public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
From: "Sergey.Belyashov at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/63808] New: [arm] Invalid register saving in FIQ handler causes register corruption
Date: Mon, 10 Nov 2014 14:56:00 -0000	[thread overview]
Message-ID: <bug-63808-4@http.gcc.gnu.org/bugzilla/> (raw)

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63808

            Bug ID: 63808
           Summary: [arm] Invalid register saving in FIQ handler causes
                    register corruption
           Product: gcc
           Version: 4.8.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: Sergey.Belyashov at gmail dot com

I have found strange bug which causes USR-mode register damage after FIQ
processing. Fiq handler stores R8 to the stack and loads it to USR-mode
registers at return instruction:
fiq:
        sub     lr, lr, #4
        stmfd   sp!, {r0, r1, r2, r3, r4, r5, r6, r7, r8, lr}
....
        ldmfd   sp!, {r0, r1, r2, r3, r4, r5, r6, r7, r8, pc}^

To reproduce use this code:

unsigned char a[8][5];
int func1(unsigned port);
unsigned func2(unsigned,void*);

__attribute__((optimize("Os"),interrupt("FIQ")))
void fiq(void)
{
    static unsigned char b[8];
    unsigned char *p = a[0];
    for(int i = 0; i < 8; ++i) {
        unsigned s = func1(i + 0x10000);
        func2(s,  &b[i]);

        do {
            if (s & 1)
                ++*p;
            ++p;
            s >>= 1;
        } while (s != 0x01);
    }
}

Compile it using:
$ arm-none-eabi-gcc -c -S -std=c99 test_fiq.c

I try to create dummy FIQ handler with one instruction, which clobbes R8:
__asm__ volatile ("bl 0x12345" : : : "r8");
But compiler creates valid entry/exit code (ignoring R8 in save/restore).

$ arm-none-eabi-gcc -v
Using built-in specs.
COLLECT_GCC=arm-none-eabi-gcc
COLLECT_LTO_WRAPPER=/usr/bin/../lib/gcc/arm-none-eabi/4.8.4/lto-wrapper
Target: arm-none-eabi
Configured with: /build/buildd/gcc-arm-none-eabi-4.8.4.2014q3/src/gcc/configure
--target=arm-none-eabi
--prefix=/build/buildd/gcc-arm-none-eabi-4.8.4.2014q3/install-native
--libexecdir=/build/buildd/gcc-arm-none-eabi-4.8.4.2014q3/install-native/lib
--infodir=/build/buildd/gcc-arm-none-eabi-4.8.4.2014q3/install-native/share/doc/gcc-arm-none-eabi/info
--mandir=/build/buildd/gcc-arm-none-eabi-4.8.4.2014q3/install-native/share/doc/gcc-arm-none-eabi/man
--htmldir=/build/buildd/gcc-arm-none-eabi-4.8.4.2014q3/install-native/share/doc/gcc-arm-none-eabi/html
--pdfdir=/build/buildd/gcc-arm-none-eabi-4.8.4.2014q3/install-native/share/doc/gcc-arm-none-eabi/pdf
--enable-languages=c,c++ --enable-plugins --disable-decimal-float
--disable-libffi --disable-libgomp --disable-libmudflap --disable-libquadmath
--disable-libssp --disable-libstdcxx-pch --disable-nls --disable-shared
--disable-threads --disable-tls --with-gnu-as --with-gnu-ld --with-newlib
--with-headers=yes --with-python-dir=share/gcc-arm-none-eabi
--with-sysroot=/build/buildd/gcc-arm-none-eabi-4.8.4.2014q3/install-native/arm-none-eabi
--with-host-libstdcxx='-static-libgcc -Wl,-Bstatic,-lstdc++,-Bdynamic -lm'
--with-pkgversion='GNU Tools for ARM Embedded Processors'
--with-multilib-list=armv6-m,armv7-m,armv7e-m,armv7-r
Thread model: single
gcc version 4.8.4 20140725 (release) [ARM/embedded-4_8-branch revision 213147]
(GNU Tools for ARM Embedded Processors)


             reply	other threads:[~2014-11-10 14:56 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-11-10 14:56 Sergey.Belyashov at gmail dot com [this message]
2014-11-11 16:35 ` [Bug target/63808] " rearnsha at gcc dot gnu.org
2014-11-11 17:00 ` rearnsha at gcc dot gnu.org
2014-11-11 17:11 ` Sergey.Belyashov at gmail dot com
2015-01-15 13:30 ` [Bug target/63808] [arm] Extra register saving in FIQ handler ramana at gcc dot gnu.org
2015-01-15 13:31 ` rearnsha at gcc dot gnu.org

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=bug-63808-4@http.gcc.gnu.org/bugzilla/ \
    --to=gcc-bugzilla@gcc.gnu.org \
    --cc=gcc-bugs@gcc.gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).