d8f365
From 88bf1c3910e4cf97dcb85c6d32291c23e572a516 Mon Sep 17 00:00:00 2001
d8f365
From: "H.J. Lu" <hjl.tools@gmail.com>
d8f365
Date: Wed, 27 Oct 2021 07:48:54 -0700
d8f365
Subject: [PATCH 1/4] x86: Add -mharden-sls=[none|all|return|indirect-branch]
d8f365
d8f365
Add -mharden-sls= to mitigate against straight line speculation (SLS)
d8f365
for function return and indirect branch by adding an INT3 instruction
d8f365
after function return and indirect branch.
d8f365
d8f365
gcc/
d8f365
d8f365
	PR target/102952
d8f365
	* config/i386/i386-opts.h (harden_sls): New enum.
d8f365
	* config/i386/i386.c (output_indirect_thunk): Mitigate against
d8f365
	SLS for function return.
d8f365
	(ix86_output_function_return): Likewise.
d8f365
	(ix86_output_jmp_thunk_or_indirect): Mitigate against indirect
d8f365
	branch.
d8f365
	(ix86_output_indirect_jmp): Likewise.
d8f365
	(ix86_output_call_insn): Likewise.
d8f365
	* config/i386/i386.opt: Add -mharden-sls=.
d8f365
	* doc/invoke.texi: Document -mharden-sls=.
d8f365
d8f365
gcc/testsuite/
d8f365
d8f365
	PR target/102952
d8f365
	* gcc.target/i386/harden-sls-1.c: New test.
d8f365
	* gcc.target/i386/harden-sls-2.c: Likewise.
d8f365
	* gcc.target/i386/harden-sls-3.c: Likewise.
d8f365
	* gcc.target/i386/harden-sls-4.c: Likewise.
d8f365
	* gcc.target/i386/harden-sls-5.c: Likewise.
d8f365
d8f365
(cherry picked from commit 53a643f8568067d7700a9f2facc8ba39974973d3)
d8f365
---
d8f365
 gcc/config/i386/i386-opts.h                  |  7 +++++++
d8f365
 gcc/config/i386/i386.c                       | 22 +++++++++++++++-----
d8f365
 gcc/config/i386/i386.opt                     | 20 ++++++++++++++++++
d8f365
 gcc/doc/invoke.texi                          | 10 ++++++++-
d8f365
 gcc/testsuite/gcc.target/i386/harden-sls-1.c | 14 +++++++++++++
d8f365
 gcc/testsuite/gcc.target/i386/harden-sls-2.c | 14 +++++++++++++
d8f365
 gcc/testsuite/gcc.target/i386/harden-sls-3.c | 14 +++++++++++++
d8f365
 gcc/testsuite/gcc.target/i386/harden-sls-4.c | 16 ++++++++++++++
d8f365
 gcc/testsuite/gcc.target/i386/harden-sls-5.c | 17 +++++++++++++++
d8f365
 9 files changed, 128 insertions(+), 6 deletions(-)
d8f365
 create mode 100644 gcc/testsuite/gcc.target/i386/harden-sls-1.c
d8f365
 create mode 100644 gcc/testsuite/gcc.target/i386/harden-sls-2.c
d8f365
 create mode 100644 gcc/testsuite/gcc.target/i386/harden-sls-3.c
d8f365
 create mode 100644 gcc/testsuite/gcc.target/i386/harden-sls-4.c
d8f365
 create mode 100644 gcc/testsuite/gcc.target/i386/harden-sls-5.c
d8f365
d8f365
diff --git a/gcc/config/i386/i386-opts.h b/gcc/config/i386/i386-opts.h
d8f365
index 46366cbfa72..34718b6d52c 100644
d8f365
--- a/gcc/config/i386/i386-opts.h
d8f365
+++ b/gcc/config/i386/i386-opts.h
d8f365
@@ -119,4 +119,11 @@ enum indirect_branch {
d8f365
   indirect_branch_thunk_extern
d8f365
 };
d8f365
 
d8f365
+enum harden_sls {
d8f365
+  harden_sls_none = 0,
d8f365
+  harden_sls_return = 1 << 0,
d8f365
+  harden_sls_indirect_branch = 1 << 1,
d8f365
+  harden_sls_all = harden_sls_return | harden_sls_indirect_branch
d8f365
+};
d8f365
+
d8f365
 #endif
d8f365
diff --git a/gcc/config/i386/i386.c b/gcc/config/i386/i386.c
d8f365
index 31502774ef3..eb9303f8742 100644
d8f365
--- a/gcc/config/i386/i386.c
d8f365
+++ b/gcc/config/i386/i386.c
d8f365
@@ -10977,6 +10977,9 @@ output_indirect_thunk (enum indirect_thunk_prefix need_prefix,
d8f365
     fputs ("\tbnd ret\n", asm_out_file);
d8f365
   else
d8f365
     fputs ("\tret\n", asm_out_file);
d8f365
+
d8f365
+  if ((ix86_harden_sls & harden_sls_return))
d8f365
+    fputs ("\tint3\n", asm_out_file);
d8f365
 }
d8f365
 
d8f365
 /* Output a funtion with a call and return thunk for indirect branch.
d8f365
@@ -28728,6 +28731,8 @@ ix86_output_jmp_thunk_or_indirect (const char *thunk_name,
d8f365
 	fprintf (asm_out_file, "\tjmp\t");
d8f365
       assemble_name (asm_out_file, thunk_name);
d8f365
       putc ('\n', asm_out_file);
d8f365
+      if ((ix86_harden_sls & harden_sls_indirect_branch))
d8f365
+	fputs ("\tint3\n", asm_out_file);
d8f365
     }
d8f365
   else
d8f365
     output_indirect_thunk (need_prefix, regno);
d8f365
@@ -28973,10 +28978,10 @@ ix86_output_indirect_jmp (rtx call_op)
d8f365
 	gcc_unreachable ();
d8f365
 
d8f365
       ix86_output_indirect_branch (call_op, "%0", true);
d8f365
-      return "";
d8f365
     }
d8f365
   else
d8f365
-    return "%!jmp\t%A0";
d8f365
+    output_asm_insn ("%!jmp\t%A0", &call_op);
d8f365
+  return (ix86_harden_sls & harden_sls_indirect_branch) ? "int3" : "";
d8f365
 }
d8f365
 
d8f365
 /* Output function return.  CALL_OP is the jump target.  Add a REP
d8f365
@@ -29018,9 +29023,11 @@ ix86_output_function_return (bool long_p)
d8f365
     }
d8f365
 
d8f365
   if (!long_p || ix86_bnd_prefixed_insn_p (current_output_insn))
d8f365
-    return "%!ret";
d8f365
+    output_asm_insn ("%!ret", NULL);
d8f365
+  else
d8f365
+    output_asm_insn ("rep%; ret", NULL);
d8f365
 
d8f365
-  return "rep%; ret";
d8f365
+  return (ix86_harden_sls & harden_sls_return) ? "int3" : "";
d8f365
 }
d8f365
 
d8f365
 /* Output indirect function return.  RET_OP is the function return
d8f365
@@ -29158,7 +29165,12 @@ ix86_output_call_insn (rtx_insn *insn, rtx call_op)
d8f365
       if (output_indirect_p && !direct_p)
d8f365
 	ix86_output_indirect_branch (call_op, xasm, true);
d8f365
       else
d8f365
-	output_asm_insn (xasm, &call_op);
d8f365
+	{
d8f365
+	  output_asm_insn (xasm, &call_op);
d8f365
+	  if (!direct_p
d8f365
+	      && (ix86_harden_sls & harden_sls_indirect_branch))
d8f365
+	    return "int3";
d8f365
+	}
d8f365
       return "";
d8f365
     }
d8f365
 
d8f365
diff --git a/gcc/config/i386/i386.opt b/gcc/config/i386/i386.opt
d8f365
index d9bd909a885..3ae48609e25 100644
d8f365
--- a/gcc/config/i386/i386.opt
d8f365
+++ b/gcc/config/i386/i386.opt
d8f365
@@ -1055,3 +1055,23 @@ Support MOVDIRI built-in functions and code generation.
d8f365
 mmovdir64b
d8f365
 Target Report Mask(ISA_MOVDIR64B) Var(ix86_isa_flags2) Save
d8f365
 Support MOVDIR64B built-in functions and code generation.
d8f365
+
d8f365
+mharden-sls=
d8f365
+Target RejectNegative Joined Enum(harden_sls) Var(ix86_harden_sls) Init(harden_sls_none)
d8f365
+Generate code to mitigate against straight line speculation.
d8f365
+
d8f365
+Enum
d8f365
+Name(harden_sls) Type(enum harden_sls)
d8f365
+Known choices for mitigation against straight line speculation with -mharden-sls=:
d8f365
+
d8f365
+EnumValue
d8f365
+Enum(harden_sls) String(none) Value(harden_sls_none)
d8f365
+
d8f365
+EnumValue
d8f365
+Enum(harden_sls) String(return) Value(harden_sls_return)
d8f365
+
d8f365
+EnumValue
d8f365
+Enum(harden_sls) String(indirect-branch) Value(harden_sls_indirect_branch)
d8f365
+
d8f365
+EnumValue
d8f365
+Enum(harden_sls) String(all) Value(harden_sls_all)
d8f365
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
d8f365
index 78ca7738df2..1e20efd6969 100644
d8f365
--- a/gcc/doc/invoke.texi
d8f365
+++ b/gcc/doc/invoke.texi
d8f365
@@ -1284,7 +1284,7 @@ See RS/6000 and PowerPC Options.
d8f365
 -mstack-protector-guard-symbol=@var{symbol} -mmitigate-rop @gol
d8f365
 -mgeneral-regs-only -mcall-ms2sysv-xlogues @gol
d8f365
 -mindirect-branch=@var{choice} -mfunction-return=@var{choice} @gol
d8f365
--mindirect-branch-register}
d8f365
+-mindirect-branch-register -mharden-sls=@var{choice}}
d8f365
 
d8f365
 @emph{x86 Windows Options}
d8f365
 @gccoptlist{-mconsole  -mcygwin  -mno-cygwin  -mdll @gol
d8f365
@@ -28036,6 +28036,14 @@ not be reachable in the large code model.
d8f365
 @opindex -mindirect-branch-register
d8f365
 Force indirect call and jump via register.
d8f365
 
d8f365
+@item -mharden-sls=@var{choice}
d8f365
+@opindex mharden-sls
d8f365
+Generate code to mitigate against straight line speculation (SLS) with
d8f365
+@var{choice}.  The default is @samp{none} which disables all SLS
d8f365
+hardening.  @samp{return} enables SLS hardening for function return.
d8f365
+@samp{indirect-branch} enables SLS hardening for indirect branch.
d8f365
+@samp{all} enables all SLS hardening.
d8f365
+
d8f365
 @end table
d8f365
 
d8f365
 These @samp{-m} switches are supported in addition to the above
d8f365
diff --git a/gcc/testsuite/gcc.target/i386/harden-sls-1.c b/gcc/testsuite/gcc.target/i386/harden-sls-1.c
d8f365
new file mode 100644
d8f365
index 00000000000..6f70dc94a23
d8f365
--- /dev/null
d8f365
+++ b/gcc/testsuite/gcc.target/i386/harden-sls-1.c
d8f365
@@ -0,0 +1,14 @@
d8f365
+/* { dg-do compile } */
d8f365
+/* { dg-options "-O2 -mindirect-branch=thunk-extern -mharden-sls=all" } */
d8f365
+/* { dg-additional-options "-fno-pic" { target { ! *-*-darwin* } } } */
d8f365
+
d8f365
+extern void foo (void);
d8f365
+
d8f365
+void
d8f365
+bar (void)
d8f365
+{
d8f365
+  foo ();
d8f365
+}
d8f365
+
d8f365
+/* { dg-final { scan-assembler "jmp\[ \t\]+_?foo" } } */
d8f365
+/* { dg-final { scan-assembler-not {int3} } } */
d8f365
diff --git a/gcc/testsuite/gcc.target/i386/harden-sls-2.c b/gcc/testsuite/gcc.target/i386/harden-sls-2.c
d8f365
new file mode 100644
d8f365
index 00000000000..a7c59078d03
d8f365
--- /dev/null
d8f365
+++ b/gcc/testsuite/gcc.target/i386/harden-sls-2.c
d8f365
@@ -0,0 +1,14 @@
d8f365
+/* { dg-do compile } */
d8f365
+/* { dg-options "-O2 -mindirect-branch=thunk-extern -mharden-sls=all" } */
d8f365
+/* { dg-additional-options "-fno-pic" { target { ! *-*-darwin* } } } */
d8f365
+
d8f365
+extern void (*fptr) (void);
d8f365
+
d8f365
+void
d8f365
+foo (void)
d8f365
+{
d8f365
+  fptr ();
d8f365
+}
d8f365
+
d8f365
+/* { dg-final { scan-assembler "jmp\[ \t\]+_?__x86_indirect_thunk_(r|e)ax" } } */
d8f365
+/* { dg-final { scan-assembler-times "int3" 1 } } */
d8f365
diff --git a/gcc/testsuite/gcc.target/i386/harden-sls-3.c b/gcc/testsuite/gcc.target/i386/harden-sls-3.c
d8f365
new file mode 100644
d8f365
index 00000000000..1a6056b6d7b
d8f365
--- /dev/null
d8f365
+++ b/gcc/testsuite/gcc.target/i386/harden-sls-3.c
d8f365
@@ -0,0 +1,14 @@
d8f365
+/* { dg-do compile } */
d8f365
+/* { dg-options "-O2 -mindirect-branch=thunk -mharden-sls=all" } */
d8f365
+/* { dg-additional-options "-fno-pic" { target { ! *-*-darwin* } } } */
d8f365
+
d8f365
+extern void (*fptr) (void);
d8f365
+
d8f365
+void
d8f365
+foo (void)
d8f365
+{
d8f365
+  fptr ();
d8f365
+}
d8f365
+
d8f365
+/* { dg-final { scan-assembler "jmp\[ \t\]+_?__x86_indirect_thunk_(r|e)ax" } } */
d8f365
+/* { dg-final { scan-assembler-times "int3" 2 } } */
d8f365
diff --git a/gcc/testsuite/gcc.target/i386/harden-sls-4.c b/gcc/testsuite/gcc.target/i386/harden-sls-4.c
d8f365
new file mode 100644
d8f365
index 00000000000..f70dd1379d3
d8f365
--- /dev/null
d8f365
+++ b/gcc/testsuite/gcc.target/i386/harden-sls-4.c
d8f365
@@ -0,0 +1,16 @@
d8f365
+/* { dg-do compile } */
d8f365
+/* { dg-options "-O2 -mindirect-branch=keep -mharden-sls=all" } */
d8f365
+/* { dg-additional-options "-fno-pic" { target { ! *-*-darwin* } } } */
d8f365
+
d8f365
+extern void (*fptr) (void);
d8f365
+
d8f365
+void
d8f365
+foo (void)
d8f365
+{
d8f365
+  fptr ();
d8f365
+}
d8f365
+
d8f365
+/* { dg-final { scan-assembler "jmp\[ \t\]+\\*_?fptr" { target { ! x32 } } } } */
d8f365
+/* { dg-final { scan-assembler "movl\[ \t\]+fptr\\(%rip\\), %eax" { target x32 } } } */
d8f365
+/* { dg-final { scan-assembler "jmp\[ \t\]+\\*%rax" { target x32 } } } */
d8f365
+/* { dg-final { scan-assembler-times "int3" 1 } } */
d8f365
diff --git a/gcc/testsuite/gcc.target/i386/harden-sls-5.c b/gcc/testsuite/gcc.target/i386/harden-sls-5.c
d8f365
new file mode 100644
d8f365
index 00000000000..613c44c6f82
d8f365
--- /dev/null
d8f365
+++ b/gcc/testsuite/gcc.target/i386/harden-sls-5.c
d8f365
@@ -0,0 +1,17 @@
d8f365
+/* { dg-do compile } */
d8f365
+/* { dg-options "-O2 -mno-indirect-branch-register -mfunction-return=keep -mindirect-branch=thunk-extern -mharden-sls=return" } */
d8f365
+/* { dg-additional-options "-fno-pic" { target { ! *-*-darwin* } } } */
d8f365
+
d8f365
+typedef void (*dispatch_t)(long offset);
d8f365
+
d8f365
+dispatch_t dispatch;
d8f365
+
d8f365
+int
d8f365
+male_indirect_jump (long offset)
d8f365
+{
d8f365
+  dispatch(offset);
d8f365
+  return 0;
d8f365
+}
d8f365
+
d8f365
+/* { dg-final { scan-assembler-times "ret" 1 } } */
d8f365
+/* { dg-final { scan-assembler-times "int3" 1 } } */
d8f365
-- 
d8f365
2.36.1
d8f365