[RFC] PR64703, glibc sysdeps/powerpc/powerpc64/dl-machine.h miscompile
Richard Biener
richard.guenther@gmail.com
Thu Jan 29 16:31:00 GMT 2015
On Thu, Jan 29, 2015 at 4:05 PM, Richard Biener
<richard.guenther@gmail.com> wrote:
> On Thu, Jan 29, 2015 at 3:14 PM, Alan Modra <amodra@gmail.com> wrote:
>> Here is the completed patch. Bootstrapped and regression tested
>> powerpc64-linux. Is this OK to apply? If not now, then when gcc is
>> in stage1 again?
>
> It's ok to apply as it is a wrong-code fix. It would also be ok to backport
> if needed.
>
> Did you check whether other targets have function descriptors (seem
> to remember the Itanic here at least)?
>
> The middle-end changes are ok, I defer to David for the rs6000 changes.
>
> I am also curious of the .029t.ealias dump from
>
> gcc -O -fdump-tree-ealias-details-alias
>
> on (the nonsensical)
>
> void x(void);
> int y;
> int main()
> {
> void *p = x;
> p+=y;
> return *(int *)p;
> }
Just checked myself with the host gcc 4.8 on gcc111. It looks like
function descriptors are not exposed in GIMPLE:
void * p;
sizetype y.1;
int y.0;
int _6;
<bb 2>:
y.0_3 = y;
y.1_4 = (sizetype) y.0_3;
# PT =
p_5 = x + y.1_4;
_6 = MEM[(int *)p_5];
return _6;
thus when the function address-taking happens in the same function
as the call there will be no aliasing as it points to nothing (points-to
doesn't track function decls). And if it's flowing in from the outside
you get "all globals".
This means that you still will be able to create a testcase that is
miscompiled with exposing the address-taking to points-to analysis.
And it means that indirect calls to const functions are severely
pessimized (not that it matters?) as they effectively become pure calls.
Richard.
> Thanks,
> Richard.
>
>> gcc/
>> PR target/64703
>> * target.def (has_function_descriptors): New hook.
>> * doc/tm.texi.in: Add TARGET_HAS_FUNCTION_DESCRIPTORS.
>> * doc/tc.texi: Regenerate.
>> * tree-ssa-alias.c (pt_solution_includes_base): New function,
>> extracted from..
>> (ref_maybe_used_by_call_p_1): ..here. Handle potential memory
>> reference by indirect calls on targets using function descriptors.
>> * config/rs6000/rs6000.c (TARGET_HAS_FUNCTION_DESCRIPTORS): Define.
>> (rs6000_has_function_descriptors): New function.
>> gcc/testsuite/
>> * gcc.target/powerpc/pr64703.c: New.
>>
>> Index: gcc/target.def
>> ===================================================================
>> --- gcc/target.def (revision 220025)
>> +++ gcc/target.def (working copy)
>> @@ -2821,6 +2821,15 @@ The default value of this hook is based on target'
>> bool, (void),
>> default_has_ifunc_p)
>>
>> +/* True if target defines the address of a function as that of a
>> + function descriptor. */
>> +DEFHOOK
>> +(has_function_descriptors,
>> + "True if target has function descriptors and defines the address\n\
>> +of a function as that of a function descriptor.",
>> + bool, (void),
>> + hook_bool_void_false)
>> +
>> /* True if it is OK to do sibling call optimization for the specified
>> call expression EXP. DECL will be the called function, or NULL if
>> this is an indirect call. */
>> Index: gcc/doc/tm.texi.in
>> ===================================================================
>> --- gcc/doc/tm.texi.in (revision 220025)
>> +++ gcc/doc/tm.texi.in (working copy)
>> @@ -8175,6 +8175,8 @@ and the associated definitions of those functions.
>>
>> @hook TARGET_HAS_IFUNC_P
>>
>> +@hook TARGET_HAS_FUNCTION_DESCRIPTORS
>> +
>> @hook TARGET_ATOMIC_ALIGN_FOR_MODE
>>
>> @hook TARGET_ATOMIC_ASSIGN_EXPAND_FENV
>> Index: gcc/doc/tm.texi
>> ===================================================================
>> --- gcc/doc/tm.texi (revision 220025)
>> +++ gcc/doc/tm.texi (working copy)
>> @@ -11510,6 +11510,11 @@ The support includes the assembler, linker and dyn
>> The default value of this hook is based on target's libc.
>> @end deftypefn
>>
>> +@deftypefn {Target Hook} bool TARGET_HAS_FUNCTION_DESCRIPTORS (void)
>> +True if target has function descriptors and defines the address
>> +of a function as that of a function descriptor.
>> +@end deftypefn
>> +
>> @deftypefn {Target Hook} {unsigned int} TARGET_ATOMIC_ALIGN_FOR_MODE (machine_mode @var{mode})
>> If defined, this function returns an appropriate alignment in bits for an atomic object of machine_mode @var{mode}. If 0 is returned then the default alignment for the specified mode is used.
>> @end deftypefn
>> Index: gcc/tree-ssa-alias.c
>> ===================================================================
>> --- gcc/tree-ssa-alias.c (revision 220025)
>> +++ gcc/tree-ssa-alias.c (working copy)
>> @@ -1532,6 +1532,25 @@ refs_output_dependent_p (tree store1, tree store2)
>> return refs_may_alias_p_1 (&r1, &r2, false);
>> }
>>
>> +/* Return true if the points-to solution *PT includes the object BASE. */
>> +
>> +static bool
>> +pt_solution_includes_base (struct pt_solution *pt, tree base)
>> +{
>> + if (DECL_P (base))
>> + return pt_solution_includes (pt, base);
>> +
>> + if ((TREE_CODE (base) == MEM_REF
>> + || TREE_CODE (base) == TARGET_MEM_REF)
>> + && TREE_CODE (TREE_OPERAND (base, 0)) == SSA_NAME)
>> + {
>> + struct ptr_info_def *pi = SSA_NAME_PTR_INFO (TREE_OPERAND (base, 0));
>> + if (pi)
>> + return pt_solutions_intersect (pt, &pi->pt);
>> + }
>> + return true;
>> +}
>> +
>> /* If the call CALL may use the memory reference REF return true,
>> otherwise return false. */
>>
>> @@ -1542,6 +1561,22 @@ ref_maybe_used_by_call_p_1 (gcall *call, ao_ref *r
>> unsigned i;
>> int flags = gimple_call_flags (call);
>>
>> + callee = gimple_call_fn (call);
>> + if (callee && TREE_CODE (callee) == SSA_NAME
>> + && targetm.has_function_descriptors ())
>> + {
>> + /* Handle indirect call. When a target defines the address of a
>> + function as that of a function descriptor, then dereferencing
>> + a function pointer implicitly references memory. */
>> + struct ptr_info_def *pi = SSA_NAME_PTR_INFO (callee);
>> + if (pi)
>> + {
>> + base = ao_ref_base (ref);
>> + if (pt_solution_includes_base (&pi->pt, base))
>> + return true;
>> + }
>> + }
>> +
>> /* Const functions without a static chain do not implicitly use memory. */
>> if (!gimple_call_chain (call)
>> && (flags & (ECF_CONST|ECF_NOVOPS)))
>> @@ -1564,7 +1599,7 @@ ref_maybe_used_by_call_p_1 (gcall *call, ao_ref *r
>> && !is_global_var (base))
>> goto process_args;
>>
>> - callee = gimple_call_fndecl (call);
>> + callee = gimple_call_addr_fndecl (callee);
>>
>> /* Handle those builtin functions explicitly that do not act as
>> escape points. See tree-ssa-structalias.c:find_func_aliases
>> @@ -1803,23 +1838,7 @@ ref_maybe_used_by_call_p_1 (gcall *call, ao_ref *r
>> }
>>
>> /* Check if the base variable is call-used. */
>> - if (DECL_P (base))
>> - {
>> - if (pt_solution_includes (gimple_call_use_set (call), base))
>> - return true;
>> - }
>> - else if ((TREE_CODE (base) == MEM_REF
>> - || TREE_CODE (base) == TARGET_MEM_REF)
>> - && TREE_CODE (TREE_OPERAND (base, 0)) == SSA_NAME)
>> - {
>> - struct ptr_info_def *pi = SSA_NAME_PTR_INFO (TREE_OPERAND (base, 0));
>> - if (!pi)
>> - return true;
>> -
>> - if (pt_solutions_intersect (gimple_call_use_set (call), &pi->pt))
>> - return true;
>> - }
>> - else
>> + if (pt_solution_includes_base (gimple_call_use_set (call), base))
>> return true;
>>
>> /* Inspect call arguments for passed-by-value aliases. */
>> Index: gcc/config/rs6000/rs6000.c
>> ===================================================================
>> --- gcc/config/rs6000/rs6000.c (revision 220025)
>> +++ gcc/config/rs6000/rs6000.c (working copy)
>> @@ -1490,6 +1490,9 @@ static const struct attribute_spec rs6000_attribut
>> #undef TARGET_ASM_CAN_OUTPUT_MI_THUNK
>> #define TARGET_ASM_CAN_OUTPUT_MI_THUNK hook_bool_const_tree_hwi_hwi_const_tree_true
>>
>> +#undef TARGET_HAS_FUNCTION_DESCRIPTORS
>> +#define TARGET_HAS_FUNCTION_DESCRIPTORS rs6000_has_function_descriptors
>> +
>> #undef TARGET_FUNCTION_OK_FOR_SIBCALL
>> #define TARGET_FUNCTION_OK_FOR_SIBCALL rs6000_function_ok_for_sibcall
>>
>> @@ -22099,6 +22102,14 @@ rs6000_return_addr (int count, rtx frame)
>> return get_hard_reg_initial_val (Pmode, LR_REGNO);
>> }
>>
>> +/* Return true if we use function descriptors. */
>> +
>> +static bool
>> +rs6000_has_function_descriptors (void)
>> +{
>> + return DEFAULT_ABI == ABI_AIX;
>> +}
>> +
>> /* Say whether a function is a candidate for sibcall handling or not. */
>>
>> static bool
>> Index: gcc/testsuite/gcc.target/powerpc/pr64703.c
>> ===================================================================
>> --- gcc/testsuite/gcc.target/powerpc/pr64703.c (revision 0)
>> +++ gcc/testsuite/gcc.target/powerpc/pr64703.c (working copy)
>> @@ -0,0 +1,36 @@
>> +/* { dg-do compile { target { powerpc*-*-* && lp64 } } } */
>> +/* { dg-skip-if "" { powerpc*-*-darwin* } { "*" } { "" } } */
>> +/* { dg-options "-O2 -mabi=elfv1" } */
>> +/* { dg-final { scan-assembler "std .\*,112\\(1\\)" } } */
>> +/* { dg-final { scan-assembler "std .\*,120\\(1\\)" } } */
>> +/* { dg-final { scan-assembler "std .\*,128\\(1\\)" } } */
>> +/* { dg-final { scan-assembler "addi .\*,1,112" } } */
>> +
>> +/* Testcase taken from glibc, powerpc64 dl-machine.h. */
>> +
>> +typedef struct {
>> + unsigned long fd_func;
>> + unsigned long fd_toc;
>> + unsigned long fd_aux;
>> +} Elf64_FuncDesc;
>> +
>> +extern unsigned long dl_hwcap;
>> +
>> +unsigned long
>> +resolve_ifunc (unsigned long value, unsigned long adjust)
>> +{
>> + Elf64_FuncDesc opd;
>> +
>> + if (adjust)
>> + {
>> + Elf64_FuncDesc *func = (Elf64_FuncDesc *) value;
>> + opd.fd_func = func->fd_func + adjust;
>> + opd.fd_toc = func->fd_toc + adjust;
>> + opd.fd_aux = func->fd_aux;
>> + value = (unsigned long) &opd;
>> + }
>> +#if 0
>> + __asm__ ("#%0" : : "r" (value));
>> +#endif
>> + return ((unsigned long (*) (unsigned long)) value) (dl_hwcap);
>> +}
>>
>> --
>> Alan Modra
>> Australia Development Lab, IBM
More information about the Gcc-patches
mailing list