[lkml]   [1996]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectAn Operand Constraint Problem in __copy_user?
I noticed that workman (SCSI) doesn't work under 2.1.5.  It was apparently
broken somewhere in 2.1.2, 2.1.3, or 2.1.4, as it did work under 2.1.1,
but not with 2.1.4. The underlying problem appears to be a bad register
assignment when copying the number of tracks to the user from sr_ioctl.c.

Specifically, edx is assigned for the mod 4 byte count, although it is also
used in exception handling. (See the asm stuff below.) I have rebuilt
2.1.5, and there appears to be only one place where this happens.

I have the cdrom stuff in a module, if that makes any difference in the
compiling environment.

Since size = 2, it appears that gcc noticed that "size" and "size & 3" are
the same, and decided that it didn't need to allocate another register.

I don't claim to understand the gcc rules here, but I would guess that the
"q" constraint is too loose. I would guess that "ab" could be used to
avoid this.

The code is from 2.1.5, using gcc-2.7.2.

struct cdrom_tochdr tochdr;
char * buffer;

sr_cmd[0] = SCMD_READ_TOC;
sr_cmd[1] = ((scsi_CDs[target].device->lun) << 5);
sr_cmd[2] = sr_cmd[3] = sr_cmd[4] = sr_cmd[5] = 0;
sr_cmd[6] = 0;
sr_cmd[7] = 0; /* MSB of length (12) */
sr_cmd[8] = 12; /* LSB of length */
sr_cmd[9] = 0;

buffer = (unsigned char *) scsi_malloc(512);
if(!buffer) return -ENOMEM;

result = do_ioctl(target, sr_cmd, buffer, 12);

tochdr.cdth_trk0 = buffer[2];
tochdr.cdth_trk1 = buffer[3];

scsi_free(buffer, 512);

err = verify_area (VERIFY_WRITE, (void *) arg, sizeof (struct cdrom_tochdr));
if (err)
return err;
copy_to_user ((void *) arg, &tochdr, sizeof (struct cdrom_tochdr));

return result;

[ Lots of code omitted. ]

leal 162(%esp),%ecx
movl %ecx,%esi
movl 40(%esp),%edx This is the "normal" full-count setup
movl 20(%esp),%ecx
movl 212(%esp),%edi
movl 84(%esp),%eax
movl $3f,%edx <===================================
incl 984(%eax)
rep; movsl
testb $2,%dl <-----------------------------------
je 1f
subb $2,%dl <-----------------------------------
1: testb $1,%dl <-----------------------------------
je 2f
decb %dl <-----------------------------------
2: decl 984(%eax)
3: lea 0(%edx,%ecx,4),%edx
movl %ebp,%eax
popl %ebx
popl %esi
popl %edi
popl %ebp
addl $180,%esp

B. D. Elliott (Seattle)

 \ /
  Last update: 2005-03-22 13:38    [W:0.019 / U:1.996 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site