[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[MiNT] Buggy blockcpy()
Hello.
Inside FreeMiNT's libkern, I have noticed a very subtle bug in blockcpy()
for 68000. It had never been triggered because this function is not used.
gas for a.out has a nontrivial bug. It allows sources like:
bra.s next
next:
A zero offset is illegal and should be rejected (it is on ELF targets).
Unfortunately, gas for a.out does not complain and produces invalid code :-(
And this happens in blockcpy() for 68000.
Also, it is obvious that the blockcpy() function has been quickly written
from a memcpy() implementation. Some code for remaining bytes was still
here, but obviously useless. I have removed it.
Now this file has been sanitized, I will patch it for ColdFire.
Alan, please commit !
- blockcopy.patch
Fixed 68000 variant and simplified. Contributed by Vincent Riviere.
--
Vincent Rivière
diff -x CVS -aurN freemint.orig/sys/libkern/asm/blockcopy.S freemint/sys/libkern/asm/blockcopy.S
--- freemint.orig/sys/libkern/asm/blockcopy.S 2005-05-07 10:58:16.000000000 +0200
+++ freemint/sys/libkern/asm/blockcopy.S 2011-03-25 00:07:26.812500000 +0100
@@ -16,7 +16,6 @@
move.l _mcpu,d1
cmp.w #40,d1
bcc.s L_040 | for 68000-68030 do quickmove
- clr.l d1
bra blkmv
L_040: dc.l 0xf6218000 | move16 (a1)+,(a0)+
dc.l 0xf6218000
@@ -53,12 +52,9 @@
subq.l #1,d0
bne L_040
rts
-#else
- clr.l d1
- bra.s blkmv
#endif
-blkmv: movem.l d1-d7/a2-a6,-(sp) | save regs
+blkmv: movem.l d2-d7/a2-a6,-(sp) | save regs
L1:
movem.l (a1)+,d1-d7/a2-a6 | read 12*4 = 48 bytes
movem.l d1-d7/a2-a6,(a0) |
@@ -85,28 +81,8 @@
lea 512(a0),a0
subq.l #1,d0
- bgt.s L1
+ bne.s L1
- movem.l (sp)+,d1-d7/a2-a6 | pop registers
+ movem.l (sp)+,d2-d7/a2-a6 | pop registers
-Leftover: | do the remaining bytes
- moveq.l #3,d0
- and.w d1,d0
- lsr.w #2,d1
- subq.w #1,d1 | prepare for dbra loop
- bmi.s L4done
- lsr.w #1,d1
- bcc.s L23
-L2l:
- move.l (a1)+,(a0)+
-L23:
- move.l (a1)+,(a0)+
- dbra d1,L2l
-L4done:
- subq.w #1,d0 | prepare for dbra loop
- bmi.s Ldone
-L2:
- move.b (a1)+,(a0)+
- dbra d0,L2
-Ldone:
rts | return