[llvm] r343968 - [AArch64][v8.5A] Restrict indirect tail calls to use x16/17 only when using BTI
Oliver Stannard via llvm-commits
llvm-commits at lists.llvm.org
Mon Oct 8 07:09:15 PDT 2018
Author: olista01
Date: Mon Oct 8 07:09:15 2018
New Revision: 343968
URL: http://llvm.org/viewvc/llvm-project?rev=343968&view=rev
Log:
[AArch64][v8.5A] Restrict indirect tail calls to use x16/17 only when using BTI
When branch target identification is enabled, all indirectly-callable
functions start with a BTI C instruction. this instruction can only be
the target of certain indirect branches (direct branches and
fall-through are not affected):
- A BLR instruction, in either a protected or unprotected page.
- A BR instruction in a protected page, using x16 or x17.
- A BR instruction in an unprotected page, using any register.
Without BTI, we can use any non call-preserved register to hold the
address for an indirect tail call. However, when BTI is enabled, then
the code being compiled might be loaded into a BTI-protected page, where
only x16 and x17 can be used for indirect tail calls.
Legacy code withiout this restriction can still indirectly tail-call
BTI-protected functions, because they will be loaded into an unprotected
page, so any register is allowed.
Differential revision: https://reviews.llvm.org/D52868
Added:
llvm/trunk/test/CodeGen/AArch64/branch-target-enforcement-indirect-calls.ll
Modified:
llvm/trunk/lib/Target/AArch64/AArch64AsmPrinter.cpp
llvm/trunk/lib/Target/AArch64/AArch64FrameLowering.cpp
llvm/trunk/lib/Target/AArch64/AArch64InstrInfo.td
llvm/trunk/lib/Target/AArch64/AArch64RegisterInfo.td
Modified: llvm/trunk/lib/Target/AArch64/AArch64AsmPrinter.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Target/AArch64/AArch64AsmPrinter.cpp?rev=343968&r1=343967&r2=343968&view=diff
==============================================================================
--- llvm/trunk/lib/Target/AArch64/AArch64AsmPrinter.cpp (original)
+++ llvm/trunk/lib/Target/AArch64/AArch64AsmPrinter.cpp Mon Oct 8 07:09:15 2018
@@ -591,6 +591,7 @@ void AArch64AsmPrinter::EmitInstruction(
// attributes (isCall, isReturn, etc.). We lower them to the real
// instruction here.
case AArch64::TCRETURNri:
+ case AArch64::TCRETURNriBTI:
case AArch64::TCRETURNriALL: {
MCInst TmpInst;
TmpInst.setOpcode(AArch64::BR);
Modified: llvm/trunk/lib/Target/AArch64/AArch64FrameLowering.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Target/AArch64/AArch64FrameLowering.cpp?rev=343968&r1=343967&r2=343968&view=diff
==============================================================================
--- llvm/trunk/lib/Target/AArch64/AArch64FrameLowering.cpp (original)
+++ llvm/trunk/lib/Target/AArch64/AArch64FrameLowering.cpp Mon Oct 8 07:09:15 2018
@@ -927,7 +927,8 @@ void AArch64FrameLowering::emitEpilogue(
DL = MBBI->getDebugLoc();
unsigned RetOpcode = MBBI->getOpcode();
IsTailCallReturn = RetOpcode == AArch64::TCRETURNdi ||
- RetOpcode == AArch64::TCRETURNri;
+ RetOpcode == AArch64::TCRETURNri ||
+ RetOpcode == AArch64::TCRETURNriBTI;
}
int NumBytes = MFI.getStackSize();
const AArch64FunctionInfo *AFI = MF.getInfo<AArch64FunctionInfo>();
Modified: llvm/trunk/lib/Target/AArch64/AArch64InstrInfo.td
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Target/AArch64/AArch64InstrInfo.td?rev=343968&r1=343967&r2=343968&view=diff
==============================================================================
--- llvm/trunk/lib/Target/AArch64/AArch64InstrInfo.td (original)
+++ llvm/trunk/lib/Target/AArch64/AArch64InstrInfo.td Mon Oct 8 07:09:15 2018
@@ -360,6 +360,9 @@ let RecomputePerFunction = 1 in {
def NotForCodeSize : Predicate<"!MF->getFunction().optForSize()">;
// Avoid generating STRQro if it is slow, unless we're optimizing for code size.
def UseSTRQro : Predicate<"!Subtarget->isSTRQroSlow() || MF->getFunction().optForSize()">;
+
+ def UseBTI : Predicate<[{ MF->getFunction().hasFnAttribute("branch-target-enforcement") }]>;
+ def NotUseBTI : Predicate<[{ !MF->getFunction().hasFnAttribute("branch-target-enforcement") }]>;
}
include "AArch64InstrFormats.td"
@@ -6641,10 +6644,18 @@ let isCall = 1, isTerminator = 1, isRetu
// some verifier checks for outlined functions.
def TCRETURNriALL : Pseudo<(outs), (ins GPR64:$dst, i32imm:$FPDiff), []>,
Sched<[WriteBrReg]>;
+ // Indirect tail-call limited to only use registers (x16 and x17) which are
+ // allowed to tail-call a "BTI c" instruction.
+ def TCRETURNriBTI : Pseudo<(outs), (ins rtcGPR64:$dst, i32imm:$FPDiff), []>,
+ Sched<[WriteBrReg]>;
}
def : Pat<(AArch64tcret tcGPR64:$dst, (i32 timm:$FPDiff)),
- (TCRETURNri tcGPR64:$dst, imm:$FPDiff)>;
+ (TCRETURNri tcGPR64:$dst, imm:$FPDiff)>,
+ Requires<[NotUseBTI]>;
+def : Pat<(AArch64tcret rtcGPR64:$dst, (i32 timm:$FPDiff)),
+ (TCRETURNriBTI rtcGPR64:$dst, imm:$FPDiff)>,
+ Requires<[UseBTI]>;
def : Pat<(AArch64tcret tglobaladdr:$dst, (i32 timm:$FPDiff)),
(TCRETURNdi texternalsym:$dst, imm:$FPDiff)>;
def : Pat<(AArch64tcret texternalsym:$dst, (i32 timm:$FPDiff)),
Modified: llvm/trunk/lib/Target/AArch64/AArch64RegisterInfo.td
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Target/AArch64/AArch64RegisterInfo.td?rev=343968&r1=343967&r2=343968&view=diff
==============================================================================
--- llvm/trunk/lib/Target/AArch64/AArch64RegisterInfo.td (original)
+++ llvm/trunk/lib/Target/AArch64/AArch64RegisterInfo.td Mon Oct 8 07:09:15 2018
@@ -200,6 +200,12 @@ def tcGPR64 : RegisterClass<"AArch64", [
X22, X23, X24, X25, X26,
X27, X28, FP, LR)>;
+// Restricted set of tail call registers, for use when branch target
+// enforcement is enabled. These are the only registers which can be used to
+// indirectly branch (not call) to the "BTI c" instruction at the start of a
+// BTI-protected function.
+def rtcGPR64 : RegisterClass<"AArch64", [i64], 64, (add X16, X17)>;
+
// GPR register classes for post increment amount of vector load/store that
// has alternate printing when Rm=31 and prints a constant immediate value
// equal to the total number of bytes transferred.
Added: llvm/trunk/test/CodeGen/AArch64/branch-target-enforcement-indirect-calls.ll
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/CodeGen/AArch64/branch-target-enforcement-indirect-calls.ll?rev=343968&view=auto
==============================================================================
--- llvm/trunk/test/CodeGen/AArch64/branch-target-enforcement-indirect-calls.ll (added)
+++ llvm/trunk/test/CodeGen/AArch64/branch-target-enforcement-indirect-calls.ll Mon Oct 8 07:09:15 2018
@@ -0,0 +1,25 @@
+; RUN: llc -mtriple aarch64--none-eabi -mattr=+bti < %s | FileCheck %s
+
+target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
+target triple = "aarch64-arm-none-eabi"
+
+; When BTI is enabled, all indirect tail-calls must use x16 or x17 (the intra
+; procedure call scratch registers) to hold the address, as these instructions
+; are allowed to target the "BTI c" instruction at the start of the target
+; function. The alternative to this would be to start functions with "BTI jc",
+; which increases the number of potential ways they could be called, and
+; weakens the security protections.
+
+define void @bti_disabled(void ()* %p) {
+entry:
+ tail call void %p()
+; CHECK: br x0
+ ret void
+}
+
+define void @bti_enabled(void ()* %p) "branch-target-enforcement" {
+entry:
+ tail call void %p()
+; CHECK: br {{x16|x17}}
+ ret void
+}
More information about the llvm-commits
mailing list