Re: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515]
> i spoted failing execution tests that expected to pass, > it turns out change_cfi_row() needs something like > > - if (!old_row->window_save && new_row->window_save) > + if (old_row->window_save != new_row->window_save) > > to generate .cfi_window_save that correctly tracks the > toggled state on aarch64, but i assume sparc wants > something else, i added Eric to CC he might know what's > right for the old&&!new case on sparc, any help is > welcome, the logic was added in > > commit dfe1fe91dbc7f068bb3efcee40237caacc0c53ae Yes, you cannot really "toggle" a register window on SPARC. > i can imagine adding a new bool flag in dw_cfi_row > for aarch64 or making the logic target specific > (depending on if the target uses REG_CFA_WINDOW_SAVE > or REG_CFA_TOGGLE_RA_MANGLE for cfi_window_save) Yes, please do not hijack again the SPARC logic here. -- Eric Botcazou
Re: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515]
The 04/17/2020 15:26, Jason Merrill wrote: > On 4/17/20 1:55 PM, Szabolcs Nagy wrote: > > The 04/17/2020 12:50, Jason Merrill wrote: > > > On 4/17/20 6:08 AM, Kyrylo Tkachov wrote: > > > > Hi Szabolcs, > > > > > > > > > -Original Message- > > > > > From: Szabolcs Nagy > > > > > Sent: 09 April 2020 15:20 > > > > > To: gcc-patches@gcc.gnu.org > > > > > Cc: Richard Earnshaw ; Richard Sandiford > > > > > ; Kyrylo Tkachov > > > > > Subject: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515] > > > > > > > > > > On aarch64 -mbranch-protection=pac-ret reuses the dwarf > > > > > opcode for window_save to mean "toggle the return address > > > > > mangle state", but in the dwarf2cfi internal logic the > > > > > state was not properly recorded so the remember/restore > > > > > logic was broken. > > > > > > > > > > This can cause the unwinder not to authenticate return > > > > > addresses that were signed (or vice versa) which means > > > > > a runtime crash on a pauth enabled system. > > > > > > > > > > Currently only aarch64 pac-ret uses REG_CFA_TOGGLE_RA_MANGLE. > > > > > > > > I think this is ok, but this code is in the midend so I've CC'ed Jason > > > > who, from what I gather from MAINTAINERS, is maintainer for this file. > > > > Thanks, > > > > Kyrill > > > > > > > > > > > > > > gcc/ChangeLog: > > > > > > > > > > 2020-04-XX Szabolcs Nagy > > > > > > > > > > PR target/94515 > > > > > * dwarf2cfi.c (dwarf2out_frame_debug): Record RA > > > > > mangle state in cur_row->window_save. > > > > > > > > > > gcc/testsuite/ChangeLog: > > > > > > > > > > 2020-04-XX Szabolcs Nagy > > > > > > > > > > PR target/94515 > > > > > * g++.target/aarch64/pr94515.C: New test. > > > > > --- > > > > >gcc/dwarf2cfi.c| 3 ++ > > > > >gcc/testsuite/g++.target/aarch64/pr94515.C | 43 > > > > > ++ > > > > >2 files changed, 46 insertions(+) > > > > >create mode 100644 gcc/testsuite/g++.target/aarch64/pr94515.C > > > > > > > > > > diff --git a/gcc/dwarf2cfi.c b/gcc/dwarf2cfi.c > > > > > index 229fbfacc30..22989a6c2fb 100644 > > > > > --- a/gcc/dwarf2cfi.c > > > > > +++ b/gcc/dwarf2cfi.c > > > > > @@ -2145,6 +2145,9 @@ dwarf2out_frame_debug (rtx_insn *insn) > > > > > case REG_CFA_TOGGLE_RA_MANGLE: > > > > > /* This uses the same DWARF opcode as the next operation. */ > > > > > dwarf2out_frame_debug_cfa_window_save (true); > > > > > + /* Keep track of RA mangle state by toggling the window_save > > > > > bit. > > > > > +This is needed so .cfi_window_save is emitted correctly. */ > > > > > + cur_row->window_save = !cur_row->window_save; > > > > > > It looks like passing 'true' to dwarf2out_frame_debug_cfa_window_save > > > prevents that function from messing with the window_safe flag. Does > > > changing the argument to 'false' get the behavior you want? > > > > we want the state = !state toggling. > > it might make more sense to do that in > > dwarf2out_frame_debug_cfa_window_save(true) > > or to inline that entire logic into the two > > places where it is used (instead of > > dispatching with a bool argument). > > I think that inlining and dropping the parameter would be cleaner. > > > for the bug fix i'd like a minimal change > > (so it can be backported), doing the fix in > > dwarf2out_frame_debug_cfa_window_save > > is fine with me, would you prefer that? > > No, thanks. If you want to commit your patch as is for backporting and then > do the inlining in a separate commit, that works for me. i spoted failing execution tests that expected to pass, it turns out change_cfi_row() needs something like - if (!old_row->window_save && new_row->window_save) + if (old_row->window_save != new_row->window_save) to generate .cfi_window_save that correctly tracks the toggled state on aarch64, but i assume sparc wants something else, i added Eric to CC he might know what's right for the old&&!new case on sparc, any help is welcome, the logic was added in commit dfe1fe91dbc7f068bb3efcee40237caacc0c53ae i can imagine adding a new bool flag in dw_cfi_row for aarch64 or making the logic target specific (depending on if the target uses REG_CFA_WINDOW_SAVE or REG_CFA_TOGGLE_RA_MANGLE for cfi_window_save) i added a test to the bug report that fails with my original patch, but works if change_cfi_row is updated.
Re: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515]
On 4/17/20 1:55 PM, Szabolcs Nagy wrote: The 04/17/2020 12:50, Jason Merrill wrote: On 4/17/20 6:08 AM, Kyrylo Tkachov wrote: Hi Szabolcs, -Original Message- From: Szabolcs Nagy Sent: 09 April 2020 15:20 To: gcc-patches@gcc.gnu.org Cc: Richard Earnshaw ; Richard Sandiford ; Kyrylo Tkachov Subject: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515] On aarch64 -mbranch-protection=pac-ret reuses the dwarf opcode for window_save to mean "toggle the return address mangle state", but in the dwarf2cfi internal logic the state was not properly recorded so the remember/restore logic was broken. This can cause the unwinder not to authenticate return addresses that were signed (or vice versa) which means a runtime crash on a pauth enabled system. Currently only aarch64 pac-ret uses REG_CFA_TOGGLE_RA_MANGLE. I think this is ok, but this code is in the midend so I've CC'ed Jason who, from what I gather from MAINTAINERS, is maintainer for this file. Thanks, Kyrill gcc/ChangeLog: 2020-04-XX Szabolcs Nagy PR target/94515 * dwarf2cfi.c (dwarf2out_frame_debug): Record RA mangle state in cur_row->window_save. gcc/testsuite/ChangeLog: 2020-04-XX Szabolcs Nagy PR target/94515 * g++.target/aarch64/pr94515.C: New test. --- gcc/dwarf2cfi.c| 3 ++ gcc/testsuite/g++.target/aarch64/pr94515.C | 43 ++ 2 files changed, 46 insertions(+) create mode 100644 gcc/testsuite/g++.target/aarch64/pr94515.C diff --git a/gcc/dwarf2cfi.c b/gcc/dwarf2cfi.c index 229fbfacc30..22989a6c2fb 100644 --- a/gcc/dwarf2cfi.c +++ b/gcc/dwarf2cfi.c @@ -2145,6 +2145,9 @@ dwarf2out_frame_debug (rtx_insn *insn) case REG_CFA_TOGGLE_RA_MANGLE: /* This uses the same DWARF opcode as the next operation. */ dwarf2out_frame_debug_cfa_window_save (true); + /* Keep track of RA mangle state by toggling the window_save bit. + This is needed so .cfi_window_save is emitted correctly. */ + cur_row->window_save = !cur_row->window_save; It looks like passing 'true' to dwarf2out_frame_debug_cfa_window_save prevents that function from messing with the window_safe flag. Does changing the argument to 'false' get the behavior you want? we want the state = !state toggling. it might make more sense to do that in dwarf2out_frame_debug_cfa_window_save(true) or to inline that entire logic into the two places where it is used (instead of dispatching with a bool argument). I think that inlining and dropping the parameter would be cleaner. for the bug fix i'd like a minimal change (so it can be backported), doing the fix in dwarf2out_frame_debug_cfa_window_save is fine with me, would you prefer that? No, thanks. If you want to commit your patch as is for backporting and then do the inlining in a separate commit, that works for me. handled_one = true; break; diff --git a/gcc/testsuite/g++.target/aarch64/pr94515.C b/gcc/testsuite/g++.target/aarch64/pr94515.C new file mode 100644 index 000..7707c773a72 --- /dev/null +++ b/gcc/testsuite/g++.target/aarch64/pr94515.C @@ -0,0 +1,43 @@ +/* PR target/94515. Check .cfi_window_save with multiple return paths. */ +/* { dg-do run } */ +/* { dg-additional-options "-O2 -mbranch-protection=pac-ret --save-temps" } */ + +volatile int zero = 0; + +__attribute__((noinline, target("branch-protection=none"))) +void unwind (void) +{ + if (zero == 0) +throw 42; +} + +__attribute__((noinline, noipa, target("branch-protection=pac-ret"))) +int test (int z) +{ + if (z) { +asm volatile ("":::"x20","x21"); +unwind (); +return 1; + } else { +unwind (); +return 2; + } +} + +__attribute__((target("branch-protection=none"))) +int main () +{ + try { +test (zero); +__builtin_abort (); + } catch (...) { +return 0; + } + __builtin_abort (); +} + +/* This check only works if there are two return paths in test and + cfi_window_save is used for both instead of cfi_remember_state + plus cfi_restore_state. This is currently the case with -O2. */ + +/* { dg-final { scan-assembler-times {\t\.cfi_window_save\n} 4 } } */ -- 2.17.1
Re: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515]
The 04/17/2020 12:50, Jason Merrill wrote: > On 4/17/20 6:08 AM, Kyrylo Tkachov wrote: > > Hi Szabolcs, > > > > > -Original Message- > > > From: Szabolcs Nagy > > > Sent: 09 April 2020 15:20 > > > To: gcc-patches@gcc.gnu.org > > > Cc: Richard Earnshaw ; Richard Sandiford > > > ; Kyrylo Tkachov > > > Subject: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515] > > > > > > On aarch64 -mbranch-protection=pac-ret reuses the dwarf > > > opcode for window_save to mean "toggle the return address > > > mangle state", but in the dwarf2cfi internal logic the > > > state was not properly recorded so the remember/restore > > > logic was broken. > > > > > > This can cause the unwinder not to authenticate return > > > addresses that were signed (or vice versa) which means > > > a runtime crash on a pauth enabled system. > > > > > > Currently only aarch64 pac-ret uses REG_CFA_TOGGLE_RA_MANGLE. > > > > I think this is ok, but this code is in the midend so I've CC'ed Jason who, > > from what I gather from MAINTAINERS, is maintainer for this file. > > Thanks, > > Kyrill > > > > > > > > gcc/ChangeLog: > > > > > > 2020-04-XX Szabolcs Nagy > > > > > > PR target/94515 > > > * dwarf2cfi.c (dwarf2out_frame_debug): Record RA > > > mangle state in cur_row->window_save. > > > > > > gcc/testsuite/ChangeLog: > > > > > > 2020-04-XX Szabolcs Nagy > > > > > > PR target/94515 > > > * g++.target/aarch64/pr94515.C: New test. > > > --- > > > gcc/dwarf2cfi.c| 3 ++ > > > gcc/testsuite/g++.target/aarch64/pr94515.C | 43 ++ > > > 2 files changed, 46 insertions(+) > > > create mode 100644 gcc/testsuite/g++.target/aarch64/pr94515.C > > > > > > diff --git a/gcc/dwarf2cfi.c b/gcc/dwarf2cfi.c > > > index 229fbfacc30..22989a6c2fb 100644 > > > --- a/gcc/dwarf2cfi.c > > > +++ b/gcc/dwarf2cfi.c > > > @@ -2145,6 +2145,9 @@ dwarf2out_frame_debug (rtx_insn *insn) > > > case REG_CFA_TOGGLE_RA_MANGLE: > > > /* This uses the same DWARF opcode as the next operation. */ > > > dwarf2out_frame_debug_cfa_window_save (true); > > > + /* Keep track of RA mangle state by toggling the window_save bit. > > > +This is needed so .cfi_window_save is emitted correctly. */ > > > + cur_row->window_save = !cur_row->window_save; > > It looks like passing 'true' to dwarf2out_frame_debug_cfa_window_save > prevents that function from messing with the window_safe flag. Does > changing the argument to 'false' get the behavior you want? we want the state = !state toggling. it might make more sense to do that in dwarf2out_frame_debug_cfa_window_save(true) or to inline that entire logic into the two places where it is used (instead of dispatching with a bool argument). for the bug fix i'd like a minimal change (so it can be backported), doing the fix in dwarf2out_frame_debug_cfa_window_save is fine with me, would you prefer that? > > > > handled_one = true; > > > break; > > > > > > diff --git a/gcc/testsuite/g++.target/aarch64/pr94515.C > > > b/gcc/testsuite/g++.target/aarch64/pr94515.C > > > new file mode 100644 > > > index 000..7707c773a72 > > > --- /dev/null > > > +++ b/gcc/testsuite/g++.target/aarch64/pr94515.C > > > @@ -0,0 +1,43 @@ > > > +/* PR target/94515. Check .cfi_window_save with multiple return paths. > > > */ > > > +/* { dg-do run } */ > > > +/* { dg-additional-options "-O2 -mbranch-protection=pac-ret > > > --save-temps" } > > > */ > > > + > > > +volatile int zero = 0; > > > + > > > +__attribute__((noinline, target("branch-protection=none"))) > > > +void unwind (void) > > > +{ > > > + if (zero == 0) > > > +throw 42; > > > +} > > > + > > > +__attribute__((noinline, noipa, target("branch-protection=pac-ret"))) > > > +int test (int z) > > > +{ > > > + if (z) { > > > +asm volatile ("":::"x20","x21"); > > > +unwind (); > > > +return 1; > > > + } else { > > > +unwind (); > > > +return 2; > > > + } > > > +} > > > + > > > +__attribute__((target("branch-protection=none"))) > > > +int main () > > > +{ > > > + try { > > > +test (zero); > > > +__builtin_abort (); > > > + } catch (...) { > > > +return 0; > > > + } > > > + __builtin_abort (); > > > +} > > > + > > > +/* This check only works if there are two return paths in test and > > > + cfi_window_save is used for both instead of cfi_remember_state > > > + plus cfi_restore_state. This is currently the case with -O2. */ > > > + > > > +/* { dg-final { scan-assembler-times {\t\.cfi_window_save\n} 4 } } */ > > > -- > > > 2.17.1 > > > --
Re: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515]
On 4/17/20 6:08 AM, Kyrylo Tkachov wrote: Hi Szabolcs, -Original Message- From: Szabolcs Nagy Sent: 09 April 2020 15:20 To: gcc-patches@gcc.gnu.org Cc: Richard Earnshaw ; Richard Sandiford ; Kyrylo Tkachov Subject: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515] On aarch64 -mbranch-protection=pac-ret reuses the dwarf opcode for window_save to mean "toggle the return address mangle state", but in the dwarf2cfi internal logic the state was not properly recorded so the remember/restore logic was broken. This can cause the unwinder not to authenticate return addresses that were signed (or vice versa) which means a runtime crash on a pauth enabled system. Currently only aarch64 pac-ret uses REG_CFA_TOGGLE_RA_MANGLE. I think this is ok, but this code is in the midend so I've CC'ed Jason who, from what I gather from MAINTAINERS, is maintainer for this file. Thanks, Kyrill gcc/ChangeLog: 2020-04-XX Szabolcs Nagy PR target/94515 * dwarf2cfi.c (dwarf2out_frame_debug): Record RA mangle state in cur_row->window_save. gcc/testsuite/ChangeLog: 2020-04-XX Szabolcs Nagy PR target/94515 * g++.target/aarch64/pr94515.C: New test. --- gcc/dwarf2cfi.c| 3 ++ gcc/testsuite/g++.target/aarch64/pr94515.C | 43 ++ 2 files changed, 46 insertions(+) create mode 100644 gcc/testsuite/g++.target/aarch64/pr94515.C diff --git a/gcc/dwarf2cfi.c b/gcc/dwarf2cfi.c index 229fbfacc30..22989a6c2fb 100644 --- a/gcc/dwarf2cfi.c +++ b/gcc/dwarf2cfi.c @@ -2145,6 +2145,9 @@ dwarf2out_frame_debug (rtx_insn *insn) case REG_CFA_TOGGLE_RA_MANGLE: /* This uses the same DWARF opcode as the next operation. */ dwarf2out_frame_debug_cfa_window_save (true); + /* Keep track of RA mangle state by toggling the window_save bit. + This is needed so .cfi_window_save is emitted correctly. */ + cur_row->window_save = !cur_row->window_save; It looks like passing 'true' to dwarf2out_frame_debug_cfa_window_save prevents that function from messing with the window_safe flag. Does changing the argument to 'false' get the behavior you want? handled_one = true; break; diff --git a/gcc/testsuite/g++.target/aarch64/pr94515.C b/gcc/testsuite/g++.target/aarch64/pr94515.C new file mode 100644 index 000..7707c773a72 --- /dev/null +++ b/gcc/testsuite/g++.target/aarch64/pr94515.C @@ -0,0 +1,43 @@ +/* PR target/94515. Check .cfi_window_save with multiple return paths. */ +/* { dg-do run } */ +/* { dg-additional-options "-O2 -mbranch-protection=pac-ret --save-temps" } */ + +volatile int zero = 0; + +__attribute__((noinline, target("branch-protection=none"))) +void unwind (void) +{ + if (zero == 0) +throw 42; +} + +__attribute__((noinline, noipa, target("branch-protection=pac-ret"))) +int test (int z) +{ + if (z) { +asm volatile ("":::"x20","x21"); +unwind (); +return 1; + } else { +unwind (); +return 2; + } +} + +__attribute__((target("branch-protection=none"))) +int main () +{ + try { +test (zero); +__builtin_abort (); + } catch (...) { +return 0; + } + __builtin_abort (); +} + +/* This check only works if there are two return paths in test and + cfi_window_save is used for both instead of cfi_remember_state + plus cfi_restore_state. This is currently the case with -O2. */ + +/* { dg-final { scan-assembler-times {\t\.cfi_window_save\n} 4 } } */ -- 2.17.1
RE: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515]
Hi Szabolcs, > -Original Message- > From: Szabolcs Nagy > Sent: 09 April 2020 15:20 > To: gcc-patches@gcc.gnu.org > Cc: Richard Earnshaw ; Richard Sandiford > ; Kyrylo Tkachov > Subject: [PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515] > > On aarch64 -mbranch-protection=pac-ret reuses the dwarf > opcode for window_save to mean "toggle the return address > mangle state", but in the dwarf2cfi internal logic the > state was not properly recorded so the remember/restore > logic was broken. > > This can cause the unwinder not to authenticate return > addresses that were signed (or vice versa) which means > a runtime crash on a pauth enabled system. > > Currently only aarch64 pac-ret uses REG_CFA_TOGGLE_RA_MANGLE. I think this is ok, but this code is in the midend so I've CC'ed Jason who, from what I gather from MAINTAINERS, is maintainer for this file. Thanks, Kyrill > > gcc/ChangeLog: > > 2020-04-XX Szabolcs Nagy > > PR target/94515 > * dwarf2cfi.c (dwarf2out_frame_debug): Record RA > mangle state in cur_row->window_save. > > gcc/testsuite/ChangeLog: > > 2020-04-XX Szabolcs Nagy > > PR target/94515 > * g++.target/aarch64/pr94515.C: New test. > --- > gcc/dwarf2cfi.c| 3 ++ > gcc/testsuite/g++.target/aarch64/pr94515.C | 43 ++ > 2 files changed, 46 insertions(+) > create mode 100644 gcc/testsuite/g++.target/aarch64/pr94515.C > > diff --git a/gcc/dwarf2cfi.c b/gcc/dwarf2cfi.c > index 229fbfacc30..22989a6c2fb 100644 > --- a/gcc/dwarf2cfi.c > +++ b/gcc/dwarf2cfi.c > @@ -2145,6 +2145,9 @@ dwarf2out_frame_debug (rtx_insn *insn) >case REG_CFA_TOGGLE_RA_MANGLE: > /* This uses the same DWARF opcode as the next operation. */ > dwarf2out_frame_debug_cfa_window_save (true); > + /* Keep track of RA mangle state by toggling the window_save bit. > +This is needed so .cfi_window_save is emitted correctly. */ > + cur_row->window_save = !cur_row->window_save; > handled_one = true; > break; > > diff --git a/gcc/testsuite/g++.target/aarch64/pr94515.C > b/gcc/testsuite/g++.target/aarch64/pr94515.C > new file mode 100644 > index 000..7707c773a72 > --- /dev/null > +++ b/gcc/testsuite/g++.target/aarch64/pr94515.C > @@ -0,0 +1,43 @@ > +/* PR target/94515. Check .cfi_window_save with multiple return paths. */ > +/* { dg-do run } */ > +/* { dg-additional-options "-O2 -mbranch-protection=pac-ret --save-temps" } > */ > + > +volatile int zero = 0; > + > +__attribute__((noinline, target("branch-protection=none"))) > +void unwind (void) > +{ > + if (zero == 0) > +throw 42; > +} > + > +__attribute__((noinline, noipa, target("branch-protection=pac-ret"))) > +int test (int z) > +{ > + if (z) { > +asm volatile ("":::"x20","x21"); > +unwind (); > +return 1; > + } else { > +unwind (); > +return 2; > + } > +} > + > +__attribute__((target("branch-protection=none"))) > +int main () > +{ > + try { > +test (zero); > +__builtin_abort (); > + } catch (...) { > +return 0; > + } > + __builtin_abort (); > +} > + > +/* This check only works if there are two return paths in test and > + cfi_window_save is used for both instead of cfi_remember_state > + plus cfi_restore_state. This is currently the case with -O2. */ > + > +/* { dg-final { scan-assembler-times {\t\.cfi_window_save\n} 4 } } */ > -- > 2.17.1
[PATCH] aarch64: Fix .cfi_window_save with pac-ret [PR94515]
On aarch64 -mbranch-protection=pac-ret reuses the dwarf opcode for window_save to mean "toggle the return address mangle state", but in the dwarf2cfi internal logic the state was not properly recorded so the remember/restore logic was broken. This can cause the unwinder not to authenticate return addresses that were signed (or vice versa) which means a runtime crash on a pauth enabled system. Currently only aarch64 pac-ret uses REG_CFA_TOGGLE_RA_MANGLE. gcc/ChangeLog: 2020-04-XX Szabolcs Nagy PR target/94515 * dwarf2cfi.c (dwarf2out_frame_debug): Record RA mangle state in cur_row->window_save. gcc/testsuite/ChangeLog: 2020-04-XX Szabolcs Nagy PR target/94515 * g++.target/aarch64/pr94515.C: New test. --- gcc/dwarf2cfi.c| 3 ++ gcc/testsuite/g++.target/aarch64/pr94515.C | 43 ++ 2 files changed, 46 insertions(+) create mode 100644 gcc/testsuite/g++.target/aarch64/pr94515.C diff --git a/gcc/dwarf2cfi.c b/gcc/dwarf2cfi.c index 229fbfacc30..22989a6c2fb 100644 --- a/gcc/dwarf2cfi.c +++ b/gcc/dwarf2cfi.c @@ -2145,6 +2145,9 @@ dwarf2out_frame_debug (rtx_insn *insn) case REG_CFA_TOGGLE_RA_MANGLE: /* This uses the same DWARF opcode as the next operation. */ dwarf2out_frame_debug_cfa_window_save (true); + /* Keep track of RA mangle state by toggling the window_save bit. + This is needed so .cfi_window_save is emitted correctly. */ + cur_row->window_save = !cur_row->window_save; handled_one = true; break; diff --git a/gcc/testsuite/g++.target/aarch64/pr94515.C b/gcc/testsuite/g++.target/aarch64/pr94515.C new file mode 100644 index 000..7707c773a72 --- /dev/null +++ b/gcc/testsuite/g++.target/aarch64/pr94515.C @@ -0,0 +1,43 @@ +/* PR target/94515. Check .cfi_window_save with multiple return paths. */ +/* { dg-do run } */ +/* { dg-additional-options "-O2 -mbranch-protection=pac-ret --save-temps" } */ + +volatile int zero = 0; + +__attribute__((noinline, target("branch-protection=none"))) +void unwind (void) +{ + if (zero == 0) +throw 42; +} + +__attribute__((noinline, noipa, target("branch-protection=pac-ret"))) +int test (int z) +{ + if (z) { +asm volatile ("":::"x20","x21"); +unwind (); +return 1; + } else { +unwind (); +return 2; + } +} + +__attribute__((target("branch-protection=none"))) +int main () +{ + try { +test (zero); +__builtin_abort (); + } catch (...) { +return 0; + } + __builtin_abort (); +} + +/* This check only works if there are two return paths in test and + cfi_window_save is used for both instead of cfi_remember_state + plus cfi_restore_state. This is currently the case with -O2. */ + +/* { dg-final { scan-assembler-times {\t\.cfi_window_save\n} 4 } } */ -- 2.17.1