Skip to content

Incorrect use of assembler constraints causes SIGILL on m68k #142342

@glaubitz

Description

@glaubitz

Bug report

Bug description:

Beginning with GCC 15, CPython was observed to crash with SIGILL on m68k which was originally suspected to be a regression in GCC. Further investigation however showed that the cause for the SIGILL crash are incorrect inline assembler operand constraints used for FPCR access in CPython.

Currently, the inline assembly code uses the "g" constraint which allows the compiler to use any register for FPCR access. However, the fmove instruction does not allow an address register as the destination when the source is the FPCR register.

The reason for the bug to not materialize earlier can be attributed to older versions of GCC not selecting an address register as the destination when generating the assembler code.

Disassembly of the crash in GDB:

Program received signal SIGILL, Illegal instruction.
PyOS_string_to_double (s=0xc02fc70c "nan", endptr=0xefffdf90, overflow_exception=0x0) at ../Python/pystrtod.c:307
307         x = _PyOS_ascii_strtod(s, &fail_pos);
(gdb) disassemble PyOS_string_to_double
Dump of assembler code for function PyOS_string_to_double:
   0x8028c2a2 <+0>:     lea %sp@(-12),%sp
   0x8028c2a6 <+4>:     fmovemx %fp2,%sp@-
   0x8028c2aa <+8>:     movel %fp,%sp@-
   0x8028c2ac <+10>:    movel %d2,%sp@-
   0x8028c2ae <+12>:    movel %sp@(36),%d2
   0x8028c2b2 <+16>:    jsr 0x8001b6d8 <__errno_location@plt>
   0x8028c2b8 <+22>:    clrl %a0@
=> 0x8028c2ba <+24>:    fmovel %fpcr,%fp
   0x8028c2be <+28>:    movel %fp,%d0
   0x8028c2c0 <+30>:    andiw #-241,%d0
   0x8028c2c4 <+34>:    movel %d0,%sp@(24)
   0x8028c2c8 <+38>:    moveq #127,%d0
   0x8028c2ca <+40>:    notb %d0
   0x8028c2cc <+42>:    orl %sp@(24),%d0
   0x8028c2d0 <+46>:    cmpl %fp,%d0
   0x8028c2d2 <+48>:    beqs 0x8028c336 <PyOS_string_to_double+148>
   0x8028c2d4 <+50>:    fmovel %d0,%fpcr
   0x8028c2d8 <+54>:    lea %sp@(28),%a1
   0x8028c2dc <+58>:    movel %a1,%sp@(24)
   0x8028c2e0 <+62>:    movel %a1,%sp@-
   0x8028c2e2 <+64>:    movel %d2,%sp@-
   0x8028c2e4 <+66>:    movel %a0,%sp@(28)
   0x8028c2e8 <+70>:    jsr 0x8028e290 <_Py_dg_strtod>
   0x8028c2ee <+76>:    fmovel %fp,%fpcr
   0x8028c2f2 <+80>:    addql #8,%sp
   0x8028c2f4 <+82>:    moveal %sp@(20),%a0
   0x8028c2f8 <+86>:    cmpl %sp@(28),%d2
   0x8028c2fc <+90>:    beqw 0x8028c3ea <PyOS_string_to_double+328>
   0x8028c300 <+94>:    movel %a0@,%d0
   0x8028c302 <+96>:    moveq #12,%d1
   0x8028c304 <+98>:    cmpl %d0,%d1
   0x8028c306 <+100>:   beqw 0x8028c3c0 <PyOS_string_to_double+286>
   0x8028c30a <+104>:   moveal %sp@(28),%a0
   0x8028c30e <+108>:   tstl %sp@(40)
   0x8028c312 <+112>:   beqs 0x8028c35c <PyOS_string_to_double+186>
   0x8028c314 <+114>:   cmpal %d2,%a0
   0x8028c316 <+116>:   beqw 0x8028c450 <PyOS_string_to_double+430>
   0x8028c31a <+120>:   moveq #34,%d1
   0x8028c31c <+122>:   cmpl %d0,%d1
   0x8028c31e <+124>:   beqw 0x8028c404 <PyOS_string_to_double+354>
   0x8028c322 <+128>:   moveal %sp@(40),%a1
   0x8028c326 <+132>:   movel %a0,%a1@
--Type <RET> for more, q to quit, c to continue without paging--

A patch to fix this issue will follow shortly.

See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122211

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    interpreter-core(Objects, Python, Grammar, and Parser dirs)type-bugAn unexpected behavior, bug, or error

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions