mirror of
https://github.com/RPCS3/llvm-mirror.git
synced 2024-12-09 12:34:25 +00:00
[AArch64][v8.5A] Restrict indirect tail calls to use x16/17 only when using BTI
When branch target identification is enabled, all indirectly-callable functions start with a BTI C instruction. this instruction can only be the target of certain indirect branches (direct branches and fall-through are not affected): - A BLR instruction, in either a protected or unprotected page. - A BR instruction in a protected page, using x16 or x17. - A BR instruction in an unprotected page, using any register. Without BTI, we can use any non call-preserved register to hold the address for an indirect tail call. However, when BTI is enabled, then the code being compiled might be loaded into a BTI-protected page, where only x16 and x17 can be used for indirect tail calls. Legacy code withiout this restriction can still indirectly tail-call BTI-protected functions, because they will be loaded into an unprotected page, so any register is allowed. Differential revision: https://reviews.llvm.org/D52868 llvm-svn: 343968
This commit is contained in:
parent
b3f32dd524
commit
886a23647c
@ -591,6 +591,7 @@ void AArch64AsmPrinter::EmitInstruction(const MachineInstr *MI) {
|
||||
// attributes (isCall, isReturn, etc.). We lower them to the real
|
||||
// instruction here.
|
||||
case AArch64::TCRETURNri:
|
||||
case AArch64::TCRETURNriBTI:
|
||||
case AArch64::TCRETURNriALL: {
|
||||
MCInst TmpInst;
|
||||
TmpInst.setOpcode(AArch64::BR);
|
||||
|
@ -927,7 +927,8 @@ void AArch64FrameLowering::emitEpilogue(MachineFunction &MF,
|
||||
DL = MBBI->getDebugLoc();
|
||||
unsigned RetOpcode = MBBI->getOpcode();
|
||||
IsTailCallReturn = RetOpcode == AArch64::TCRETURNdi ||
|
||||
RetOpcode == AArch64::TCRETURNri;
|
||||
RetOpcode == AArch64::TCRETURNri ||
|
||||
RetOpcode == AArch64::TCRETURNriBTI;
|
||||
}
|
||||
int NumBytes = MFI.getStackSize();
|
||||
const AArch64FunctionInfo *AFI = MF.getInfo<AArch64FunctionInfo>();
|
||||
|
@ -360,6 +360,9 @@ let RecomputePerFunction = 1 in {
|
||||
def NotForCodeSize : Predicate<"!MF->getFunction().optForSize()">;
|
||||
// Avoid generating STRQro if it is slow, unless we're optimizing for code size.
|
||||
def UseSTRQro : Predicate<"!Subtarget->isSTRQroSlow() || MF->getFunction().optForSize()">;
|
||||
|
||||
def UseBTI : Predicate<[{ MF->getFunction().hasFnAttribute("branch-target-enforcement") }]>;
|
||||
def NotUseBTI : Predicate<[{ !MF->getFunction().hasFnAttribute("branch-target-enforcement") }]>;
|
||||
}
|
||||
|
||||
include "AArch64InstrFormats.td"
|
||||
@ -6641,10 +6644,18 @@ let isCall = 1, isTerminator = 1, isReturn = 1, isBarrier = 1, Uses = [SP] in {
|
||||
// some verifier checks for outlined functions.
|
||||
def TCRETURNriALL : Pseudo<(outs), (ins GPR64:$dst, i32imm:$FPDiff), []>,
|
||||
Sched<[WriteBrReg]>;
|
||||
// Indirect tail-call limited to only use registers (x16 and x17) which are
|
||||
// allowed to tail-call a "BTI c" instruction.
|
||||
def TCRETURNriBTI : Pseudo<(outs), (ins rtcGPR64:$dst, i32imm:$FPDiff), []>,
|
||||
Sched<[WriteBrReg]>;
|
||||
}
|
||||
|
||||
def : Pat<(AArch64tcret tcGPR64:$dst, (i32 timm:$FPDiff)),
|
||||
(TCRETURNri tcGPR64:$dst, imm:$FPDiff)>;
|
||||
(TCRETURNri tcGPR64:$dst, imm:$FPDiff)>,
|
||||
Requires<[NotUseBTI]>;
|
||||
def : Pat<(AArch64tcret rtcGPR64:$dst, (i32 timm:$FPDiff)),
|
||||
(TCRETURNriBTI rtcGPR64:$dst, imm:$FPDiff)>,
|
||||
Requires<[UseBTI]>;
|
||||
def : Pat<(AArch64tcret tglobaladdr:$dst, (i32 timm:$FPDiff)),
|
||||
(TCRETURNdi texternalsym:$dst, imm:$FPDiff)>;
|
||||
def : Pat<(AArch64tcret texternalsym:$dst, (i32 timm:$FPDiff)),
|
||||
|
@ -200,6 +200,12 @@ def tcGPR64 : RegisterClass<"AArch64", [i64], 64, (sub GPR64common, X19, X20, X2
|
||||
X22, X23, X24, X25, X26,
|
||||
X27, X28, FP, LR)>;
|
||||
|
||||
// Restricted set of tail call registers, for use when branch target
|
||||
// enforcement is enabled. These are the only registers which can be used to
|
||||
// indirectly branch (not call) to the "BTI c" instruction at the start of a
|
||||
// BTI-protected function.
|
||||
def rtcGPR64 : RegisterClass<"AArch64", [i64], 64, (add X16, X17)>;
|
||||
|
||||
// GPR register classes for post increment amount of vector load/store that
|
||||
// has alternate printing when Rm=31 and prints a constant immediate value
|
||||
// equal to the total number of bytes transferred.
|
||||
|
@ -0,0 +1,25 @@
|
||||
; RUN: llc -mtriple aarch64--none-eabi -mattr=+bti < %s | FileCheck %s
|
||||
|
||||
target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
|
||||
target triple = "aarch64-arm-none-eabi"
|
||||
|
||||
; When BTI is enabled, all indirect tail-calls must use x16 or x17 (the intra
|
||||
; procedure call scratch registers) to hold the address, as these instructions
|
||||
; are allowed to target the "BTI c" instruction at the start of the target
|
||||
; function. The alternative to this would be to start functions with "BTI jc",
|
||||
; which increases the number of potential ways they could be called, and
|
||||
; weakens the security protections.
|
||||
|
||||
define void @bti_disabled(void ()* %p) {
|
||||
entry:
|
||||
tail call void %p()
|
||||
; CHECK: br x0
|
||||
ret void
|
||||
}
|
||||
|
||||
define void @bti_enabled(void ()* %p) "branch-target-enforcement" {
|
||||
entry:
|
||||
tail call void %p()
|
||||
; CHECK: br {{x16|x17}}
|
||||
ret void
|
||||
}
|
Loading…
Reference in New Issue
Block a user