[x86] Implement a tagged-globals backend feature.

[morehouse]

Summary

The feature tells the backend to allow tags in the upper bits of global
variable addresses. These tags will be ignored by upcoming CPUs with
the Intel LAM feature but may be used in instrumentation passes (e.g.,
HWASan).

This patch implements the feature by using @GOTPCREL relocations instead
of direct references to the locally defined global. Thus the full
tagged address can be loaded by a single instruction:

movq global@GOTPCREL(%rip), %rax

[eugenis]

LGTM

This also needs the -mrelax-relocations=no flag to work correctly, right?

[morehouse]

• Clarify that -mrelax-relocations=no is required.

[morehouse]

• Fix diffbase.

[morehouse]

In D111343#3049374, @eugenis wrote:

This also needs the -mrelax-relocations=no flag to work correctly, right?

Yes, updated the feature description to state this.

llvm/lib/Target/X86/X86.td

 
 // Mitigate LVI attacks against data loads
 def FeatureLVILoadHardening
     : SubtargetFeature<
           "lvi-load-hardening", "UseLVILoadHardening", "true",
           "Insert LFENCE instructions to prevent data speculatively injected "
           "into loads from being used maliciously.">;
 
+def FeatureTaggedGlobals
+    : SubtargetFeature<
+          "tagged-globals", "AllowTaggedGlobals", "true",
+          "Use an instruction sequence for taking the address of a global "
+          "that allows a memory tag in the upper address bits. Currently "
+          "also requires -mrelax-relocations=no to work properly.">;
+
 //===----------------------------------------------------------------------===//
 // X86 Subtarget Tuning features
 //===----------------------------------------------------------------------===//
 
 def TuningSlowSHLD : SubtargetFeature<"slow-shld", "IsSHLDSlow", "true",
                                        "SHLD instruction is slow">;
 
 def TuningSlowPMULLD : SubtargetFeature<"slow-pmulld", "IsPMULLDSlow", "true",

llvm/lib/Target/X86/X86Subtarget.h

class X86Subtarget final : public X86GenSubtargetInfo {
 
   /// Enable Speculative Execution Side Effect Suppression
   bool UseSpeculativeExecutionSideEffectSuppression = false;
 
   /// Insert LFENCE instructions to prevent data speculatively injected into
   /// loads from being used maliciously.
   bool UseLVILoadHardening = false;
 
+  /// Use an instruction sequence for taking the address of a global that allows
+  /// a memory tag in the upper address bits.
+  bool AllowTaggedGlobals = false;
+
   /// Use software floating point for code generation.
   bool UseSoftFloat = false;
 
   /// Use alias analysis during code generation.
   bool UseAA = false;
 
   /// The minimum alignment known to hold of the stack frame on
   /// entry to the function and which must be maintained by every function.
public:
   }
   bool useIndirectThunkBranches() const {
     return useRetpolineIndirectBranches() || useLVIControlFlowIntegrity();
   }
 
   bool preferMaskRegisters() const { return PreferMaskRegisters; }
   bool useGLMDivSqrtCosts() const { return UseGLMDivSqrtCosts; }
   bool useLVIControlFlowIntegrity() const { return UseLVIControlFlowIntegrity; }
+  bool allowTaggedGlobals() const { return AllowTaggedGlobals; }
   bool useLVILoadHardening() const { return UseLVILoadHardening; }
   bool useSpeculativeExecutionSideEffectSuppression() const {
     return UseSpeculativeExecutionSideEffectSuppression;
   }
 
   unsigned getPreferVectorWidth() const { return PreferVectorWidth; }
   unsigned getRequiredVectorWidth() const { return RequiredVectorWidth; }
 

llvm/lib/Target/X86/X86Subtarget.cpp

 /// how we should reference it in a non-pcrel context.
 unsigned char
 X86Subtarget::classifyGlobalReference(const GlobalValue *GV) const {
   return classifyGlobalReference(GV, *GV->getParent());
 }
 
 unsigned char
 X86Subtarget::classifyLocalReference(const GlobalValue *GV) const {
+  // Tagged globals have non-zero upper bits, which makes direct references
+  // require a 64-bit immediate.  On the small code model this causes relocation
+  // errors, so we go through the GOT instead.
+  if (AllowTaggedGlobals && TM.getCodeModel() == CodeModel::Small &&
+      !isa_and_nonnull<Function>(GV))
+    return X86II::MO_GOTPCREL;
+
   // If we're not PIC, it's not very interesting.
   if (!isPositionIndependent())
     return X86II::MO_NO_FLAG;
 
   if (is64Bit()) {
     // 64-bit ELF PIC local references may use GOTOFF relocations.
     if (isTargetELF()) {
       switch (TM.getCodeModel()) {

llvm/test/CodeGen/X86/tagged-globals-pic.ll

+; RUN: llc --relocation-model=pic < %s | FileCheck %s
+
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+@global = external global i32
+declare void @func()
+
+define i32* @global_addr() #0 {
+  ; CHECK-LABEL: global_addr:
+  ; CHECK: movq global@GOTPCREL(%rip), %rax
+  ; CHECK: retq
+
+  ret i32* @global
+}
+
+define i32 @global_load() #0 {
+  ; CHECK-LABEL: global_load:
+  ; CHECK: movq global@GOTPCREL(%rip), [[REG:%r[0-9a-z]+]]
+  ; CHECK: movl ([[REG]]), %eax
+  ; CHECK: retq
+
+  %load = load i32, i32* @global
+  ret i32 %load
+}
+
+define void @global_store() #0 {
+  ; CHECK-LABEL: global_store:
+  ; CHECK: movq global@GOTPCREL(%rip), [[REG:%r[0-9a-z]+]]
+  ; CHECK: movl $0, ([[REG]])
+  ; CHECK: retq
+
+  store i32 0, i32* @global
+  ret void
+}
+
+define void ()* @func_addr() #0 {
+  ; CHECK-LABEL: func_addr:
+  ; CHECK: movq func@GOTPCREL(%rip), %rax
+  ; CHECK: retq
+
+  ret void ()* @func
+}
+
+attributes #0 = { "target-features"="+tagged-globals" }

llvm/test/CodeGen/X86/tagged-globals-static.ll

+; RUN: llc --relocation-model=static < %s | FileCheck %s
+
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+@global = external dso_local global i32
+declare dso_local void @func()
+
+define i32* @global_addr() #0 {
+  ; CHECK-LABEL: global_addr:
+  ; CHECK: movq global@GOTPCREL(%rip), %rax
+  ; CHECK: retq
+
+  ret i32* @global
+}
+
+define i32 @global_load() #0 {
+  ; CHECK-LABEL: global_load:
+  ; CHECK: movq global@GOTPCREL(%rip), [[REG:%r[0-9a-z]+]]
+  ; CHECK: movl ([[REG]]), %eax
+  ; CHECK: retq
+
+  %load = load i32, i32* @global
+  ret i32 %load
+}
+
+define void @global_store() #0 {
+  ; CHECK-LABEL: global_store:
+  ; CHECK: movq global@GOTPCREL(%rip), [[REG:%r[0-9a-z]+]]
+  ; CHECK: movl $0, ([[REG]])
+  ; CHECK: retq
+
+  store i32 0, i32* @global
+  ret void
+}
+
+define void ()* @func_addr() #0 {
+  ; CHECK-LABEL: func_addr:
+  ; CHECK: movl $func, %eax
+  ; CHECK: retq
+
+  ret void ()* @func
+}
+
+attributes #0 = { "target-features"="+tagged-globals" }