Re: [PATCH 2/4] x86: Add -mfunction-return=

[H.J. Lu]

On Sat, Jan 13, 2018 at 9:31 AM, Jan Hubicka  wrote:
>> On Sat, Jan 13, 2018 at 8:51 AM, Woodhouse, David  wrote:
>> > On Sat, 2018-01-13 at 08:09 -0800, H.J. Lu wrote:
>> >>
>> >> > Again please extend both documentation hunks so it is clear what is 
>> >> > purpose
>> >> > of this hack.
>> >>
>> >> David, can you help here?
>> >
>> > On most older CPUs the indirect branch issue is limited to actual
>> > indirect branches.
>> >
>> > On Skylake-era CPUs, however, an underflow of the RSB (return stack
>> > buffer) caused by a call/ret imbalance (such as on context switch) will
>> > cause predictions to come from the same problematic branch predictor —
>> > essentially, allowing 'ret' instructions to be targeted by an attacker
>> > in precisely the same way as indirect branches.
>> >
>> > Note that there are plenty of other causes for RSB underflow. Like
>> > taking an SMI, which clears the RSB completely. Or various other
>> > things. Including a call stack deeper than 16 function calls.
>> >
>> > The -mfunction-return option was an experiment to use the retpoline
>> > approach for 'ret' too. I forget the implementation (I could look
>> > upthread), but essentially it was equivalent to replacing ret with
>> > 'pop %r12; jmp __x86_indirect_thunk_r12' so that you *never* deplete
>> > the RSB because of the 'call;ret' trick in the retpoline itself. Hence
>> > your exposure on Skylake was reduced to the possibility of taking an
>> > SMI while *in* the retpoline.
>>
>> RCX/ECX is a scratch register for both 32-bit and 64-bit.  Is it OK
>> to use it for "ret":
>>
>> pop %rcx
>> jmp __x86_indirect_thunk_rcx

There is no need for that since the return address is already on top
of stack.  We can just do

   __x86_return_thunk:
call L2
L1:
pause
jmp L1
L2:
lea 8(%rsp), %rsp|lea 4(%esp), %esp
ret

ret becomes: jmp __x86_return_thunk as my current patch does.

> Is it also safe for local functions and IPA-ra?

Yes.

> Also what will your patchset do with large code model? Perhaps we want
> to sorry there that it is not suported.

True.  I will prepare a separate patch for it.

> Honza
>>
>> > This would, of course, be forcing a mispredict/pipeline stall on every
>> > 'ret', rather than only on every indirect branch as in the original
>> > retpoline idea. HJ added the code, but I'm not sure anyone at Intel
>> > ever did actually do the *testing* to establish the performance
>> > characteristics. Dave/Arjan?
>> >
>> > For my part, right *now* the kernel doesn't use this option. But then,
>> > we don't have a comprehensive answer for Skylake yet other than "use
>> > the new microcode features". Which are slower than retpoline, but not
>> > as *much* slower on Skylake as they are on other CPUs.
>> >
>> > Amazon Web Services UK Limited. Registered in England and Wales with 
>> > registration number 08650665 and which has its registered office at 60 
>> > Holborn Viaduct, London EC1A 2FD, United Kingdom.
>>
>>
>>
>> --
>> H.J.



-- 
H.J.

Re: [PATCH 2/4] x86: Add -mfunction-return=

[Jan Hubicka]

> On Sat, Jan 13, 2018 at 8:51 AM, Woodhouse, David  wrote:
> > On Sat, 2018-01-13 at 08:09 -0800, H.J. Lu wrote:
> >>
> >> > Again please extend both documentation hunks so it is clear what is 
> >> > purpose
> >> > of this hack.
> >>
> >> David, can you help here?
> >
> > On most older CPUs the indirect branch issue is limited to actual
> > indirect branches.
> >
> > On Skylake-era CPUs, however, an underflow of the RSB (return stack
> > buffer) caused by a call/ret imbalance (such as on context switch) will
> > cause predictions to come from the same problematic branch predictor —
> > essentially, allowing 'ret' instructions to be targeted by an attacker
> > in precisely the same way as indirect branches.
> >
> > Note that there are plenty of other causes for RSB underflow. Like
> > taking an SMI, which clears the RSB completely. Or various other
> > things. Including a call stack deeper than 16 function calls.
> >
> > The -mfunction-return option was an experiment to use the retpoline
> > approach for 'ret' too. I forget the implementation (I could look
> > upthread), but essentially it was equivalent to replacing ret with
> > 'pop %r12; jmp __x86_indirect_thunk_r12' so that you *never* deplete
> > the RSB because of the 'call;ret' trick in the retpoline itself. Hence
> > your exposure on Skylake was reduced to the possibility of taking an
> > SMI while *in* the retpoline.
> 
> RCX/ECX is a scratch register for both 32-bit and 64-bit.  Is it OK
> to use it for "ret":
> 
> pop %rcx
> jmp __x86_indirect_thunk_rcx

Is it also safe for local functions and IPA-ra?
Also what will your patchset do with large code model? Perhaps we want
to sorry there that it is not suported.

Honza
> 
> > This would, of course, be forcing a mispredict/pipeline stall on every
> > 'ret', rather than only on every indirect branch as in the original
> > retpoline idea. HJ added the code, but I'm not sure anyone at Intel
> > ever did actually do the *testing* to establish the performance
> > characteristics. Dave/Arjan?
> >
> > For my part, right *now* the kernel doesn't use this option. But then,
> > we don't have a comprehensive answer for Skylake yet other than "use
> > the new microcode features". Which are slower than retpoline, but not
> > as *much* slower on Skylake as they are on other CPUs.
> >
> > Amazon Web Services UK Limited. Registered in England and Wales with 
> > registration number 08650665 and which has its registered office at 60 
> > Holborn Viaduct, London EC1A 2FD, United Kingdom.
> 
> 
> 
> -- 
> H.J.

Re: [PATCH 2/4] x86: Add -mfunction-return=

[H.J. Lu]

On Sat, Jan 13, 2018 at 8:51 AM, Woodhouse, David  wrote:
> On Sat, 2018-01-13 at 08:09 -0800, H.J. Lu wrote:
>>
>> > Again please extend both documentation hunks so it is clear what is purpose
>> > of this hack.
>>
>> David, can you help here?
>
> On most older CPUs the indirect branch issue is limited to actual
> indirect branches.
>
> On Skylake-era CPUs, however, an underflow of the RSB (return stack
> buffer) caused by a call/ret imbalance (such as on context switch) will
> cause predictions to come from the same problematic branch predictor —
> essentially, allowing 'ret' instructions to be targeted by an attacker
> in precisely the same way as indirect branches.
>
> Note that there are plenty of other causes for RSB underflow. Like
> taking an SMI, which clears the RSB completely. Or various other
> things. Including a call stack deeper than 16 function calls.
>
> The -mfunction-return option was an experiment to use the retpoline
> approach for 'ret' too. I forget the implementation (I could look
> upthread), but essentially it was equivalent to replacing ret with
> 'pop %r12; jmp __x86_indirect_thunk_r12' so that you *never* deplete
> the RSB because of the 'call;ret' trick in the retpoline itself. Hence
> your exposure on Skylake was reduced to the possibility of taking an
> SMI while *in* the retpoline.

RCX/ECX is a scratch register for both 32-bit and 64-bit.  Is it OK
to use it for "ret":

pop %rcx
jmp __x86_indirect_thunk_rcx

> This would, of course, be forcing a mispredict/pipeline stall on every
> 'ret', rather than only on every indirect branch as in the original
> retpoline idea. HJ added the code, but I'm not sure anyone at Intel
> ever did actually do the *testing* to establish the performance
> characteristics. Dave/Arjan?
>
> For my part, right *now* the kernel doesn't use this option. But then,
> we don't have a comprehensive answer for Skylake yet other than "use
> the new microcode features". Which are slower than retpoline, but not
> as *much* slower on Skylake as they are on other CPUs.
>
> Amazon Web Services UK Limited. Registered in England and Wales with 
> registration number 08650665 and which has its registered office at 60 
> Holborn Viaduct, London EC1A 2FD, United Kingdom.



-- 
H.J.

Re: [PATCH 2/4] x86: Add -mfunction-return=

[Woodhouse, David]

On Sat, 2018-01-13 at 08:09 -0800, H.J. Lu wrote:
> 
> > Again please extend both documentation hunks so it is clear what is purpose
> > of this hack.
> 
> David, can you help here?

On most older CPUs the indirect branch issue is limited to actual
indirect branches.

On Skylake-era CPUs, however, an underflow of the RSB (return stack
buffer) caused by a call/ret imbalance (such as on context switch) will
cause predictions to come from the same problematic branch predictor —
essentially, allowing 'ret' instructions to be targeted by an attacker
in precisely the same way as indirect branches.

Note that there are plenty of other causes for RSB underflow. Like
taking an SMI, which clears the RSB completely. Or various other
things. Including a call stack deeper than 16 function calls.

The -mfunction-return option was an experiment to use the retpoline
approach for 'ret' too. I forget the implementation (I could look
upthread), but essentially it was equivalent to replacing ret with
'pop %r12; jmp __x86_indirect_thunk_r12' so that you *never* deplete
the RSB because of the 'call;ret' trick in the retpoline itself. Hence
your exposure on Skylake was reduced to the possibility of taking an
SMI while *in* the retpoline.

This would, of course, be forcing a mispredict/pipeline stall on every
'ret', rather than only on every indirect branch as in the original
retpoline idea. HJ added the code, but I'm not sure anyone at Intel
ever did actually do the *testing* to establish the performance
characteristics. Dave/Arjan?

For my part, right *now* the kernel doesn't use this option. But then,
we don't have a comprehensive answer for Skylake yet other than "use
the new microcode features". Which are slower than retpoline, but not
as *much* slower on Skylake as they are on other CPUs.


smime.p7s
Description: S/MIME cryptographic signature

Re: [PATCH 2/4] x86: Add -mfunction-return=

[H.J. Lu]

On Fri, Jan 12, 2018 at 9:55 AM, Jan Hubicka  wrote:
>> Add -mfunction-return= option to convert function return to call and
>> return thunks.  The default is 'keep', which keeps function return
>> unmodified.  'thunk' converts function return to call and return thunk.
>> 'thunk-inline' converts function return to inlined call and return thunk.  
>> 'thunk-extern' converts function return to external call and return
>> thunk provided in a separate object file.  You can control this behavior
>> for a specific function by using the function attribute function_return.
>>
>> Function return thunk is the same as memory thunk for -mindirect-branch=
>> where the return address is at the top of the stack:
>>
>> __x86_return_thunk:
>>   call L2
>> L1:
>>   pause
>>   jmp L1
>> L2:
>>   lea 8(%rsp), %rsp|lea 4(%esp), %esp
>>   ret
>>
>> and function return becomes
>>
>>   jmp __x86_return_thunk
>>
>> -mindirect-branch= tests are updated with -mfunction-return=keep to
>> avoid false test failures when -mfunction-return=thunk is added to
>> RUNTESTFLAGS for "make check".
>>
>> gcc/
>>
>>   * config/i386/i386-protos.h (ix86_output_function_return): New.
>>   * config/i386/i386.c (ix86_set_indirect_branch_type): Also
>>   set function_return_type.
>>   (indirect_thunk_name): Add ret_p to indicate thunk for function
>>   return.
>>   (output_indirect_thunk_function): Pass false to
>>   indirect_thunk_name.
>>   (ix86_output_indirect_branch): Likewise.
>>   (output_indirect_thunk_function): Create alias for function
>>   return thunk if regno < 0.
>>   (ix86_output_function_return): New function.
>>   (ix86_handle_fndecl_attribute): Handle function_return.
>>   (ix86_attribute_table): Add function_return.
>>   * config/i386/i386.h (machine_function): Add
>>   function_return_type.
>>   * config/i386/i386.md (simple_return_internal): Use
>>   ix86_output_function_return.
>>   (simple_return_internal_long): Likewise.
>>   * config/i386/i386.opt (mfunction-return=): New option.
>>   (indirect_branch): Mention -mfunction-return=.
>>   * doc/extend.texi: Document function_return function attribute.
>>   * doc/invoke.texi: Document -mfunction-return= option.
>>
>> gcc/testsuite/
>>
>>   * gcc.target/i386/indirect-thunk-1.c (dg-options): Add
>>   -mfunction-return=keep.
>>   * gcc.target/i386/indirect-thunk-2.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-3.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-4.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-5.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-6.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-7.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-attr-1.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-attr-2.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-attr-3.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-attr-4.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-attr-5.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-attr-6.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-attr-7.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-attr-8.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-bnd-1.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-bnd-2.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-bnd-3.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-bnd-4.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-extern-1.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-extern-2.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-extern-3.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-extern-4.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-extern-5.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-extern-6.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-extern-7.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-inline-1.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-inline-2.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-inline-3.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-inline-4.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-inline-5.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-inline-6.c: Likewise.
>>   * gcc.target/i386/indirect-thunk-inline-7.c: Likewise.
>>   * gcc.target/i386/ret-thunk-1.c: New test.
>>   * gcc.target/i386/ret-thunk-10.c: Likewise.
>>   * gcc.target/i386/ret-thunk-11.c: Likewise.
>>   * gcc.target/i386/ret-thunk-12.c: Likewise.
>>   * gcc.target/i386/ret-thunk-13.c: Likewise.
>>   * gcc.target/i386/ret-thunk-14.c: Likewise.
>>   * gcc.target/i386/ret-thunk-15.c: Likewise.
>>   * gcc.target/i386/ret-thunk-16.c: Likewise.
>>   * gcc.target/i386/ret-thunk-2.c: Likewise.
>>   * gcc.target/i386/ret-thunk-3.c: Likewise.
>>   * gcc.target/i386/ret-thunk-4.c: Likewise.
>>   * 

Re: [PATCH 2/4] x86: Add -mfunction-return=

[Jan Hubicka]

> Add -mfunction-return= option to convert function return to call and
> return thunks.  The default is 'keep', which keeps function return
> unmodified.  'thunk' converts function return to call and return thunk.
> 'thunk-inline' converts function return to inlined call and return thunk.  
> 'thunk-extern' converts function return to external call and return
> thunk provided in a separate object file.  You can control this behavior
> for a specific function by using the function attribute function_return.
> 
> Function return thunk is the same as memory thunk for -mindirect-branch=
> where the return address is at the top of the stack:
> 
> __x86_return_thunk:
>   call L2
> L1:
>   pause
>   jmp L1
> L2:
>   lea 8(%rsp), %rsp|lea 4(%esp), %esp
>   ret
> 
> and function return becomes
> 
>   jmp __x86_return_thunk
> 
> -mindirect-branch= tests are updated with -mfunction-return=keep to
> avoid false test failures when -mfunction-return=thunk is added to
> RUNTESTFLAGS for "make check".
> 
> gcc/
> 
>   * config/i386/i386-protos.h (ix86_output_function_return): New.
>   * config/i386/i386.c (ix86_set_indirect_branch_type): Also
>   set function_return_type.
>   (indirect_thunk_name): Add ret_p to indicate thunk for function
>   return.
>   (output_indirect_thunk_function): Pass false to
>   indirect_thunk_name.
>   (ix86_output_indirect_branch): Likewise.
>   (output_indirect_thunk_function): Create alias for function
>   return thunk if regno < 0.
>   (ix86_output_function_return): New function.
>   (ix86_handle_fndecl_attribute): Handle function_return.
>   (ix86_attribute_table): Add function_return.
>   * config/i386/i386.h (machine_function): Add
>   function_return_type.
>   * config/i386/i386.md (simple_return_internal): Use
>   ix86_output_function_return.
>   (simple_return_internal_long): Likewise.
>   * config/i386/i386.opt (mfunction-return=): New option.
>   (indirect_branch): Mention -mfunction-return=.
>   * doc/extend.texi: Document function_return function attribute.
>   * doc/invoke.texi: Document -mfunction-return= option.
> 
> gcc/testsuite/
> 
>   * gcc.target/i386/indirect-thunk-1.c (dg-options): Add
>   -mfunction-return=keep.
>   * gcc.target/i386/indirect-thunk-2.c: Likewise.
>   * gcc.target/i386/indirect-thunk-3.c: Likewise.
>   * gcc.target/i386/indirect-thunk-4.c: Likewise.
>   * gcc.target/i386/indirect-thunk-5.c: Likewise.
>   * gcc.target/i386/indirect-thunk-6.c: Likewise.
>   * gcc.target/i386/indirect-thunk-7.c: Likewise.
>   * gcc.target/i386/indirect-thunk-attr-1.c: Likewise.
>   * gcc.target/i386/indirect-thunk-attr-2.c: Likewise.
>   * gcc.target/i386/indirect-thunk-attr-3.c: Likewise.
>   * gcc.target/i386/indirect-thunk-attr-4.c: Likewise.
>   * gcc.target/i386/indirect-thunk-attr-5.c: Likewise.
>   * gcc.target/i386/indirect-thunk-attr-6.c: Likewise.
>   * gcc.target/i386/indirect-thunk-attr-7.c: Likewise.
>   * gcc.target/i386/indirect-thunk-attr-8.c: Likewise.
>   * gcc.target/i386/indirect-thunk-bnd-1.c: Likewise.
>   * gcc.target/i386/indirect-thunk-bnd-2.c: Likewise.
>   * gcc.target/i386/indirect-thunk-bnd-3.c: Likewise.
>   * gcc.target/i386/indirect-thunk-bnd-4.c: Likewise.
>   * gcc.target/i386/indirect-thunk-extern-1.c: Likewise.
>   * gcc.target/i386/indirect-thunk-extern-2.c: Likewise.
>   * gcc.target/i386/indirect-thunk-extern-3.c: Likewise.
>   * gcc.target/i386/indirect-thunk-extern-4.c: Likewise.
>   * gcc.target/i386/indirect-thunk-extern-5.c: Likewise.
>   * gcc.target/i386/indirect-thunk-extern-6.c: Likewise.
>   * gcc.target/i386/indirect-thunk-extern-7.c: Likewise.
>   * gcc.target/i386/indirect-thunk-inline-1.c: Likewise.
>   * gcc.target/i386/indirect-thunk-inline-2.c: Likewise.
>   * gcc.target/i386/indirect-thunk-inline-3.c: Likewise.
>   * gcc.target/i386/indirect-thunk-inline-4.c: Likewise.
>   * gcc.target/i386/indirect-thunk-inline-5.c: Likewise.
>   * gcc.target/i386/indirect-thunk-inline-6.c: Likewise.
>   * gcc.target/i386/indirect-thunk-inline-7.c: Likewise.
>   * gcc.target/i386/ret-thunk-1.c: New test.
>   * gcc.target/i386/ret-thunk-10.c: Likewise.
>   * gcc.target/i386/ret-thunk-11.c: Likewise.
>   * gcc.target/i386/ret-thunk-12.c: Likewise.
>   * gcc.target/i386/ret-thunk-13.c: Likewise.
>   * gcc.target/i386/ret-thunk-14.c: Likewise.
>   * gcc.target/i386/ret-thunk-15.c: Likewise.
>   * gcc.target/i386/ret-thunk-16.c: Likewise.
>   * gcc.target/i386/ret-thunk-2.c: Likewise.
>   * gcc.target/i386/ret-thunk-3.c: Likewise.
>   * gcc.target/i386/ret-thunk-4.c: Likewise.
>   * gcc.target/i386/ret-thunk-5.c: Likewise.
>   * gcc.target/i386/ret-thunk-6.c: Likewise.
>   * gcc.target/i386/ret-thunk-7.c: Likewise.
>   * 

[PATCH 2/4] x86: Add -mfunction-return=

[H.J. Lu]

Add -mfunction-return= option to convert function return to call and
return thunks.  The default is 'keep', which keeps function return
unmodified.  'thunk' converts function return to call and return thunk.
'thunk-inline' converts function return to inlined call and return thunk.  
'thunk-extern' converts function return to external call and return
thunk provided in a separate object file.  You can control this behavior
for a specific function by using the function attribute function_return.

Function return thunk is the same as memory thunk for -mindirect-branch=
where the return address is at the top of the stack:

__x86_return_thunk:
call L2
L1:
pause
jmp L1
L2:
lea 8(%rsp), %rsp|lea 4(%esp), %esp
ret

and function return becomes

jmp __x86_return_thunk

-mindirect-branch= tests are updated with -mfunction-return=keep to
avoid false test failures when -mfunction-return=thunk is added to
RUNTESTFLAGS for "make check".

gcc/

* config/i386/i386-protos.h (ix86_output_function_return): New.
* config/i386/i386.c (ix86_set_indirect_branch_type): Also
set function_return_type.
(indirect_thunk_name): Add ret_p to indicate thunk for function
return.
(output_indirect_thunk_function): Pass false to
indirect_thunk_name.
(ix86_output_indirect_branch): Likewise.
(output_indirect_thunk_function): Create alias for function
return thunk if regno < 0.
(ix86_output_function_return): New function.
(ix86_handle_fndecl_attribute): Handle function_return.
(ix86_attribute_table): Add function_return.
* config/i386/i386.h (machine_function): Add
function_return_type.
* config/i386/i386.md (simple_return_internal): Use
ix86_output_function_return.
(simple_return_internal_long): Likewise.
* config/i386/i386.opt (mfunction-return=): New option.
(indirect_branch): Mention -mfunction-return=.
* doc/extend.texi: Document function_return function attribute.
* doc/invoke.texi: Document -mfunction-return= option.

gcc/testsuite/

* gcc.target/i386/indirect-thunk-1.c (dg-options): Add
-mfunction-return=keep.
* gcc.target/i386/indirect-thunk-2.c: Likewise.
* gcc.target/i386/indirect-thunk-3.c: Likewise.
* gcc.target/i386/indirect-thunk-4.c: Likewise.
* gcc.target/i386/indirect-thunk-5.c: Likewise.
* gcc.target/i386/indirect-thunk-6.c: Likewise.
* gcc.target/i386/indirect-thunk-7.c: Likewise.
* gcc.target/i386/indirect-thunk-attr-1.c: Likewise.
* gcc.target/i386/indirect-thunk-attr-2.c: Likewise.
* gcc.target/i386/indirect-thunk-attr-3.c: Likewise.
* gcc.target/i386/indirect-thunk-attr-4.c: Likewise.
* gcc.target/i386/indirect-thunk-attr-5.c: Likewise.
* gcc.target/i386/indirect-thunk-attr-6.c: Likewise.
* gcc.target/i386/indirect-thunk-attr-7.c: Likewise.
* gcc.target/i386/indirect-thunk-attr-8.c: Likewise.
* gcc.target/i386/indirect-thunk-bnd-1.c: Likewise.
* gcc.target/i386/indirect-thunk-bnd-2.c: Likewise.
* gcc.target/i386/indirect-thunk-bnd-3.c: Likewise.
* gcc.target/i386/indirect-thunk-bnd-4.c: Likewise.
* gcc.target/i386/indirect-thunk-extern-1.c: Likewise.
* gcc.target/i386/indirect-thunk-extern-2.c: Likewise.
* gcc.target/i386/indirect-thunk-extern-3.c: Likewise.
* gcc.target/i386/indirect-thunk-extern-4.c: Likewise.
* gcc.target/i386/indirect-thunk-extern-5.c: Likewise.
* gcc.target/i386/indirect-thunk-extern-6.c: Likewise.
* gcc.target/i386/indirect-thunk-extern-7.c: Likewise.
* gcc.target/i386/indirect-thunk-inline-1.c: Likewise.
* gcc.target/i386/indirect-thunk-inline-2.c: Likewise.
* gcc.target/i386/indirect-thunk-inline-3.c: Likewise.
* gcc.target/i386/indirect-thunk-inline-4.c: Likewise.
* gcc.target/i386/indirect-thunk-inline-5.c: Likewise.
* gcc.target/i386/indirect-thunk-inline-6.c: Likewise.
* gcc.target/i386/indirect-thunk-inline-7.c: Likewise.
* gcc.target/i386/ret-thunk-1.c: New test.
* gcc.target/i386/ret-thunk-10.c: Likewise.
* gcc.target/i386/ret-thunk-11.c: Likewise.
* gcc.target/i386/ret-thunk-12.c: Likewise.
* gcc.target/i386/ret-thunk-13.c: Likewise.
* gcc.target/i386/ret-thunk-14.c: Likewise.
* gcc.target/i386/ret-thunk-15.c: Likewise.
* gcc.target/i386/ret-thunk-16.c: Likewise.
* gcc.target/i386/ret-thunk-2.c: Likewise.
* gcc.target/i386/ret-thunk-3.c: Likewise.
* gcc.target/i386/ret-thunk-4.c: Likewise.
* gcc.target/i386/ret-thunk-5.c: Likewise.
* gcc.target/i386/ret-thunk-6.c: Likewise.
* gcc.target/i386/ret-thunk-7.c: Likewise.
* gcc.target/i386/ret-thunk-8.c: Likewise.
*