[all-commits] [llvm/llvm-project] f5f28d: [ARM] Implement BTI placement pass for PACBTI-M

[Ties Stuij via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: f5f28d5b0ce76af8f6944774aa73bad9e328b020
      https://github.com/llvm/llvm-project/commit/f5f28d5b0ce76af8f6944774aa73bad9e328b020
  Author: Ties Stuij <ties.stuij at arm.com>
  Date:   2021-12-01 (Wed, 01 Dec 2021)

  Changed paths:
    M llvm/include/llvm/CodeGen/TargetInstrInfo.h
    M llvm/lib/CodeGen/MachineOutliner.cpp
    M llvm/lib/CodeGen/TargetInstrInfo.cpp
    M llvm/lib/Target/ARM/ARM.h
    M llvm/lib/Target/ARM/ARMBaseInstrInfo.cpp
    M llvm/lib/Target/ARM/ARMBaseInstrInfo.h
    A llvm/lib/Target/ARM/ARMBranchTargets.cpp
    M llvm/lib/Target/ARM/ARMConstantIslandPass.cpp
    M llvm/lib/Target/ARM/ARMTargetMachine.cpp
    M llvm/lib/Target/ARM/CMakeLists.txt
    M llvm/test/CodeGen/ARM/O3-pipeline.ll
    A llvm/test/CodeGen/Thumb2/bti-const-island-multiple-jump-tables.mir
    A llvm/test/CodeGen/Thumb2/bti-const-island.mir
    A llvm/test/CodeGen/Thumb2/bti-entry-blocks.ll
    A llvm/test/CodeGen/Thumb2/bti-indirect-branches.ll
    A llvm/test/CodeGen/Thumb2/bti-jump-table.mir
    A llvm/test/CodeGen/Thumb2/bti-outliner-1.ll
    A llvm/test/CodeGen/Thumb2/bti-outliner-2.ll
    A llvm/test/CodeGen/Thumb2/bti-outliner-cost-1.ll
    A llvm/test/CodeGen/Thumb2/bti-outliner-cost-2.ll

  Log Message:
  -----------
  [ARM] Implement BTI placement pass for PACBTI-M

This patch implements a new MachineFunction in the ARM backend for
placing BTI instructions. It is similar to the existing AArch64
aarch64-branch-targets pass.

BTI instructions are inserted into basic blocks that:
- Have their address taken
- Are the entry block of a function, if the function has external
  linkage or has its address taken
- Are mentioned in jump tables
- Are exception/cleanup landing pads

Each BTI instructions is placed in the beginning of a BB after the
so-called meta instructions (e.g. exception handler labels).

Each outlining candidate and the outlined function need to be in agreement about
whether BTI placement is enabled or not. If branch target enforcement is
disabled for a function, the outliner should not covertly enable it by emitting
a call to an outlined function, which begins with BTI.

The cost mode of the outliner is adjusted to account for the extra BTI
instructions in the outlined function.

The ARM Constant Islands pass will maintain the count of the jump tables, which
reference a block. A `BTI` instruction is removed from a block only if the
reference count reaches zero.

PAC instructions in entry blocks are replaced with PACBTI instructions (tests
for this case will be added in a later patch because the compiler currently does
not generate PAC instructions).

The ARM Constant Island pass is adjusted to handle BTI
instructions correctly.

Functions with static linkage that don't have their address taken can
still be called indirectly by linker-generated veneers and thus their
entry points need be marked with BTI or PACBTI.

The changes are tested using "LLVM IR -> assembly" tests, jump tables
also have a MIR test. Unfortunately it is not possible add MIR tests
for exception handling and computed gotos because of MIR parser
limitations.

This patch is part of a series that adds support for the PACBTI-M extension of
the Armv8.1-M architecture, as detailed here:

https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/armv8-1-m-pointer-authentication-and-branch-target-identification-extension

The PACBTI-M specification can be found in the Armv8-M Architecture Reference
Manual:

https://developer.arm.com/documentation/ddi0553/latest

The following people contributed to this patch:

- Mikhail Maltsev
- Momchil Velikov
- Ties Stuij

Reviewed By: ostannard

Differential Revision: https://reviews.llvm.org/D112426