#1400 closed defect (fixed)

Floating point context management flaw

Reported by: Sebastian Huber Owned by: Joel Sherrill
Priority: normal Milestone: 4.10.3
Component: score Version: 4.10
Severity: normal Keywords:
Cc: chrisj@…, plattro@…, gedare@… Blocked By:


There is a flaw in the floating point (FP) context management. The FP context is allocated from the workspace during thread creation and released during thread deletion. The pointer to the allocated memory is stored in TCB.Start.fp_context. The actual FP context used for save and restore is available via TCB.fp_context. A special feature _Context_Fp_start() allows to modify the FP context pointer during thread creation. Unfortunately this affects also TCB.Start.fp_context which is used to allocate and release the FP context area. This may lead to a workspace corruption. Proposed solution: Move the feature into the FP context initialization invoked during the thread load environment routine and remove _Context_Fp_start() completely. This is possible because _Context_Initialize_fp() passes a pointer to the FP context handle. The current _Context_Fp_start() is a NOP on all architectures with the exception of some m68k and ColdFire? variants.

Change History (5)

comment:1 Changed on Apr 14, 2009 at 12:36:42 PM by Rob Platt

Cc: Rob Platt added

comment:2 Changed on May 2, 2014 at 5:04:37 PM by Gedare Bloom

Cc: Gedare Bloom added

comment:3 Changed on May 5, 2014 at 5:16:01 AM by Sebastian Huber

Yes, this is still relevant.

The floating point context is not affected by the recent thread allocation changes since it is optional.

comment:4 Changed on Nov 22, 2014 at 1:33:48 PM by Gedare Bloom


comment:5 Changed on Jan 26, 2017 at 6:33:01 AM by Sebastian Huber <sebastian.huber@…>

Resolution: fixed
Status: newclosed

In 27bfcd88f7e65c81b406afa85d81b060e2ea24e3/rtems:

score: Delete _CPU_Context_Fp_start()

Since the FP area pointer is passed by reference in
_CPU_Context_Initialize_fp() the optional FP area adjustment via
_CPU_Context_Fp_start() is superfluous. It is also wrong with respect
to memory management, e.g. pointer passed to _Workspace_Free() may be
not the one returned by _Workspace_Allocate().

Close #1400.

Note: See TracTickets for help on using tickets.