Wrong Regsiter Usage on ARM

[Alexander Warg <alex dot warg at gmx dot net>]

PRODUCT GCC (C++) version 3.3
HOST: i686-pc-linux
TARGET: arm-linux
BUILD: i686-pc-linux
SEVERITY: CIRTICAL

The compiler uses register fp (r11) as memory reference, but it contains
a prior loaded non-pointer value.

# arm-linux-g++ -v
Reading specs from /usr/local/lib/gcc-lib/arm-linux/3.3/specs
Configured with: ./configure --prefix=/usr/local --target=arm-linux
--with-newlib --enable-languages=c,c++ --disable-libgcj
--program-suffix=-3.3 -v : (reconfigured) ./configure
--prefix=/usr/local --target=arm-linux
--exec-prefix=/usr/local/arm-linux --with-newlib
--enable-languages=c,c++ --disable-libgcj --program-suffix=-3.3 -v :
(reconfigured) ./configure --prefix=/usr/local --target=arm-linux
--exec-prefix=/usr/local --with-newlib --enable-languages=c,c++
--disable-libgcj -v : (reconfigured) ./configure --prefix=/usr/local
--target=arm-linux --exec-prefix=/usr/local --with-newlib
--enable-languages=c,c++ --disable-libgcj -v : (reconfigured)
./configure --prefix=/usr/local --target=arm-linux
--exec-prefix=/usr/local --with-newlib --enable-languages=c,c++
--disable-libgcj -v : (reconfigured) ./configure --prefix=/usr/local
--target=arm-linux --exec-prefix=/usr/local --with-newlib
--enable-languages=c,c++ --disable-libgcj --disable-threads -v
Thread model: single
gcc version 3.3

Command line:
arm-linux-g++ -c -MD -nostdinc -I../src/types/arm -I../src/types      \
-I../src/drivers/arm -I../src/drivers                                 \
-I../src/lib/minilibc/arm/include -I../src/lib/minilibc/include       \
-I../src/lib/lmm -I../src/lib/amm -I../src/boot                       \
-I../src/kern/arm -I../src/kern -I../src/lib/libk/arm                 \
-I../src/lib/libk -I. -Iauto                                          \
-I/usr/local/lib/gcc-lib/arm-linux/3.3//include -W -Wall -fno-rtti    \
-fno-exceptions   -fno-defer-pop -freg-struct-return -g -Wall -W      \
-frename-registers -finline-limit=10000 -O1 ../src/sigma0-arm/test.cc \
-o test.o

Compiler output:
../src/sigma0-arm/test.cc: In function `int main()':
../src/sigma0-arm/test.cc:21: warning: unused variable `l4_threadid_t
my_pager'
../src/sigma0-arm/test.cc:21: warning: unused variable `l4_threadid_t 
   my_preempter'
../src/sigma0-arm/test.cc: In function `void thread_action(unsigned int,
   unsigned int, unsigned int)':
../src/sigma0-arm/test.cc:85: warning: unused parameter `unsigned int b'
../src/sigma0-arm/test.cc:85: warning: unused parameter `unsigned int c'

the source file is attached: test.ii

the annotatied objdump:

00000000 <main>:
   0:   e92d4ff0        stmdb   sp!, {r4, r5, r6, r7, r8, r9, sl, fp,
lr}
   4:   e24dd04c        sub     sp, sp, #76     ; 0x4c
   8:   e3a00000        mov     r0, #0  ; 0x0
   c:   e58d0028        str     r0, [sp, #40]
  10:   e3a01002        mov     r1, #2  ; 0x2
  14:   e5cd102a        strb    r1, [sp, #42]
  18:   e58d0024        str     r0, [sp, #36]
  1c:   e3a0e004        mov     lr, #4  ; 0x4
  20:   e5cde026        strb    lr, [sp, #38]
  24:   e59dc024        ldr     ip, [sp, #36]
  28:   e3ccbb3e        bic     fp, ip, #63488  ; 0xf800 
                        ^ loading fp with a task id (not a pointer to
                          some thing)

  2c:   e38bab01        orr     sl, fp, #1024   ; 0x400
  30:   e58da024        str     sl, [sp, #36]
  34:   e92d0800        stmdb   sp!, {fp}
  38:   e3a00000        mov     r0, #0  ; 0x0
  3c:   e1a0e00f        mov     lr, pc
  40:   e3e0f00f        mvn     pc, #15 ; 0xf
  44:   e1a00001        mov     r0, r1
  48:   e8bd0800        ldmia   sp!, {fp}
  4c:   e58d0020        str     r0, [sp, #32]
  50:   e58db018        str     fp, [sp, #24]
  54:   e28d9020        add     r9, sp, #32     ; 0x20
  58:   e5d91002        ldrb    r1, [r9, #2]
  5c:   e5d98001        ldrb    r8, [r9, #1]
  60:   e1a02128        mov     r2, r8, lsr #2
  64:   e5dd3026        ldrb    r3, [sp, #38]
  68:   e5dd7025        ldrb    r7, [sp, #37]
  6c:   e1a06127        mov     r6, r7, lsr #2
  70:   e58d6000        str     r6, [sp]
  74:   e59f5178        ldr     r5, [pc, #376]  ; 1f4 <main+0x1f4>
  78:   e58d5004        str     r5, [sp, #4]
  7c:   e59f0174        ldr     r0, [pc, #372]  ; 1f8 <main+0x1f8>
  80:   ebfffffe        bl      0 <main>
  84:   e5dd202a        ldrb    r2, [sp, #42]
  88:   e5dd4029        ldrb    r4, [sp, #41]
  8c:   e1a03124        mov     r3, r4, lsr #2
  90:   e59f0164        ldr     r0, [pc, #356]  ; 1fc <main+0x1fc>
  94:   e59d1028        ldr     r1, [sp, #40]
  98:   ebfffffe        bl      0 <main>
  9c:   e2853eff        add     r3, r5, #4080   ; 0xff0
  a0:   e59d2024        ldr     r2, [sp, #36]
  a4:   e1a01522        mov     r1, r2, lsr #10
  a8:   e201003f        and     r0, r1, #63     ; 0x3f
  ac:   e59f114c        ldr     r1, [pc, #332]  ; 200 <main+0x200>
  b0:   e1a02003        mov     r2, r3
  b4:   e59d3028        ldr     r3, [sp, #40]
  b8:   e59da018        ldr     sl, [sp, #24]
  bc:   e92d0800        stmdb   sp!, {fp}
  c0:   e1a0e00f        mov     lr, pc
  c4:   e3e0f01f        mvn     pc, #31 ; 0x1f
  c8:   e8bd0800        ldmia   sp!, {fp}
  cc:   e58d3028        str     r3, [sp, #40]
  d0:   e5db1002        ldrb    r1, [fp, #2] 
                        ^ access fp+2 in memory (but fp still contains 
                          the L4 thread id and not an address!!
                          This causes a page fault.
  d4:   e5db0001        ldrb    r0, [fp, #1]
  d8:   e1a02120        mov     r2, r0, lsr #2

-- 
Alexander Warg <alex.warg@gmx.net>

Attachment: test.ii
Description: Text document