Re: [PATCH 2/4] x86: Add -mfunction-return=
On Sat, Jan 13, 2018 at 9:31 AM, Jan Hubicka wrote: >> On Sat, Jan 13, 2018 at 8:51 AM, Woodhouse, David wrote: >> > On Sat, 2018-01-13 at 08:09 -0800, H.J. Lu wrote: >> >> >> >> > Again please extend both documentation hunks so it is clear what is >> >> > purpose >> >> > of this hack. >> >> >> >> David, can you help here? >> > >> > On most older CPUs the indirect branch issue is limited to actual >> > indirect branches. >> > >> > On Skylake-era CPUs, however, an underflow of the RSB (return stack >> > buffer) caused by a call/ret imbalance (such as on context switch) will >> > cause predictions to come from the same problematic branch predictor — >> > essentially, allowing 'ret' instructions to be targeted by an attacker >> > in precisely the same way as indirect branches. >> > >> > Note that there are plenty of other causes for RSB underflow. Like >> > taking an SMI, which clears the RSB completely. Or various other >> > things. Including a call stack deeper than 16 function calls. >> > >> > The -mfunction-return option was an experiment to use the retpoline >> > approach for 'ret' too. I forget the implementation (I could look >> > upthread), but essentially it was equivalent to replacing ret with >> > 'pop %r12; jmp __x86_indirect_thunk_r12' so that you *never* deplete >> > the RSB because of the 'call;ret' trick in the retpoline itself. Hence >> > your exposure on Skylake was reduced to the possibility of taking an >> > SMI while *in* the retpoline. >> >> RCX/ECX is a scratch register for both 32-bit and 64-bit. Is it OK >> to use it for "ret": >> >> pop %rcx >> jmp __x86_indirect_thunk_rcx There is no need for that since the return address is already on top of stack. We can just do __x86_return_thunk: call L2 L1: pause jmp L1 L2: lea 8(%rsp), %rsp|lea 4(%esp), %esp ret ret becomes: jmp __x86_return_thunk as my current patch does. > Is it also safe for local functions and IPA-ra? Yes. > Also what will your patchset do with large code model? Perhaps we want > to sorry there that it is not suported. True. I will prepare a separate patch for it. > Honza >> >> > This would, of course, be forcing a mispredict/pipeline stall on every >> > 'ret', rather than only on every indirect branch as in the original >> > retpoline idea. HJ added the code, but I'm not sure anyone at Intel >> > ever did actually do the *testing* to establish the performance >> > characteristics. Dave/Arjan? >> > >> > For my part, right *now* the kernel doesn't use this option. But then, >> > we don't have a comprehensive answer for Skylake yet other than "use >> > the new microcode features". Which are slower than retpoline, but not >> > as *much* slower on Skylake as they are on other CPUs. >> > >> > Amazon Web Services UK Limited. Registered in England and Wales with >> > registration number 08650665 and which has its registered office at 60 >> > Holborn Viaduct, London EC1A 2FD, United Kingdom. >> >> >> >> -- >> H.J. -- H.J.
Re: [PATCH 2/4] x86: Add -mfunction-return=
> On Sat, Jan 13, 2018 at 8:51 AM, Woodhouse, David wrote: > > On Sat, 2018-01-13 at 08:09 -0800, H.J. Lu wrote: > >> > >> > Again please extend both documentation hunks so it is clear what is > >> > purpose > >> > of this hack. > >> > >> David, can you help here? > > > > On most older CPUs the indirect branch issue is limited to actual > > indirect branches. > > > > On Skylake-era CPUs, however, an underflow of the RSB (return stack > > buffer) caused by a call/ret imbalance (such as on context switch) will > > cause predictions to come from the same problematic branch predictor — > > essentially, allowing 'ret' instructions to be targeted by an attacker > > in precisely the same way as indirect branches. > > > > Note that there are plenty of other causes for RSB underflow. Like > > taking an SMI, which clears the RSB completely. Or various other > > things. Including a call stack deeper than 16 function calls. > > > > The -mfunction-return option was an experiment to use the retpoline > > approach for 'ret' too. I forget the implementation (I could look > > upthread), but essentially it was equivalent to replacing ret with > > 'pop %r12; jmp __x86_indirect_thunk_r12' so that you *never* deplete > > the RSB because of the 'call;ret' trick in the retpoline itself. Hence > > your exposure on Skylake was reduced to the possibility of taking an > > SMI while *in* the retpoline. > > RCX/ECX is a scratch register for both 32-bit and 64-bit. Is it OK > to use it for "ret": > > pop %rcx > jmp __x86_indirect_thunk_rcx Is it also safe for local functions and IPA-ra? Also what will your patchset do with large code model? Perhaps we want to sorry there that it is not suported. Honza > > > This would, of course, be forcing a mispredict/pipeline stall on every > > 'ret', rather than only on every indirect branch as in the original > > retpoline idea. HJ added the code, but I'm not sure anyone at Intel > > ever did actually do the *testing* to establish the performance > > characteristics. Dave/Arjan? > > > > For my part, right *now* the kernel doesn't use this option. But then, > > we don't have a comprehensive answer for Skylake yet other than "use > > the new microcode features". Which are slower than retpoline, but not > > as *much* slower on Skylake as they are on other CPUs. > > > > Amazon Web Services UK Limited. Registered in England and Wales with > > registration number 08650665 and which has its registered office at 60 > > Holborn Viaduct, London EC1A 2FD, United Kingdom. > > > > -- > H.J.
Re: [PATCH 2/4] x86: Add -mfunction-return=
On Sat, Jan 13, 2018 at 8:51 AM, Woodhouse, David wrote: > On Sat, 2018-01-13 at 08:09 -0800, H.J. Lu wrote: >> >> > Again please extend both documentation hunks so it is clear what is purpose >> > of this hack. >> >> David, can you help here? > > On most older CPUs the indirect branch issue is limited to actual > indirect branches. > > On Skylake-era CPUs, however, an underflow of the RSB (return stack > buffer) caused by a call/ret imbalance (such as on context switch) will > cause predictions to come from the same problematic branch predictor — > essentially, allowing 'ret' instructions to be targeted by an attacker > in precisely the same way as indirect branches. > > Note that there are plenty of other causes for RSB underflow. Like > taking an SMI, which clears the RSB completely. Or various other > things. Including a call stack deeper than 16 function calls. > > The -mfunction-return option was an experiment to use the retpoline > approach for 'ret' too. I forget the implementation (I could look > upthread), but essentially it was equivalent to replacing ret with > 'pop %r12; jmp __x86_indirect_thunk_r12' so that you *never* deplete > the RSB because of the 'call;ret' trick in the retpoline itself. Hence > your exposure on Skylake was reduced to the possibility of taking an > SMI while *in* the retpoline. RCX/ECX is a scratch register for both 32-bit and 64-bit. Is it OK to use it for "ret": pop %rcx jmp __x86_indirect_thunk_rcx > This would, of course, be forcing a mispredict/pipeline stall on every > 'ret', rather than only on every indirect branch as in the original > retpoline idea. HJ added the code, but I'm not sure anyone at Intel > ever did actually do the *testing* to establish the performance > characteristics. Dave/Arjan? > > For my part, right *now* the kernel doesn't use this option. But then, > we don't have a comprehensive answer for Skylake yet other than "use > the new microcode features". Which are slower than retpoline, but not > as *much* slower on Skylake as they are on other CPUs. > > Amazon Web Services UK Limited. Registered in England and Wales with > registration number 08650665 and which has its registered office at 60 > Holborn Viaduct, London EC1A 2FD, United Kingdom. -- H.J.
Re: [PATCH 2/4] x86: Add -mfunction-return=
On Sat, 2018-01-13 at 08:09 -0800, H.J. Lu wrote: > > > Again please extend both documentation hunks so it is clear what is purpose > > of this hack. > > David, can you help here? On most older CPUs the indirect branch issue is limited to actual indirect branches. On Skylake-era CPUs, however, an underflow of the RSB (return stack buffer) caused by a call/ret imbalance (such as on context switch) will cause predictions to come from the same problematic branch predictor — essentially, allowing 'ret' instructions to be targeted by an attacker in precisely the same way as indirect branches. Note that there are plenty of other causes for RSB underflow. Like taking an SMI, which clears the RSB completely. Or various other things. Including a call stack deeper than 16 function calls. The -mfunction-return option was an experiment to use the retpoline approach for 'ret' too. I forget the implementation (I could look upthread), but essentially it was equivalent to replacing ret with 'pop %r12; jmp __x86_indirect_thunk_r12' so that you *never* deplete the RSB because of the 'call;ret' trick in the retpoline itself. Hence your exposure on Skylake was reduced to the possibility of taking an SMI while *in* the retpoline. This would, of course, be forcing a mispredict/pipeline stall on every 'ret', rather than only on every indirect branch as in the original retpoline idea. HJ added the code, but I'm not sure anyone at Intel ever did actually do the *testing* to establish the performance characteristics. Dave/Arjan? For my part, right *now* the kernel doesn't use this option. But then, we don't have a comprehensive answer for Skylake yet other than "use the new microcode features". Which are slower than retpoline, but not as *much* slower on Skylake as they are on other CPUs. smime.p7s Description: S/MIME cryptographic signature
Re: [PATCH 2/4] x86: Add -mfunction-return=
On Fri, Jan 12, 2018 at 9:55 AM, Jan Hubicka wrote: >> Add -mfunction-return= option to convert function return to call and >> return thunks. The default is 'keep', which keeps function return >> unmodified. 'thunk' converts function return to call and return thunk. >> 'thunk-inline' converts function return to inlined call and return thunk. >> 'thunk-extern' converts function return to external call and return >> thunk provided in a separate object file. You can control this behavior >> for a specific function by using the function attribute function_return. >> >> Function return thunk is the same as memory thunk for -mindirect-branch= >> where the return address is at the top of the stack: >> >> __x86_return_thunk: >> call L2 >> L1: >> pause >> jmp L1 >> L2: >> lea 8(%rsp), %rsp|lea 4(%esp), %esp >> ret >> >> and function return becomes >> >> jmp __x86_return_thunk >> >> -mindirect-branch= tests are updated with -mfunction-return=keep to >> avoid false test failures when -mfunction-return=thunk is added to >> RUNTESTFLAGS for "make check". >> >> gcc/ >> >> * config/i386/i386-protos.h (ix86_output_function_return): New. >> * config/i386/i386.c (ix86_set_indirect_branch_type): Also >> set function_return_type. >> (indirect_thunk_name): Add ret_p to indicate thunk for function >> return. >> (output_indirect_thunk_function): Pass false to >> indirect_thunk_name. >> (ix86_output_indirect_branch): Likewise. >> (output_indirect_thunk_function): Create alias for function >> return thunk if regno < 0. >> (ix86_output_function_return): New function. >> (ix86_handle_fndecl_attribute): Handle function_return. >> (ix86_attribute_table): Add function_return. >> * config/i386/i386.h (machine_function): Add >> function_return_type. >> * config/i386/i386.md (simple_return_internal): Use >> ix86_output_function_return. >> (simple_return_internal_long): Likewise. >> * config/i386/i386.opt (mfunction-return=): New option. >> (indirect_branch): Mention -mfunction-return=. >> * doc/extend.texi: Document function_return function attribute. >> * doc/invoke.texi: Document -mfunction-return= option. >> >> gcc/testsuite/ >> >> * gcc.target/i386/indirect-thunk-1.c (dg-options): Add >> -mfunction-return=keep. >> * gcc.target/i386/indirect-thunk-2.c: Likewise. >> * gcc.target/i386/indirect-thunk-3.c: Likewise. >> * gcc.target/i386/indirect-thunk-4.c: Likewise. >> * gcc.target/i386/indirect-thunk-5.c: Likewise. >> * gcc.target/i386/indirect-thunk-6.c: Likewise. >> * gcc.target/i386/indirect-thunk-7.c: Likewise. >> * gcc.target/i386/indirect-thunk-attr-1.c: Likewise. >> * gcc.target/i386/indirect-thunk-attr-2.c: Likewise. >> * gcc.target/i386/indirect-thunk-attr-3.c: Likewise. >> * gcc.target/i386/indirect-thunk-attr-4.c: Likewise. >> * gcc.target/i386/indirect-thunk-attr-5.c: Likewise. >> * gcc.target/i386/indirect-thunk-attr-6.c: Likewise. >> * gcc.target/i386/indirect-thunk-attr-7.c: Likewise. >> * gcc.target/i386/indirect-thunk-attr-8.c: Likewise. >> * gcc.target/i386/indirect-thunk-bnd-1.c: Likewise. >> * gcc.target/i386/indirect-thunk-bnd-2.c: Likewise. >> * gcc.target/i386/indirect-thunk-bnd-3.c: Likewise. >> * gcc.target/i386/indirect-thunk-bnd-4.c: Likewise. >> * gcc.target/i386/indirect-thunk-extern-1.c: Likewise. >> * gcc.target/i386/indirect-thunk-extern-2.c: Likewise. >> * gcc.target/i386/indirect-thunk-extern-3.c: Likewise. >> * gcc.target/i386/indirect-thunk-extern-4.c: Likewise. >> * gcc.target/i386/indirect-thunk-extern-5.c: Likewise. >> * gcc.target/i386/indirect-thunk-extern-6.c: Likewise. >> * gcc.target/i386/indirect-thunk-extern-7.c: Likewise. >> * gcc.target/i386/indirect-thunk-inline-1.c: Likewise. >> * gcc.target/i386/indirect-thunk-inline-2.c: Likewise. >> * gcc.target/i386/indirect-thunk-inline-3.c: Likewise. >> * gcc.target/i386/indirect-thunk-inline-4.c: Likewise. >> * gcc.target/i386/indirect-thunk-inline-5.c: Likewise. >> * gcc.target/i386/indirect-thunk-inline-6.c: Likewise. >> * gcc.target/i386/indirect-thunk-inline-7.c: Likewise. >> * gcc.target/i386/ret-thunk-1.c: New test. >> * gcc.target/i386/ret-thunk-10.c: Likewise. >> * gcc.target/i386/ret-thunk-11.c: Likewise. >> * gcc.target/i386/ret-thunk-12.c: Likewise. >> * gcc.target/i386/ret-thunk-13.c: Likewise. >> * gcc.target/i386/ret-thunk-14.c: Likewise. >> * gcc.target/i386/ret-thunk-15.c: Likewise. >> * gcc.target/i386/ret-thunk-16.c: Likewise. >> * gcc.target/i386/ret-thunk-2.c: Likewise. >> * gcc.target/i386/ret-thunk-3.c: Likewise. >> * gcc.target/i386/ret-thunk-4.c: Likewise. >> * gcc.target/i386/ret-thu
Re: [PATCH 2/4] x86: Add -mfunction-return=
> Add -mfunction-return= option to convert function return to call and > return thunks. The default is 'keep', which keeps function return > unmodified. 'thunk' converts function return to call and return thunk. > 'thunk-inline' converts function return to inlined call and return thunk. > 'thunk-extern' converts function return to external call and return > thunk provided in a separate object file. You can control this behavior > for a specific function by using the function attribute function_return. > > Function return thunk is the same as memory thunk for -mindirect-branch= > where the return address is at the top of the stack: > > __x86_return_thunk: > call L2 > L1: > pause > jmp L1 > L2: > lea 8(%rsp), %rsp|lea 4(%esp), %esp > ret > > and function return becomes > > jmp __x86_return_thunk > > -mindirect-branch= tests are updated with -mfunction-return=keep to > avoid false test failures when -mfunction-return=thunk is added to > RUNTESTFLAGS for "make check". > > gcc/ > > * config/i386/i386-protos.h (ix86_output_function_return): New. > * config/i386/i386.c (ix86_set_indirect_branch_type): Also > set function_return_type. > (indirect_thunk_name): Add ret_p to indicate thunk for function > return. > (output_indirect_thunk_function): Pass false to > indirect_thunk_name. > (ix86_output_indirect_branch): Likewise. > (output_indirect_thunk_function): Create alias for function > return thunk if regno < 0. > (ix86_output_function_return): New function. > (ix86_handle_fndecl_attribute): Handle function_return. > (ix86_attribute_table): Add function_return. > * config/i386/i386.h (machine_function): Add > function_return_type. > * config/i386/i386.md (simple_return_internal): Use > ix86_output_function_return. > (simple_return_internal_long): Likewise. > * config/i386/i386.opt (mfunction-return=): New option. > (indirect_branch): Mention -mfunction-return=. > * doc/extend.texi: Document function_return function attribute. > * doc/invoke.texi: Document -mfunction-return= option. > > gcc/testsuite/ > > * gcc.target/i386/indirect-thunk-1.c (dg-options): Add > -mfunction-return=keep. > * gcc.target/i386/indirect-thunk-2.c: Likewise. > * gcc.target/i386/indirect-thunk-3.c: Likewise. > * gcc.target/i386/indirect-thunk-4.c: Likewise. > * gcc.target/i386/indirect-thunk-5.c: Likewise. > * gcc.target/i386/indirect-thunk-6.c: Likewise. > * gcc.target/i386/indirect-thunk-7.c: Likewise. > * gcc.target/i386/indirect-thunk-attr-1.c: Likewise. > * gcc.target/i386/indirect-thunk-attr-2.c: Likewise. > * gcc.target/i386/indirect-thunk-attr-3.c: Likewise. > * gcc.target/i386/indirect-thunk-attr-4.c: Likewise. > * gcc.target/i386/indirect-thunk-attr-5.c: Likewise. > * gcc.target/i386/indirect-thunk-attr-6.c: Likewise. > * gcc.target/i386/indirect-thunk-attr-7.c: Likewise. > * gcc.target/i386/indirect-thunk-attr-8.c: Likewise. > * gcc.target/i386/indirect-thunk-bnd-1.c: Likewise. > * gcc.target/i386/indirect-thunk-bnd-2.c: Likewise. > * gcc.target/i386/indirect-thunk-bnd-3.c: Likewise. > * gcc.target/i386/indirect-thunk-bnd-4.c: Likewise. > * gcc.target/i386/indirect-thunk-extern-1.c: Likewise. > * gcc.target/i386/indirect-thunk-extern-2.c: Likewise. > * gcc.target/i386/indirect-thunk-extern-3.c: Likewise. > * gcc.target/i386/indirect-thunk-extern-4.c: Likewise. > * gcc.target/i386/indirect-thunk-extern-5.c: Likewise. > * gcc.target/i386/indirect-thunk-extern-6.c: Likewise. > * gcc.target/i386/indirect-thunk-extern-7.c: Likewise. > * gcc.target/i386/indirect-thunk-inline-1.c: Likewise. > * gcc.target/i386/indirect-thunk-inline-2.c: Likewise. > * gcc.target/i386/indirect-thunk-inline-3.c: Likewise. > * gcc.target/i386/indirect-thunk-inline-4.c: Likewise. > * gcc.target/i386/indirect-thunk-inline-5.c: Likewise. > * gcc.target/i386/indirect-thunk-inline-6.c: Likewise. > * gcc.target/i386/indirect-thunk-inline-7.c: Likewise. > * gcc.target/i386/ret-thunk-1.c: New test. > * gcc.target/i386/ret-thunk-10.c: Likewise. > * gcc.target/i386/ret-thunk-11.c: Likewise. > * gcc.target/i386/ret-thunk-12.c: Likewise. > * gcc.target/i386/ret-thunk-13.c: Likewise. > * gcc.target/i386/ret-thunk-14.c: Likewise. > * gcc.target/i386/ret-thunk-15.c: Likewise. > * gcc.target/i386/ret-thunk-16.c: Likewise. > * gcc.target/i386/ret-thunk-2.c: Likewise. > * gcc.target/i386/ret-thunk-3.c: Likewise. > * gcc.target/i386/ret-thunk-4.c: Likewise. > * gcc.target/i386/ret-thunk-5.c: Likewise. > * gcc.target/i386/ret-thunk-6.c: Likewise. > * gcc.target/i386/ret-thunk-7.c: Likewise. > * gcc.target/i386
[PATCH 2/4] x86: Add -mfunction-return=
Add -mfunction-return= option to convert function return to call and return thunks. The default is 'keep', which keeps function return unmodified. 'thunk' converts function return to call and return thunk. 'thunk-inline' converts function return to inlined call and return thunk. 'thunk-extern' converts function return to external call and return thunk provided in a separate object file. You can control this behavior for a specific function by using the function attribute function_return. Function return thunk is the same as memory thunk for -mindirect-branch= where the return address is at the top of the stack: __x86_return_thunk: call L2 L1: pause jmp L1 L2: lea 8(%rsp), %rsp|lea 4(%esp), %esp ret and function return becomes jmp __x86_return_thunk -mindirect-branch= tests are updated with -mfunction-return=keep to avoid false test failures when -mfunction-return=thunk is added to RUNTESTFLAGS for "make check". gcc/ * config/i386/i386-protos.h (ix86_output_function_return): New. * config/i386/i386.c (ix86_set_indirect_branch_type): Also set function_return_type. (indirect_thunk_name): Add ret_p to indicate thunk for function return. (output_indirect_thunk_function): Pass false to indirect_thunk_name. (ix86_output_indirect_branch): Likewise. (output_indirect_thunk_function): Create alias for function return thunk if regno < 0. (ix86_output_function_return): New function. (ix86_handle_fndecl_attribute): Handle function_return. (ix86_attribute_table): Add function_return. * config/i386/i386.h (machine_function): Add function_return_type. * config/i386/i386.md (simple_return_internal): Use ix86_output_function_return. (simple_return_internal_long): Likewise. * config/i386/i386.opt (mfunction-return=): New option. (indirect_branch): Mention -mfunction-return=. * doc/extend.texi: Document function_return function attribute. * doc/invoke.texi: Document -mfunction-return= option. gcc/testsuite/ * gcc.target/i386/indirect-thunk-1.c (dg-options): Add -mfunction-return=keep. * gcc.target/i386/indirect-thunk-2.c: Likewise. * gcc.target/i386/indirect-thunk-3.c: Likewise. * gcc.target/i386/indirect-thunk-4.c: Likewise. * gcc.target/i386/indirect-thunk-5.c: Likewise. * gcc.target/i386/indirect-thunk-6.c: Likewise. * gcc.target/i386/indirect-thunk-7.c: Likewise. * gcc.target/i386/indirect-thunk-attr-1.c: Likewise. * gcc.target/i386/indirect-thunk-attr-2.c: Likewise. * gcc.target/i386/indirect-thunk-attr-3.c: Likewise. * gcc.target/i386/indirect-thunk-attr-4.c: Likewise. * gcc.target/i386/indirect-thunk-attr-5.c: Likewise. * gcc.target/i386/indirect-thunk-attr-6.c: Likewise. * gcc.target/i386/indirect-thunk-attr-7.c: Likewise. * gcc.target/i386/indirect-thunk-attr-8.c: Likewise. * gcc.target/i386/indirect-thunk-bnd-1.c: Likewise. * gcc.target/i386/indirect-thunk-bnd-2.c: Likewise. * gcc.target/i386/indirect-thunk-bnd-3.c: Likewise. * gcc.target/i386/indirect-thunk-bnd-4.c: Likewise. * gcc.target/i386/indirect-thunk-extern-1.c: Likewise. * gcc.target/i386/indirect-thunk-extern-2.c: Likewise. * gcc.target/i386/indirect-thunk-extern-3.c: Likewise. * gcc.target/i386/indirect-thunk-extern-4.c: Likewise. * gcc.target/i386/indirect-thunk-extern-5.c: Likewise. * gcc.target/i386/indirect-thunk-extern-6.c: Likewise. * gcc.target/i386/indirect-thunk-extern-7.c: Likewise. * gcc.target/i386/indirect-thunk-inline-1.c: Likewise. * gcc.target/i386/indirect-thunk-inline-2.c: Likewise. * gcc.target/i386/indirect-thunk-inline-3.c: Likewise. * gcc.target/i386/indirect-thunk-inline-4.c: Likewise. * gcc.target/i386/indirect-thunk-inline-5.c: Likewise. * gcc.target/i386/indirect-thunk-inline-6.c: Likewise. * gcc.target/i386/indirect-thunk-inline-7.c: Likewise. * gcc.target/i386/ret-thunk-1.c: New test. * gcc.target/i386/ret-thunk-10.c: Likewise. * gcc.target/i386/ret-thunk-11.c: Likewise. * gcc.target/i386/ret-thunk-12.c: Likewise. * gcc.target/i386/ret-thunk-13.c: Likewise. * gcc.target/i386/ret-thunk-14.c: Likewise. * gcc.target/i386/ret-thunk-15.c: Likewise. * gcc.target/i386/ret-thunk-16.c: Likewise. * gcc.target/i386/ret-thunk-2.c: Likewise. * gcc.target/i386/ret-thunk-3.c: Likewise. * gcc.target/i386/ret-thunk-4.c: Likewise. * gcc.target/i386/ret-thunk-5.c: Likewise. * gcc.target/i386/ret-thunk-6.c: Likewise. * gcc.target/i386/ret-thunk-7.c: Likewise. * gcc.target/i386/ret-thunk-8.c: Likewise. * gcc.target/i386/re