public inbox for gcc-cvs@sourceware.org
help / color / mirror / Atom feed
* [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap
@ 2022-10-25 2:52 Alexandre Oliva
0 siblings, 0 replies; 10+ messages in thread
From: Alexandre Oliva @ 2022-10-25 2:52 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:c51983438a9d360306c7c8849c2df4ade82707d4
commit c51983438a9d360306c7c8849c2df4ade82707d4
Author: Alexandre Oliva <oliva@adacore.com>
Date: Wed Oct 19 20:36:28 2022 -0300
hardcfr: prevent deferred sets of visited bitmap
Make bitmap sets volatile-ish, preventing deferral and likely
combinations.
for gcc/ChangeLog
* gimple-harden-control-flow.cc
(rt_bb_visited::rt_bb_visited): Move optimization barrier...
(rt_bb_visited::vset): ... here.
Diff:
---
gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
1 file changed, 30 insertions(+), 18 deletions(-)
diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
gimple_seq_add_stmt (&seq, vstore);
+ /* Prevent stores into visited from being deferred, forcing
+ subsequent bitsets to reload the word rather than reusing
+ values already in register. The purpose is threefold: make the
+ bitset get to memory in this block, so that control flow
+ attacks in functions called in this block don't easily bypass
+ the bitset; prevent the bitset word from being retained in a
+ register across blocks, which could, in an attack scenario,
+ make a later block set more than one bit; and prevent hoisting
+ or sinking loads or stores of bitset words out of loops or even
+ throughout functions, which could significantly weaken the
+ verification. This is equivalent to making the bitsetting
+ volatile within the function body, but without changing its
+ type; making the bitset volatile would make inline checking far
+ less optimizable for no reason. */
+ vec<tree, va_gc> *inputs = NULL;
+ vec<tree, va_gc> *outputs = NULL;
+ vec_safe_push (outputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (2, "=m")),
+ visited));
+ vec_safe_push (inputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (1, "m")),
+ visited));
+ gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+ NULL, NULL);
+ gimple_seq_add_stmt (&seq, stabilize);
+
return seq;
}
@@ -615,24 +645,6 @@ public:
tree visited_type = vtype ();
visited = create_tmp_var (visited_type, ".cfrvisited");
- /* Prevent stores into visited from being used to optimize the
- control flow redundancy checks. asm ("" : "+m" (visited)); */
- vec<tree, va_gc> *inputs = NULL;
- vec<tree, va_gc> *outputs = NULL;
- vec_safe_push (outputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (2, "=m")),
- visited));
- vec_safe_push (inputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (1, "m")),
- visited));
- gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
- NULL, NULL);
- gimple_seq_add_stmt (&ckseq, detach);
-
if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
|| checkpoints > 1)
{
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap
@ 2023-06-09 8:07 Alexandre Oliva
0 siblings, 0 replies; 10+ messages in thread
From: Alexandre Oliva @ 2023-06-09 8:07 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:0e2a8d05cd6f6103e9d9746d6a3e61f84030d299
commit 0e2a8d05cd6f6103e9d9746d6a3e61f84030d299
Author: Alexandre Oliva <oliva@adacore.com>
Date: Thu Jun 8 01:35:23 2023 -0300
hardcfr: prevent deferred sets of visited bitmap
Make bitmap sets volatile-ish, preventing deferral and likely
combinations.
for gcc/ChangeLog
* gimple-harden-control-flow.cc
(rt_bb_visited::rt_bb_visited): Move optimization barrier...
(rt_bb_visited::vset): ... here.
Diff:
---
gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
1 file changed, 30 insertions(+), 18 deletions(-)
diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
gimple_seq_add_stmt (&seq, vstore);
+ /* Prevent stores into visited from being deferred, forcing
+ subsequent bitsets to reload the word rather than reusing
+ values already in register. The purpose is threefold: make the
+ bitset get to memory in this block, so that control flow
+ attacks in functions called in this block don't easily bypass
+ the bitset; prevent the bitset word from being retained in a
+ register across blocks, which could, in an attack scenario,
+ make a later block set more than one bit; and prevent hoisting
+ or sinking loads or stores of bitset words out of loops or even
+ throughout functions, which could significantly weaken the
+ verification. This is equivalent to making the bitsetting
+ volatile within the function body, but without changing its
+ type; making the bitset volatile would make inline checking far
+ less optimizable for no reason. */
+ vec<tree, va_gc> *inputs = NULL;
+ vec<tree, va_gc> *outputs = NULL;
+ vec_safe_push (outputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (2, "=m")),
+ visited));
+ vec_safe_push (inputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (1, "m")),
+ visited));
+ gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+ NULL, NULL);
+ gimple_seq_add_stmt (&seq, stabilize);
+
return seq;
}
@@ -615,24 +645,6 @@ public:
tree visited_type = vtype ();
visited = create_tmp_var (visited_type, ".cfrvisited");
- /* Prevent stores into visited from being used to optimize the
- control flow redundancy checks. asm ("" : "+m" (visited)); */
- vec<tree, va_gc> *inputs = NULL;
- vec<tree, va_gc> *outputs = NULL;
- vec_safe_push (outputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (2, "=m")),
- visited));
- vec_safe_push (inputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (1, "m")),
- visited));
- gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
- NULL, NULL);
- gimple_seq_add_stmt (&ckseq, detach);
-
if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
|| checkpoints > 1)
{
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap
@ 2023-06-09 6:17 Alexandre Oliva
0 siblings, 0 replies; 10+ messages in thread
From: Alexandre Oliva @ 2023-06-09 6:17 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:7dd60c2f0a42a9664baabcde0b345b3a6f94f46f
commit 7dd60c2f0a42a9664baabcde0b345b3a6f94f46f
Author: Alexandre Oliva <oliva@adacore.com>
Date: Thu Jun 8 01:35:23 2023 -0300
hardcfr: prevent deferred sets of visited bitmap
Make bitmap sets volatile-ish, preventing deferral and likely
combinations.
for gcc/ChangeLog
* gimple-harden-control-flow.cc
(rt_bb_visited::rt_bb_visited): Move optimization barrier...
(rt_bb_visited::vset): ... here.
Diff:
---
gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
1 file changed, 30 insertions(+), 18 deletions(-)
diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
gimple_seq_add_stmt (&seq, vstore);
+ /* Prevent stores into visited from being deferred, forcing
+ subsequent bitsets to reload the word rather than reusing
+ values already in register. The purpose is threefold: make the
+ bitset get to memory in this block, so that control flow
+ attacks in functions called in this block don't easily bypass
+ the bitset; prevent the bitset word from being retained in a
+ register across blocks, which could, in an attack scenario,
+ make a later block set more than one bit; and prevent hoisting
+ or sinking loads or stores of bitset words out of loops or even
+ throughout functions, which could significantly weaken the
+ verification. This is equivalent to making the bitsetting
+ volatile within the function body, but without changing its
+ type; making the bitset volatile would make inline checking far
+ less optimizable for no reason. */
+ vec<tree, va_gc> *inputs = NULL;
+ vec<tree, va_gc> *outputs = NULL;
+ vec_safe_push (outputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (2, "=m")),
+ visited));
+ vec_safe_push (inputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (1, "m")),
+ visited));
+ gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+ NULL, NULL);
+ gimple_seq_add_stmt (&seq, stabilize);
+
return seq;
}
@@ -615,24 +645,6 @@ public:
tree visited_type = vtype ();
visited = create_tmp_var (visited_type, ".cfrvisited");
- /* Prevent stores into visited from being used to optimize the
- control flow redundancy checks. asm ("" : "+m" (visited)); */
- vec<tree, va_gc> *inputs = NULL;
- vec<tree, va_gc> *outputs = NULL;
- vec_safe_push (outputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (2, "=m")),
- visited));
- vec_safe_push (inputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (1, "m")),
- visited));
- gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
- NULL, NULL);
- gimple_seq_add_stmt (&ckseq, detach);
-
if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
|| checkpoints > 1)
{
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap
@ 2023-06-08 10:59 Alexandre Oliva
0 siblings, 0 replies; 10+ messages in thread
From: Alexandre Oliva @ 2023-06-08 10:59 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:f5057562f04b9ddc866223539ff8421ab5090ae8
commit f5057562f04b9ddc866223539ff8421ab5090ae8
Author: Alexandre Oliva <oliva@adacore.com>
Date: Wed Oct 19 20:36:28 2022 -0300
hardcfr: prevent deferred sets of visited bitmap
Make bitmap sets volatile-ish, preventing deferral and likely
combinations.
for gcc/ChangeLog
* gimple-harden-control-flow.cc
(rt_bb_visited::rt_bb_visited): Move optimization barrier...
(rt_bb_visited::vset): ... here.
Diff:
---
gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
1 file changed, 30 insertions(+), 18 deletions(-)
diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
gimple_seq_add_stmt (&seq, vstore);
+ /* Prevent stores into visited from being deferred, forcing
+ subsequent bitsets to reload the word rather than reusing
+ values already in register. The purpose is threefold: make the
+ bitset get to memory in this block, so that control flow
+ attacks in functions called in this block don't easily bypass
+ the bitset; prevent the bitset word from being retained in a
+ register across blocks, which could, in an attack scenario,
+ make a later block set more than one bit; and prevent hoisting
+ or sinking loads or stores of bitset words out of loops or even
+ throughout functions, which could significantly weaken the
+ verification. This is equivalent to making the bitsetting
+ volatile within the function body, but without changing its
+ type; making the bitset volatile would make inline checking far
+ less optimizable for no reason. */
+ vec<tree, va_gc> *inputs = NULL;
+ vec<tree, va_gc> *outputs = NULL;
+ vec_safe_push (outputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (2, "=m")),
+ visited));
+ vec_safe_push (inputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (1, "m")),
+ visited));
+ gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+ NULL, NULL);
+ gimple_seq_add_stmt (&seq, stabilize);
+
return seq;
}
@@ -615,24 +645,6 @@ public:
tree visited_type = vtype ();
visited = create_tmp_var (visited_type, ".cfrvisited");
- /* Prevent stores into visited from being used to optimize the
- control flow redundancy checks. asm ("" : "+m" (visited)); */
- vec<tree, va_gc> *inputs = NULL;
- vec<tree, va_gc> *outputs = NULL;
- vec_safe_push (outputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (2, "=m")),
- visited));
- vec_safe_push (inputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (1, "m")),
- visited));
- gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
- NULL, NULL);
- gimple_seq_add_stmt (&ckseq, detach);
-
if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
|| checkpoints > 1)
{
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap
@ 2023-06-08 10:43 Alexandre Oliva
0 siblings, 0 replies; 10+ messages in thread
From: Alexandre Oliva @ 2023-06-08 10:43 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:97a39ca4fd4ccf1dd825bb3c7c6c36f312572dfa
commit 97a39ca4fd4ccf1dd825bb3c7c6c36f312572dfa
Author: Alexandre Oliva <oliva@adacore.com>
Date: Thu Jun 8 01:35:23 2023 -0300
hardcfr: prevent deferred sets of visited bitmap
Make bitmap sets volatile-ish, preventing deferral and likely
combinations.
for gcc/ChangeLog
* gimple-harden-control-flow.cc
(rt_bb_visited::rt_bb_visited): Move optimization barrier...
(rt_bb_visited::vset): ... here.
Diff:
---
gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
1 file changed, 30 insertions(+), 18 deletions(-)
diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
gimple_seq_add_stmt (&seq, vstore);
+ /* Prevent stores into visited from being deferred, forcing
+ subsequent bitsets to reload the word rather than reusing
+ values already in register. The purpose is threefold: make the
+ bitset get to memory in this block, so that control flow
+ attacks in functions called in this block don't easily bypass
+ the bitset; prevent the bitset word from being retained in a
+ register across blocks, which could, in an attack scenario,
+ make a later block set more than one bit; and prevent hoisting
+ or sinking loads or stores of bitset words out of loops or even
+ throughout functions, which could significantly weaken the
+ verification. This is equivalent to making the bitsetting
+ volatile within the function body, but without changing its
+ type; making the bitset volatile would make inline checking far
+ less optimizable for no reason. */
+ vec<tree, va_gc> *inputs = NULL;
+ vec<tree, va_gc> *outputs = NULL;
+ vec_safe_push (outputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (2, "=m")),
+ visited));
+ vec_safe_push (inputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (1, "m")),
+ visited));
+ gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+ NULL, NULL);
+ gimple_seq_add_stmt (&seq, stabilize);
+
return seq;
}
@@ -615,24 +645,6 @@ public:
tree visited_type = vtype ();
visited = create_tmp_var (visited_type, ".cfrvisited");
- /* Prevent stores into visited from being used to optimize the
- control flow redundancy checks. asm ("" : "+m" (visited)); */
- vec<tree, va_gc> *inputs = NULL;
- vec<tree, va_gc> *outputs = NULL;
- vec_safe_push (outputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (2, "=m")),
- visited));
- vec_safe_push (inputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (1, "m")),
- visited));
- gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
- NULL, NULL);
- gimple_seq_add_stmt (&ckseq, detach);
-
if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
|| checkpoints > 1)
{
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap
@ 2023-06-08 9:17 Alexandre Oliva
0 siblings, 0 replies; 10+ messages in thread
From: Alexandre Oliva @ 2023-06-08 9:17 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:f5057562f04b9ddc866223539ff8421ab5090ae8
commit f5057562f04b9ddc866223539ff8421ab5090ae8
Author: Alexandre Oliva <oliva@adacore.com>
Date: Wed Oct 19 20:36:28 2022 -0300
hardcfr: prevent deferred sets of visited bitmap
Make bitmap sets volatile-ish, preventing deferral and likely
combinations.
for gcc/ChangeLog
* gimple-harden-control-flow.cc
(rt_bb_visited::rt_bb_visited): Move optimization barrier...
(rt_bb_visited::vset): ... here.
Diff:
---
gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
1 file changed, 30 insertions(+), 18 deletions(-)
diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
gimple_seq_add_stmt (&seq, vstore);
+ /* Prevent stores into visited from being deferred, forcing
+ subsequent bitsets to reload the word rather than reusing
+ values already in register. The purpose is threefold: make the
+ bitset get to memory in this block, so that control flow
+ attacks in functions called in this block don't easily bypass
+ the bitset; prevent the bitset word from being retained in a
+ register across blocks, which could, in an attack scenario,
+ make a later block set more than one bit; and prevent hoisting
+ or sinking loads or stores of bitset words out of loops or even
+ throughout functions, which could significantly weaken the
+ verification. This is equivalent to making the bitsetting
+ volatile within the function body, but without changing its
+ type; making the bitset volatile would make inline checking far
+ less optimizable for no reason. */
+ vec<tree, va_gc> *inputs = NULL;
+ vec<tree, va_gc> *outputs = NULL;
+ vec_safe_push (outputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (2, "=m")),
+ visited));
+ vec_safe_push (inputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (1, "m")),
+ visited));
+ gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+ NULL, NULL);
+ gimple_seq_add_stmt (&seq, stabilize);
+
return seq;
}
@@ -615,24 +645,6 @@ public:
tree visited_type = vtype ();
visited = create_tmp_var (visited_type, ".cfrvisited");
- /* Prevent stores into visited from being used to optimize the
- control flow redundancy checks. asm ("" : "+m" (visited)); */
- vec<tree, va_gc> *inputs = NULL;
- vec<tree, va_gc> *outputs = NULL;
- vec_safe_push (outputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (2, "=m")),
- visited));
- vec_safe_push (inputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (1, "m")),
- visited));
- gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
- NULL, NULL);
- gimple_seq_add_stmt (&ckseq, detach);
-
if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
|| checkpoints > 1)
{
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap
@ 2023-06-08 4:47 Alexandre Oliva
0 siblings, 0 replies; 10+ messages in thread
From: Alexandre Oliva @ 2023-06-08 4:47 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:a273f6e55352f2596c98e0c3d96a106fe21561c9
commit a273f6e55352f2596c98e0c3d96a106fe21561c9
Author: Alexandre Oliva <oliva@adacore.com>
Date: Wed Oct 19 20:36:28 2022 -0300
hardcfr: prevent deferred sets of visited bitmap
Make bitmap sets volatile-ish, preventing deferral and likely
combinations.
for gcc/ChangeLog
* gimple-harden-control-flow.cc
(rt_bb_visited::rt_bb_visited): Move optimization barrier...
(rt_bb_visited::vset): ... here.
Diff:
---
gcc/gimple-harden-control-flow.cc | 48 ++++++++++++++++++++++++---------------
1 file changed, 30 insertions(+), 18 deletions(-)
diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 53717a652ca..3e6fe2db479 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,36 @@ class rt_bb_visited
gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
gimple_seq_add_stmt (&seq, vstore);
+ /* Prevent stores into visited from being deferred, forcing
+ subsequent bitsets to reload the word rather than reusing
+ values already in register. The purpose is threefold: make the
+ bitset get to memory in this block, so that control flow
+ attacks in functions called in this block don't easily bypass
+ the bitset; prevent the bitset word from being retained in a
+ register across blocks, which could, in an attack scenario,
+ make a later block set more than one bit; and prevent hoisting
+ or sinking loads or stores of bitset words out of loops or even
+ throughout functions, which could significantly weaken the
+ verification. This is equivalent to making the bitsetting
+ volatile within the function body, but without changing its
+ type; making the bitset volatile would make inline checking far
+ less optimizable for no reason. */
+ vec<tree, va_gc> *inputs = NULL;
+ vec<tree, va_gc> *outputs = NULL;
+ vec_safe_push (outputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (2, "=m")),
+ visited));
+ vec_safe_push (inputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (1, "m")),
+ visited));
+ gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+ NULL, NULL);
+ gimple_seq_add_stmt (&seq, stabilize);
+
return seq;
}
@@ -615,24 +645,6 @@ public:
tree visited_type = vtype ();
visited = create_tmp_var (visited_type, ".cfrvisited");
- /* Prevent stores into visited from being used to optimize the
- control flow redundancy checks. asm ("" : "+m" (visited)); */
- vec<tree, va_gc> *inputs = NULL;
- vec<tree, va_gc> *outputs = NULL;
- vec_safe_push (outputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (2, "=m")),
- visited));
- vec_safe_push (inputs,
- build_tree_list
- (build_tree_list
- (NULL_TREE, build_string (1, "m")),
- visited));
- gasm *detach = gimple_build_asm_vec ("", inputs, outputs,
- NULL, NULL);
- gimple_seq_add_stmt (&ckseq, detach);
-
if (nblocks - NUM_FIXED_BLOCKS > blknum (param_hardcfr_max_inline_blocks)
|| checkpoints > 1)
{
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap
@ 2022-10-20 22:32 Alexandre Oliva
0 siblings, 0 replies; 10+ messages in thread
From: Alexandre Oliva @ 2022-10-20 22:32 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:12d0b287d4ae77cd70604451214965a0f03fd9ca
commit 12d0b287d4ae77cd70604451214965a0f03fd9ca
Author: Alexandre Oliva <oliva@adacore.com>
Date: Wed Oct 19 20:36:28 2022 -0300
hardcfr: prevent deferred sets of visited bitmap
Force bitmap sets to hit memory, preventing deferral and likely
combinations.
for gcc/ChangeLog
* gimple-harden-control-flow.cc (rt_bb_visited::vset): Prevent
deferral of bitmap sets.
Diff:
---
gcc/gimple-harden-control-flow.cc | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 1ea47615cd4..862cdd45eaf 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,19 @@ class rt_bb_visited
gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
gimple_seq_add_stmt (&seq, vstore);
+ /* Prevent stores into visited from being deferred, without
+ forcing subsequent bitsets to reload the word. */
+ vec<tree, va_gc> *inputs = NULL;
+ vec<tree, va_gc> *outputs = NULL;
+ vec_safe_push (inputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (1, "m")),
+ visited));
+ gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+ NULL, NULL);
+ gimple_seq_add_stmt (&seq, stabilize);
+
return seq;
}
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap
@ 2022-10-20 5:46 Alexandre Oliva
0 siblings, 0 replies; 10+ messages in thread
From: Alexandre Oliva @ 2022-10-20 5:46 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:bacbf8a89d79238228344cbe41444b565ec4979c
commit bacbf8a89d79238228344cbe41444b565ec4979c
Author: Alexandre Oliva <oliva@adacore.com>
Date: Wed Oct 19 20:36:28 2022 -0300
hardcfr: prevent deferred sets of visited bitmap
Diff:
---
gcc/gimple-harden-control-flow.cc | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 1ea47615cd4..4d40fc98779 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,26 @@ class rt_bb_visited
gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
gimple_seq_add_stmt (&seq, vstore);
+ /* Prevent stores into visited from being deferred.
+ asm ("" : "+m" (visited)); */
+ vec<tree, va_gc> *inputs = NULL;
+ vec<tree, va_gc> *outputs = NULL;
+#if 0 /* ... or combined in any way. */
+ vec_safe_push (outputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (2, "=m")),
+ visited));
+#endif
+ vec_safe_push (inputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (1, "m")),
+ visited));
+ gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+ NULL, NULL);
+ gimple_seq_add_stmt (&seq, stabilize);
+
return seq;
}
^ permalink raw reply [flat|nested] 10+ messages in thread
* [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap
@ 2022-10-20 4:09 Alexandre Oliva
0 siblings, 0 replies; 10+ messages in thread
From: Alexandre Oliva @ 2022-10-20 4:09 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:4273bf679dccd279a75727c48d5d6312f34e4bbc
commit 4273bf679dccd279a75727c48d5d6312f34e4bbc
Author: Alexandre Oliva <oliva@adacore.com>
Date: Wed Oct 19 20:36:28 2022 -0300
hardcfr: prevent deferred sets of visited bitmap
Diff:
---
gcc/gimple-harden-control-flow.cc | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/gcc/gimple-harden-control-flow.cc b/gcc/gimple-harden-control-flow.cc
index 1ea47615cd4..4d40fc98779 100644
--- a/gcc/gimple-harden-control-flow.cc
+++ b/gcc/gimple-harden-control-flow.cc
@@ -545,6 +545,26 @@ class rt_bb_visited
gassign *vstore = gimple_build_assign (unshare_expr (setme), temp);
gimple_seq_add_stmt (&seq, vstore);
+ /* Prevent stores into visited from being deferred.
+ asm ("" : "+m" (visited)); */
+ vec<tree, va_gc> *inputs = NULL;
+ vec<tree, va_gc> *outputs = NULL;
+#if 0 /* ... or combined in any way. */
+ vec_safe_push (outputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (2, "=m")),
+ visited));
+#endif
+ vec_safe_push (inputs,
+ build_tree_list
+ (build_tree_list
+ (NULL_TREE, build_string (1, "m")),
+ visited));
+ gasm *stabilize = gimple_build_asm_vec ("", inputs, outputs,
+ NULL, NULL);
+ gimple_seq_add_stmt (&seq, stabilize);
+
return seq;
}
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2023-06-09 8:07 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-25 2:52 [gcc(refs/users/aoliva/heads/testme)] hardcfr: prevent deferred sets of visited bitmap Alexandre Oliva
-- strict thread matches above, loose matches on Subject: below --
2023-06-09 8:07 Alexandre Oliva
2023-06-09 6:17 Alexandre Oliva
2023-06-08 10:59 Alexandre Oliva
2023-06-08 10:43 Alexandre Oliva
2023-06-08 9:17 Alexandre Oliva
2023-06-08 4:47 Alexandre Oliva
2022-10-20 22:32 Alexandre Oliva
2022-10-20 5:46 Alexandre Oliva
2022-10-20 4:09 Alexandre Oliva
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).