MIPS: math-emu: Fix jalr emulation when rd == $0

commit ab4a92e66741b35ca12f8497896bafbe579c28a1 upstream.

When emulating a jalr instruction with rd == $0, the code in
isBranchInstr was incorrectly writing to GPR $0 which should actually
always remain zeroed. This would lead to any further instructions
emulated which use $0 operating on a bogus value until the task is next
context switched, at which point the value of $0 in the task context
would be restored to the correct zero by a store in SAVE_SOME. Fix this
by not writing to rd if it is $0.

Fixes: 102cedc32a6e ("MIPS: microMIPS: Floating point support.")
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: Maciej W. Rozycki <macro@imgtec.com>
Cc: James Hogan <james.hogan@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13160/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
index 32f0e19a0d7f71fef2bb693e0da7b7bbc6bc9af9..734a2c7665ec28f92f64ec8fa95c7c46a5fbd516 100644 (file)
--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -445,9 +445,11 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
        case spec_op:
                switch (insn.r_format.func) {
                case jalr_op:
-                       regs->regs[insn.r_format.rd] =
-                               regs->cp0_epc + dec_insn.pc_inc +
-                               dec_insn.next_pc_inc;
+                       if (insn.r_format.rd != 0) {
+                               regs->regs[insn.r_format.rd] =
+                                       regs->cp0_epc + dec_insn.pc_inc +
+                                       dec_insn.next_pc_inc;
+                       }
                        /* Fall through */
                case jr_op:
                        /* For R6, JR already emulated in jalr_op */