[Bug rtl-optimization/60947] New: [4.9 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[Bug rtl-optimization/60947] New: [4.9 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[yufan8.chen at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

            Bug ID: 60947
           Summary: [4.9 Regression] Unable to handle kernel paging
                    request (linux kernel 2.6.28.9) with gcc 4.9 release
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: yufan8.chen at gmail dot com
            Target: arm-none-linux-gnueabi

Created attachment 32670
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32670&action=edit
kernel oops message

When running linux kernel (2.6.28.9) compiled by gcc 4.9.0, I got "unable to
handle kernel paging request" on snd_pcm_hw_constraints_init().

Then I tried to debug it and found that:

int snd_pcm_hw_constraints_init(struct snd_pcm_substream *substream)
{
        struct snd_pcm_runtime *runtime = substream->runtime;
        struct snd_pcm_hw_constraints *constrs = &runtime->hw_constraints;
        int k, err;

        for (k = SNDRV_PCM_HW_PARAM_FIRST_MASK; k
<=SNDRV_PCM_HW_PARAM_LAST_MASK; k++) {
             //printk("1234567\n");                      
             snd_mask_any(constrs_mask(constrs, k));
        }

        ...
}

When I added a "printk()" statement in the for loop, the kernel could work
correctly, otherwise it couldn't.

The gcc command:
arm-linux-gcc -Wp,-MD,sound/core/.pcm_native.o.d  -nostdinc -isystem
/opt/Mozart3_Toolchain/arm-eabi-uclibc/usr/lib/gcc/arm-buildroot-linux-uclibcgnueabi/4.9.0/include
-D__KERNEL__ -Iinclude 
-I/home/blackjack/MyGit/CEO_Project/mozart_kernel/arch/arm/include -include
include/linux/autoconf.h -mlittle-endian -Iarch/arm/mach-mozart/include -Wall
-Wundef -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common
-Werror-implicit-function-declaration -Os -marm -fno-omit-frame-pointer -mapcs
-mno-sched-prolog -mabi=aapcs-linux -mno-thumb-interwork -D__LINUX_ARM_ARCH__=5
-march=armv5te -mtune=arm9tdmi -msoft-float -Uarm -Wframe-larger-than=0
-fno-stack-protector -fno-omit-frame-pointer -fno-optimize-sibling-calls
-Wdeclaration-after-statement -Wno-pointer-sign -fwrapv  -D"KBUILD_STR(s)=#s"
-D"KBUILD_BASENAME=KBUILD_STR(pcm_native)" 
-D"KBUILD_MODNAME=KBUILD_STR(snd_pcm)"  -c -o sound/core/pcm_native.o
sound/core/pcm_native.c

[Bug rtl-optimization/60947] [4.9 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[yufan8.chen at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #1 from YuFan <yufan8.chen at gmail dot com> ---
Created attachment 32671
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32671&action=edit
kernel source code

[Bug rtl-optimization/60947] [4.9 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[yufan8.chen at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #2 from YuFan <yufan8.chen at gmail dot com> ---
Created attachment 32672
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32672&action=edit
the assembly code of originial pcm_native.c

[Bug rtl-optimization/60947] [4.9 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[yufan8.chen at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #3 from YuFan <yufan8.chen at gmail dot com> ---
Created attachment 32673
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32673&action=edit
the assembly code of modifying  pcm_native.c with printk()

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.9.0
            Summary|[4.9 Regression] Unable to  |[4.9/4.10 Regression]
                   |handle kernel paging        |Unable to handle kernel
                   |request (linux kernel       |paging request (linux
                   |2.6.28.9) with gcc 4.9      |kernel 2.6.28.9) with gcc
                   |release                     |4.9 release

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Could there be an out of bounds access in that loop?  Can you try adding
-fno-vrp?

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[yufan8.chen at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #5 from YuFan <yufan8.chen at gmail dot com> ---
(In reply to Andrew Pinski from comment #4)
> Could there be an out of bounds access in that loop?

I traced the code, and the following code is equal to the original one with
replacing inline functions. In C code, there would be no possibility to get an
out of bounds access.

#SNDRV_PCM_HW_PARAM_FIRST_MASK 0
#SNDRV_PCM_HW_PARAM_LAST_MASK 2
for (k = SNDRV_PCM_HW_PARAM_FIRST_MASK; k <= SNDRV_PCM_HW_PARAM_LAST_MASK; k++)
{
    memset(&constrs->masks[k - SNDRV_PCM_HW_PARAM_FIRST_MASK], 0xff,
SNDRV_MASK_SIZE * sizeof(u_int32_t)); 

}

> Can you try adding -fno-vrp?
I supposed you mean -fno-tree-vrp. I tried it but still has the same issue.

The following assembly code snippet is the same as the original one without
-fno-tree-vrp  

===============================================
snd_pcm_hw_constraints_init:
    @ args = 0, pretend = 0, frame = 0
    @ frame_needed = 1, uses_anonymous_args = 0
    mov    ip, sp
    stmfd    sp!, {r4, r5, r6, r7, r8, r9, r10, fp, ip, lr, pc}
    sub    fp, ip, #4
    sub    sp, sp, #20
    ldr    r8, [r0, #112]
    add    r3, r8, #232
    add    r4, r8, #328
.L1062:
    mov    r0, r3
    mov    r1, #255
    mov    r2, #8
    bl    memset
    add    r3, r0, #32
    cmp    r3, r4
    bne    .L1062
    mov    r3, #0
    mov    r2, r8
    mov    r5, r3
    mov    r4, #12
    mvn    lr, #0
===============================================

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
   Last reconfirmed|                            |2014-04-24
     Ever confirmed|0                           |1

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Please provide preprocessed source of pcm_native.c

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[yufan8.chen at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #7 from YuFan <yufan8.chen at gmail dot com> ---
(In reply to Richard Biener from comment #6)
> Please provide preprocessed source of pcm_native.c

Hi, Please check the attachment: "kernel source code".

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[trippels at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

Markus Trippelsdorf <trippels at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |trippels at gcc dot gnu.org

--- Comment #8 from Markus Trippelsdorf <trippels at gcc dot gnu.org> ---
(In reply to YuFan from comment #7)
> (In reply to Richard Biener from comment #6)
> > Please provide preprocessed source of pcm_native.c
> 
> Hi, Please check the attachment: "kernel source code".

Your attachment is not enough. You can generate a preprocessed source
by adding --save-temps to the gcc invocation. And then please attach the
pcm_native.i file here.

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[yufan8.chen at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #9 from YuFan <yufan8.chen at gmail dot com> ---
Created attachment 32674
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=32674&action=edit
pcm_native.i

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |UNCONFIRMED
     Ever confirmed|1                           |0

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[yufan8.chen at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #10 from YuFan <yufan8.chen at gmail dot com> ---
After more tests, I figure out the issue is caused by the commit:

SVN revision:
r206552 | amker | 2014-01-11 17:33:39 +0800 (六, 11  1月 2014) | 7 lines


        * tree-ssa-loop-ivopts.c (iv_ca_narrow): New parameter.
        Start narrowing with START.  Apply candidate-use pair
        and check overall cost in narrowing.
        (iv_ca_prune): Pass new argument.
>From gcc-bugs-return-450039-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Apr 28 09:36:27 2014
Return-Path: <gcc-bugs-return-450039-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 16910 invoked by alias); 28 Apr 2014 09:36:27 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 16870 invoked by uid 48); 28 Apr 2014 09:36:23 -0000
From: "rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/60978] -Wenum-compare warns too eagerly
Date: Mon, 28 Apr 2014 09:36:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: unknown
X-Bugzilla-Keywords: diagnostic
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenth at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: keywords bug_status cf_reconfirmed_on short_desc everconfirmed cf_known_to_fail
Message-ID: <bug-60978-4-iAVsnJJ3BE@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-60978-4@http.gcc.gnu.org/bugzilla/>
References: <bug-60978-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-04/txt/msg02059.txt.bz2
Content-length: 825

http://gcc.gnu.org/bugzilla/show_bug.cgi?id`978

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |diagnostic
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-04-28
            Summary|[4.9 Regression]            |-Wenum-compare warns too
                   |-Wenum-compare warns too    |eagerly
                   |eagerly                     |
     Ever confirmed|0                           |1
      Known to fail|                            |4.3.6

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Warns since forever (checked up to GCC 4.3.x), confirmed.

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[yufan8.chen at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #11 from YuFan <yufan8.chen at gmail dot com> ---
any update?
Do I need to provide other information?

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[amker at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #12 from amker at gcc dot gnu.org ---
Emm, sorry it slipped away somehow.  I will look into it.

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[amker at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #13 from amker at gcc dot gnu.org ---
OK, I compared generated assembly before/after revision 206552.
BEFORE)
    @ frame_needed = 1, uses_anonymous_args = 0
    mov    ip, sp
    stmfd    sp!, {r4, r5, r6, r7, r8, r9, r10, fp, ip, lr, pc}
    sub    fp, ip, #4
    sub    sp, sp, #20
    mov    r4, #0
    ldr    r8, [r0, #112]
.L1064:
    add    r0, r4, #232
    add    r0, r8, r0
    mov    r1, #255
    mov    r2, #8
    add    r4, r4, #32
    bl    memset
    cmp    r4, #96
    bne    .L1064

AFTER)
    @ frame_needed = 1, uses_anonymous_args = 0
    mov    ip, sp
    stmfd    sp!, {r4, r5, r6, r7, r8, r9, r10, fp, ip, lr, pc}
    sub    fp, ip, #4
    sub    sp, sp, #20
    ldr    r8, [r0, #112]
    add    r3, r8, #232
    add    r4, r8, #328
.L1064:
    mov    r0, r3
    mov    r1, #255
    mov    r2, #8
    bl    memset
    add    r3, r0, #32   <---X
    cmp    r3, r4
    bne    .L1064

The only possibility I can see is GCC now uses r3 as the induction variable,
which is a scratch register according to arm acps.  Problem is according to
posix standard:
#include <string.h>

void *memset(void *s, int c, size_t n);

RETURN VALUE:
The memset() function shall return s; no return value is reserved to indicate
an error.

So r0 returned in INSN X should be set r3 back to right value.

This can be confirmed by rtl dumps before/after reload:
BEFORE reload)
   24: NOTE_INSN_BASIC_BLOCK 2
    2: NOTE_INSN_DELETED
    3: NOTE_INSN_FUNCTION_BEG
   26: r114:SI=[r0:SI+0x70]
      REG_DEAD r0:SI
   27: r165:SI=r114:SI+0xe8
   28: r162:SI=r114:SI+0x148
   32: L32:
   33: NOTE_INSN_BASIC_BLOCK 3
   34: r0:SI=r165:SI
  684: r1:SI=0xff
  685: r2:SI=0x8
   37: r0:SI=call [`memset'] argc:0
      REG_RETURNED r165:SI
      REG_DEAD r2:SI
      REG_DEAD r1:SI
      REG_UNUSED r0:SI
      REG_EH_REGION 0
   38: r165:SI=r165:SI+0x20
   40: cc:CC=cmp(r165:SI,r162:SI)
   41: pc={(cc:CC!=0)?L32:pc}
      REG_DEAD cc:CC
      REG_BR_PROB 6667

AFTER reload)
   24: NOTE_INSN_BASIC_BLOCK 2
    2: NOTE_INSN_DELETED
    3: NOTE_INSN_FUNCTION_BEG
   26: r8:SI=[r0:SI+0x70]
   27: r3:SI=r8:SI+0xe8
   28: r4:SI=r8:SI+0x148
   32: L32:
   33: NOTE_INSN_BASIC_BLOCK 3
   34: r0:SI=r3:SI
  684: r1:SI=0xff
  685: r2:SI=0x8
   37: r0:SI=call [`memset'] argc:0
      REG_RETURNED r3:SI
      REG_EH_REGION 0
  755: r3:SI=r0:SI            <--------restore r3 from r0
   38: r3:SI=r3:SI+0x20
   40: cc:CC=cmp(r3:SI,r4:SI)
   41: pc={(cc:CC!=0)?L32:pc}
      REG_BR_PROB 6667


So here I really don't know why this program can fail.

As far as ivopt is concerned, the dumps of ivopt are like:
BEFORE patch)
  sizetype ivtmp.551;

  <bb 2>:
  runtime_9 = substream_8(D)->runtime;
  goto <bb 4>;

  <bb 3>:

  <bb 4>:
  # ivtmp.551_154 = PHI <ivtmp.551_150(3), 0(2)>
  _13 = ivtmp.551_154 + 232;
  _1 = runtime_9 + _13;
  _59 = _1;
  memset (_59, 255, 8);
  ivtmp.551_150 = ivtmp.551_154 + 32;
  if (ivtmp.551_150 != 96)
    goto <bb 3>;
  else
    goto <bb 48>;

AFTER patch)
  unsigned int ivtmp.550;

  <bb 2>:
  runtime_9 = substream_8(D)->runtime;
  _1 = runtime_9 + 232;
  ivtmp.550_13 = (unsigned int) _1;
  _143 = runtime_9 + 328;
  _142 = (unsigned int) _143;
  goto <bb 4>;

  <bb 3>:

  <bb 4>:
  # ivtmp.550_154 = PHI <ivtmp.550_150(3), ivtmp.550_13(2)>
  _59 = (struct snd_mask *) ivtmp.550_154;
  memset (_59, 255, 8);
  ivtmp.550_150 = ivtmp.550_154 + 32;
  if (ivtmp.550_150 != _142)
    goto <bb 3>;
  else
    goto <bb 48>;

The transformation looks fine to me, right?

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[amker at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #14 from amker at gcc dot gnu.org ---
Created attachment 33001
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33001&action=edit
Dump of cunroll/ivopt/ira/reload passes after revision 206552 for the
preprocessed file.

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[amker at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #15 from amker at gcc dot gnu.org ---
Well, only thing suspicious that I can see, the memset function is a special
implementation and not from C standard library.  Basically it doesn't need to
follow the standard, which means the return value could be something else other
than the passed in pointer.  Though I doubt it would actually break the
standard.

So YuFan, could you help look into implementation of memset to see if it acts
as expected?

Thanks.

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[amker at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #17 from amker at gcc dot gnu.org ---
(In reply to Mikael Pettersson from comment #16)
> (In reply to amker from comment #15)
> > Well, only thing suspicious that I can see, the memset function is a special
> > implementation and not from C standard library.  Basically it doesn't need
> > to follow the standard, which means the return value could be something else
> > other than the passed in pointer.  Though I doubt it would actually break
> > the standard.
> > 
> > So YuFan, could you help look into implementation of memset to see if it
> > acts as expected?
> > 
> > Thanks.
> 
> I recall seeing reports of the Linux/ARM kernel being miscompiled by gcc-4.8
> (or so) a while ago, and it was traced to an in-kernel memset() (or related
> mem/str-function) implementation not following the same return value
> convention as the normal user-space version.  The problem is that newer
> gcc:s optimize some mem/str-functions based on those return value
> conventions, so things broke.  The 2.6.28 kernel is ancient, so it's not at
> all surprising it won't work when compiled by non-ancient gcc:s.

Ah, I checked the architecture implementation of memset on ARM in 2.6.28
kernel, seems to me it does operate on r0/arg1 directly and return the modified
register.  This means it does violate the standard.

Hi YuFan, It seems to me GCC works fine, you may need to confirm the finding
here and patch the implementation of memset.

Thanks.

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[amker at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

amker at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #18 from amker at gcc dot gnu.org ---
Mark it as invalid.

[Bug rtl-optimization/60947] [4.9/4.10 Regression] Unable to handle kernel paging request (linux kernel 2.6.28.9) with gcc 4.9 release

[yufan8.chen at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60947

--- Comment #19 from YuFan <yufan8.chen at gmail dot com> ---

After patching the memset.S, it works correctly.
Thanks a lot.