On Wed, Sep 23, 2026 at 8:45 AM Hongtao Liu <[email protected]> wrote:
>
> On Tue Sep 22, 2026 at 3:07 AM PDT, Uros Bizjak wrote:
> > On Tue, Sep 22, 2026 at 11:34 AM <[email protected]> wrote:
> >>
> >> From: Kyrylo Tkachov <[email protected]>
> >>
> >> Different switch tables can reach the same case block. The CET pass
> >> inserts an ENDBR for each table, although the destination needs only one.
> >> This also affects dispatches that share a table.
> >>
> >> Reuse an existing ENDBR after the destination label. The x86 table-sharing
> >> hook remains disabled.
> >>
> >> The regression test has two ordinary tables with eight common destinations.
> >> It emits 17 ENDBR instructions before the fix and 9 after it, in both
> >> 32-bit and 64-bit code. Both outputs assemble. A 64-bit runtime check
> >> passes on x86_64.
> >>
> >> This patch was written by an AI agent as I'm not familiar enough with
> >> the x86 internals and can't vouch for it. But if the x86 maintainers
> >> want it I'm happy to push it.
> >>
> >> Assisted-by: OpenAI Codex 5.6 Sol
> >>
> >> gcc/ChangeLog:
> >>
> >> * config/i386/i386-features.cc
> >> (rest_of_insert_endbr_and_patchable_area): Reuse an existing
> >> ENDBR at a switch destination.
> >>
> >> gcc/testsuite/ChangeLog:
> >>
> >> * gcc.target/i386/cet-switch-4.c: New test.
> >>
> >> Cc: Uros Bizjak <[email protected]>
> >> Signed-off-by: Kyrylo Tkachov <[email protected]>
> >> ---
> >> gcc/config/i386/i386-features.cc | 4 ++
> >> gcc/testsuite/gcc.target/i386/cet-switch-4.c | 56 ++++++++++++++++++++
> >> 2 files changed, 60 insertions(+)
> >> create mode 100644 gcc/testsuite/gcc.target/i386/cet-switch-4.c
> >>
> >> diff --git a/gcc/config/i386/i386-features.cc
> >> b/gcc/config/i386/i386-features.cc
> >> index 1d26aa0c336..7c992eadf3c 100644
> >> --- a/gcc/config/i386/i386-features.cc
> >> +++ b/gcc/config/i386/i386-features.cc
> >> @@ -3274,6 +3274,10 @@ rest_of_insert_endbr_and_patchable_area (bool
> >> need_endbr,
> >> dest_blk = e->dest;
> >> insn = BB_HEAD (dest_blk);
> >> gcc_assert (LABEL_P (insn));
> >> + rtx_insn *next = next_nonnote_nondebug_insn (insn);
> >> + if (next && INSN_P (next)
> >> + && recog_memoized (next) == CODE_FOR_nop_endbr)
> >
> > The condition should read:
> >
> > if (next && NONJUMP_INSN_P (next)
> NONDEBUG_INSN_P (next)?
next is found with:
rtx_insn *next = next_nonnote_nondebug_insn (insn);
so we are sure we are dealing with nondebug insn.
Uros.
>
> > && GET_CODE (PATTERN (next)) == UNSPEC_VOLATILE
> > && XINT (PATTERN (next), 1) == UNSPECV_NOP_ENDBR)
> >
> > IMO, this should prevent duplicate ENDBR insns during any reorg. CC
> > Hongtao and HJ.
> Yes, it's a nice optimization.
>
> >
> > Uros.
> >
> >> + continue;
> >> endbr = gen_nop_endbr ();
> >> emit_insn_after (endbr, insn);
> >> }
> >> diff --git a/gcc/testsuite/gcc.target/i386/cet-switch-4.c
> >> b/gcc/testsuite/gcc.target/i386/cet-switch-4.c
> >> new file mode 100644
> >> index 00000000000..53cb960f0d5
> >> --- /dev/null
> >> +++ b/gcc/testsuite/gcc.target/i386/cet-switch-4.c
> >> @@ -0,0 +1,56 @@
> >> +/* PR middle-end/126236 */
> >> +/* { dg-do compile } */
> >> +/* { dg-options "-O2 -fcf-protection=branch -mcet-switch -fno-pie
> >> -fno-pic" } */
> >> +/* { dg-final { scan-assembler-times "endbr32" 9 { target ia32 } } } */
> >> +/* { dg-final { scan-assembler-times "endbr64" 9 { target { ! ia32 } } }
> >> } */
> >> +/* { dg-final { scan-assembler-times "\[ \t]+jmp\[ \t]+\[*]" 2 } } */
> >> +
> >> +/* Both tables reach the same eight destinations. */
> >> +
> >> +void f0 (void);
> >> +void f1 (void);
> >> +void f2 (void);
> >> +void f3 (void);
> >> +void f4 (void);
> >> +void f5 (void);
> >> +void f6 (void);
> >> +void f7 (void);
> >> +
> >> +void
> >> +foo (unsigned x, int which)
> >> +{
> >> + if (which)
> >> + switch (x)
> >> + {
> >> + case 0: goto a;
> >> + case 1: goto b;
> >> + case 2: goto c;
> >> + case 3: goto d;
> >> + case 4: goto e;
> >> + case 5: goto f;
> >> + case 6: goto g;
> >> + case 7: goto h;
> >> + default: return;
> >> + }
> >> + else
> >> + switch (x)
> >> + {
> >> + case 0: goto h;
> >> + case 1: goto g;
> >> + case 2: goto f;
> >> + case 3: goto e;
> >> + case 4: goto d;
> >> + case 5: goto c;
> >> + case 6: goto b;
> >> + case 7: goto a;
> >> + default: return;
> >> + }
> >> +a: f0 (); return;
> >> +b: f1 (); return;
> >> +c: f2 (); return;
> >> +d: f3 (); return;
> >> +e: f4 (); return;
> >> +f: f5 (); return;
> >> +g: f6 (); return;
> >> +h: f7 (); return;
> >> +}
> >> --
> >> 2.50.1 (Apple Git-155)
> >>
>
