From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by sourceware.org (Postfix) with ESMTPS id B50653858421 for ; Sat, 13 May 2023 09:20:52 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B50653858421 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1683969652; x=1715505652; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=+VTyKxxPWs8COICWhnadPliZmHiP3RlM6HxOlt/jTEQ=; b=nkfrp4C4P5l0mVwT5P9lCcbNP47G4Yg4EVAk5cXKHESu/5Q676WCHW5b 1qh0i2M0VtuoPTSBq6JjKYcFp2YupAWFUkYjAkgxd0SKKsTbe0uPfAG6N CSpYvTFn1K1zChkiFhAyrGvLJm4NKjimi5QwUdANnU2lW+rLKe/3PkbP3 HI1NwZMTh6wWfzzdy0HOKcOEX3gI6vLyIVStXxynG3e8b66SBHQh3oYua M+5YZ/HqhCGarsq7jXcZ3qe9+XhOsAfpLbA60WFOQ8rYNzunCi+X40GL/ EXjNXX85/pScczKcbJVT9FFxj/VxMz2bYY4cdrJz+rIxBnVWKh6+rLHj5 A==; X-IronPort-AV: E=McAfee;i="6600,9927,10708"; a="437277590" X-IronPort-AV: E=Sophos;i="5.99,271,1677571200"; d="scan'208";a="437277590" Received: from orsmga007.jf.intel.com ([10.7.209.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 May 2023 02:20:51 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10708"; a="694501841" X-IronPort-AV: E=Sophos;i="5.99,271,1677571200"; d="scan'208";a="694501841" Received: from shvmail03.sh.intel.com ([10.239.245.20]) by orsmga007.jf.intel.com with ESMTP; 13 May 2023 02:20:44 -0700 Received: from shliclel4217.sh.intel.com (shliclel4217.sh.intel.com [10.239.240.127]) by shvmail03.sh.intel.com (Postfix) with ESMTP id D26B11007BA7; Sat, 13 May 2023 17:20:42 +0800 (CST) From: liuhongt To: gcc-patches@gcc.gnu.org Cc: crazylht@gmail.com, hjl.tools@gmail.com Subject: [PATCH V2] Provide -fcf-protection=branch,return. Date: Sat, 13 May 2023 17:20:42 +0800 Message-Id: <20230513092042.3927038-1-hongtao.liu@intel.com> X-Mailer: git-send-email 2.39.1.388.g2fc9e9ca3c In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-12.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,KAM_SHORT,SPF_HELO_NONE,SPF_NONE,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: > I think this could be simplified if you use either EnumSet or > EnumBitSet instead in common.opt for `-fcf-protection=`. Use EnumSet instead of EnumBitSet since CF_FULL is not power of 2. It is a bit tricky for sets classification, cf_branch and cf_return should be in different sets, but they both "conflicts" cf_full, cf_none. And current EnumSet don't handle this well. So in the current implementation, only cf_full,cf_none are exclusive to each other, but they can be combined with any cf_branch, cf_return, cf_check. It's not perfect, but still an improvement than original one. gcc/ChangeLog: * common.opt: (fcf-protection=): Add EnumSet attribute to support combination of params. gcc/testsuite/ChangeLog: * c-c++-common/fcf-protection-10.c: New test. * c-c++-common/fcf-protection-11.c: New test. * c-c++-common/fcf-protection-12.c: New test. * c-c++-common/fcf-protection-8.c: New test. * c-c++-common/fcf-protection-9.c: New test. * gcc.target/i386/pr89701-1.c: New test. * gcc.target/i386/pr89701-2.c: New test. * gcc.target/i386/pr89701-3.c: New test. --- gcc/common.opt | 12 ++++++------ gcc/testsuite/c-c++-common/fcf-protection-10.c | 2 ++ gcc/testsuite/c-c++-common/fcf-protection-11.c | 2 ++ gcc/testsuite/c-c++-common/fcf-protection-12.c | 2 ++ gcc/testsuite/c-c++-common/fcf-protection-8.c | 2 ++ gcc/testsuite/c-c++-common/fcf-protection-9.c | 2 ++ gcc/testsuite/gcc.target/i386/pr89701-1.c | 4 ++++ gcc/testsuite/gcc.target/i386/pr89701-2.c | 4 ++++ gcc/testsuite/gcc.target/i386/pr89701-3.c | 4 ++++ 9 files changed, 28 insertions(+), 6 deletions(-) create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-10.c create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-11.c create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-12.c create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-8.c create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-9.c create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-1.c create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-2.c create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-3.c diff --git a/gcc/common.opt b/gcc/common.opt index a28ca13385a..02f2472959a 100644 --- a/gcc/common.opt +++ b/gcc/common.opt @@ -1886,7 +1886,7 @@ fcf-protection Common RejectNegative Alias(fcf-protection=,full) fcf-protection= -Common Joined RejectNegative Enum(cf_protection_level) Var(flag_cf_protection) Init(CF_NONE) +Common Joined RejectNegative Enum(cf_protection_level) EnumSet Var(flag_cf_protection) Init(CF_NONE) -fcf-protection=[full|branch|return|none|check] Instrument functions with checks to verify jump/call/return control-flow transfer instructions have valid targets. @@ -1894,19 +1894,19 @@ Enum Name(cf_protection_level) Type(enum cf_protection_level) UnknownError(unknown Control-Flow Protection Level %qs) EnumValue -Enum(cf_protection_level) String(full) Value(CF_FULL) +Enum(cf_protection_level) String(full) Value(CF_FULL) Set(1) EnumValue -Enum(cf_protection_level) String(branch) Value(CF_BRANCH) +Enum(cf_protection_level) String(branch) Value(CF_BRANCH) Set(2) EnumValue -Enum(cf_protection_level) String(return) Value(CF_RETURN) +Enum(cf_protection_level) String(return) Value(CF_RETURN) Set(3) EnumValue -Enum(cf_protection_level) String(check) Value(CF_CHECK) +Enum(cf_protection_level) String(check) Value(CF_CHECK) Set(4) EnumValue -Enum(cf_protection_level) String(none) Value(CF_NONE) +Enum(cf_protection_level) String(none) Value(CF_NONE) Set(1) finstrument-functions Common Var(flag_instrument_function_entry_exit,1) diff --git a/gcc/testsuite/c-c++-common/fcf-protection-10.c b/gcc/testsuite/c-c++-common/fcf-protection-10.c new file mode 100644 index 00000000000..b271d134e52 --- /dev/null +++ b/gcc/testsuite/c-c++-common/fcf-protection-10.c @@ -0,0 +1,2 @@ +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */ +/* { dg-options "-fcf-protection=branch,check" } */ diff --git a/gcc/testsuite/c-c++-common/fcf-protection-11.c b/gcc/testsuite/c-c++-common/fcf-protection-11.c new file mode 100644 index 00000000000..2e566350ccd --- /dev/null +++ b/gcc/testsuite/c-c++-common/fcf-protection-11.c @@ -0,0 +1,2 @@ +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */ +/* { dg-options "-fcf-protection=branch,return" } */ diff --git a/gcc/testsuite/c-c++-common/fcf-protection-12.c b/gcc/testsuite/c-c++-common/fcf-protection-12.c new file mode 100644 index 00000000000..b39c2f8e25d --- /dev/null +++ b/gcc/testsuite/c-c++-common/fcf-protection-12.c @@ -0,0 +1,2 @@ +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */ +/* { dg-options "-fcf-protection=return,branch" } */ diff --git a/gcc/testsuite/c-c++-common/fcf-protection-8.c b/gcc/testsuite/c-c++-common/fcf-protection-8.c new file mode 100644 index 00000000000..3b97095a92c --- /dev/null +++ b/gcc/testsuite/c-c++-common/fcf-protection-8.c @@ -0,0 +1,2 @@ +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */ +/* { dg-options "-fcf-protection=branch,none" } */ diff --git a/gcc/testsuite/c-c++-common/fcf-protection-9.c b/gcc/testsuite/c-c++-common/fcf-protection-9.c new file mode 100644 index 00000000000..6a37e749fcb --- /dev/null +++ b/gcc/testsuite/c-c++-common/fcf-protection-9.c @@ -0,0 +1,2 @@ +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */ +/* { dg-options "-fcf-protection=branch,full" } */ diff --git a/gcc/testsuite/gcc.target/i386/pr89701-1.c b/gcc/testsuite/gcc.target/i386/pr89701-1.c new file mode 100644 index 00000000000..1879c9ab4d8 --- /dev/null +++ b/gcc/testsuite/gcc.target/i386/pr89701-1.c @@ -0,0 +1,4 @@ +/* { dg-do compile { target *-*-linux* } } */ +/* { dg-options "-fcf-protection=branch,return" } */ +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */ +/* { dg-final { scan-assembler-times ".long 0x3" 1 } } */ diff --git a/gcc/testsuite/gcc.target/i386/pr89701-2.c b/gcc/testsuite/gcc.target/i386/pr89701-2.c new file mode 100644 index 00000000000..d5100575028 --- /dev/null +++ b/gcc/testsuite/gcc.target/i386/pr89701-2.c @@ -0,0 +1,4 @@ +/* { dg-do compile { target *-*-linux* } } */ +/* { dg-options "-fcf-protection=return,branch" } */ +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */ +/* { dg-final { scan-assembler-times ".long 0x3" 1 } } */ diff --git a/gcc/testsuite/gcc.target/i386/pr89701-3.c b/gcc/testsuite/gcc.target/i386/pr89701-3.c new file mode 100644 index 00000000000..88afb546fbf --- /dev/null +++ b/gcc/testsuite/gcc.target/i386/pr89701-3.c @@ -0,0 +1,4 @@ +/* { dg-do compile { target *-*-linux* } } */ +/* { dg-options "-fcf-protection=return,none" } */ +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */ +/* { dg-final { scan-assembler-times ".long 0x2" 1 } } */ -- 2.39.1.388.g2fc9e9ca3c