Bug in PowerPC math emulator (stfiwx)

[Jean-Denis Boyer]

Hi,

I encountered a problem while running "valgrind" on my 8323E based
system, running kernel 2.6.19.7. My userland program performs a few
floating point operations at initialization, which is normally handled
by the math emulator. But when running it through valgrind, the VEX will
"regenerate" code dynamically, and internally uses instruction "stfiwx".
Here is a disassembly of that instruction taken from gdb.

	0x42336e64:     stfiwx  f15,0,r1

Although this instruction is valid, the math-emulator rejects it as
invalid. I looked into arch/powerpc/math-emu/math.c, and this is caused
by the second argument which is 0 (rA=0).

In fact, it appears to me that the case XE and XEU are swapped. The
argument rA=0 is invalid for the instructions which updates rA after
computing the effective address, but this is checked in the XE case
instead of XEU.

In attachement, there is a patch for this. The valgrind is very happy
with it now.

There is also a test program (fputest.c) which no longer produces a
SIGILL with the patch.


P.S.: Please CC me cause I'm not on your mailing list.

Sincerely,

Jean-Denis Boyer, Eng.
Mediatrix Telecom, a division of Media5 Corporation
(819)829-8749 x241 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: math.patch
Type: application/octet-stream
Size: 589 bytes
Desc: math.patch
Url : http://ozlabs.org/pipermail/linuxppc-embedded/attachments/20070720/212e4a51/attachment.obj 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fputest.c
Type: application/octet-stream
Size: 143 bytes
Desc: fputest.c
Url : http://ozlabs.org/pipermail/linuxppc-embedded/attachments/20070720/212e4a51/attachment-0001.obj