[General Omni Discussion] Lanchon:
without a device, this is what i can do:

1)make a userland FP corruption detector

2)instrument a kernel to detect FP corruption in ISRs

3)modify a kernel to save FP context for all or some interrupts

i've been looking at how to make 2) or 3) just now. problem is, i doubt it will be useful.

objdumping the kernel, these are the instructions that mention d0 to d31:

~/android/system/out/target/product/i9100-copy $ find vmlinux.o -iname '*.o' | xargs arm-linux-androideabi-objdump -d | grep -Pw '(d([0-9][0-9]?)(?!([:]| [<])))|file format'
vmlinux.o: file format elf32-littlearm
cb4:	ecba0b20	vldmia	sl!, {d0-d15}
cc4:	0cfa0b20	vldmiaeq	sl!, {d16-d31}
d50:	eca00b20	vstmia	r0!, {d0-d15}
d60:	0ce00b20	vstmiaeq	r0!, {d16-d31}
fa8:	ec510b10	vmov	r0, r1, d0
fb0:	ec510b11	vmov	r0, r1, d1
fb8:	ec510b12	vmov	r0, r1, d2
fc0:	ec510b13	vmov	r0, r1, d3
fc8:	ec510b14	vmov	r0, r1, d4
fd0:	ec510b15	vmov	r0, r1, d5
fd8:	ec510b16	vmov	r0, r1, d6
fe0:	ec510b17	vmov	r0, r1, d7
fe8:	ec510b18	vmov	r0, r1, d8
ff0:	ec510b19	vmov	r0, r1, d9
ff8:	ec510b1a	vmov	r0, r1, d10
1000:	ec510b1b	vmov	r0, r1, d11
1008:	ec510b1c	vmov	r0, r1, d12
1010:	ec510b1d	vmov	r0, r1, d13
1018:	ec510b1e	vmov	r0, r1, d14
1020:	ec510b1f	vmov	r0, r1, d15
1028:	ec510b30	vmov	r0, r1, d16
1030:	ec510b31	vmov	r0, r1, d17
1038:	ec510b32	vmov	r0, r1, d18
1040:	ec510b33	vmov	r0, r1, d19
1048:	ec510b34	vmov	r0, r1, d20
1050:	ec510b35	vmov	r0, r1, d21
1058:	ec510b36	vmov	r0, r1, d22
1060:	ec510b37	vmov	r0, r1, d23
1068:	ec510b38	vmov	r0, r1, d24
1070:	ec510b39	vmov	r0, r1, d25
1078:	ec510b3a	vmov	r0, r1, d26
1080:	ec510b3b	vmov	r0, r1, d27
1088:	ec510b3c	vmov	r0, r1, d28
1090:	ec510b3d	vmov	r0, r1, d29
1098:	ec510b3e	vmov	r0, r1, d30
10a0:	ec510b3f	vmov	r0, r1, d31
10bc:	ec410b10	vmov	d0, r0, r1
10c4:	ec410b11	vmov	d1, r0, r1
10cc:	ec410b12	vmov	d2, r0, r1
10d4:	ec410b13	vmov	d3, r0, r1
10dc:	ec410b14	vmov	d4, r0, r1
10e4:	ec410b15	vmov	d5, r0, r1
10ec:	ec410b16	vmov	d6, r0, r1
10f4:	ec410b17	vmov	d7, r0, r1
10fc:	ec410b18	vmov	d8, r0, r1
1104:	ec410b19	vmov	d9, r0, r1
110c:	ec410b1a	vmov	d10, r0, r1
1114:	ec410b1b	vmov	d11, r0, r1
111c:	ec410b1c	vmov	d12, r0, r1
1124:	ec410b1d	vmov	d13, r0, r1
112c:	ec410b1e	vmov	d14, r0, r1
1134:	ec410b1f	vmov	d15, r0, r1
113c:	ec410b30	vmov	d16, r0, r1
1144:	ec410b31	vmov	d17, r0, r1
114c:	ec410b32	vmov	d18, r0, r1
1154:	ec410b33	vmov	d19, r0, r1
115c:	ec410b34	vmov	d20, r0, r1
1164:	ec410b35	vmov	d21, r0, r1
116c:	ec410b36	vmov	d22, r0, r1
1174:	ec410b37	vmov	d23, r0, r1
117c:	ec410b38	vmov	d24, r0, r1
1184:	ec410b39	vmov	d25, r0, r1
118c:	ec410b3a	vmov	d26, r0, r1
1194:	ec410b3b	vmov	d27, r0, r1
119c:	ec410b3c	vmov	d28, r0, r1
11a4:	ec410b3d	vmov	d29, r0, r1
11ac:	ec410b3e	vmov	d30, r0, r1
11b4:	ec410b3f	vmov	d31, r0, r1

in all of the kernel there's just that. looks like ordinary FP context save and restore. the first 4 instructions for neon processors, the others for vfp, ill take a look at the code at some point.

dumping the *.o files that make up the kernel, same story:

~/android/system/out/target/product/i9100-copy $ find KERNEL_OBJ/ -iname '*.o' | xargs arm-linux-androideabi-objdump -d | grep -Pw '(d([0-9][0-9]?)(?!([:]| [<])))|file format'
KERNEL_OBJ/arch/arm/vfp/vfp.o: file format elf32-littlearm
728:	ecba0b20	vldmia	sl!, {d0-d15}
738:	0cfa0b20	vldmiaeq	sl!, {d16-d31}
7c4:	eca00b20	vstmia	r0!, {d0-d15}
7d4:	0ce00b20	vstmiaeq	r0!, {d16-d31}
a1c:	ec510b10	vmov	r0, r1, d0
a24:	ec510b11	vmov	r0, r1, d1
a2c:	ec510b12	vmov	r0, r1, d2
a34:	ec510b13	vmov	r0, r1, d3
a3c:	ec510b14	vmov	r0, r1, d4
a44:	ec510b15	vmov	r0, r1, d5
a4c:	ec510b16	vmov	r0, r1, d6
a54:	ec510b17	vmov	r0, r1, d7
a5c:	ec510b18	vmov	r0, r1, d8
a64:	ec510b19	vmov	r0, r1, d9
a6c:	ec510b1a	vmov	r0, r1, d10
a74:	ec510b1b	vmov	r0, r1, d11
a7c:	ec510b1c	vmov	r0, r1, d12
a84:	ec510b1d	vmov	r0, r1, d13
a8c:	ec510b1e	vmov	r0, r1, d14
a94:	ec510b1f	vmov	r0, r1, d15
a9c:	ec510b30	vmov	r0, r1, d16
aa4:	ec510b31	vmov	r0, r1, d17
aac:	ec510b32	vmov	r0, r1, d18
ab4:	ec510b33	vmov	r0, r1, d19
abc:	ec510b34	vmov	r0, r1, d20
ac4:	ec510b35	vmov	r0, r1, d21
acc:	ec510b36	vmov	r0, r1, d22
ad4:	ec510b37	vmov	r0, r1, d23
adc:	ec510b38	vmov	r0, r1, d24
ae4:	ec510b39	vmov	r0, r1, d25
aec:	ec510b3a	vmov	r0, r1, d26
af4:	ec510b3b	vmov	r0, r1, d27
afc:	ec510b3c	vmov	r0, r1, d28
b04:	ec510b3d	vmov	r0, r1, d29
b0c:	ec510b3e	vmov	r0, r1, d30
b14:	ec510b3f	vmov	r0, r1, d31
b30:	ec410b10	vmov	d0, r0, r1
b38:	ec410b11	vmov	d1, r0, r1
b40:	ec410b12	vmov	d2, r0, r1
b48:	ec410b13	vmov	d3, r0, r1
b50:	ec410b14	vmov	d4, r0, r1
b58:	ec410b15	vmov	d5, r0, r1
b60:	ec410b16	vmov	d6, r0, r1
b68:	ec410b17	vmov	d7, r0, r1
b70:	ec410b18	vmov	d8, r0, r1
b78:	ec410b19	vmov	d9, r0, r1
b80:	ec410b1a	vmov	d10, r0, r1
b88:	ec410b1b	vmov	d11, r0, r1
b90:	ec410b1c	vmov	d12, r0, r1
b98:	ec410b1d	vmov	d13, r0, r1
ba0:	ec410b1e	vmov	d14, r0, r1
ba8:	ec410b1f	vmov	d15, r0, r1
bb0:	ec410b30	vmov	d16, r0, r1
bb8:	ec410b31	vmov	d17, r0, r1
bc0:	ec410b32	vmov	d18, r0, r1
bc8:	ec410b33	vmov	d19, r0, r1
bd0:	ec410b34	vmov	d20, r0, r1
bd8:	ec410b35	vmov	d21, r0, r1
be0:	ec410b36	vmov	d22, r0, r1
be8:	ec410b37	vmov	d23, r0, r1
bf0:	ec410b38	vmov	d24, r0, r1
bf8:	ec410b39	vmov	d25, r0, r1
c00:	ec410b3a	vmov	d26, r0, r1
c08:	ec410b3b	vmov	d27, r0, r1
c10:	ec410b3c	vmov	d28, r0, r1
c18:	ec410b3d	vmov	d29, r0, r1
c20:	ec410b3e	vmov	d30, r0, r1
c28:	ec410b3f	vmov	d31, r0, r1
KERNEL_OBJ/arch/arm/vfp/built-in.o: file format elf32-littlearm
728:	ecba0b20	vldmia	sl!, {d0-d15}
738:	0cfa0b20	vldmiaeq	sl!, {d16-d31}
7c4:	eca00b20	vstmia	r0!, {d0-d15}
7d4:	0ce00b20	vstmiaeq	r0!, {d16-d31}
a1c:	ec510b10	vmov	r0, r1, d0
a24:	ec510b11	vmov	r0, r1, d1
a2c:	ec510b12	vmov	r0, r1, d2
a34:	ec510b13	vmov	r0, r1, d3
a3c:	ec510b14	vmov	r0, r1, d4
a44:	ec510b15	vmov	r0, r1, d5
a4c:	ec510b16	vmov	r0, r1, d6
a54:	ec510b17	vmov	r0, r1, d7
a5c:	ec510b18	vmov	r0, r1, d8
a64:	ec510b19	vmov	r0, r1, d9
a6c:	ec510b1a	vmov	r0, r1, d10
a74:	ec510b1b	vmov	r0, r1, d11
a7c:	ec510b1c	vmov	r0, r1, d12
a84:	ec510b1d	vmov	r0, r1, d13
a8c:	ec510b1e	vmov	r0, r1, d14
a94:	ec510b1f	vmov	r0, r1, d15
a9c:	ec510b30	vmov	r0, r1, d16
aa4:	ec510b31	vmov	r0, r1, d17
aac:	ec510b32	vmov	r0, r1, d18
ab4:	ec510b33	vmov	r0, r1, d19
abc:	ec510b34	vmov	r0, r1, d20
ac4:	ec510b35	vmov	r0, r1, d21
acc:	ec510b36	vmov	r0, r1, d22
ad4:	ec510b37	vmov	r0, r1, d23
adc:	ec510b38	vmov	r0, r1, d24
ae4:	ec510b39	vmov	r0, r1, d25
aec:	ec510b3a	vmov	r0, r1, d26
af4:	ec510b3b	vmov	r0, r1, d27
afc:	ec510b3c	vmov	r0, r1, d28
b04:	ec510b3d	vmov	r0, r1, d29
b0c:	ec510b3e	vmov	r0, r1, d30
b14:	ec510b3f	vmov	r0, r1, d31
b30:	ec410b10	vmov	d0, r0, r1
b38:	ec410b11	vmov	d1, r0, r1
b40:	ec410b12	vmov	d2, r0, r1
b48:	ec410b13	vmov	d3, r0, r1
b50:	ec410b14	vmov	d4, r0, r1
b58:	ec410b15	vmov	d5, r0, r1
b60:	ec410b16	vmov	d6, r0, r1
b68:	ec410b17	vmov	d7, r0, r1
b70:	ec410b18	vmov	d8, r0, r1
b78:	ec410b19	vmov	d9, r0, r1
b80:	ec410b1a	vmov	d10, r0, r1
b88:	ec410b1b	vmov	d11, r0, r1
b90:	ec410b1c	vmov	d12, r0, r1
b98:	ec410b1d	vmov	d13, r0, r1
ba0:	ec410b1e	vmov	d14, r0, r1
ba8:	ec410b1f	vmov	d15, r0, r1
bb0:	ec410b30	vmov	d16, r0, r1
bb8:	ec410b31	vmov	d17, r0, r1
bc0:	ec410b32	vmov	d18, r0, r1
bc8:	ec410b33	vmov	d19, r0, r1
bd0:	ec410b34	vmov	d20, r0, r1
bd8:	ec410b35	vmov	d21, r0, r1
be0:	ec410b36	vmov	d22, r0, r1
be8:	ec410b37	vmov	d23, r0, r1
bf0:	ec410b38	vmov	d24, r0, r1
bf8:	ec410b39	vmov	d25, r0, r1
c00:	ec410b3a	vmov	d26, r0, r1
c08:	ec410b3b	vmov	d27, r0, r1
c10:	ec410b3c	vmov	d28, r0, r1
c18:	ec410b3d	vmov	d29, r0, r1
c20:	ec410b3e	vmov	d30, r0, r1
c28:	ec410b3f	vmov	d31, r0, r1
KERNEL_OBJ/arch/arm/vfp/vfphw.o: file format elf32-littlearm
2c:	ecba0b20	vldmia	sl!, {d0-d15}
3c:	0cfa0b20	vldmiaeq	sl!, {d16-d31}
c8:	eca00b20	vstmia	r0!, {d0-d15}
d8:	0ce00b20	vstmiaeq	r0!, {d16-d31}
320:	ec510b10	vmov	r0, r1, d0
328:	ec510b11	vmov	r0, r1, d1
330:	ec510b12	vmov	r0, r1, d2
338:	ec510b13	vmov	r0, r1, d3
340:	ec510b14	vmov	r0, r1, d4
348:	ec510b15	vmov	r0, r1, d5
350:	ec510b16	vmov	r0, r1, d6
358:	ec510b17	vmov	r0, r1, d7
360:	ec510b18	vmov	r0, r1, d8
368:	ec510b19	vmov	r0, r1, d9
370:	ec510b1a	vmov	r0, r1, d10
378:	ec510b1b	vmov	r0, r1, d11
380:	ec510b1c	vmov	r0, r1, d12
388:	ec510b1d	vmov	r0, r1, d13
390:	ec510b1e	vmov	r0, r1, d14
398:	ec510b1f	vmov	r0, r1, d15
3a0:	ec510b30	vmov	r0, r1, d16
3a8:	ec510b31	vmov	r0, r1, d17
3b0:	ec510b32	vmov	r0, r1, d18
3b8:	ec510b33	vmov	r0, r1, d19
3c0:	ec510b34	vmov	r0, r1, d20
3c8:	ec510b35	vmov	r0, r1, d21
3d0:	ec510b36	vmov	r0, r1, d22
3d8:	ec510b37	vmov	r0, r1, d23
3e0:	ec510b38	vmov	r0, r1, d24
3e8:	ec510b39	vmov	r0, r1, d25
3f0:	ec510b3a	vmov	r0, r1, d26
3f8:	ec510b3b	vmov	r0, r1, d27
400:	ec510b3c	vmov	r0, r1, d28
408:	ec510b3d	vmov	r0, r1, d29
410:	ec510b3e	vmov	r0, r1, d30
418:	ec510b3f	vmov	r0, r1, d31
434:	ec410b10	vmov	d0, r0, r1
43c:	ec410b11	vmov	d1, r0, r1
444:	ec410b12	vmov	d2, r0, r1
44c:	ec410b13	vmov	d3, r0, r1
454:	ec410b14	vmov	d4, r0, r1
45c:	ec410b15	vmov	d5, r0, r1
464:	ec410b16	vmov	d6, r0, r1
46c:	ec410b17	vmov	d7, r0, r1
474:	ec410b18	vmov	d8, r0, r1
47c:	ec410b19	vmov	d9, r0, r1
484:	ec410b1a	vmov	d10, r0, r1
48c:	ec410b1b	vmov	d11, r0, r1
494:	ec410b1c	vmov	d12, r0, r1
49c:	ec410b1d	vmov	d13, r0, r1
4a4:	ec410b1e	vmov	d14, r0, r1
4ac:	ec410b1f	vmov	d15, r0, r1
4b4:	ec410b30	vmov	d16, r0, r1
4bc:	ec410b31	vmov	d17, r0, r1
4c4:	ec410b32	vmov	d18, r0, r1
4cc:	ec410b33	vmov	d19, r0, r1
4d4:	ec410b34	vmov	d20, r0, r1
4dc:	ec410b35	vmov	d21, r0, r1
4e4:	ec410b36	vmov	d22, r0, r1
4ec:	ec410b37	vmov	d23, r0, r1
4f4:	ec410b38	vmov	d24, r0, r1
4fc:	ec410b39	vmov	d25, r0, r1
504:	ec410b3a	vmov	d26, r0, r1
50c:	ec410b3b	vmov	d27, r0, r1
514:	ec410b3c	vmov	d28, r0, r1
51c:	ec410b3d	vmov	d29, r0, r1
524:	ec410b3e	vmov	d30, r0, r1
52c:	ec410b3f	vmov	d31, r0, r1

ive dumped the rest of the obj directory then everything else and attached the files to this post if anyone's interested.

i've also dumped the *.ko, also all the ones in CM11-M10, and found no mention of the FP regs.

is there any other code (even if we only have binaries for it) that executes in kernel mode? userland code of course can't corrupt. unless there is more code (im not familiar with the linux kernel), then the kernel can't be clobbering. what are the options?

1) the kernel is compiled with the wrong options for the particular architecture and is not making the FP context switches correctly. FP clobbering then would be userland-to-userland. the context switch may be wrong itself, or if lazy FP switching is used (very probable i guess), there could be something wrong with the laziness.

2) the architecture is corrupting data, and the only cure would be disabling architecture optimizations (such as the errata above) or setting workaround flags in the compiler.

so again, this crucial question: besides the kernel and *.ko modules, is there any other code that executes in kernel mode? if not, it looks like instrumenting the ISRs is not very useful.

also, if the ISR is threaded, the corruption would happen in a kernel thread later scheduled by the kernel, and the ISR instrumentation wouldnt see it.