[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[Alexandre Oliva]

https://gcc.gnu.org/g:12d0b287d4ae77cd70604451214965a0f03fd9ca

commit 12d0b287d4ae77cd70604451214965a0f03fd9ca
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Wed Oct 19 20:36:28 2022 -0300

    hardcfr: prevent deferred sets of visited bitmap
    
    Force bitmap sets to hit memory, preventing deferral and likely
    combinations.
    
    
    for  gcc/ChangeLog
    
            * gimple-harden-control-flow.cc (rt_bb_visited::vset): Prevent
            deferral of bitmap sets.

Diff:
---
 gcc/gimple-harden-control-flow.cc | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 1ea47615cd4..862cdd45eaf 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,19 @@ class rt_bb_visited
     gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
     gimple_seq_add_stmt (&seq, vstore);
 
+    /* Prevent stores into visited from being deferred, without
+       forcing subsequent bitsets to reload the word.  */
+    vec<tree, va_gc> *inputs = NULL;
+    vec<tree, va_gc> *outputs = NULL;
+    vec_safe_push (inputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (1, "m")),
+		    visited));
+    gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+					    NULL, NULL);
+    gimple_seq_add_stmt (&seq, stabilize);
+
     return seq;
   }

[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[Alexandre Oliva]

https://gcc.gnu.org/g:0e2a8d05cd6f6103e9d9746d6a3e61f84030d299

commit 0e2a8d05cd6f6103e9d9746d6a3e61f84030d299
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Thu Jun 8 01:35:23 2023 -0300

    hardcfr: prevent deferred sets of visited bitmap
    
    Make bitmap sets volatile-ish, preventing deferral and likely
    combinations.
    
    
    for  gcc/ChangeLog
    
            * gimple-harden-control-flow.cc
            (rt_bb_visited::rt_bb_visited): Move optimization barrier...
            (rt_bb_visited::vset): ... here.

Diff:
---
 gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 18 deletions(-)

diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
     gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
     gimple_seq_add_stmt (&seq, vstore);
 
+    /* Prevent stores into visited from being deferred, forcing
+       subsequent bitsets to reload the word rather than reusing
+       values already in register.  The purpose is threefold: make the
+       bitset get to memory in this block, so that control flow
+       attacks in functions called in this block don't easily bypass
+       the bitset; prevent the bitset word from being retained in a
+       register across blocks, which could, in an attack scenario,
+       make a later block set more than one bit; and prevent hoisting
+       or sinking loads or stores of bitset words out of loops or even
+       throughout functions, which could significantly weaken the
+       verification.  This is equivalent to making the bitsetting
+       volatile within the function body, but without changing its
+       type; making the bitset volatile would make inline checking far
+       less optimizable for no reason.  */
+    vec<tree, va_gc> *inputs = NULL;
+    vec<tree, va_gc> *outputs = NULL;
+    vec_safe_push (outputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (2, "=m")),
+		    visited));
+    vec_safe_push (inputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (1, "m")),
+		    visited));
+    gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+					    NULL, NULL);
+    gimple_seq_add_stmt (&seq, stabilize);
+
     return seq;
   }
 
@@ -615,24 +645,6 @@ public:
     tree visited_type = vtype ();
     visited = create_tmp_var (visited_type, ".cfrvisited");
 
-    /* Prevent stores into visited from being used to optimize the
-       control flow redundancy checks. asm ("" : "+m" (visited)); */
-    vec<tree, va_gc> *inputs = NULL;
-    vec<tree, va_gc> *outputs = NULL;
-    vec_safe_push (outputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (2, "=m")),
-		    visited));
-    vec_safe_push (inputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (1, "m")),
-		    visited));
-    gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
-					 NULL, NULL);
-    gimple_seq_add_stmt (&ckseq, detach);
-
     if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
 	|| checkpoints > 1)
       {

[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[Alexandre Oliva]

https://gcc.gnu.org/g:7dd60c2f0a42a9664baabcde0b345b3a6f94f46f

commit 7dd60c2f0a42a9664baabcde0b345b3a6f94f46f
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Thu Jun 8 01:35:23 2023 -0300

    hardcfr: prevent deferred sets of visited bitmap
    
    Make bitmap sets volatile-ish, preventing deferral and likely
    combinations.
    
    
    for  gcc/ChangeLog
    
            * gimple-harden-control-flow.cc
            (rt_bb_visited::rt_bb_visited): Move optimization barrier...
            (rt_bb_visited::vset): ... here.

Diff:
---
 gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 18 deletions(-)

diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
     gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
     gimple_seq_add_stmt (&seq, vstore);
 
+    /* Prevent stores into visited from being deferred, forcing
+       subsequent bitsets to reload the word rather than reusing
+       values already in register.  The purpose is threefold: make the
+       bitset get to memory in this block, so that control flow
+       attacks in functions called in this block don't easily bypass
+       the bitset; prevent the bitset word from being retained in a
+       register across blocks, which could, in an attack scenario,
+       make a later block set more than one bit; and prevent hoisting
+       or sinking loads or stores of bitset words out of loops or even
+       throughout functions, which could significantly weaken the
+       verification.  This is equivalent to making the bitsetting
+       volatile within the function body, but without changing its
+       type; making the bitset volatile would make inline checking far
+       less optimizable for no reason.  */
+    vec<tree, va_gc> *inputs = NULL;
+    vec<tree, va_gc> *outputs = NULL;
+    vec_safe_push (outputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (2, "=m")),
+		    visited));
+    vec_safe_push (inputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (1, "m")),
+		    visited));
+    gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+					    NULL, NULL);
+    gimple_seq_add_stmt (&seq, stabilize);
+
     return seq;
   }
 
@@ -615,24 +645,6 @@ public:
     tree visited_type = vtype ();
     visited = create_tmp_var (visited_type, ".cfrvisited");
 
-    /* Prevent stores into visited from being used to optimize the
-       control flow redundancy checks. asm ("" : "+m" (visited)); */
-    vec<tree, va_gc> *inputs = NULL;
-    vec<tree, va_gc> *outputs = NULL;
-    vec_safe_push (outputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (2, "=m")),
-		    visited));
-    vec_safe_push (inputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (1, "m")),
-		    visited));
-    gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
-					 NULL, NULL);
-    gimple_seq_add_stmt (&ckseq, detach);
-
     if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
 	|| checkpoints > 1)
       {

[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[Alexandre Oliva]

https://gcc.gnu.org/g:f5057562f04b9ddc866223539ff8421ab5090ae8

commit f5057562f04b9ddc866223539ff8421ab5090ae8
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Wed Oct 19 20:36:28 2022 -0300

    hardcfr: prevent deferred sets of visited bitmap
    
    Make bitmap sets volatile-ish, preventing deferral and likely
    combinations.
    
    
    for  gcc/ChangeLog
    
            * gimple-harden-control-flow.cc
            (rt_bb_visited::rt_bb_visited): Move optimization barrier...
            (rt_bb_visited::vset): ... here.

Diff:
---
 gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 18 deletions(-)

diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
     gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
     gimple_seq_add_stmt (&seq, vstore);
 
+    /* Prevent stores into visited from being deferred, forcing
+       subsequent bitsets to reload the word rather than reusing
+       values already in register.  The purpose is threefold: make the
+       bitset get to memory in this block, so that control flow
+       attacks in functions called in this block don't easily bypass
+       the bitset; prevent the bitset word from being retained in a
+       register across blocks, which could, in an attack scenario,
+       make a later block set more than one bit; and prevent hoisting
+       or sinking loads or stores of bitset words out of loops or even
+       throughout functions, which could significantly weaken the
+       verification.  This is equivalent to making the bitsetting
+       volatile within the function body, but without changing its
+       type; making the bitset volatile would make inline checking far
+       less optimizable for no reason.  */
+    vec<tree, va_gc> *inputs = NULL;
+    vec<tree, va_gc> *outputs = NULL;
+    vec_safe_push (outputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (2, "=m")),
+		    visited));
+    vec_safe_push (inputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (1, "m")),
+		    visited));
+    gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+					    NULL, NULL);
+    gimple_seq_add_stmt (&seq, stabilize);
+
     return seq;
   }
 
@@ -615,24 +645,6 @@ public:
     tree visited_type = vtype ();
     visited = create_tmp_var (visited_type, ".cfrvisited");
 
-    /* Prevent stores into visited from being used to optimize the
-       control flow redundancy checks. asm ("" : "+m" (visited)); */
-    vec<tree, va_gc> *inputs = NULL;
-    vec<tree, va_gc> *outputs = NULL;
-    vec_safe_push (outputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (2, "=m")),
-		    visited));
-    vec_safe_push (inputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (1, "m")),
-		    visited));
-    gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
-					 NULL, NULL);
-    gimple_seq_add_stmt (&ckseq, detach);
-
     if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
 	|| checkpoints > 1)
       {

[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[Alexandre Oliva]

https://gcc.gnu.org/g:97a39ca4fd4ccf1dd825bb3c7c6c36f312572dfa

commit 97a39ca4fd4ccf1dd825bb3c7c6c36f312572dfa
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Thu Jun 8 01:35:23 2023 -0300

    hardcfr: prevent deferred sets of visited bitmap
    
    Make bitmap sets volatile-ish, preventing deferral and likely
    combinations.
    
    
    for  gcc/ChangeLog
    
            * gimple-harden-control-flow.cc
            (rt_bb_visited::rt_bb_visited): Move optimization barrier...
            (rt_bb_visited::vset): ... here.

Diff:
---
 gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 18 deletions(-)

diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
     gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
     gimple_seq_add_stmt (&seq, vstore);
 
+    /* Prevent stores into visited from being deferred, forcing
+       subsequent bitsets to reload the word rather than reusing
+       values already in register.  The purpose is threefold: make the
+       bitset get to memory in this block, so that control flow
+       attacks in functions called in this block don't easily bypass
+       the bitset; prevent the bitset word from being retained in a
+       register across blocks, which could, in an attack scenario,
+       make a later block set more than one bit; and prevent hoisting
+       or sinking loads or stores of bitset words out of loops or even
+       throughout functions, which could significantly weaken the
+       verification.  This is equivalent to making the bitsetting
+       volatile within the function body, but without changing its
+       type; making the bitset volatile would make inline checking far
+       less optimizable for no reason.  */
+    vec<tree, va_gc> *inputs = NULL;
+    vec<tree, va_gc> *outputs = NULL;
+    vec_safe_push (outputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (2, "=m")),
+		    visited));
+    vec_safe_push (inputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (1, "m")),
+		    visited));
+    gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+					    NULL, NULL);
+    gimple_seq_add_stmt (&seq, stabilize);
+
     return seq;
   }
 
@@ -615,24 +645,6 @@ public:
     tree visited_type = vtype ();
     visited = create_tmp_var (visited_type, ".cfrvisited");
 
-    /* Prevent stores into visited from being used to optimize the
-       control flow redundancy checks. asm ("" : "+m" (visited)); */
-    vec<tree, va_gc> *inputs = NULL;
-    vec<tree, va_gc> *outputs = NULL;
-    vec_safe_push (outputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (2, "=m")),
-		    visited));
-    vec_safe_push (inputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (1, "m")),
-		    visited));
-    gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
-					 NULL, NULL);
-    gimple_seq_add_stmt (&ckseq, detach);
-
     if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
 	|| checkpoints > 1)
       {

[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[Alexandre Oliva]

https://gcc.gnu.org/g:f5057562f04b9ddc866223539ff8421ab5090ae8

commit f5057562f04b9ddc866223539ff8421ab5090ae8
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Wed Oct 19 20:36:28 2022 -0300

    hardcfr: prevent deferred sets of visited bitmap
    
    Make bitmap sets volatile-ish, preventing deferral and likely
    combinations.
    
    
    for  gcc/ChangeLog
    
            * gimple-harden-control-flow.cc
            (rt_bb_visited::rt_bb_visited): Move optimization barrier...
            (rt_bb_visited::vset): ... here.

Diff:
---
 gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 18 deletions(-)

diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
     gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
     gimple_seq_add_stmt (&seq, vstore);
 
+    /* Prevent stores into visited from being deferred, forcing
+       subsequent bitsets to reload the word rather than reusing
+       values already in register.  The purpose is threefold: make the
+       bitset get to memory in this block, so that control flow
+       attacks in functions called in this block don't easily bypass
+       the bitset; prevent the bitset word from being retained in a
+       register across blocks, which could, in an attack scenario,
+       make a later block set more than one bit; and prevent hoisting
+       or sinking loads or stores of bitset words out of loops or even
+       throughout functions, which could significantly weaken the
+       verification.  This is equivalent to making the bitsetting
+       volatile within the function body, but without changing its
+       type; making the bitset volatile would make inline checking far
+       less optimizable for no reason.  */
+    vec<tree, va_gc> *inputs = NULL;
+    vec<tree, va_gc> *outputs = NULL;
+    vec_safe_push (outputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (2, "=m")),
+		    visited));
+    vec_safe_push (inputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (1, "m")),
+		    visited));
+    gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+					    NULL, NULL);
+    gimple_seq_add_stmt (&seq, stabilize);
+
     return seq;
   }
 
@@ -615,24 +645,6 @@ public:
     tree visited_type = vtype ();
     visited = create_tmp_var (visited_type, ".cfrvisited");
 
-    /* Prevent stores into visited from being used to optimize the
-       control flow redundancy checks. asm ("" : "+m" (visited)); */
-    vec<tree, va_gc> *inputs = NULL;
-    vec<tree, va_gc> *outputs = NULL;
-    vec_safe_push (outputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (2, "=m")),
-		    visited));
-    vec_safe_push (inputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (1, "m")),
-		    visited));
-    gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
-					 NULL, NULL);
-    gimple_seq_add_stmt (&ckseq, detach);
-
     if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
 	|| checkpoints > 1)
       {

[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[Alexandre Oliva]

https://gcc.gnu.org/g:a273f6e55352f2596c98e0c3d96a106fe21561c9

commit a273f6e55352f2596c98e0c3d96a106fe21561c9
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Wed Oct 19 20:36:28 2022 -0300

    hardcfr: prevent deferred sets of visited bitmap
    
    Make bitmap sets volatile-ish, preventing deferral and likely
    combinations.
    
    
    for  gcc/ChangeLog
    
            * gimple-harden-control-flow.cc
            (rt_bb_visited::rt_bb_visited): Move optimization barrier...
            (rt_bb_visited::vset): ... here.

Diff:
---
 gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 18 deletions(-)

diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
     gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
     gimple_seq_add_stmt (&seq, vstore);
 
+    /* Prevent stores into visited from being deferred, forcing
+       subsequent bitsets to reload the word rather than reusing
+       values already in register.  The purpose is threefold: make the
+       bitset get to memory in this block, so that control flow
+       attacks in functions called in this block don't easily bypass
+       the bitset; prevent the bitset word from being retained in a
+       register across blocks, which could, in an attack scenario,
+       make a later block set more than one bit; and prevent hoisting
+       or sinking loads or stores of bitset words out of loops or even
+       throughout functions, which could significantly weaken the
+       verification.  This is equivalent to making the bitsetting
+       volatile within the function body, but without changing its
+       type; making the bitset volatile would make inline checking far
+       less optimizable for no reason.  */
+    vec<tree, va_gc> *inputs = NULL;
+    vec<tree, va_gc> *outputs = NULL;
+    vec_safe_push (outputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (2, "=m")),
+		    visited));
+    vec_safe_push (inputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (1, "m")),
+		    visited));
+    gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+					    NULL, NULL);
+    gimple_seq_add_stmt (&seq, stabilize);
+
     return seq;
   }
 
@@ -615,24 +645,6 @@ public:
     tree visited_type = vtype ();
     visited = create_tmp_var (visited_type, ".cfrvisited");
 
-    /* Prevent stores into visited from being used to optimize the
-       control flow redundancy checks. asm ("" : "+m" (visited)); */
-    vec<tree, va_gc> *inputs = NULL;
-    vec<tree, va_gc> *outputs = NULL;
-    vec_safe_push (outputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (2, "=m")),
-		    visited));
-    vec_safe_push (inputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (1, "m")),
-		    visited));
-    gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
-					 NULL, NULL);
-    gimple_seq_add_stmt (&ckseq, detach);
-
     if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
 	|| checkpoints > 1)
       {

[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[Alexandre Oliva]

https://gcc.gnu.org/g:c51983438a9d360306c7c8849c2df4ade82707d4

commit c51983438a9d360306c7c8849c2df4ade82707d4
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Wed Oct 19 20:36:28 2022 -0300

    hardcfr: prevent deferred sets of visited bitmap
    
    Make bitmap sets volatile-ish, preventing deferral and likely
    combinations.
    
    
    for  gcc/ChangeLog
    
            * gimple-harden-control-flow.cc
            (rt_bb_visited::rt_bb_visited): Move optimization barrier...
            (rt_bb_visited::vset): ... here.

Diff:
---
 gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 18 deletions(-)

diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
     gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
     gimple_seq_add_stmt (&seq, vstore);
 
+    /* Prevent stores into visited from being deferred, forcing
+       subsequent bitsets to reload the word rather than reusing
+       values already in register.  The purpose is threefold: make the
+       bitset get to memory in this block, so that control flow
+       attacks in functions called in this block don't easily bypass
+       the bitset; prevent the bitset word from being retained in a
+       register across blocks, which could, in an attack scenario,
+       make a later block set more than one bit; and prevent hoisting
+       or sinking loads or stores of bitset words out of loops or even
+       throughout functions, which could significantly weaken the
+       verification.  This is equivalent to making the bitsetting
+       volatile within the function body, but without changing its
+       type; making the bitset volatile would make inline checking far
+       less optimizable for no reason.  */
+    vec<tree, va_gc> *inputs = NULL;
+    vec<tree, va_gc> *outputs = NULL;
+    vec_safe_push (outputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (2, "=m")),
+		    visited));
+    vec_safe_push (inputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (1, "m")),
+		    visited));
+    gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+					    NULL, NULL);
+    gimple_seq_add_stmt (&seq, stabilize);
+
     return seq;
   }
 
@@ -615,24 +645,6 @@ public:
     tree visited_type = vtype ();
     visited = create_tmp_var (visited_type, ".cfrvisited");
 
-    /* Prevent stores into visited from being used to optimize the
-       control flow redundancy checks. asm ("" : "+m" (visited)); */
-    vec<tree, va_gc> *inputs = NULL;
-    vec<tree, va_gc> *outputs = NULL;
-    vec_safe_push (outputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (2, "=m")),
-		    visited));
-    vec_safe_push (inputs,
-		   build_tree_list
-		   (build_tree_list
-		    (NULL_TREE, build_string (1, "m")),
-		    visited));
-    gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
-					 NULL, NULL);
-    gimple_seq_add_stmt (&ckseq, detach);
-
     if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
 	|| checkpoints > 1)
       {

[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[Alexandre Oliva]

https://gcc.gnu.org/g:bacbf8a89d79238228344cbe41444b565ec4979c

commit bacbf8a89d79238228344cbe41444b565ec4979c
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Wed Oct 19 20:36:28 2022 -0300

    hardcfr: prevent deferred sets of visited bitmap

Diff:
---
 gcc/gimple-harden-control-flow.cc | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 1ea47615cd4..4d40fc98779 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,26 @@ class rt_bb_visited
     gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
     gimple_seq_add_stmt (&seq, vstore);
 
+    /* Prevent stores into visited from being deferred.
+       asm ("" : "+m" (visited)); */
+    vec<tree, va_gc> *inputs = NULL;
+    vec<tree, va_gc> *outputs = NULL;
+#if 0 /* ... or combined in any way.  */
+    vec_safe_push (outputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (2, "=m")),
+		    visited));
+#endif
+    vec_safe_push (inputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (1, "m")),
+		    visited));
+    gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+					    NULL, NULL);
+    gimple_seq_add_stmt (&seq, stabilize);
+
     return seq;
   }

[gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap

[Alexandre Oliva]

https://gcc.gnu.org/g:4273bf679dccd279a75727c48d5d6312f34e4bbc

commit 4273bf679dccd279a75727c48d5d6312f34e4bbc
Author: Alexandre Oliva <oliva@adacore.com>
Date:   Wed Oct 19 20:36:28 2022 -0300

    hardcfr: prevent deferred sets of visited bitmap

Diff:
---
 gcc/gimple-harden-control-flow.cc | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 1ea47615cd4..4d40fc98779 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,26 @@ class rt_bb_visited
     gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
     gimple_seq_add_stmt (&seq, vstore);
 
+    /* Prevent stores into visited from being deferred.
+       asm ("" : "+m" (visited)); */
+    vec<tree, va_gc> *inputs = NULL;
+    vec<tree, va_gc> *outputs = NULL;
+#if 0 /* ... or combined in any way.  */
+    vec_safe_push (outputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (2, "=m")),
+		    visited));
+#endif
+    vec_safe_push (inputs,
+		   build_tree_list
+		   (build_tree_list
+		    (NULL_TREE, build_string (1, "m")),
+		    visited));
+    gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+					    NULL, NULL);
+    gimple_seq_add_stmt (&seq, stabilize);
+
     return seq;
   }