NetBSD Problem Report #44639

From tsutsui@ceres.dti.ne.jp  Sat Feb 26 10:09:33 2011
Return-Path: <tsutsui@ceres.dti.ne.jp>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id B103C63B842
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 26 Feb 2011 10:09:33 +0000 (UTC)
Message-Id: <201102261009.p1QA9UFK013679@mirage.localdomain>
Date: Sat, 26 Feb 2011 19:09:30 +0900 (JST)
From: Izumi Tsutsui <tsutsui@ceres.dti.ne.jp>
Reply-To: tsutsui@ceres.dti.ne.jp
To: gnats-bugs@gnats.NetBSD.org
Cc: tsutsui@ceres.dti.ne.jp
Subject: MIPS FP exception caused by BDslot insn isn't handled properly
X-Send-Pr-Version: 3.95

>Number:         44639
>Category:       port-mips
>Synopsis:       MIPS FP exception caused by BDslot insn isn't handled properly
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    port-mips-maintainer
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Feb 26 10:10:01 +0000 2011
>Closed-Date:    Sun Mar 04 05:36:39 +0000 2012
>Last-Modified:  Sun Mar 04 05:36:39 +0000 2012
>Originator:     Izumi Tsutsui
>Release:        NetBSD 5.99.46
>Organization:
>Environment:
System: NetBSD 5.99.46 around 20110225
Architecture: mipsel/mipseb
Machine: cobalt, ews4800mips, probably all mips3 machines
>Description:
Before the second matt-nb5-mips64 merge,
MachFPTrap() takes cause value passed from trap()
and it checks branch delay bit in it to fetch
an instruction that causes the exception.

After the merge, MachFPTrap() is renamed to mips_fpu_trap()
and it no longer takes cause value. It loads the cause value
from trapframe in curlwp passed from trap() instead.
But CAUSE in trapframe doesn't reflect actual cause status
which should be fetched in the exception handler.

So, if the exception is caused by instruction in BDslot,
branch delay bit check doesn't work and mips_fpu_trap()
fetches branch instruction instead of the actual FP instruction.
Then it won't emulate the FP instruction and returns SIGILL.

>How-To-Repeat:
atf-run(1) in /usr/tests/lib/libc/ieeefp.

t_subnormal float test gets SIGILL, and in that case
mips_fpuillinst() is called with branch opcode:
---
 :
tp-start: t_subnormal, 2
tc-start: test_double
tc-end: test_double, passed
tc-start: test_float
mips_fpuillinst(1000ffe2,0x7dfa1f24)
---

Instructions around 0x7dfa1f24 are:
---
7dfa1f20: c4606928	lwc1	$f0,26920(v1)
7dfa1f24: 1000ffe2	b	0x7dfa1eb0
7dfa1f28: 46001302	mul.s	$f12,$f2,$f0
---
The exception is caused by mul.s in BDslot.

>Fix:
Pass cause value from trap() to mips_fpu_trap() seems to fix the problem.

But no idea how to pass cause value from cpu_intr() to mips_fpu_intr()
because cpu_intr() no longer takes cause.

>Release-Note:

>Audit-Trail:
From: "Izumi Tsutsui" <tsutsui@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44639 CVS commit: src/sys/arch/mips/mips
Date: Sat, 26 Feb 2011 15:41:33 +0000

 Module Name:	src
 Committed By:	tsutsui
 Date:		Sat Feb 26 15:41:32 UTC 2011

 Modified Files:
 	src/sys/arch/mips/mips: fp.S mips_fputrap.c

 Log Message:
 Use mips_fpexcept() instead of fpemul_trapsignal() to deliver SIGFPE,
 and remove now unused fpemul_trapsignal() introduced for PR port-mips/26410.

 Fixes PR port-mips/35326 and now t_except unmasked tests in
 /usr/tests/lib/libc/ieeefp pass.

 Note t_subnormal double test still fails as mentioned in PR port-mips/44639.


 To generate a diff of this commit:
 cvs rdiff -u -r1.42 -r1.43 src/sys/arch/mips/mips/fp.S
 cvs rdiff -u -r1.9 -r1.10 src/sys/arch/mips/mips/mips_fputrap.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Izumi Tsutsui" <tsutsui@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44639 CVS commit: src/sys/arch/mips/mips
Date: Tue, 8 Mar 2011 15:12:46 +0000

 Module Name:	src
 Committed By:	tsutsui
 Date:		Tue Mar  8 15:12:46 UTC 2011

 Modified Files:
 	src/sys/arch/mips/mips: locore_mips1.S

 Log Message:
 Pass correct exception PC value to cpu_intr() as mipsX_subr.S does.
 Fixes SIGILL on all FPU exceptions on R3000.

 XXX: cpu_intr() may require cause value as mentioned in PR port-mips/44639


 To generate a diff of this commit:
 cvs rdiff -u -r1.74 -r1.75 src/sys/arch/mips/mips/locore_mips1.S

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Izumi Tsutsui" <tsutsui@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44639 CVS commit: src/sys/arch/mips/mips
Date: Wed, 16 Mar 2011 15:14:08 +0000

 Module Name:	src
 Committed By:	tsutsui
 Date:		Wed Mar 16 15:14:08 UTC 2011

 Modified Files:
 	src/sys/arch/mips/mips: trap.c

 Log Message:
 Set R_CAUSE into trapframe in curlwp before calling mips_fpu_trap()
 for workaround PR port-mips/44639.

 mipsX_user_gen_exception() in mipsX_subr.S (which may call
 mips_fpu_trap()) doesn't set R_CAUSE in curlwp trapframe, while
 mips1_use_intr() in locore_mips1.S (that may call mips_fpu_intr()) does.

 All tests in tests/lib/libc/ieeefp on MIPS3 should pass now.


 To generate a diff of this commit:
 cvs rdiff -u -r1.228 -r1.229 src/sys/arch/mips/mips/trap.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->feedback
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Thu, 24 Mar 2011 02:39:20 +0000
State-Changed-Why:
Is this fully fixed now?


State-Changed-From-To: feedback->analyzed
State-Changed-By: tsutsui@NetBSD.org
State-Changed-When: Sat, 23 Apr 2011 20:12:57 +0900
State-Changed-Why:
The workaround needs to be reviewed by real mips guys.


State-Changed-From-To: analyzed->closed
State-Changed-By: tsutsui@NetBSD.org
State-Changed-When: Sun, 04 Mar 2012 14:36:39 +0900
State-Changed-Why:
No worth to wait review for ~a year.


>Unformatted:

Home	PR Database Search