPU emulation. For simplicity then, always terminate the emulation loop whenever a mode change is detected, denoted by an ISA mode bit flip. As from commit |
||
|---|---|---|
| .. | ||
| cp1emu.c | ||
| dp_2008class.c | ||
| dp_add.c | ||
| dp_cmp.c | ||
| dp_div.c | ||
| dp_fint.c | ||
| dp_flong.c | ||
| dp_fmax.c | ||
| dp_fmin.c | ||
| dp_fsp.c | ||
| dp_maddf.c | ||
| dp_mul.c | ||
| dp_simple.c | ||
| dp_sqrt.c | ||
| dp_sub.c | ||
| dp_tint.c | ||
| dp_tlong.c | ||
| dsemul.c | ||
| ieee754.c | ||
| ieee754.h | ||
| ieee754d.c | ||
| ieee754dp.c | ||
| ieee754dp.h | ||
| ieee754int.h | ||
| ieee754sp.c | ||
| ieee754sp.h | ||
| Makefile | ||
| me-debugfs.c | ||
| sp_2008class.c | ||
| sp_add.c | ||
| sp_cmp.c | ||
| sp_div.c | ||
| sp_fdp.c | ||
| sp_fint.c | ||
| sp_flong.c | ||
| sp_fmax.c | ||
| sp_fmin.c | ||
| sp_maddf.c | ||
| sp_mul.c | ||
| sp_simple.c | ||
| sp_sqrt.c | ||
| sp_sub.c | ||
| sp_tint.c | ||
| sp_tlong.c | ||