This is an archive of the discontinued LLVM Phabricator instance.

[AArch64][v8.5A] Restrict indirect tail calls to use x16/17 only when using BTI
ClosedPublic

Authored by olista01 on Oct 4 2018, 1:34 AM.

Details

Summary

When branch target identification is enabled, all indirectly-callable
functions start with a BTI C instruction. this instruction can only be
the target of certain indirect branches (direct branches and
fall-through are not affected):

  • A BLR instruction, in either a protected or unprotected page.
  • A BR instruction in a protected page, using x16 or x17.
  • A BR instruction in an unprotected page, using any register.

Without BTI, we can use any non call-preserved register to hold the
address for an indirect tail call. However, when BTI is enabled, then
the code being compiled might be loaded into a BTI-protected page, where
only x16 and x17 can be used for indirect tail calls.

Legacy code withiout this restriction can still indirectly tail-call
BTI-protected functions, because they will be loaded into an unprotected
page, so any register is allowed.

Diff Detail

Repository
rL LLVM

Event Timeline

olista01 created this revision.Oct 4 2018, 1:34 AM
t.p.northover added inline comments.Oct 8 2018, 4:04 AM
lib/Target/AArch64/AArch64InstrInfo.td
6641

I don't think the Requires clauses here actually affect anything: there's no assembly syntax (or indeed MC-level feature) and the patterns are separate.

olista01 updated this revision to Diff 168656.Oct 8 2018, 6:56 AM

Remove unnecessary Requires on pseudo-instructions.

t.p.northover accepted this revision.Oct 8 2018, 6:57 AM

Thanks. This looks fine now.

This revision is now accepted and ready to land.Oct 8 2018, 6:57 AM
This revision was automatically updated to reflect the committed changes.

Would it also make sense to enforce the corresponding restriction, that non-tail-call indirect branches shouldn't use x16/x17?