[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[cvs-commit at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #19 from CVS Commits  ---
The releases/gcc-9 branch has been updated by H.J. Lu :

https://gcc.gnu.org/g:5ed78f8bd84eb696579d928c816bc840664829b2

commit r9-9792-g5ed78f8bd84eb696579d928c816bc840664829b2
Author: H.J. Lu 
Date:   Thu Oct 21 09:45:14 2021 -0700

x86: Document -fcf-protection requires i686 or newer

PR target/98667
* doc/invoke.texi: Document -fcf-protection requires i686 or
new.

(cherry picked from commit 1373066a46d8d47abd97e46a005aef3b3dbfe94a)

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[cvs-commit at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #18 from CVS Commits  ---
The releases/gcc-10 branch has been updated by H.J. Lu :

https://gcc.gnu.org/g:523dc71f5cb858da18e1f648269746dab519b445

commit r10-10228-g523dc71f5cb858da18e1f648269746dab519b445
Author: H.J. Lu 
Date:   Thu Oct 21 09:45:14 2021 -0700

x86: Document -fcf-protection requires i686 or newer

PR target/98667
* doc/invoke.texi: Document -fcf-protection requires i686 or
new.

(cherry picked from commit 1373066a46d8d47abd97e46a005aef3b3dbfe94a)

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[cvs-commit at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #17 from CVS Commits  ---
The releases/gcc-11 branch has been updated by H.J. Lu :

https://gcc.gnu.org/g:e74336df42fa36244d576dd155d7e2e2c42bc3a0

commit r11-9179-ge74336df42fa36244d576dd155d7e2e2c42bc3a0
Author: H.J. Lu 
Date:   Thu Oct 21 09:45:14 2021 -0700

x86: Document -fcf-protection requires i686 or newer

PR target/98667
* doc/invoke.texi: Document -fcf-protection requires i686 or
new.

(cherry picked from commit 1373066a46d8d47abd97e46a005aef3b3dbfe94a)

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[cvs-commit at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #16 from CVS Commits  ---
The master branch has been updated by H.J. Lu :

https://gcc.gnu.org/g:1373066a46d8d47abd97e46a005aef3b3dbfe94a

commit r12-4619-g1373066a46d8d47abd97e46a005aef3b3dbfe94a
Author: H.J. Lu 
Date:   Thu Oct 21 09:45:14 2021 -0700

x86: Document -fcf-protection requires i686 or newer

PR target/98667
* doc/invoke.texi: Document -fcf-protection requires i686 or
new.

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[marxin at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #15 from Martin Liška  ---
(In reply to H.J. Lu from comment #14)
> (In reply to Martin Liška from comment #13)
> > @H.J. Can you please document that one needs at least i686 CPU for the
> > functionality?
> 
> Like this?
> 
> diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
> index c66a25fcd69..71992b8c597 100644
> --- a/gcc/doc/invoke.texi
> +++ b/gcc/doc/invoke.texi
> @@ -15542,7 +15542,8 @@ which functions and calls should be skipped from
> instrumentation
>  (@pxref{Function Attributes}).
>  
>  Currently the x86 GNU/Linux target provides an implementation based
> -on Intel Control-flow Enforcement Technology (CET).
> +on Intel Control-flow Enforcement Technology (CET) which works for
> +i686 processor or newer.
>  
>  @item -fstack-protector
>  @opindex fstack-protector

Yes, please.

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[hjl.tools at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #14 from H.J. Lu  ---
(In reply to Martin Liška from comment #13)
> @H.J. Can you please document that one needs at least i686 CPU for the
> functionality?

Like this?

diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index c66a25fcd69..71992b8c597 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -15542,7 +15542,8 @@ which functions and calls should be skipped from
instrumentation
 (@pxref{Function Attributes}).

 Currently the x86 GNU/Linux target provides an implementation based
-on Intel Control-flow Enforcement Technology (CET).
+on Intel Control-flow Enforcement Technology (CET) which works for
+i686 processor or newer.

 @item -fstack-protector
 @opindex fstack-protector

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[marxin at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

Martin Liška  changed:

   What|Removed |Added

 CC||marxin at gcc dot gnu.org

--- Comment #13 from Martin Liška  ---
@H.J. Can you please document that one needs at least i686 CPU for the
functionality?

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[hjl.tools at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

H.J. Lu  changed:

   What|Removed |Added

   Target Milestone|--- |11.0
 Status|NEW |RESOLVED
 Resolution|--- |FIXED

--- Comment #12 from H.J. Lu  ---
Fixed for GCC 11.

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[hjl.tools at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667
Bug 98667 depends on bug 70454, which changed state.

Bug 70454 Summary: --with-arch=native isn't applied to 32-bit x86 target library
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70454

   What|Removed |Added

 Status|NEW |RESOLVED
 Resolution|--- |FIXED

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[tedheadster at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #11 from Matthew Whitehead  ---
A patch has been proposed to remove the -fcf-protection=full from the ebuild
script:

https://bugs.gentoo.org/765442

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[hjl.tools at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #10 from H.J. Lu  ---
(In reply to Matthew Whitehead from comment #1)
> Here is the full set of compiler flags used.
> 
> readelf --string-dump='.GCC.command.line' /usr/lib/debug/$( which eix
> ).debug  
> 
> String dump of section '.GCC.command.line':
>   [ 0]  -I .
>   [ 5]  -I ..
>   [ b]  -D_GNU_SOURCE
>   [19]  -D HAVE_CONFIG_H
>   [2a]  -D SYSCONFDIR="/etc"
>   [3f]  -D LOCALEDIR="/usr/share/locale"
>   [60]  -D _FORTIFY_SOURCE=2
>   [75]  various/drop_permissions.cc
>   [91]  -march=i486
>   [9d]  -auxbase-strip various/drop_permissions.o
>   [c7]  -g
>   [ca]  -ggdb
>   [d0]  -O2
>   [d4]  -fdata-sections
>   [e4]  -ffunction-sections
>   [f8]  -fcf-protection=full
>

Please remove -fcf-protection=full.

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[cvs-commit at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #9 from CVS Commits  ---
The master branch has been updated by H.J. Lu :

https://gcc.gnu.org/g:77d372abec0fbf2cfe922e3140ee3410248f979e

commit r11-6672-g77d372abec0fbf2cfe922e3140ee3410248f979e
Author: H.J. Lu 
Date:   Thu Jan 14 05:56:46 2021 -0800

x86: Error on -fcf-protection with incompatible target

-fcf-protection with CF_BRANCH inserts ENDBR32 at function entries.
ENDBR32 is NOP only on 64-bit processors and 32-bit TARGET_CMOV
processors.  Issue an error for -fcf-protection with CF_BRANCH when
compiling for 32-bit non-TARGET_CMOV targets.

gcc/

PR target/98667
* config/i386/i386-options.c (ix86_option_override_internal):
Issue an error for -fcf-protection with CF_BRANCH when compiling
for 32-bit non-TARGET_CMOV targets.

gcc/testsuite/

PR target/98667
* gcc.target/i386/pr98667-1.c: New file.
* gcc.target/i386/pr98667-2.c: Likewise.
* gcc.target/i386/pr98667-3.c: Likewise.

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[hjl.tools at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #8 from H.J. Lu  ---
(In reply to Richard Biener from comment #6)
> It probably makes sense to disable CET by default when GCC is configured to
> "less" than i686-linux (definitely for i386 and i486, not sure about i586).
> Thus change the regexps in config/cet.m4 to not include those for =auto
> at least.

config/cet.m4 is OK:

ENDBR32 is NOP on SSE2 processors:

# Check if target supports multi-byte NOPs
# and if compiler and assembler support CET.
AC_COMPILE_IFELSE(
 [AC_LANG_PROGRAM(
  [],
  [
#if !defined(__SSE2__)
#error target does not support multi-byte NOPs
#else
asm ("setssbsy");
#endif
  ])],
 [enable_cet=yes],
 [enable_cet=no])
;;

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[hjl.tools at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #7 from H.J. Lu  ---
A patch is posted at

https://gcc.gnu.org/pipermail/gcc-patches/2021-January/563478.html

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[rguenth at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

Richard Biener  changed:

   What|Removed |Added

 Status|UNCONFIRMED |NEW
   Last reconfirmed||2021-01-14
 Ever confirmed|0   |1

--- Comment #6 from Richard Biener  ---
It probably makes sense to disable CET by default when GCC is configured to
"less" than i686-linux (definitely for i386 and i486, not sure about i586).
Thus change the regexps in config/cet.m4 to not include those for =auto
at least.

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[jakub at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

Jakub Jelinek  changed:

   What|Removed |Added

 CC||jakub at gcc dot gnu.org

--- Comment #5 from Jakub Jelinek  ---
I guess to stay compatible with such CPUs one would need to disable CET
completely.
Pentium II (or whatever is the oldest that supports it):
https://stackoverflow.com/questions/56120231/how-do-old-cpus-execute-the-new-endbr64-and-endbr32-instructions
treat it as nops, which is the expected behavior on non-CET enabled hw.

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[tedheadster at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #4 from Matthew Whitehead  ---
It looks like /usr/bin/gdb 10.1 also has this opcode in it:

objdump -D /usr/bin/gdb | grep -B6 -A6 endbr32 

  60d7b5:   3f  aas
  60d7b6:   1a 3b   sbb(%ebx),%bh
  60d7b8:   2a 32   sub(%edx),%dh
  60d7ba:   24 22   and$0x22,%al
  60d7bc:   00 00   add%al,(%eax)
  60d7be:   00 00   add%al,(%eax)
  60d7c0:   f3 0f 1e fb endbr32 
  60d7c4:   ff a3 00 00 00 00   jmp*0x0(%ebx)
  60d7ca:   66 0f 1f 44 00 00   nopw   0x0(%eax,%eax,1)
  60d7d0:   f3 0f 1e fb endbr32 
  60d7d4:   ff 25 00 00 00 00   jmp*0x0
  60d7da:   66 0f 1f 44 00 00   nopw   0x0(%eax,%eax,1)
  60d7e0:   ff b3 04 00 00 00   pushl  0x4(%ebx)
  60d7e6:   ff a3 08 00 00 00   jmp*0x8(%ebx)
  60d7ec:   0f 1f 40 00 nopl   0x0(%eax)
  60d7f0:   f3 0f 1e fb endbr32 
  60d7f4:   68 00 00 00 00  push   $0x0
  60d7f9:   e9 00 00 00 00  jmp60d7fe
<_IO_stdin_used@@Base+0xd77fa>
  60d7fe:   66 90   xchg   %ax,%ax
  60d800:   ff 35 00 00 00 00   pushl  0x0
  60d806:   ff 25 00 00 00 00   jmp*0x0
  60d80c:   0f 1f 40 00 nopl   0x0(%eax)

i686-pentium4-mpentium4-lenovo /usr/lib/debug/usr/bin # /usr/bin/gdb --version 
GNU gdb (Gentoo 10.1 vanilla) 10.1
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

I will provide the gcc compile switches if asked, but it is long: 2156 items.

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[tedheadster at gmail dot com via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #3 from Matthew Whitehead  ---
This is on an actual first generation i486DX 40MHz system I use to test for
code issues exactly like this case.

[Bug target/98667] gcc generates endbr32 invalid opcode on -march=i486

[pinskia at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98667

--- Comment #2 from Andrew Pinski  ---
Is this directly on a i486 box or VirtualBox?  VirtualBox might have a bug.