From patchwork Sat May 13 09:20:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: liuhongt X-Patchwork-Id: 93493 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp5660343vqo; Sat, 13 May 2023 02:21:42 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ5yAsoyKXTtC0kpCkf7QcRIiyLnmIXObm9M8RLa9hGHZ4u70kPBNsv+wYSzUVMKYGPxY8b4 X-Received: by 2002:a17:907:3207:b0:957:48c8:b081 with SMTP id xg7-20020a170907320700b0095748c8b081mr20691095ejb.24.1683969702486; Sat, 13 May 2023 02:21:42 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683969702; cv=none; d=google.com; s=arc-20160816; b=HB+GyhcWKgmsXPzryJcgr4zIbqJT6S4Nd7WeuEOBWzve9BkGiRbjmoE1yqfz8w6QTM S/l3VNEL5blE6vFHzfST2HYcAtS7l9CZJnE39AC0QBuaQZBBaK0zwDDaQNftb4rZ/KXm QH3Z79Kfhs9tFK4403fdZSZUjgi7S7zkMfEHZEjJXhNuKZaQetsixDMNjtk+qf6A+fga 4WKn8NfwAIVaTsxzf7LM767A92GMoqT5uglgGW7E5Q5Z2UDtgFMic3v5ws/D/3AglTeR HQl/wzcmPB0t4mmHjlqmDb9Yg7FaZG/ygXJm+PMzFsoF9fMz8mzXd4Dm5T+q1aXTs63B inHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:dmarc-filter:delivered-to :dkim-signature:dkim-filter; bh=T4eFI6f8jZiSI1yAkQjxCNwTXxl4/O/KlwGpXfqWILo=; b=mzsz/BfdFzirjmgEo+227LXNWZZES4m6FkEb6PyxXOdUNoyb4mP/yXt3Sr5IudFX+6 T8lhrHmb6PlsSPW+cxpBEzNUB3AhNop6IAr1L/QHS0fD0LLTHcGvj8nWKSmvN1lTZUvJ sZS7HRW+3wz4nCTrsUOCLrgaO+hUTj1QtmUv+GB4iA4CajeYbvigQWV/rQdNRjjz9vew Ksf+/+lWWF6uogfK8648FCRPE84N/0fOPs/X2TaySJLJMJfqlNSzJFIqgT7fOgPyGgnK Nf/Fp5m8G39jWpZDlQatlra3UNXXTtUyohuGLp1HoEKjomXuYH4op4JJNozvX/dA4zsZ DGiw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=CFYAQRrr; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id fb15-20020a1709073a0f00b00965d0f5f8desi8403894ejc.850.2023.05.13.02.21.42 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 13 May 2023 02:21:42 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org header.s=default header.b=CFYAQRrr; spf=pass (google.com: domain of gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=gnu.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 18543385701E for ; Sat, 13 May 2023 09:21:41 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 18543385701E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1683969701; bh=T4eFI6f8jZiSI1yAkQjxCNwTXxl4/O/KlwGpXfqWILo=; h=To:Cc:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=CFYAQRrryhsXDRVhIeP+q7ytMqEBIFCIwV+O7Wp7i9p9M+twhHjWKGhkrqO8XIom9 qCQoCoSz+sp4+D9IDySRfwmL0yfH0VKkFExz9E8RyfZ5ZbkdjHhS6xI9eissg9sSJY A9BqZCtcF+qoMwkscHw4JwP/5qrxfNLbYHZpjeRw= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by sourceware.org (Postfix) with ESMTPS id B50653858421 for ; Sat, 13 May 2023 09:20:52 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B50653858421 X-IronPort-AV: E=McAfee;i="6600,9927,10708"; a="437277590" X-IronPort-AV: E=Sophos;i="5.99,271,1677571200"; d="scan'208";a="437277590" Received: from orsmga007.jf.intel.com ([10.7.209.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 May 2023 02:20:51 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10708"; a="694501841" X-IronPort-AV: E=Sophos;i="5.99,271,1677571200"; d="scan'208";a="694501841" Received: from shvmail03.sh.intel.com ([10.239.245.20]) by orsmga007.jf.intel.com with ESMTP; 13 May 2023 02:20:44 -0700 Received: from shliclel4217.sh.intel.com (shliclel4217.sh.intel.com [10.239.240.127]) by shvmail03.sh.intel.com (Postfix) with ESMTP id D26B11007BA7; Sat, 13 May 2023 17:20:42 +0800 (CST) To: gcc-patches@gcc.gnu.org Cc: crazylht@gmail.com, hjl.tools@gmail.com Subject: [PATCH V2] Provide -fcf-protection=branch,return. Date: Sat, 13 May 2023 17:20:42 +0800 Message-Id: <20230513092042.3927038-1-hongtao.liu@intel.com> X-Mailer: git-send-email 2.39.1.388.g2fc9e9ca3c In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-12.1 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, KAM_SHORT, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: liuhongt via Gcc-patches From: liuhongt Reply-To: liuhongt Errors-To: gcc-patches-bounces+ouuuleilei=gmail.com@gcc.gnu.org Sender: "Gcc-patches" X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765666019261924849?= X-GMAIL-MSGID: =?utf-8?q?1765770215092115727?= > I think this could be simplified if you use either EnumSet or > EnumBitSet instead in common.opt for `-fcf-protection=`. Use EnumSet instead of EnumBitSet since CF_FULL is not power of 2. It is a bit tricky for sets classification, cf_branch and cf_return should be in different sets, but they both "conflicts" cf_full, cf_none. And current EnumSet don't handle this well. So in the current implementation, only cf_full,cf_none are exclusive to each other, but they can be combined with any cf_branch, cf_return, cf_check. It's not perfect, but still an improvement than original one. gcc/ChangeLog: * common.opt: (fcf-protection=): Add EnumSet attribute to support combination of params. gcc/testsuite/ChangeLog: * c-c++-common/fcf-protection-10.c: New test. * c-c++-common/fcf-protection-11.c: New test. * c-c++-common/fcf-protection-12.c: New test. * c-c++-common/fcf-protection-8.c: New test. * c-c++-common/fcf-protection-9.c: New test. * gcc.target/i386/pr89701-1.c: New test. * gcc.target/i386/pr89701-2.c: New test. * gcc.target/i386/pr89701-3.c: New test. --- gcc/common.opt | 12 ++++++------ gcc/testsuite/c-c++-common/fcf-protection-10.c | 2 ++ gcc/testsuite/c-c++-common/fcf-protection-11.c | 2 ++ gcc/testsuite/c-c++-common/fcf-protection-12.c | 2 ++ gcc/testsuite/c-c++-common/fcf-protection-8.c | 2 ++ gcc/testsuite/c-c++-common/fcf-protection-9.c | 2 ++ gcc/testsuite/gcc.target/i386/pr89701-1.c | 4 ++++ gcc/testsuite/gcc.target/i386/pr89701-2.c | 4 ++++ gcc/testsuite/gcc.target/i386/pr89701-3.c | 4 ++++ 9 files changed, 28 insertions(+), 6 deletions(-) create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-10.c create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-11.c create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-12.c create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-8.c create mode 100644 gcc/testsuite/c-c++-common/fcf-protection-9.c create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-1.c create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-2.c create mode 100644 gcc/testsuite/gcc.target/i386/pr89701-3.c diff --git a/gcc/common.opt b/gcc/common.opt index a28ca13385a..02f2472959a 100644 --- a/gcc/common.opt +++ b/gcc/common.opt @@ -1886,7 +1886,7 @@ fcf-protection Common RejectNegative Alias(fcf-protection=,full) fcf-protection= -Common Joined RejectNegative Enum(cf_protection_level) Var(flag_cf_protection) Init(CF_NONE) +Common Joined RejectNegative Enum(cf_protection_level) EnumSet Var(flag_cf_protection) Init(CF_NONE) -fcf-protection=[full|branch|return|none|check] Instrument functions with checks to verify jump/call/return control-flow transfer instructions have valid targets. @@ -1894,19 +1894,19 @@ Enum Name(cf_protection_level) Type(enum cf_protection_level) UnknownError(unknown Control-Flow Protection Level %qs) EnumValue -Enum(cf_protection_level) String(full) Value(CF_FULL) +Enum(cf_protection_level) String(full) Value(CF_FULL) Set(1) EnumValue -Enum(cf_protection_level) String(branch) Value(CF_BRANCH) +Enum(cf_protection_level) String(branch) Value(CF_BRANCH) Set(2) EnumValue -Enum(cf_protection_level) String(return) Value(CF_RETURN) +Enum(cf_protection_level) String(return) Value(CF_RETURN) Set(3) EnumValue -Enum(cf_protection_level) String(check) Value(CF_CHECK) +Enum(cf_protection_level) String(check) Value(CF_CHECK) Set(4) EnumValue -Enum(cf_protection_level) String(none) Value(CF_NONE) +Enum(cf_protection_level) String(none) Value(CF_NONE) Set(1) finstrument-functions Common Var(flag_instrument_function_entry_exit,1) diff --git a/gcc/testsuite/c-c++-common/fcf-protection-10.c b/gcc/testsuite/c-c++-common/fcf-protection-10.c new file mode 100644 index 00000000000..b271d134e52 --- /dev/null +++ b/gcc/testsuite/c-c++-common/fcf-protection-10.c @@ -0,0 +1,2 @@ +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */ +/* { dg-options "-fcf-protection=branch,check" } */ diff --git a/gcc/testsuite/c-c++-common/fcf-protection-11.c b/gcc/testsuite/c-c++-common/fcf-protection-11.c new file mode 100644 index 00000000000..2e566350ccd --- /dev/null +++ b/gcc/testsuite/c-c++-common/fcf-protection-11.c @@ -0,0 +1,2 @@ +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */ +/* { dg-options "-fcf-protection=branch,return" } */ diff --git a/gcc/testsuite/c-c++-common/fcf-protection-12.c b/gcc/testsuite/c-c++-common/fcf-protection-12.c new file mode 100644 index 00000000000..b39c2f8e25d --- /dev/null +++ b/gcc/testsuite/c-c++-common/fcf-protection-12.c @@ -0,0 +1,2 @@ +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */ +/* { dg-options "-fcf-protection=return,branch" } */ diff --git a/gcc/testsuite/c-c++-common/fcf-protection-8.c b/gcc/testsuite/c-c++-common/fcf-protection-8.c new file mode 100644 index 00000000000..3b97095a92c --- /dev/null +++ b/gcc/testsuite/c-c++-common/fcf-protection-8.c @@ -0,0 +1,2 @@ +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */ +/* { dg-options "-fcf-protection=branch,none" } */ diff --git a/gcc/testsuite/c-c++-common/fcf-protection-9.c b/gcc/testsuite/c-c++-common/fcf-protection-9.c new file mode 100644 index 00000000000..6a37e749fcb --- /dev/null +++ b/gcc/testsuite/c-c++-common/fcf-protection-9.c @@ -0,0 +1,2 @@ +/* { dg-do compile { target { "i?86-*-* x86_64-*-*" } } } */ +/* { dg-options "-fcf-protection=branch,full" } */ diff --git a/gcc/testsuite/gcc.target/i386/pr89701-1.c b/gcc/testsuite/gcc.target/i386/pr89701-1.c new file mode 100644 index 00000000000..1879c9ab4d8 --- /dev/null +++ b/gcc/testsuite/gcc.target/i386/pr89701-1.c @@ -0,0 +1,4 @@ +/* { dg-do compile { target *-*-linux* } } */ +/* { dg-options "-fcf-protection=branch,return" } */ +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */ +/* { dg-final { scan-assembler-times ".long 0x3" 1 } } */ diff --git a/gcc/testsuite/gcc.target/i386/pr89701-2.c b/gcc/testsuite/gcc.target/i386/pr89701-2.c new file mode 100644 index 00000000000..d5100575028 --- /dev/null +++ b/gcc/testsuite/gcc.target/i386/pr89701-2.c @@ -0,0 +1,4 @@ +/* { dg-do compile { target *-*-linux* } } */ +/* { dg-options "-fcf-protection=return,branch" } */ +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */ +/* { dg-final { scan-assembler-times ".long 0x3" 1 } } */ diff --git a/gcc/testsuite/gcc.target/i386/pr89701-3.c b/gcc/testsuite/gcc.target/i386/pr89701-3.c new file mode 100644 index 00000000000..88afb546fbf --- /dev/null +++ b/gcc/testsuite/gcc.target/i386/pr89701-3.c @@ -0,0 +1,4 @@ +/* { dg-do compile { target *-*-linux* } } */ +/* { dg-options "-fcf-protection=return,none" } */ +/* { dg-final { scan-assembler-times ".note.gnu.property" 1 } } */ +/* { dg-final { scan-assembler-times ".long 0x2" 1 } } */