From d938ec4509c47d461377527fc2877ae14b91275c Mon Sep 17 00:00:00 2001 From: Kristof Beyls Date: Fri, 22 May 2020 21:00:46 +0100 Subject: [PATCH] [AArch64] Avoid incompatibility between SLSBLR mitigation and BTI codegen. A "BTI c" instruction only allows jumping/calling to using a BLR* instruction. However, the SLSBLR mitigation changes a BLR to a BR to implement the function call. Therefore, a "BTI c" check that passed before could trigger after the BLR->BL change done by the SLSBLR mitigation. However, if the register used in BR is X16 or X17, this trigger will not fire (see ArmARM for further details). Therefore, this patch simply changes the function stubs for the SLSBLR mitigation from __llvm_slsblr_thunk_x: br x SpeculationBarrier to __llvm_slsblr_thunk_x: mov x16, x br x16 SpeculationBarrier Differential Revision: https://reviews.llvm.org/D81405 --- llvm/lib/Target/AArch64/AArch64SLSHardening.cpp | 7 ++++++- llvm/test/CodeGen/AArch64/speculation-hardening-sls.ll | 6 ++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/llvm/lib/Target/AArch64/AArch64SLSHardening.cpp b/llvm/lib/Target/AArch64/AArch64SLSHardening.cpp index 9d225fa89fa4..0baf22a51c92 100644 --- a/llvm/lib/Target/AArch64/AArch64SLSHardening.cpp +++ b/llvm/lib/Target/AArch64/AArch64SLSHardening.cpp @@ -223,7 +223,12 @@ void SLSBLRThunkInserter::populateThunk(MachineFunction &MF) { // BR xN // barrierInsts Entry->addLiveIn(ThunkReg); - BuildMI(Entry, DebugLoc(), TII->get(AArch64::BR)).addReg(ThunkReg); + // MOV X16, ThunkReg == ORR X16, XZR, ThunkReg, LSL #0 + BuildMI(Entry, DebugLoc(), TII->get(AArch64::ORRXrs), AArch64::X16) + .addReg(AArch64::XZR) + .addReg(ThunkReg) + .addImm(0); + BuildMI(Entry, DebugLoc(), TII->get(AArch64::BR)).addReg(AArch64::X16); // Make sure the thunks do not make use of the SB extension in case there is // a function somewhere that will call to it that for some reason disabled // the SB extension locally on that function, even though it's enabled for diff --git a/llvm/test/CodeGen/AArch64/speculation-hardening-sls.ll b/llvm/test/CodeGen/AArch64/speculation-hardening-sls.ll index b7ea875dc661..90d27830134a 100644 --- a/llvm/test/CodeGen/AArch64/speculation-hardening-sls.ll +++ b/llvm/test/CodeGen/AArch64/speculation-hardening-sls.ll @@ -203,14 +203,16 @@ entry: } ; HARDEN-label: __llvm_slsblr_thunk_x0: -; HARDEN: br x0 +; HARDEN: mov x16, x0 +; HARDEN: br x16 ; ISBDSB-NEXT: dsb sy ; ISBDSB-NEXT: isb ; SB-NEXT: dsb sy ; SB-NEXT: isb ; HARDEN-NEXT: .Lfunc_end ; HARDEN-label: __llvm_slsblr_thunk_x19: -; HARDEN: br x19 +; HARDEN: mov x16, x19 +; HARDEN: br x16 ; ISBDSB-NEXT: dsb sy ; ISBDSB-NEXT: isb ; SB-NEXT: dsb sy -- GitLab