From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by sourceware.org (Postfix) with ESMTPS id F055A3944803 for ; Fri, 23 Apr 2021 22:24:14 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org F055A3944803 Received: from pps.filterd (m0098409.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 13NM4JS4089859; Fri, 23 Apr 2021 18:24:13 -0400 Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 3841bv0j0v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 23 Apr 2021 18:24:13 -0400 Received: from m0098409.ppops.net (m0098409.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 13NM4i9V090629; Fri, 23 Apr 2021 18:24:13 -0400 Received: from ppma04dal.us.ibm.com (7a.29.35a9.ip4.static.sl-reverse.com [169.53.41.122]) by mx0a-001b2d01.pphosted.com with ESMTP id 3841bv0j0m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 23 Apr 2021 18:24:13 -0400 Received: from pps.filterd (ppma04dal.us.ibm.com [127.0.0.1]) by ppma04dal.us.ibm.com (8.16.0.43/8.16.0.43) with SMTP id 13NMMp56024447; Fri, 23 Apr 2021 22:24:12 GMT Received: from b03cxnp08027.gho.boulder.ibm.com (b03cxnp08027.gho.boulder.ibm.com [9.17.130.19]) by ppma04dal.us.ibm.com with ESMTP id 37yqaart5e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 23 Apr 2021 22:24:12 +0000 Received: from b03ledav004.gho.boulder.ibm.com (b03ledav004.gho.boulder.ibm.com [9.17.130.235]) by b03cxnp08027.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 13NMOBi655771676 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 23 Apr 2021 22:24:11 GMT Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id EFCAC78060; Fri, 23 Apr 2021 22:24:10 +0000 (GMT) Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 10EA578063; Fri, 23 Apr 2021 22:24:09 +0000 (GMT) Received: from ibm-toto.the-meissners.org (unknown [9.160.105.177]) by b03ledav004.gho.boulder.ibm.com (Postfix) with ESMTPS; Fri, 23 Apr 2021 22:24:09 +0000 (GMT) Date: Fri, 23 Apr 2021 18:24:07 -0400 From: Michael Meissner To: Segher Boessenkool Cc: Michael Meissner , gcc-patches@gcc.gnu.org, David Edelsohn , Bill Schmidt , Peter Bergner , Will Schmidt Subject: Re: [PATCH] Fix logic error in 32-bit trampolines, PR target/98952 Message-ID: <20210423222407.GA15741@ibm-toto.the-meissners.org> Mail-Followup-To: Michael Meissner , Segher Boessenkool , gcc-patches@gcc.gnu.org, David Edelsohn , Bill Schmidt , Peter Bergner , Will Schmidt References: <20210409210907.GA5325@ibm-toto.the-meissners.org> <20210422225632.GH27473@gate.crashing.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="RnlQjJ0d97Da+TV1" Content-Disposition: inline In-Reply-To: <20210422225632.GH27473@gate.crashing.org> User-Agent: Mutt/1.5.21 (2010-09-15) X-TM-AS-GCONF: 00 X-Proofpoint-GUID: xGlGg5VH-hjlZ1CYTeYH6lQTVqfP4xJO X-Proofpoint-ORIG-GUID: xHkpMn3HkHskvG1IWq8fvQ1j1tgS0CNL X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.761 definitions=2021-04-23_13:2021-04-23, 2021-04-23 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 malwarescore=0 adultscore=0 bulkscore=0 suspectscore=0 mlxlogscore=999 impostorscore=0 mlxscore=0 lowpriorityscore=0 spamscore=0 priorityscore=1501 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104060000 definitions=main-2104230147 X-Spam-Status: No, score=-10.9 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_EF, GIT_PATCH_0, KAM_NUMSUBJECT, RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Apr 2021 22:24:16 -0000 --RnlQjJ0d97Da+TV1 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Thu, Apr 22, 2021 at 05:56:32PM -0500, Segher Boessenkool wrote: > On Fri, Apr 09, 2021 at 05:09:07PM -0400, Michael Meissner wrote: > > Fix logic error in 32-bit trampolines, PR target/98952. > > > > The test in the PowerPC 32-bit trampoline support is backwards. It aborts > > if the trampoline size is greater than the expected size. It should abort > > when the trampoline size is less than the expected size. > > > PR target/98952 > > * config/rs6000/tramp.S (__trampoline_setup): Fix trampoline size > > comparison in 32-bit. > > > --- a/libgcc/config/rs6000/tramp.S > > +++ b/libgcc/config/rs6000/tramp.S > > @@ -64,8 +64,7 @@ FUNC_START(__trampoline_setup) > > mflr r11 > > addi r7,r11,trampoline_initial-4-.LCF0 /* trampoline address -4 */ > > > > - li r8,trampoline_size /* verify that the trampoline is big enough */ > > - cmpw cr1,r8,r4 > > + cmpwi cr1,r4,trampoline_size /* verify that the trampoline is big enough */ > > srwi r4,r4,2 /* # words to move */ > > addi r9,r3,-4 /* adjust pointer for lwzu */ > > mtctr r4 > > As Will says, it looks like the ELFv2 version has the same bug. Please > fix that the same way. Yes it has the same bug. However in practice it would never be hit, since this bug is 32-bit, and we only build 64-bit systems with ELF v2. I did fix it. > In the commit message and the changelog, point out that you folded the > cmp with the li while you were at it. It is easier to read code like > this so the change is fine, but do point it out. > > Can you test this in a testcase somehow? That would have found the > ELFv2 case, for example. I created a test case calling __trampoline_setup with a larger buffer. If it doesn't abort the test passes. > Okay for trunk. Okay for backport to 11 when that branch opens again. > Does this need more backports? (Those should follow after 11 of > course). Bill mentioned we may want to backport this to earlier branches before they are frozen. Tulio, are backports to earlier revisions important? I will attach the patch that I just commited. -- Michael Meissner, IBM IBM, M/S 2506R, 550 King Street, Littleton, MA 01460-6245, USA email: meissner@linux.ibm.com, phone: +1 (978) 899-4797 --RnlQjJ0d97Da+TV1 Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="pr98952.patch001b" >From 9a30a3f06b908e4e781324c2e813cd1db87119df Mon Sep 17 00:00:00 2001 From: Michael Meissner Date: Fri, 23 Apr 2021 18:16:03 -0400 Subject: [PATCH] Fix logic error in 32-bit trampolines. The test in the PowerPC 32-bit trampoline support is backwards. It aborts if the trampoline size is greater than the expected size. It should abort when the trampoline size is less than the expected size. I fixed the test so the operands are reversed. I then folded the load immediate into the compare instruction. I verified this by creating a 32-bit trampoline program and manually changing the size of the trampoline to be 48 instead of 40. The program aborted with the larger size. I updated this code and ran the test again and it passed. I added a test case that runs on PowerPC 32-bit Linux systems and it calls the __trampoline_setup function with a larger buffer size than the compiler uses. The test is not run on 64-bit systems, since the function __trampoline_setup is not called. I also limited the test to just Linux systems, in case trampolines are handled differently in other systems. libgcc/ 2021-04-23 Michael Meissner PR target/98952 * config/rs6000/tramp.S (__trampoline_setup, elfv1 #ifdef): Fix trampoline size comparison in 32-bit by reversing test and combining load immediate with compare. (__trampoline_setup, elfv2 #ifdef): Fix trampoline size comparison in 32-bit by reversing test and combining load immediate with compare. gcc/testsuite/ 2021-04-23 Michael Meissner PR target/98952 * gcc.target/powerpc/pr98952.c: New test. --- gcc/testsuite/gcc.target/powerpc/pr98952.c | 28 ++++++++++++++++++++++ libgcc/config/rs6000/tramp.S | 6 ++--- 2 files changed, 30 insertions(+), 4 deletions(-) create mode 100644 gcc/testsuite/gcc.target/powerpc/pr98952.c diff --git a/gcc/testsuite/gcc.target/powerpc/pr98952.c b/gcc/testsuite/gcc.target/powerpc/pr98952.c new file mode 100644 index 00000000000..c487fbc403e --- /dev/null +++ b/gcc/testsuite/gcc.target/powerpc/pr98952.c @@ -0,0 +1,28 @@ +/* { dg-do run { target { powerpc*-*-linux* && ilp32 } } } */ +/* { dg-options "-O2" } */ + +/* PR 96983 reported that the test in libgcc's tramp.S was backwards and it + would abort if the trampoline size passed to the function was greater than + the size the runtime was expecting (40). It should abort if the size is less + than 40, not greater than 40. This test creates a call to __trampoline_setup + with a much larger buffer to make sure the function does not abort. + + We do not run this test on 64-bit since __trampoline_setup is not present in + 64-bit systems. + + We only run the test under Linux in case the other systems have some + different variant for __trampoline_setup. */ + +#ifndef SIZE +#define SIZE 100 +#endif + +extern void __trampoline_setup (int *, unsigned, void *, void *); + +int main (void) +{ + int tramp[SIZE / sizeof (int)]; + + __trampoline_setup (tramp, SIZE, 0, 0); + return 0; +} diff --git a/libgcc/config/rs6000/tramp.S b/libgcc/config/rs6000/tramp.S index 4236a82b402..68baf16de9f 100644 --- a/libgcc/config/rs6000/tramp.S +++ b/libgcc/config/rs6000/tramp.S @@ -64,8 +64,7 @@ FUNC_START(__trampoline_setup) mflr r11 addi r7,r11,trampoline_initial-4-.LCF0 /* trampoline address -4 */ - li r8,trampoline_size /* verify that the trampoline is big enough */ - cmpw cr1,r8,r4 + cmpwi cr1,r4,trampoline_size /* verify that the trampoline is big enough */ srwi r4,r4,2 /* # words to move */ addi r9,r3,-4 /* adjust pointer for lwzu */ mtctr r4 @@ -156,8 +155,7 @@ FUNC_START(__trampoline_setup) ld 7,.LC0@toc@l(7) /* trampoline address -8 */ #endif - li r8,trampoline_size /* verify that the trampoline is big enough */ - cmpw cr1,r8,r4 + cmpwi cr1,r4,trampoline_size /* verify that the trampoline is big enough */ srwi r4,r4,3 /* # doublewords to move */ addi r9,r3,-8 /* adjust pointer for stdu */ mtctr r4 -- 2.22.0 --RnlQjJ0d97Da+TV1--