From: "Marc Poulhiès" <poulhies@adacore.com>
To: gcc-patches@gcc.gnu.org
Cc: Alexandre Oliva <oliva@adacore.com>
Subject: [COMMITED] ada: hardened conditionals: exemplify codegen changes
Date: Thu, 6 Oct 2022 11:31:08 +0200 [thread overview]
Message-ID: <20221006093108.261899-1-poulhies@adacore.com> (raw)
From: Alexandre Oliva <oliva@adacore.com>
gcc/ada/
* doc/gnat_rm/security_hardening_features.rst: Add examples of
codegen changes in hardened conditionals.
* gnat_rm.texi: Regenerate.
Tested on x86_64-pc-linux-gnu, committed on master.
---
.../gnat_rm/security_hardening_features.rst | 51 ++++++++++++++++++-
gcc/ada/gnat_rm.texi | 47 ++++++++++++++++-
2 files changed, 94 insertions(+), 4 deletions(-)
diff --git a/gcc/ada/doc/gnat_rm/security_hardening_features.rst b/gcc/ada/doc/gnat_rm/security_hardening_features.rst
index d8ea849c032..d7c02b94f36 100644
--- a/gcc/ada/doc/gnat_rm/security_hardening_features.rst
+++ b/gcc/ada/doc/gnat_rm/security_hardening_features.rst
@@ -203,11 +203,58 @@ activated by a separate command-line option.
The option :switch:`-fharden-compares` enables hardening of compares
that compute results stored in variables, adding verification that the
-reversed compare yields the opposite result.
+reversed compare yields the opposite result, turning:
+
+.. code-block:: ada
+
+ B := X = Y;
+
+
+into:
+
+.. code-block:: ada
+
+ B := X = Y;
+ declare
+ NotB : Boolean := X /= Y; -- Computed independently of B.
+ begin
+ if B = NotB then
+ <__builtin_trap>;
+ end if;
+ end;
+
The option :switch:`-fharden-conditional-branches` enables hardening
of compares that guard conditional branches, adding verification of
-the reversed compare to both execution paths.
+the reversed compare to both execution paths, turning:
+
+.. code-block:: ada
+
+ if X = Y then
+ X := Z + 1;
+ else
+ Y := Z - 1;
+ end if;
+
+
+into:
+
+.. code-block:: ada
+
+ if X = Y then
+ if X /= Y then -- Computed independently of X = Y.
+ <__builtin_trap>;
+ end if;
+ X := Z + 1;
+ else
+ if X /= Y then -- Computed independently of X = Y.
+ null;
+ else
+ <__builtin_trap>;
+ end if;
+ Y := Z - 1;
+ end if;
+
These transformations are introduced late in the compilation pipeline,
long after boolean expressions are decomposed into separate compares,
diff --git a/gcc/ada/gnat_rm.texi b/gcc/ada/gnat_rm.texi
index dad0092713e..e13dba037ff 100644
--- a/gcc/ada/gnat_rm.texi
+++ b/gcc/ada/gnat_rm.texi
@@ -28858,11 +28858,54 @@ activated by a separate command-line option.
The option @code{-fharden-compares} enables hardening of compares
that compute results stored in variables, adding verification that the
-reversed compare yields the opposite result.
+reversed compare yields the opposite result, turning:
+
+@example
+B := X = Y;
+@end example
+
+into:
+
+@example
+B := X = Y;
+declare
+ NotB : Boolean := X /= Y; -- Computed independently of B.
+begin
+ if B = NotB then
+ <__builtin_trap>;
+ end if;
+end;
+@end example
The option @code{-fharden-conditional-branches} enables hardening
of compares that guard conditional branches, adding verification of
-the reversed compare to both execution paths.
+the reversed compare to both execution paths, turning:
+
+@example
+if X = Y then
+ X := Z + 1;
+else
+ Y := Z - 1;
+end if;
+@end example
+
+into:
+
+@example
+if X = Y then
+ if X /= Y then -- Computed independently of X = Y.
+ <__builtin_trap>;
+ end if;
+ X := Z + 1;
+else
+ if X /= Y then -- Computed independently of X = Y.
+ null;
+ else
+ <__builtin_trap>;
+ end if;
+ Y := Z - 1;
+end if;
+@end example
These transformations are introduced late in the compilation pipeline,
long after boolean expressions are decomposed into separate compares,
--
2.34.1
reply other threads:[~2022-10-06 9:31 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221006093108.261899-1-poulhies@adacore.com \
--to=poulhies@adacore.com \
--cc=gcc-patches@gcc.gnu.org \
--cc=oliva@adacore.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).