Re: recent SIGBUS/SIGSEGV mips kernel bug

[David Daney <ddaney@caviumnetworks.com>]

On 10/21/2010 09:19 AM, David Daney wrote:
> On 10/20/2010 02:31 PM, Camm Maguire wrote:
>> Greetings!
>>
>> Does this suffice?
>>
>> (sid)camm@gabrielli:~/maxima-5.22.1/tests$ uname -a
>> Linux gabrielli 2.6.35.4-dsa-octeon #1 SMP Fri Sep 17 21:15:34 UTC
>> 2010 mips64 GNU/Linux
>> (sid)camm@gabrielli:~/maxima-5.22.1/tests$ cat /proc/cpuinfo
>> system type : CUST_WSX16 (CN3860p3.X-500-EXP)
>> processor : 0
>> cpu model : Cavium Octeon V0.3
> [...]
>
> Hah! I have those things piled up all around me.
>
> No guarantees, but I will try to reproduce it. If I can reproduce it, it
> should be easy to fix.
>

Definitely a kernel bug.  Consider this program:

------------8<--------sigbus.c-------
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#include <sys/mman.h>

int main(int argc, char *argv[])
{
   int pgsize;
   float *p1;
   float *p2;
   int r;

   pgsize = getpagesize();

   p1 = mmap(NULL, pgsize, PROT_READ | PROT_WRITE,
	    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

   if (p1 == MAP_FAILED) {
     perror("mmap p1 failed");
     exit(1);
   }

   p2 = mmap(NULL, pgsize, PROT_READ | PROT_WRITE,
	    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

   if (p2 == MAP_FAILED) {
     perror("mmap p2 failed");
     exit(1);
   }

   *p1 = 2.5;
   *p2 = 3.5;

   r = mprotect(p1, pgsize, PROT_READ);
   if (r) {
     perror("mprotect p1 failed");
     exit(1);
   }

   r = mprotect(p2, pgsize, PROT_READ);
   if (r) {
     perror("mprotect p2 failed");
     exit(1);
   }

   *p2 = *p1;

   asm volatile("" ::: "memory");

   puts("All done!");

   exit(0);
}
------------8<-----------------------

$ mips64-octeon-linux-gnu-gcc -Wall -mhard-float -march=mips64 -O3 -o 
sigbus sigbus.c
$ mips64-octeon-linux-gnu-objdump -d sigbus > sigbus.dis

The float copy '*p2 = *p1;' dissassembles as:

    120000b30:	c6400000 	lwc1	$f0,0(s2)
    120000b34:	e6000000 	swc1	$f0,0(s0)

When run on an FPU-less system I get:

~ # ./sigbus
Bus error

When run on my x86_64 workstation:

$ ./sigbus
Segmentation fault (core dumped)

I will fix this kernel bug.

David Daney