[PowerPC] Add option for ROP Protection

[stefanp]

Summary

Added -mrop-protection for Power PC to turn on codegen that provides some
protection from ROP attacks.

The option is off by default and can be turned on for Power 8, Power 9 and
Power 10.

This patch is for the option only. The feature will be implemented by a later
patch.

[amyk]

I just have a small question about the patch but overall I think this LGTM.

llvm/lib/Target/PowerPC/PPC.td

317

Does FeatureROPProtection need to be here and in the P9/P10 features?

[stefanp]

Added missing FeatureROPProtection to P8AdditionalFeatures.

The P9 and P10 features list will inherit from the P8 list.

clang/include/clang/Driver/Options.td

 def mno_float128 : Flag<["-"], "mno-float128">,
     Group<m_ppc_Features_Group>;
 def mlongcall: Flag<["-"], "mlongcall">,
     Group<m_ppc_Features_Group>;
 def mno_longcall : Flag<["-"], "mno-longcall">,
     Group<m_ppc_Features_Group>;
 def mmma: Flag<["-"], "mmma">, Group<m_ppc_Features_Group>;
 def mno_mma: Flag<["-"], "mno-mma">, Group<m_ppc_Features_Group>;
+def mrop_protection : Flag<["-"], "mrop-protection">,
+    Group<m_ppc_Features_Group>;
 def maix_struct_return : Flag<["-"], "maix-struct-return">,
   Group<m_Group>, Flags<[CC1Option]>,
   HelpText<"Return all structs in memory (PPC32 only)">;
 def msvr4_struct_return : Flag<["-"], "msvr4-struct-return">,
   Group<m_Group>, Flags<[CC1Option]>,
   HelpText<"Return small structs in registers (PPC32 only)">;
 
 def mvx : Flag<["-"], "mvx">, Group<m_Group>;

clang/lib/Basic/Targets/PPC.h

class LLVM_LIBRARY_VISIBILITY PPCTargetInfo : public TargetInfo {
   static const char *const GCCRegNames[];
   static const TargetInfo::GCCRegAlias GCCRegAliases[];
   std::string CPU;
   enum PPCFloatABI { HardFloat, SoftFloat } FloatABI;
 
   // Target cpu features.
   bool HasAltivec = false;
   bool HasMMA = false;
+  bool HasROPProtection = false;
   bool HasVSX = false;
   bool HasP8Vector = false;
   bool HasP8Crypto = false;
   bool HasDirectMove = false;
   bool HasHTM = false;
   bool HasBPERMD = false;
   bool HasExtDiv = false;
   bool HasP9Vector = false;

clang/lib/Basic/Targets/PPC.cpp

if (Feature == "+altivec") {
       LongDoubleWidth = LongDoubleAlign = 64;
       LongDoubleFormat = &llvm::APFloat::IEEEdouble();
     } else if (Feature == "-hard-float") {
       FloatABI = SoftFloat;
     } else if (Feature == "+paired-vector-memops") {
       PairedVectorMemops = true;
     } else if (Feature == "+mma") {
       HasMMA = true;
+    } else if (Feature == "+rop-protection") {
+      HasROPProtection = true;
     }
     // TODO: Finish this list and add an assert that we've handled them
     // all.
   }
 
   return true;
 }
 
void PPCTargetInfo::getTargetDefines(const LangOptions &Opts,
   if (HasHTM)
     Builder.defineMacro("__HTM__");
   if (HasFloat128)
     Builder.defineMacro("__FLOAT128__");
   if (HasP9Vector)
     Builder.defineMacro("__POWER9_VECTOR__");
   if (HasMMA)
     Builder.defineMacro("__MMA__");
+  if (HasROPProtection)
+    Builder.defineMacro("__ROP_PROTECTION__");
   if (HasP10Vector)
     Builder.defineMacro("__POWER10_VECTOR__");
 
   Builder.defineMacro("__GCC_HAVE_SYNC_COMPARE_AND_SWAP_1");
   Builder.defineMacro("__GCC_HAVE_SYNC_COMPARE_AND_SWAP_2");
   Builder.defineMacro("__GCC_HAVE_SYNC_COMPARE_AND_SWAP_4");
   if (PointerWidth == 64)
     Builder.defineMacro("__GCC_HAVE_SYNC_COMPARE_AND_SWAP_8");
Features["vsx"] = llvm::StringSwitch<bool>(CPU)
                         .Case("pwr7", true)
                         .Default(false);
   Features["htm"] = llvm::StringSwitch<bool>(CPU)
                         .Case("ppc64le", true)
                         .Case("pwr9", true)
                         .Case("pwr8", true)
                         .Default(false);
 
+  // ROP Protection is off by default.
+  Features["rop-protection"] = false;
+
   Features["spe"] = llvm::StringSwitch<bool>(CPU)
                         .Case("8548", true)
                         .Case("e500", true)
                         .Default(false);
 
   // Power10 includes all the same features as Power9 plus any features specific
   // to the Power10 core.
   if (CPU == "pwr10" || CPU == "power10") {
bool PPCTargetInfo::initFeatureMap(
 
   if (!(ArchDefs & ArchDefinePwr10) &&
       llvm::find(FeaturesVec, "+mma") != FeaturesVec.end()) {
     // We have MMA on PPC but not power 10 and above.
     Diags.Report(diag::err_opt_not_valid_with_opt) << "-mmma" << CPU;
     return false;
   }
 
+  if (!(ArchDefs & ArchDefinePwr8) &&
+      llvm::find(FeaturesVec, "+rop-protection") != FeaturesVec.end()) {
+    // We can turn on ROP Protection on Power 8 and above.
+    Diags.Report(diag::err_opt_not_valid_with_opt) << "-mrop-protection" << CPU;
+    return false;
+  }
+
   return TargetInfo::initFeatureMap(Features, Diags, CPU, FeaturesVec);
 }
 
 // Add any Power10 specific features.
 void PPCTargetInfo::addP10SpecificFeatures(
     llvm::StringMap<bool> &Features) const {
   Features["htm"] = false; // HTM was removed for P10.
   Features["paired-vector-memops"] = true;
return llvm::StringSwitch<bool>(Feature)
       .Case("extdiv", HasExtDiv)
       .Case("float128", HasFloat128)
       .Case("power9-vector", HasP9Vector)
       .Case("paired-vector-memops", PairedVectorMemops)
       .Case("power10-vector", HasP10Vector)
       .Case("pcrelative-memops", HasPCRelativeMemops)
       .Case("spe", HasSPE)
       .Case("mma", HasMMA)
+      .Case("rop-protection", HasROPProtection)
       .Default(false);
 }
 
 void PPCTargetInfo::setFeatureEnabled(llvm::StringMap<bool> &Features,
                                       StringRef Name, bool Enabled) const {
   if (Enabled) {
     if (Name == "efpu2")
       Features["spe"] = true;

clang/test/Driver/ppc-mrop-protection-support-check.c

+// RUN: not %clang -target powerpc64le-unknown-linux-gnu -fsyntax-only \
+// RUN:   -mcpu=pwr10 -mrop-protection %s 2>&1 | FileCheck %s --check-prefix=HASROP
+// RUN: not %clang -target powerpc64le-unknown-linux-gnu -fsyntax-only \
+// RUN:   -mcpu=power10 -mrop-protection %s 2>&1 | FileCheck %s --check-prefix=HASROP
+// RUN: not %clang -target powerpc64le-unknown-linux-gnu -fsyntax-only \
+// RUN:   -mcpu=pwr9 -mrop-protection %s 2>&1 | FileCheck %s --check-prefix=HASROP
+// RUN: not %clang -target powerpc64le-unknown-linux-gnu -fsyntax-only \
+// RUN:   -mcpu=power9 -mrop-protection %s 2>&1 | FileCheck %s --check-prefix=HASROP
+// RUN: not %clang -target powerpc64le-unknown-linux-gnu -fsyntax-only \
+// RUN:   -mcpu=pwr8 -mrop-protection %s 2>&1 | FileCheck %s --check-prefix=HASROP
+// RUN: not %clang -target powerpc64le-unknown-linux-gnu -fsyntax-only \
+// RUN:   -mcpu=power8 -mrop-protection %s 2>&1 | FileCheck %s --check-prefix=HASROP
+
+// RUN: not %clang -target powerpc64le-unknown-linux-gnu -fsyntax-only \
+// RUN:   -mcpu=pwr7 -mrop-protection %s 2>&1 | FileCheck %s --check-prefix=NOROP
+// RUN: not %clang -target powerpc64le-unknown-linux-gnu -fsyntax-only \
+// RUN:   -mcpu=power7 -mrop-protection %s 2>&1 | FileCheck %s --check-prefix=NOROP
+
+#ifdef __ROP_PROTECTION__
+static_assert(false, "ROP Protection enabled");
+#endif
+
+// HASROP: ROP Protection enabled
+// HASROP-NOT: option '-mrop-protection' cannot be specified with
+// NOROP: option '-mrop-protection' cannot be specified with
+

clang/test/Preprocessor/init-ppc64.c

 // PPCPWR8:#define _ARCH_PPCSQ 1
 // PPCPWR8:#define _ARCH_PWR4 1
 // PPCPWR8:#define _ARCH_PWR5 1
 // PPCPWR8:#define _ARCH_PWR5X 1
 // PPCPWR8:#define _ARCH_PWR6 1
 // PPCPWR8-NOT:#define _ARCH_PWR6X 1
 // PPCPWR8:#define _ARCH_PWR7 1
 // PPCPWR8:#define _ARCH_PWR8 1
+// PPCPWR8-NOT:#define __ROP_PROTECTION__ 1
 //
 // RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-cpu power8 -fno-signed-char < /dev/null | FileCheck -match-full-lines -check-prefix PPCPOWER8 %s
 //
 // ppc64le also defaults to power8.
 // RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64le-none-none -target-cpu ppc64le -fno-signed-char < /dev/null | FileCheck -match-full-lines -check-prefix PPCPOWER8 %s
 //
 // PPCPOWER8:#define _ARCH_PPC 1
 // PPCPOWER8:#define _ARCH_PPC64 1
 // PPCPOWER8:#define _ARCH_PPCGR 1
 // PPCPOWER8:#define _ARCH_PPCSQ 1
 // PPCPOWER8:#define _ARCH_PWR4 1
 // PPCPOWER8:#define _ARCH_PWR5 1
 // PPCPOWER8:#define _ARCH_PWR5X 1
 // PPCPOWER8:#define _ARCH_PWR6 1
 // PPCPOWER8-NOT:#define _ARCH_PWR6X 1
 // PPCPOWER8:#define _ARCH_PWR7 1
 // PPCPOWER8:#define _ARCH_PWR8 1
+// PPCPOWER8-NOT:#define __ROP_PROTECTION__ 1
 //
 // RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-cpu pwr9 -fno-signed-char < /dev/null | FileCheck -match-full-lines -check-prefix PPCPWR9 %s
 //
 // PPCPWR9:#define _ARCH_PPC 1
 // PPCPWR9:#define _ARCH_PPC64 1
 // PPCPWR9:#define _ARCH_PPCGR 1
 // PPCPWR9:#define _ARCH_PPCSQ 1
 // PPCPWR9:#define _ARCH_PWR4 1
 // PPCPWR9:#define _ARCH_PWR5 1
 // PPCPWR9:#define _ARCH_PWR5X 1
 // PPCPWR9:#define _ARCH_PWR6 1
 // PPCPWR9-NOT:#define _ARCH_PWR6X 1
 // PPCPWR9:#define _ARCH_PWR7 1
 // PPCPWR9:#define _ARCH_PWR9 1
+// PPCPWR9-NOT:#define __ROP_PROTECTION__ 1
 //
 // RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-cpu power9 -fno-signed-char < /dev/null | FileCheck -match-full-lines -check-prefix PPCPOWER9 %s
 //
 // PPCPOWER9:#define _ARCH_PPC 1
 // PPCPOWER9:#define _ARCH_PPC64 1
 // PPCPOWER9:#define _ARCH_PPCGR 1
 // PPCPOWER9:#define _ARCH_PPCSQ 1
 // PPCPOWER9:#define _ARCH_PWR4 1
 // PPCPOWER9:#define _ARCH_PWR5 1
 // PPCPOWER9:#define _ARCH_PWR5X 1
 // PPCPOWER9:#define _ARCH_PWR6 1
 // PPCPOWER9-NOT:#define _ARCH_PWR6X 1
 // PPCPOWER9:#define _ARCH_PWR7 1
 // PPCPOWER9:#define _ARCH_PWR9 1
+// PPCPOWER9-NOT:#define __ROP_PROTECTION__ 1
 //
 // RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-cpu pwr10 -fno-signed-char < /dev/null | FileCheck -match-full-lines -check-prefix PPCPOWER10 %s
 // RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-cpu power10 -fno-signed-char < /dev/null | FileCheck -match-full-lines -check-prefix PPCPOWER10 %s
 //
 // PPCPOWER10:#define _ARCH_PPC 1
 // PPCPOWER10:#define _ARCH_PPC64 1
 // PPCPOWER10:#define _ARCH_PPCGR 1
 // PPCPOWER10:#define _ARCH_PPCSQ 1
 // PPCPOWER10:#define _ARCH_PWR10 1
 // PPCPOWER10:#define _ARCH_PWR4 1
 // PPCPOWER10:#define _ARCH_PWR5 1
 // PPCPOWER10:#define _ARCH_PWR5X 1
 // PPCPOWER10:#define _ARCH_PWR6 1
 // PPCPOWER10-NOT:#define _ARCH_PWR6X 1
 // PPCPOWER10:#define _ARCH_PWR7 1
 // PPCPOWER10:#define _ARCH_PWR8 1
 // PPCPOWER10:#define _ARCH_PWR9 1
 // PPCPOWER10:#define __MMA__ 1
+// PPCPOWER10-NOT:#define __ROP_PROTECTION__ 1
 //
 // RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-cpu future -fno-signed-char < /dev/null | FileCheck -match-full-lines -check-prefix PPCFUTURE %s
 //
 // PPCFUTURE:#define _ARCH_PPC 1
 // PPCFUTURE:#define _ARCH_PPC64 1
 // PPCFUTURE:#define _ARCH_PPCGR 1
 // PPCFUTURE:#define _ARCH_PPCSQ 1
 // PPCFUTURE:#define _ARCH_PWR10 1
 // PPCFUTURE:#define _ARCH_PWR4 1
 // PPCFUTURE:#define _ARCH_PWR5 1
 // PPCFUTURE:#define _ARCH_PWR5X 1
 // PPCFUTURE:#define _ARCH_PWR6 1
 // PPCFUTURE-NOT:#define _ARCH_PWR6X 1
 // PPCFUTURE:#define _ARCH_PWR7 1
 // PPCFUTURE:#define _ARCH_PWR8 1
 // PPCFUTURE:#define _ARCH_PWR9 1
 // PPCFUTURE:#define _ARCH_PWR_FUTURE 1
 // PPCFUTURE:#define __MMA__ 1
+// PPCFUTURE-NOT:#define __ROP_PROTECTION__ 1
 //
 // RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-feature +mma -target-cpu power10 -fno-signed-char < /dev/null | FileCheck -check-prefix PPC-MMA %s
 // PPC-MMA:#define __MMA__ 1
 //
+// RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-feature +rop-protection -target-cpu power10 -fno-signed-char < /dev/null | FileCheck -check-prefix PPC-ROP %s
+// RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-feature +rop-protection -target-cpu power9 -fno-signed-char < /dev/null | FileCheck -check-prefix PPC-ROP %s
+// RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-feature +rop-protection -target-cpu power8 -fno-signed-char < /dev/null | FileCheck -check-prefix PPC-ROP %s
+// PPC-ROP:#define __ROP_PROTECTION__ 1
+//
 // RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-none-none -target-feature +float128 -target-cpu power9 -fno-signed-char < /dev/null | FileCheck -check-prefix PPC-FLOAT128 %s
 // PPC-FLOAT128:#define __FLOAT128__ 1
 //
 // RUN: %clang_cc1 -E -dM -ffreestanding -triple=powerpc64-ibm-aix7.1.0.0 -fno-signed-char < /dev/null | FileCheck -match-full-lines -check-prefix PPC64-AIX %s
 //
 // PPC64-AIX:#define _AIX 1
 // PPC64-AIX:#define _ARCH_PPC 1
 // PPC64-AIX:#define _ARCH_PPC64 1

llvm/lib/Target/PowerPC/PPC.td

 def FeaturePairedVectorMemops:
   SubtargetFeature<"paired-vector-memops", "PairedVectorMemops", "true",
                    "32Byte load and store instructions",
                    [FeatureISA3_0]>;
 def FeatureMMA : SubtargetFeature<"mma", "HasMMA", "true",
                                   "Enable MMA instructions",
                                   [FeatureP8Vector, FeatureP9Altivec,
                                    FeaturePairedVectorMemops]>;
+def FeatureROPProtection :
+  SubtargetFeature<"rop-protection", "HasROPProtection", "false",
+                   "Add ROP protection">;
 
 def FeaturePredictableSelectIsExpensive :
   SubtargetFeature<"predictable-select-expensive",
                    "PredictableSelectIsExpensive",
                    "true",
                    "Prefer likely predicted branches over selects">;
 
 // Since new processors generally contain a superset of features of those that
list<SubtargetFeature> P7InheritableFeatures = [DirectivePwr7,
                                                   DeprecatedDST,
                                                   FeatureTwoConstNR,
                                                   FeatureUnalignedFloats];
   list<SubtargetFeature> P7SpecificFeatures = [];
   list<SubtargetFeature> P7Features =
     !listconcat(P7InheritableFeatures, P7SpecificFeatures);
 
   // Power8
   list<SubtargetFeature> P8AdditionalFeatures =
     [DirectivePwr8,
      FeatureP8Altivec,
      FeatureP8Vector,
      FeatureP8Crypto,
      FeatureHTM,
      FeatureDirectMove,
      FeatureICBT,
      FeaturePartwordAtomic,

llvm/lib/Target/PowerPC/PPCSubtarget.h

protected:
   bool HasP8Altivec;
   bool HasP8Crypto;
   bool HasP9Vector;
   bool HasP9Altivec;
   bool HasP10Vector;
   bool HasPrefixInstrs;
   bool HasPCRelativeMemops;
   bool HasMMA;
+  bool HasROPProtection;
   bool HasFCPSGN;
   bool HasFSQRT;
   bool HasFRE, HasFRES, HasFRSQRTE, HasFRSQRTES;
   bool HasRecipPrec;
   bool HasSTFIWX;
   bool HasLFIWAX;
   bool HasFPRND;
   bool HasFPCVT;
public:
   bool hasP8Altivec() const { return HasP8Altivec; }
   bool hasP8Crypto() const { return HasP8Crypto; }
   bool hasP9Vector() const { return HasP9Vector; }
   bool hasP9Altivec() const { return HasP9Altivec; }
   bool hasP10Vector() const { return HasP10Vector; }
   bool hasPrefixInstrs() const { return HasPrefixInstrs; }
   bool hasPCRelativeMemops() const { return HasPCRelativeMemops; }
   bool hasMMA() const { return HasMMA; }
+  bool hasROPProtection() const { return HasROPProtection; }
   bool pairedVectorMemops() const { return PairedVectorMemops; }
   bool hasMFOCRF() const { return HasMFOCRF; }
   bool hasISEL() const { return HasISEL; }
   bool hasBPERMD() const { return HasBPERMD; }
   bool hasExtDiv() const { return HasExtDiv; }
   bool hasCMPB() const { return HasCMPB; }
   bool hasLDBRX() const { return HasLDBRX; }
   bool isBookE() const { return IsBookE; }

llvm/lib/Target/PowerPC/PPCSubtarget.cpp

void PPCSubtarget::initializeEnvironment() {
   HasVSX = false;
   NeedsTwoConstNR = false;
   HasP8Vector = false;
   HasP8Altivec = false;
   HasP8Crypto = false;
   HasP9Vector = false;
   HasP9Altivec = false;
   HasMMA = false;
+  HasROPProtection = false;
   HasP10Vector = false;
   HasPrefixInstrs = false;
   HasPCRelativeMemops = false;
   HasFCPSGN = false;
   HasFSQRT = false;
   HasFRE = false;
   HasFRES = false;
   HasFRSQRTE = false;

llvm/test/CodeGen/PowerPC/future-check-features.ll

-; RUN: llc -mattr=pcrelative-memops,prefix-instrs,paired-vector-memops,mma \
+; RUN: llc -mattr=pcrelative-memops,prefix-instrs,paired-vector-memops,mma,rop-protection \
 ; RUN:   -verify-machineinstrs -mtriple=powerpc64le-unknown-unknown \
 ; RUN:   -ppc-asm-full-reg-names %s -o - 2>&1 | FileCheck %s
-; RUN: llc -mattr=pcrelative-memops,prefix-instrs,paired-vector-memops,mma \
+; RUN: llc -mattr=pcrelative-memops,prefix-instrs,paired-vector-memops,mma,rop-protection \
 ; RUN:   -verify-machineinstrs -mtriple=powerpc64-unknown-unknown \
 ; RUN:   -ppc-asm-full-reg-names %s -o - 2>&1 | FileCheck %s
 
 define dso_local signext i32 @f() {
 entry:
   ret i32 0
 }
 
 ; Make sure that all of the features listed are recognized.
 ; CHECK-NOT:    is not a recognized feature for this target
 
 ; Make sure that the test was actually compiled.
 ; CHECK:        li r3, 0
 ; CHECK-NEXT:   blr