Bug 96828

Summary: Wrong code generated with -fstack-protector and -msingle-pic-base
Product: gcc Reporter: Ilya Oleinik <abatur45en>
Component: targetAssignee: Not yet assigned to anyone <unassigned>
Status: UNCONFIRMED ---    
Severity: normal Keywords: fixed-but-no-testcase, wrong-code
Priority: P3    
Version: 10.1.1   
Target Milestone: ---   
See Also: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85434
Host: Target: arm-eabi
Build: Known to work: 8.3.1
Known to fail: 10.1.1, 9.2.1 Last reconfirmed:
Attachments: test case
patch

Description Ilya Oleinik 2020-08-28 03:13:44 UTC
Created attachment 49143 [details]
test case

$ arm-none-eabi-gcc -v
Using built-in specs.
COLLECT_GCC=./gcc/gcc-arm-none-eabi-10-2020-q2-preview/bin/arm-none-eabi-gcc
COLLECT_LTO_WRAPPER=/mnt/c/Users/Ilya/Desktop/bug/gcc/gcc-arm-none-eabi-10-2020-q2-preview/bin/../lib/gcc/arm-none-eabi/10.1.1/lto-wrapper
Target: arm-none-eabi
Configured with: /mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/src/gcc/configure --target=arm-none-eabi --prefix=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native --libexecdir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/lib --infodir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/share/doc/gcc-arm-none-eabi/info --mandir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/share/doc/gcc-arm-none-eabi/man --htmldir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/share/doc/gcc-arm-none-eabi/html --pdfdir=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/share/doc/gcc-arm-none-eabi/pdf --enable-languages=c,c++ --enable-plugins --disable-decimal-float --disable-libffi --disable-libgomp --disable-libmudflap --disable-libquadmath --disable-libssp --disable-libstdcxx-pch --disable-nls --disable-shared --disable-threads --disable-tls --with-gnu-as --with-gnu-ld --with-newlib --with-headers=yes --with-python-dir=share/gcc-arm-none-eabi --with-sysroot=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/install-native/arm-none-eabi --build=x86_64-linux-gnu --host=x86_64-linux-gnu --with-gmp=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/build-native/host-libs/usr --with-mpfr=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/build-native/host-libs/usr --with-mpc=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/build-native/host-libs/usr --with-isl=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/build-native/host-libs/usr --with-libelf=/mnt/workspace/workspace/GCC-10-pipeline/jenkins-GCC-10-pipeline-13_20200625_1593044217/build-native/host-libs/usr --with-host-libstdcxx='-static-libgcc -Wl,-Bstatic,-lstdc++,-Bdynamic -lm' --with-pkgversion='GNU Arm Embedded Toolchain 10-2020-q2-preview' --with-multilib-list=rmprofile,aprofile
Thread model: single
Supported LTO compression algorithms: zlib
gcc version 10.1.1 20200529 (release) (GNU Arm Embedded Toolchain 10-2020-q2-preview)

Compilation of the test case with options "arm-none-eabi-gcc -c bug.c -fstack-protector -fpie -mno-pic-data-is-text-relative -msingle-pic-base", uses wrong register for GOT access when storing and loading stack canary (variable access included to demonstrate correct behavior):

        push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	ldr	r3, .L4
        @ r2 is used instead of r9
	ldr	r3, [r2, r3]  
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3, #0
	ldr	r3, .L4+4
        @ correct behavior, r9 is used as base
	ldr	r3, [r9, r3]
	ldr	r3, [r3]
	ldr	r2, .L4
        @ r1 is used instead of r9
	ldr	r2, [r1, r2]
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	beq	.L3
	bl	__stack_chk_fail(PLT)
.L3:
	mov	r0, r3
	sub	sp, fp, #4
	pop	{fp, lr}
	bx	lr
Comment 1 Ilya Oleinik 2020-10-02 04:17:14 UTC
Created attachment 49296 [details]
patch
Comment 2 Ilya Oleinik 2020-10-02 04:23:24 UTC
Seems like PR85434 caused this issue.
This patch fixes it, however i'm not sure if mov instruction insertion is the right way of fixing armv6m inability to do a load from hiregs.