Re: recent SIGBUS/SIGSEGV mips kernel bug

[David Daney <ddaney@caviumnetworks.com>]

On 10/21/2010 09:19 AM, David Daney wrote:
> On 10/20/2010 02:31 PM, Camm Maguire wrote:
> > Greetings!
> >
> > Does this suffice?
> >
> > (sid)camm@gabrielli:~/maxima-5.22.1/tests$ uname -a
> > Linux gabrielli 2.6.35.4-dsa-octeon #1 SMP Fri Sep 17 21:15:34 UTC
> > 2010 mips64 GNU/Linux
> > (sid)camm@gabrielli:~/maxima-5.22.1/tests$ cat /proc/cpuinfo
> > system type : CUST_WSX16 (CN3860p3.X-500-EXP)
> > processor : 0
> > cpu model : Cavium Octeon V0.3
> [...]
>
> Hah! I have those things piled up all around me.
>
> No guarantees, but I will try to reproduce it. If I can reproduce it, it
> should be easy to fix.

Definitely a kernel bug.  Consider this program:

------------8<--------sigbus.c-------
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#include <sys/mman.h>

int main(int argc, char *argv[])
{
  int pgsize;
  float *p1;
  float *p2;
  int r;

  pgsize = getpagesize();

  p1 = mmap(NULL, pgsize, PROT_READ | PROT_WRITE,
	    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

  if (p1 == MAP_FAILED) {
    perror("mmap p1 failed");
    exit(1);
  }

  p2 = mmap(NULL, pgsize, PROT_READ | PROT_WRITE,
	    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

  if (p2 == MAP_FAILED) {
    perror("mmap p2 failed");
    exit(1);
  }

  *p1 = 2.5;
  *p2 = 3.5;

  r = mprotect(p1, pgsize, PROT_READ);
  if (r) {
    perror("mprotect p1 failed");
    exit(1);
  }

  r = mprotect(p2, pgsize, PROT_READ);
  if (r) {
    perror("mprotect p2 failed");
    exit(1);
  }

  *p2 = *p1;

  asm volatile("" ::: "memory");

  puts("All done!");

  exit(0);
}
------------8<-----------------------

$ mips64-octeon-linux-gnu-gcc -Wall -mhard-float -march=mips64 -O3 -o 
sigbus sigbus.c
$ mips64-octeon-linux-gnu-objdump -d sigbus > sigbus.dis

The float copy '*p2 = *p1;' dissassembles as:

   120000b30:	c6400000 	lwc1	$f0,0(s2)
   120000b34:	e6000000 	swc1	$f0,0(s0)

When run on an FPU-less system I get:

~ # ./sigbus
Bus error

When run on my x86_64 workstation:

$ ./sigbus
Segmentation fault (core dumped)

I will fix this kernel bug.

David Daney