Page MenuHomePhabricator

[AArch64][v8.3A] Avoid inserting implicit landing pads (PACI*SP)
Needs ReviewPublic

Authored by pbarrio on May 5 2021, 9:26 AM.



PACI*SP have the advantage that they are in HINT space, meaning
they can be run successfully in hardware without PAuth support -
they will just behave as a NOP. However, PACI*SP are also implicit
landing pads (think of an extra BTI jc). Therefore, they allow
indirect jumps of all kinds into them, potentially inserting new
gadgets. This patch replaces PACI*SP by PACI* LR, SP when
compiling explicitly for hardware with full PAuth support. PACI*
is not in the HINT space, therefore it will fault when run in
hardware without PAuth support, but it is also not a landing pad,
making programs safer in newer HW.

Diff Detail

Event Timeline

pbarrio created this revision.May 5 2021, 9:26 AM
pbarrio requested review of this revision.May 5 2021, 9:26 AM
Herald added a project: Restricted Project. · View Herald TranscriptMay 5 2021, 9:26 AM

Wondering if AArch64InstrInfo::getOutliningType and the outline should do the same because it might emit PACIASP.
see the old change:



pbarrio updated this revision to Diff 344374.May 11 2021, 5:35 AM

Added handling of outlining for PACI* similarly to PACI*SP etc, and RegState info to SP.

pbarrio marked an inline comment as done.May 11 2021, 5:38 AM
pbarrio added a reviewer: ab.May 13 2021, 5:41 AM
pbarrio updated this revision to Diff 345102.May 13 2021, 5:43 AM

Updated PAC handling in the outliner. Now all outlined functions should use v8.3a instructions where possible.

All comments addressed (thank you @danielkiss). Does it look reasonable now?

efriedma added inline comments.

This isn't necessary, I think. The PACIA has an explicit "LR" operand, which should block outlining anyway.