diff mbox series

[V2] Provide -fcf-protection=branch,return.

Message ID	20230513092042.3927038-1-hongtao.liu@intel.com
State	Accepted
Headers	Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B50653858421 To: gcc-patches@gcc.gnu.org Cc: crazylht@gmail.com, hjl.tools@gmail.com Subject: [PATCH V2] Provide -fcf-protection=branch,return. Date: Sat, 13 May 2023 17:20:42 +0800 Message-Id: <20230513092042.3927038-1-hongtao.liu@intel.com> In-Reply-To: <CAMZc-bxNdnzPecb6nO7gWXG27ChDU-dGwdSeJc0TiVvhdbumew@mail.gmail.com> References: <CAMZc-bxNdnzPecb6nO7gWXG27ChDU-dGwdSeJc0TiVvhdbumew@mail.gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: list From: liuhongt via Gcc-patches <gcc-patches@gcc.gnu.org> Reply-To: liuhongt <hongtao.liu@intel.com> Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" <gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org> X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?=
Series	[V2] Provide -fcf-protection=branch,return. \| [V2] Provide -fcf-protection=branch,return.

Checks

Context	Check	Description
snail/gcc-patch-check	success	Github commit url

Commit Message

liuhongt May 13, 2023, 9:20 a.m. UTC

  > I think this could be simplified if you use either EnumSet or
> EnumBitSet instead in common.opt for `-fcf-protection=`.

Use EnumSet instead of EnumBitSet since CF_FULL is not power of 2.
It is a bit tricky for sets classification, cf_branch and cf_return
should be in different sets, but they both "conflicts" cf_full,
cf_none. And current EnumSet don't handle this well.

So in the current implementation, only cf_full,cf_none are exclusive
to each other, but they can be combined with any cf_branch, cf_return,
cf_check. It's not perfect, but still an improvement than original
one.

gcc/ChangeLog:

	* common.opt: (fcf-protection=): Add EnumSet attribute to
	support combination of params.

gcc/testsuite/ChangeLog:

	* c-c++-common/fcf-protection-10.c: New test.
	* c-c++-common/fcf-protection-11.c: New test.
	* c-c++-common/fcf-protection-12.c: New test.
	* c-c++-common/fcf-protection-8.c: New test.
	* c-c++-common/fcf-protection-9.c: New test.
	* gcc.target/i386/pr89701-1.c: New test.
	* gcc.target/i386/pr89701-2.c: New test.
	* gcc.target/i386/pr89701-3.c: New test.
---
 gcc/common.opt                                 | 12 ++++++------
 gcc/testsuite/c-c++-common/fcf-protection-10.c |  2 ++
 gcc/testsuite/c-c++-common/fcf-protection-11.c |  2 ++
 gcc/testsuite/c-c++-common/fcf-protection-12.c |  2 ++
 gcc/testsuite/c-c++-common/fcf-protection-8.c  |  2 ++
 gcc/testsuite/c-c++-common/fcf-protection-9.c  |  2 ++
 gcc/testsuite/gcc.target/i386/pr89701-1.c      |  4 ++++
 gcc/testsuite/gcc.target/i386/pr89701-2.c      |  4 ++++
 gcc/testsuite/gcc.target/i386/pr89701-3.c      |  4 ++++
 9 files changed, 28 insertions(+), 6 deletions(-)
 create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-10.c
 create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-11.c
 create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-12.c
 create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-8.c
 create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-9.c
 create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-1.c
 create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-2.c
 create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-3.c

Comments

Hongtao Liu May 22, 2023, 8:08 a.m. UTC | #1

ping.

On Sat, May 13, 2023 at 5:20 PM liuhongt <hongtao.liu@intel.com> wrote:
>
> > I think this could be simplified if you use either EnumSet or
> > EnumBitSet instead in common.opt for `-fcf-protection=`.
>
> Use EnumSet instead of EnumBitSet since CF_FULL is not power of 2.
> It is a bit tricky for sets classification, cf_branch and cf_return
> should be in different sets, but they both "conflicts" cf_full,
> cf_none. And current EnumSet don't handle this well.
>
> So in the current implementation, only cf_full,cf_none are exclusive
> to each other, but they can be combined with any cf_branch, cf_return,
> cf_check. It's not perfect, but still an improvement than original
> one.
>
> gcc/ChangeLog:
>
>         * common.opt: (fcf-protection=): Add EnumSet attribute to
>         support combination of params.
>
> gcc/testsuite/ChangeLog:
>
>         * c-c++-common/fcf-protection-10.c: New test.
>         * c-c++-common/fcf-protection-11.c: New test.
>         * c-c++-common/fcf-protection-12.c: New test.
>         * c-c++-common/fcf-protection-8.c: New test.
>         * c-c++-common/fcf-protection-9.c: New test.
>         * gcc.target/i386/pr89701-1.c: New test.
>         * gcc.target/i386/pr89701-2.c: New test.
>         * gcc.target/i386/pr89701-3.c: New test.
> ---
>  gcc/common.opt                                 | 12 ++++++------
>  gcc/testsuite/c-c++-common/fcf-protection-10.c |  2 ++
>  gcc/testsuite/c-c++-common/fcf-protection-11.c |  2 ++
>  gcc/testsuite/c-c++-common/fcf-protection-12.c |  2 ++
>  gcc/testsuite/c-c++-common/fcf-protection-8.c  |  2 ++
>  gcc/testsuite/c-c++-common/fcf-protection-9.c  |  2 ++
>  gcc/testsuite/gcc.target/i386/pr89701-1.c      |  4 ++++
>  gcc/testsuite/gcc.target/i386/pr89701-2.c      |  4 ++++
>  gcc/testsuite/gcc.target/i386/pr89701-3.c      |  4 ++++
>  9 files changed, 28 insertions(+), 6 deletions(-)
>  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-10.c
>  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-11.c
>  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-12.c
>  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-8.c
>  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-9.c
>  create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-1.c
>  create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-2.c
>  create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-3.c
>
> diff --git a/gcc/common.opt b/gcc/common.opt
> index a28ca13385a..02f2472959a 100644
> --- a/gcc/common.opt
> +++ b/gcc/common.opt
> @@ -1886,7 +1886,7 @@ fcf-protection
>  Common RejectNegative Alias(fcf-protection=,full)
>
>  fcf-protection=
> -Common Joined RejectNegative Enum(cf_protection_level) Var(flag_cf_protection) Init(CF_NONE)
> +Common Joined RejectNegative Enum(cf_protection_level) EnumSet Var(flag_cf_protection) Init(CF_NONE)
>  -fcf-protection=[full|branch|return|none|check]        Instrument functions with checks to verify jump/call/return control-flow transfer
>  instructions have valid targets.
>
> @@ -1894,19 +1894,19 @@ Enum
>  Name(cf_protection_level) Type(enum cf_protection_level) UnknownError(unknown Control-Flow Protection Level %qs)
>
>  EnumValue
> -Enum(cf_protection_level) String(full) Value(CF_FULL)
> +Enum(cf_protection_level) String(full) Value(CF_FULL) Set(1)
>
>  EnumValue
> -Enum(cf_protection_level) String(branch) Value(CF_BRANCH)
> +Enum(cf_protection_level) String(branch) Value(CF_BRANCH) Set(2)
>
>  EnumValue
> -Enum(cf_protection_level) String(return) Value(CF_RETURN)
> +Enum(cf_protection_level) String(return) Value(CF_RETURN) Set(3)
>
>  EnumValue
> -Enum(cf_protection_level) String(check) Value(CF_CHECK)
> +Enum(cf_protection_level) String(check) Value(CF_CHECK) Set(4)
>
>  EnumValue
> -Enum(cf_protection_level) String(none) Value(CF_NONE)
> +Enum(cf_protection_level) String(none) Value(CF_NONE) Set(1)
>
>  finstrument-functions
>  Common Var(flag_instrument_function_entry_exit,1)
> diff --git a/gcc/testsuite/c-c++-common/fcf-protection-10.c b/gcc/testsuite/c-c++-common/fcf-protection-10.c
> new file mode 100644
> index 00000000000..b271d134e52
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/fcf-protection-10.c
> @@ -0,0 +1,2 @@
> +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> +/* { dg-options "-fcf-protection=branch,check" } */
> diff --git a/gcc/testsuite/c-c++-common/fcf-protection-11.c b/gcc/testsuite/c-c++-common/fcf-protection-11.c
> new file mode 100644
> index 00000000000..2e566350ccd
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/fcf-protection-11.c
> @@ -0,0 +1,2 @@
> +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> +/* { dg-options "-fcf-protection=branch,return" } */
> diff --git a/gcc/testsuite/c-c++-common/fcf-protection-12.c b/gcc/testsuite/c-c++-common/fcf-protection-12.c
> new file mode 100644
> index 00000000000..b39c2f8e25d
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/fcf-protection-12.c
> @@ -0,0 +1,2 @@
> +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> +/* { dg-options "-fcf-protection=return,branch" } */
> diff --git a/gcc/testsuite/c-c++-common/fcf-protection-8.c b/gcc/testsuite/c-c++-common/fcf-protection-8.c
> new file mode 100644
> index 00000000000..3b97095a92c
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/fcf-protection-8.c
> @@ -0,0 +1,2 @@
> +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> +/* { dg-options "-fcf-protection=branch,none" } */
> diff --git a/gcc/testsuite/c-c++-common/fcf-protection-9.c b/gcc/testsuite/c-c++-common/fcf-protection-9.c
> new file mode 100644
> index 00000000000..6a37e749fcb
> --- /dev/null
> +++ b/gcc/testsuite/c-c++-common/fcf-protection-9.c
> @@ -0,0 +1,2 @@
> +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> +/* { dg-options "-fcf-protection=branch,full" } */
> diff --git a/gcc/testsuite/gcc.target/i386/pr89701-1.c b/gcc/testsuite/gcc.target/i386/pr89701-1.c
> new file mode 100644
> index 00000000000..1879c9ab4d8
> --- /dev/null
> +++ b/gcc/testsuite/gcc.target/i386/pr89701-1.c
> @@ -0,0 +1,4 @@
> +/* { dg-do compile { target *-*-linux* } } */
> +/* { dg-options "-fcf-protection=branch,return" } */
> +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
> +/* { dg-final { scan-assembler-times ".long    0x3" 1 } } */
> diff --git a/gcc/testsuite/gcc.target/i386/pr89701-2.c b/gcc/testsuite/gcc.target/i386/pr89701-2.c
> new file mode 100644
> index 00000000000..d5100575028
> --- /dev/null
> +++ b/gcc/testsuite/gcc.target/i386/pr89701-2.c
> @@ -0,0 +1,4 @@
> +/* { dg-do compile { target *-*-linux* } } */
> +/* { dg-options "-fcf-protection=return,branch" } */
> +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
> +/* { dg-final { scan-assembler-times ".long    0x3" 1 } } */
> diff --git a/gcc/testsuite/gcc.target/i386/pr89701-3.c b/gcc/testsuite/gcc.target/i386/pr89701-3.c
> new file mode 100644
> index 00000000000..88afb546fbf
> --- /dev/null
> +++ b/gcc/testsuite/gcc.target/i386/pr89701-3.c
> @@ -0,0 +1,4 @@
> +/* { dg-do compile { target *-*-linux* } } */
> +/* { dg-options "-fcf-protection=return,none" } */
> +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
> +/* { dg-final { scan-assembler-times ".long    0x2" 1 } } */
> --
> 2.39.1.388.g2fc9e9ca3c
>

Hongtao Liu July 12, 2023, 7:27 a.m. UTC | #2

ping.

On Mon, May 22, 2023 at 4:08 PM Hongtao Liu <crazylht@gmail.com> wrote:
>
> ping.
>
> On Sat, May 13, 2023 at 5:20 PM liuhongt <hongtao.liu@intel.com> wrote:
> >
> > > I think this could be simplified if you use either EnumSet or
> > > EnumBitSet instead in common.opt for `-fcf-protection=`.
> >
> > Use EnumSet instead of EnumBitSet since CF_FULL is not power of 2.
> > It is a bit tricky for sets classification, cf_branch and cf_return
> > should be in different sets, but they both "conflicts" cf_full,
> > cf_none. And current EnumSet don't handle this well.
> >
> > So in the current implementation, only cf_full,cf_none are exclusive
> > to each other, but they can be combined with any cf_branch, cf_return,
> > cf_check. It's not perfect, but still an improvement than original
> > one.
> >
> > gcc/ChangeLog:
> >
> >         * common.opt: (fcf-protection=): Add EnumSet attribute to
> >         support combination of params.
> >
> > gcc/testsuite/ChangeLog:
> >
> >         * c-c++-common/fcf-protection-10.c: New test.
> >         * c-c++-common/fcf-protection-11.c: New test.
> >         * c-c++-common/fcf-protection-12.c: New test.
> >         * c-c++-common/fcf-protection-8.c: New test.
> >         * c-c++-common/fcf-protection-9.c: New test.
> >         * gcc.target/i386/pr89701-1.c: New test.
> >         * gcc.target/i386/pr89701-2.c: New test.
> >         * gcc.target/i386/pr89701-3.c: New test.
> > ---
> >  gcc/common.opt                                 | 12 ++++++------
> >  gcc/testsuite/c-c++-common/fcf-protection-10.c |  2 ++
> >  gcc/testsuite/c-c++-common/fcf-protection-11.c |  2 ++
> >  gcc/testsuite/c-c++-common/fcf-protection-12.c |  2 ++
> >  gcc/testsuite/c-c++-common/fcf-protection-8.c  |  2 ++
> >  gcc/testsuite/c-c++-common/fcf-protection-9.c  |  2 ++
> >  gcc/testsuite/gcc.target/i386/pr89701-1.c      |  4 ++++
> >  gcc/testsuite/gcc.target/i386/pr89701-2.c      |  4 ++++
> >  gcc/testsuite/gcc.target/i386/pr89701-3.c      |  4 ++++
> >  9 files changed, 28 insertions(+), 6 deletions(-)
> >  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-10.c
> >  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-11.c
> >  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-12.c
> >  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-8.c
> >  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-9.c
> >  create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-1.c
> >  create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-2.c
> >  create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-3.c
> >
> > diff --git a/gcc/common.opt b/gcc/common.opt
> > index a28ca13385a..02f2472959a 100644
> > --- a/gcc/common.opt
> > +++ b/gcc/common.opt
> > @@ -1886,7 +1886,7 @@ fcf-protection
> >  Common RejectNegative Alias(fcf-protection=,full)
> >
> >  fcf-protection=
> > -Common Joined RejectNegative Enum(cf_protection_level) Var(flag_cf_protection) Init(CF_NONE)
> > +Common Joined RejectNegative Enum(cf_protection_level) EnumSet Var(flag_cf_protection) Init(CF_NONE)
> >  -fcf-protection=[full|branch|return|none|check]        Instrument functions with checks to verify jump/call/return control-flow transfer
> >  instructions have valid targets.
> >
> > @@ -1894,19 +1894,19 @@ Enum
> >  Name(cf_protection_level) Type(enum cf_protection_level) UnknownError(unknown Control-Flow Protection Level %qs)
> >
> >  EnumValue
> > -Enum(cf_protection_level) String(full) Value(CF_FULL)
> > +Enum(cf_protection_level) String(full) Value(CF_FULL) Set(1)
> >
> >  EnumValue
> > -Enum(cf_protection_level) String(branch) Value(CF_BRANCH)
> > +Enum(cf_protection_level) String(branch) Value(CF_BRANCH) Set(2)
> >
> >  EnumValue
> > -Enum(cf_protection_level) String(return) Value(CF_RETURN)
> > +Enum(cf_protection_level) String(return) Value(CF_RETURN) Set(3)
> >
> >  EnumValue
> > -Enum(cf_protection_level) String(check) Value(CF_CHECK)
> > +Enum(cf_protection_level) String(check) Value(CF_CHECK) Set(4)
> >
> >  EnumValue
> > -Enum(cf_protection_level) String(none) Value(CF_NONE)
> > +Enum(cf_protection_level) String(none) Value(CF_NONE) Set(1)
> >
> >  finstrument-functions
> >  Common Var(flag_instrument_function_entry_exit,1)
> > diff --git a/gcc/testsuite/c-c++-common/fcf-protection-10.c b/gcc/testsuite/c-c++-common/fcf-protection-10.c
> > new file mode 100644
> > index 00000000000..b271d134e52
> > --- /dev/null
> > +++ b/gcc/testsuite/c-c++-common/fcf-protection-10.c
> > @@ -0,0 +1,2 @@
> > +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> > +/* { dg-options "-fcf-protection=branch,check" } */
> > diff --git a/gcc/testsuite/c-c++-common/fcf-protection-11.c b/gcc/testsuite/c-c++-common/fcf-protection-11.c
> > new file mode 100644
> > index 00000000000..2e566350ccd
> > --- /dev/null
> > +++ b/gcc/testsuite/c-c++-common/fcf-protection-11.c
> > @@ -0,0 +1,2 @@
> > +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> > +/* { dg-options "-fcf-protection=branch,return" } */
> > diff --git a/gcc/testsuite/c-c++-common/fcf-protection-12.c b/gcc/testsuite/c-c++-common/fcf-protection-12.c
> > new file mode 100644
> > index 00000000000..b39c2f8e25d
> > --- /dev/null
> > +++ b/gcc/testsuite/c-c++-common/fcf-protection-12.c
> > @@ -0,0 +1,2 @@
> > +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> > +/* { dg-options "-fcf-protection=return,branch" } */
> > diff --git a/gcc/testsuite/c-c++-common/fcf-protection-8.c b/gcc/testsuite/c-c++-common/fcf-protection-8.c
> > new file mode 100644
> > index 00000000000..3b97095a92c
> > --- /dev/null
> > +++ b/gcc/testsuite/c-c++-common/fcf-protection-8.c
> > @@ -0,0 +1,2 @@
> > +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> > +/* { dg-options "-fcf-protection=branch,none" } */
> > diff --git a/gcc/testsuite/c-c++-common/fcf-protection-9.c b/gcc/testsuite/c-c++-common/fcf-protection-9.c
> > new file mode 100644
> > index 00000000000..6a37e749fcb
> > --- /dev/null
> > +++ b/gcc/testsuite/c-c++-common/fcf-protection-9.c
> > @@ -0,0 +1,2 @@
> > +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> > +/* { dg-options "-fcf-protection=branch,full" } */
> > diff --git a/gcc/testsuite/gcc.target/i386/pr89701-1.c b/gcc/testsuite/gcc.target/i386/pr89701-1.c
> > new file mode 100644
> > index 00000000000..1879c9ab4d8
> > --- /dev/null
> > +++ b/gcc/testsuite/gcc.target/i386/pr89701-1.c
> > @@ -0,0 +1,4 @@
> > +/* { dg-do compile { target *-*-linux* } } */
> > +/* { dg-options "-fcf-protection=branch,return" } */
> > +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
> > +/* { dg-final { scan-assembler-times ".long    0x3" 1 } } */
> > diff --git a/gcc/testsuite/gcc.target/i386/pr89701-2.c b/gcc/testsuite/gcc.target/i386/pr89701-2.c
> > new file mode 100644
> > index 00000000000..d5100575028
> > --- /dev/null
> > +++ b/gcc/testsuite/gcc.target/i386/pr89701-2.c
> > @@ -0,0 +1,4 @@
> > +/* { dg-do compile { target *-*-linux* } } */
> > +/* { dg-options "-fcf-protection=return,branch" } */
> > +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
> > +/* { dg-final { scan-assembler-times ".long    0x3" 1 } } */
> > diff --git a/gcc/testsuite/gcc.target/i386/pr89701-3.c b/gcc/testsuite/gcc.target/i386/pr89701-3.c
> > new file mode 100644
> > index 00000000000..88afb546fbf
> > --- /dev/null
> > +++ b/gcc/testsuite/gcc.target/i386/pr89701-3.c
> > @@ -0,0 +1,4 @@
> > +/* { dg-do compile { target *-*-linux* } } */
> > +/* { dg-options "-fcf-protection=return,none" } */
> > +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
> > +/* { dg-final { scan-assembler-times ".long    0x2" 1 } } */
> > --
> > 2.39.1.388.g2fc9e9ca3c
> >
>
>
> --
> BR,
> Hongtao

Hongtao Liu July 19, 2023, 8:37 a.m. UTC | #3

On Wed, Jul 12, 2023 at 3:27 PM Hongtao Liu <crazylht@gmail.com> wrote:
>
> ping.
>
> On Mon, May 22, 2023 at 4:08 PM Hongtao Liu <crazylht@gmail.com> wrote:
> >
> > ping.
> >
> > On Sat, May 13, 2023 at 5:20 PM liuhongt <hongtao.liu@intel.com> wrote:
> > >
> > > > I think this could be simplified if you use either EnumSet or
> > > > EnumBitSet instead in common.opt for `-fcf-protection=`.
> > >
> > > Use EnumSet instead of EnumBitSet since CF_FULL is not power of 2.
> > > It is a bit tricky for sets classification, cf_branch and cf_return
> > > should be in different sets, but they both "conflicts" cf_full,
> > > cf_none. And current EnumSet don't handle this well.
> > >
> > > So in the current implementation, only cf_full,cf_none are exclusive
> > > to each other, but they can be combined with any cf_branch, cf_return,
> > > cf_check. It's not perfect, but still an improvement than original
> > > one.
> > >
I'm going to commit this patch if there's no objection, it's just a
refactor of option -fcf-protection=.
If there's any regression observed, I will fix(or revert the patch).
> > > gcc/ChangeLog:
> > >
> > >         * common.opt: (fcf-protection=): Add EnumSet attribute to
> > >         support combination of params.
> > >
> > > gcc/testsuite/ChangeLog:
> > >
> > >         * c-c++-common/fcf-protection-10.c: New test.
> > >         * c-c++-common/fcf-protection-11.c: New test.
> > >         * c-c++-common/fcf-protection-12.c: New test.
> > >         * c-c++-common/fcf-protection-8.c: New test.
> > >         * c-c++-common/fcf-protection-9.c: New test.
> > >         * gcc.target/i386/pr89701-1.c: New test.
> > >         * gcc.target/i386/pr89701-2.c: New test.
> > >         * gcc.target/i386/pr89701-3.c: New test.
> > > ---
> > >  gcc/common.opt                                 | 12 ++++++------
> > >  gcc/testsuite/c-c++-common/fcf-protection-10.c |  2 ++
> > >  gcc/testsuite/c-c++-common/fcf-protection-11.c |  2 ++
> > >  gcc/testsuite/c-c++-common/fcf-protection-12.c |  2 ++
> > >  gcc/testsuite/c-c++-common/fcf-protection-8.c  |  2 ++
> > >  gcc/testsuite/c-c++-common/fcf-protection-9.c  |  2 ++
> > >  gcc/testsuite/gcc.target/i386/pr89701-1.c      |  4 ++++
> > >  gcc/testsuite/gcc.target/i386/pr89701-2.c      |  4 ++++
> > >  gcc/testsuite/gcc.target/i386/pr89701-3.c      |  4 ++++
> > >  9 files changed, 28 insertions(+), 6 deletions(-)
> > >  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-10.c
> > >  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-11.c
> > >  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-12.c
> > >  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-8.c
> > >  create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-9.c
> > >  create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-1.c
> > >  create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-2.c
> > >  create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-3.c
> > >
> > > diff --git a/gcc/common.opt b/gcc/common.opt
> > > index a28ca13385a..02f2472959a 100644
> > > --- a/gcc/common.opt
> > > +++ b/gcc/common.opt
> > > @@ -1886,7 +1886,7 @@ fcf-protection
> > >  Common RejectNegative Alias(fcf-protection=,full)
> > >
> > >  fcf-protection=
> > > -Common Joined RejectNegative Enum(cf_protection_level) Var(flag_cf_protection) Init(CF_NONE)
> > > +Common Joined RejectNegative Enum(cf_protection_level) EnumSet Var(flag_cf_protection) Init(CF_NONE)
> > >  -fcf-protection=[full|branch|return|none|check]        Instrument functions with checks to verify jump/call/return control-flow transfer
> > >  instructions have valid targets.
> > >
> > > @@ -1894,19 +1894,19 @@ Enum
> > >  Name(cf_protection_level) Type(enum cf_protection_level) UnknownError(unknown Control-Flow Protection Level %qs)
> > >
> > >  EnumValue
> > > -Enum(cf_protection_level) String(full) Value(CF_FULL)
> > > +Enum(cf_protection_level) String(full) Value(CF_FULL) Set(1)
> > >
> > >  EnumValue
> > > -Enum(cf_protection_level) String(branch) Value(CF_BRANCH)
> > > +Enum(cf_protection_level) String(branch) Value(CF_BRANCH) Set(2)
> > >
> > >  EnumValue
> > > -Enum(cf_protection_level) String(return) Value(CF_RETURN)
> > > +Enum(cf_protection_level) String(return) Value(CF_RETURN) Set(3)
> > >
> > >  EnumValue
> > > -Enum(cf_protection_level) String(check) Value(CF_CHECK)
> > > +Enum(cf_protection_level) String(check) Value(CF_CHECK) Set(4)
> > >
> > >  EnumValue
> > > -Enum(cf_protection_level) String(none) Value(CF_NONE)
> > > +Enum(cf_protection_level) String(none) Value(CF_NONE) Set(1)
> > >
> > >  finstrument-functions
> > >  Common Var(flag_instrument_function_entry_exit,1)
> > > diff --git a/gcc/testsuite/c-c++-common/fcf-protection-10.c b/gcc/testsuite/c-c++-common/fcf-protection-10.c
> > > new file mode 100644
> > > index 00000000000..b271d134e52
> > > --- /dev/null
> > > +++ b/gcc/testsuite/c-c++-common/fcf-protection-10.c
> > > @@ -0,0 +1,2 @@
> > > +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> > > +/* { dg-options "-fcf-protection=branch,check" } */
> > > diff --git a/gcc/testsuite/c-c++-common/fcf-protection-11.c b/gcc/testsuite/c-c++-common/fcf-protection-11.c
> > > new file mode 100644
> > > index 00000000000..2e566350ccd
> > > --- /dev/null
> > > +++ b/gcc/testsuite/c-c++-common/fcf-protection-11.c
> > > @@ -0,0 +1,2 @@
> > > +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> > > +/* { dg-options "-fcf-protection=branch,return" } */
> > > diff --git a/gcc/testsuite/c-c++-common/fcf-protection-12.c b/gcc/testsuite/c-c++-common/fcf-protection-12.c
> > > new file mode 100644
> > > index 00000000000..b39c2f8e25d
> > > --- /dev/null
> > > +++ b/gcc/testsuite/c-c++-common/fcf-protection-12.c
> > > @@ -0,0 +1,2 @@
> > > +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> > > +/* { dg-options "-fcf-protection=return,branch" } */
> > > diff --git a/gcc/testsuite/c-c++-common/fcf-protection-8.c b/gcc/testsuite/c-c++-common/fcf-protection-8.c
> > > new file mode 100644
> > > index 00000000000..3b97095a92c
> > > --- /dev/null
> > > +++ b/gcc/testsuite/c-c++-common/fcf-protection-8.c
> > > @@ -0,0 +1,2 @@
> > > +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> > > +/* { dg-options "-fcf-protection=branch,none" } */
> > > diff --git a/gcc/testsuite/c-c++-common/fcf-protection-9.c b/gcc/testsuite/c-c++-common/fcf-protection-9.c
> > > new file mode 100644
> > > index 00000000000..6a37e749fcb
> > > --- /dev/null
> > > +++ b/gcc/testsuite/c-c++-common/fcf-protection-9.c
> > > @@ -0,0 +1,2 @@
> > > +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
> > > +/* { dg-options "-fcf-protection=branch,full" } */
> > > diff --git a/gcc/testsuite/gcc.target/i386/pr89701-1.c b/gcc/testsuite/gcc.target/i386/pr89701-1.c
> > > new file mode 100644
> > > index 00000000000..1879c9ab4d8
> > > --- /dev/null
> > > +++ b/gcc/testsuite/gcc.target/i386/pr89701-1.c
> > > @@ -0,0 +1,4 @@
> > > +/* { dg-do compile { target *-*-linux* } } */
> > > +/* { dg-options "-fcf-protection=branch,return" } */
> > > +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
> > > +/* { dg-final { scan-assembler-times ".long    0x3" 1 } } */
> > > diff --git a/gcc/testsuite/gcc.target/i386/pr89701-2.c b/gcc/testsuite/gcc.target/i386/pr89701-2.c
> > > new file mode 100644
> > > index 00000000000..d5100575028
> > > --- /dev/null
> > > +++ b/gcc/testsuite/gcc.target/i386/pr89701-2.c
> > > @@ -0,0 +1,4 @@
> > > +/* { dg-do compile { target *-*-linux* } } */
> > > +/* { dg-options "-fcf-protection=return,branch" } */
> > > +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
> > > +/* { dg-final { scan-assembler-times ".long    0x3" 1 } } */
> > > diff --git a/gcc/testsuite/gcc.target/i386/pr89701-3.c b/gcc/testsuite/gcc.target/i386/pr89701-3.c
> > > new file mode 100644
> > > index 00000000000..88afb546fbf
> > > --- /dev/null
> > > +++ b/gcc/testsuite/gcc.target/i386/pr89701-3.c
> > > @@ -0,0 +1,4 @@
> > > +/* { dg-do compile { target *-*-linux* } } */
> > > +/* { dg-options "-fcf-protection=return,none" } */
> > > +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
> > > +/* { dg-final { scan-assembler-times ".long    0x2" 1 } } */
> > > --
> > > 2.39.1.388.g2fc9e9ca3c
> > >
> >
> >
> > --
> > BR,
> > Hongtao
>
>
>
> --
> BR,
> Hongtao

diff mbox series

Patch

diff --git a/gcc/common.opt b/gcc/common.opt
index a28ca13385a..02f2472959a 100644
--- a/gcc/common.opt
+++ b/gcc/common.opt
@@ -1886,7 +1886,7 @@  fcf-protection
 Common RejectNegative Alias(fcf-protection=,full)
 
 fcf-protection=
-Common Joined RejectNegative Enum(cf_protection_level) Var(flag_cf_protection) Init(CF_NONE)
+Common Joined RejectNegative Enum(cf_protection_level) EnumSet Var(flag_cf_protection) Init(CF_NONE)
 -fcf-protection=[full|branch|return|none|check]	Instrument functions with checks to verify jump/call/return control-flow transfer
 instructions have valid targets.
 
@@ -1894,19 +1894,19 @@  Enum
 Name(cf_protection_level) Type(enum cf_protection_level) UnknownError(unknown Control-Flow Protection Level %qs)
 
 EnumValue
-Enum(cf_protection_level) String(full) Value(CF_FULL)
+Enum(cf_protection_level) String(full) Value(CF_FULL) Set(1)
 
 EnumValue
-Enum(cf_protection_level) String(branch) Value(CF_BRANCH)
+Enum(cf_protection_level) String(branch) Value(CF_BRANCH) Set(2)
 
 EnumValue
-Enum(cf_protection_level) String(return) Value(CF_RETURN)
+Enum(cf_protection_level) String(return) Value(CF_RETURN) Set(3)
 
 EnumValue
-Enum(cf_protection_level) String(check) Value(CF_CHECK)
+Enum(cf_protection_level) String(check) Value(CF_CHECK) Set(4)
 
 EnumValue
-Enum(cf_protection_level) String(none) Value(CF_NONE)
+Enum(cf_protection_level) String(none) Value(CF_NONE) Set(1)
 
 finstrument-functions
 Common Var(flag_instrument_function_entry_exit,1)
diff --git a/gcc/testsuite/c-c++-common/fcf-protection-10.c b/gcc/testsuite/c-c++-common/fcf-protection-10.c
new file mode 100644
index 00000000000..b271d134e52
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/fcf-protection-10.c
@@ -0,0 +1,2 @@ 
+/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
+/* { dg-options "-fcf-protection=branch,check" } */
diff --git a/gcc/testsuite/c-c++-common/fcf-protection-11.c b/gcc/testsuite/c-c++-common/fcf-protection-11.c
new file mode 100644
index 00000000000..2e566350ccd
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/fcf-protection-11.c
@@ -0,0 +1,2 @@ 
+/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
+/* { dg-options "-fcf-protection=branch,return" } */
diff --git a/gcc/testsuite/c-c++-common/fcf-protection-12.c b/gcc/testsuite/c-c++-common/fcf-protection-12.c
new file mode 100644
index 00000000000..b39c2f8e25d
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/fcf-protection-12.c
@@ -0,0 +1,2 @@ 
+/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
+/* { dg-options "-fcf-protection=return,branch" } */
diff --git a/gcc/testsuite/c-c++-common/fcf-protection-8.c b/gcc/testsuite/c-c++-common/fcf-protection-8.c
new file mode 100644
index 00000000000..3b97095a92c
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/fcf-protection-8.c
@@ -0,0 +1,2 @@ 
+/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
+/* { dg-options "-fcf-protection=branch,none" } */
diff --git a/gcc/testsuite/c-c++-common/fcf-protection-9.c b/gcc/testsuite/c-c++-common/fcf-protection-9.c
new file mode 100644
index 00000000000..6a37e749fcb
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/fcf-protection-9.c
@@ -0,0 +1,2 @@ 
+/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */
+/* { dg-options "-fcf-protection=branch,full" } */
diff --git a/gcc/testsuite/gcc.target/i386/pr89701-1.c b/gcc/testsuite/gcc.target/i386/pr89701-1.c
new file mode 100644
index 00000000000..1879c9ab4d8
--- /dev/null
+++ b/gcc/testsuite/gcc.target/i386/pr89701-1.c
@@ -0,0 +1,4 @@ 
+/* { dg-do compile { target *-*-linux* } } */
+/* { dg-options "-fcf-protection=branch,return" } */
+/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
+/* { dg-final { scan-assembler-times ".long	0x3" 1 } } */
diff --git a/gcc/testsuite/gcc.target/i386/pr89701-2.c b/gcc/testsuite/gcc.target/i386/pr89701-2.c
new file mode 100644
index 00000000000..d5100575028
--- /dev/null
+++ b/gcc/testsuite/gcc.target/i386/pr89701-2.c
@@ -0,0 +1,4 @@ 
+/* { dg-do compile { target *-*-linux* } } */
+/* { dg-options "-fcf-protection=return,branch" } */
+/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
+/* { dg-final { scan-assembler-times ".long	0x3" 1 } } */
diff --git a/gcc/testsuite/gcc.target/i386/pr89701-3.c b/gcc/testsuite/gcc.target/i386/pr89701-3.c
new file mode 100644
index 00000000000..88afb546fbf
--- /dev/null
+++ b/gcc/testsuite/gcc.target/i386/pr89701-3.c
@@ -0,0 +1,4 @@ 
+/* { dg-do compile { target *-*-linux* } } */
+/* { dg-options "-fcf-protection=return,none" } */
+/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */
+/* { dg-final { scan-assembler-times ".long	0x2" 1 } } */