[PATCH] D52868: [AArch64][v8.5A] Restrict indirect tail calls to use x16/17 only when using BTI

[Oliver Stannard via Phabricator via llvm-commits]

olista01 created this revision.
olista01 added reviewers: t.p.northover, rengolin, LukeCheeseman.
Herald added a reviewer: javed.absar.
Herald added a subscriber: kristof.beyls.

When branch target identification is enabled, all indirectly-callable
functions start with a BTI C instruction. this instruction can only be
the target of certain indirect branches (direct branches and
fall-through are not affected):

- A BLR instruction, in either a protected or unprotected page.
- A BR instruction in a protected page, using x16 or x17.
- A BR instruction in an unprotected page, using any register.

Without BTI, we can use any non call-preserved register to hold the
address for an indirect tail call. However, when BTI is enabled, then
the code being compiled might be loaded into a BTI-protected page, where
only x16 and x17 can be used for indirect tail calls.

Legacy code withiout this restriction can still indirectly tail-call
BTI-protected functions, because they will be loaded into an unprotected
page, so any register is allowed.


Repository:
  rL LLVM

https://reviews.llvm.org/D52868

Files:
  lib/Target/AArch64/AArch64AsmPrinter.cpp
  lib/Target/AArch64/AArch64FrameLowering.cpp
  lib/Target/AArch64/AArch64InstrInfo.td
  lib/Target/AArch64/AArch64RegisterInfo.td
  test/CodeGen/AArch64/branch-target-enforcement-indirect-calls.ll

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D52868.168237.patch
Type: text/x-patch
Size: 5242 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20181004/c495adaf/attachment-0001.bin>