Skip to content

Commit 9e844b9

Browse files
DanielKristofKissDanielKristofKiss
committed
Emit attributes for functions always.
Branch protection, sign return address, guarded control stack flags are only emitted as module flags if not specified per function. The inliner might inline functions with different set of flags as it doesn't see the flags. In case of LTO build the module flags get merged with the `min` rule which means if one of the modules is not build with PAC/BTI then the features will be turned off on all functions due to the functions takes the branch-protection and sign-return-address features from the module flags. The sign-return-address is function level option therefore it is expected functions from files that are compiled with -mbranch-protection=pac-ret to be protected but in LTO case this might not happen. This patch adds the flags to functions in case of an LTO build therefore they don't need to rely on the module flag.
1 parent dfec4ef commit 9e844b9

File tree

8 files changed

+119
-61
lines changed

8 files changed

+119
-61
lines changed

‎clang/include/clang/Basic/TargetInfo.h

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,9 @@
3131
#include "llvm/ADT/StringRef.h"
3232
#include "llvm/ADT/StringSet.h"
3333
#include "llvm/Frontend/OpenMP/OMPGridValues.h"
34+
#include "llvm/IR/Attributes.h"
3435
#include "llvm/IR/DerivedTypes.h"
36+
#include "llvm/IR/Function.h"
3537
#include "llvm/Support/DataTypes.h"
3638
#include "llvm/Support/Error.h"
3739
#include "llvm/Support/VersionTuple.h"
@@ -1368,15 +1370,15 @@ class TargetInfo : public TransferrableTargetInfo,
13681370
return StringRef();
13691371
}
13701372

1371-
struct BranchProtectionInfo {
1373+
class BranchProtectionInfo {
1374+
public:
13721375
LangOptions::SignReturnAddressScopeKind SignReturnAddr;
13731376
LangOptions::SignReturnAddressKeyKind SignKey;
13741377
bool BranchTargetEnforcement;
13751378
bool BranchProtectionPAuthLR;
13761379
bool GuardedControlStack;
13771380

1378-
BranchProtectionInfo() = default;
1379-
1381+
protected:
13801382
const char *getSignReturnAddrStr() const {
13811383
switch (SignReturnAddr) {
13821384
case LangOptions::SignReturnAddressScopeKind::None:
@@ -1398,6 +1400,42 @@ class TargetInfo : public TransferrableTargetInfo,
13981400
}
13991401
llvm_unreachable("Unexpected SignReturnAddressKeyKind");
14001402
}
1403+
1404+
public:
1405+
BranchProtectionInfo() = default;
1406+
BranchProtectionInfo(const LangOptions &LangOpts) {
1407+
SignReturnAddr =
1408+
LangOpts.hasSignReturnAddress()
1409+
? (LangOpts.isSignReturnAddressScopeAll()
1410+
? LangOptions::SignReturnAddressScopeKind::All
1411+
: LangOptions::SignReturnAddressScopeKind::NonLeaf)
1412+
: LangOptions::SignReturnAddressScopeKind::None;
1413+
SignKey = LangOpts.isSignReturnAddressWithAKey()
1414+
? LangOptions::SignReturnAddressKeyKind::AKey
1415+
: LangOptions::SignReturnAddressKeyKind::BKey;
1416+
BranchTargetEnforcement = LangOpts.BranchTargetEnforcement;
1417+
BranchProtectionPAuthLR = LangOpts.BranchProtectionPAuthLR;
1418+
GuardedControlStack = LangOpts.GuardedControlStack;
1419+
}
1420+
1421+
void setFnAttributes(llvm::Function &F) {
1422+
llvm::AttrBuilder FuncAttrs(F.getContext());
1423+
setFnAttributes(FuncAttrs);
1424+
F.addFnAttrs(FuncAttrs);
1425+
}
1426+
1427+
void setFnAttributes(llvm::AttrBuilder &FuncAttrs) {
1428+
if (SignReturnAddr != LangOptions::SignReturnAddressScopeKind::None) {
1429+
FuncAttrs.addAttribute("sign-return-address", getSignReturnAddrStr());
1430+
FuncAttrs.addAttribute("sign-return-address-key", getSignKeyStr());
1431+
}
1432+
if (BranchTargetEnforcement)
1433+
FuncAttrs.addAttribute("branch-target-enforcement", "true");
1434+
if (BranchProtectionPAuthLR)
1435+
FuncAttrs.addAttribute("branch-protection-pauth-lr", "true");
1436+
if (GuardedControlStack)
1437+
FuncAttrs.addAttribute("guarded-control-stack", "true");
1438+
}
14011439
};
14021440

14031441
/// Determine if the Architecture in this TargetInfo supports branch

‎clang/lib/CodeGen/Targets/AArch64.cpp

Lines changed: 15 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -116,37 +116,22 @@ class AArch64TargetCodeGenInfo : public TargetCodeGenInfo {
116116
if (!FD)
117117
return;
118118

119-
const auto *TA = FD->getAttr<TargetAttr>();
120-
if (TA == nullptr)
121-
return;
122-
123-
ParsedTargetAttr Attr =
124-
CGM.getTarget().parseTargetAttr(TA->getFeaturesStr());
125-
if (Attr.BranchProtection.empty())
126-
return;
127-
128-
TargetInfo::BranchProtectionInfo BPI;
129-
StringRef Error;
130-
(void)CGM.getTarget().validateBranchProtection(Attr.BranchProtection,
131-
Attr.CPU, BPI, Error);
132-
assert(Error.empty());
133-
134-
auto *Fn = cast<llvm::Function>(GV);
135-
Fn->addFnAttr("sign-return-address", BPI.getSignReturnAddrStr());
136-
137-
if (BPI.SignReturnAddr != LangOptions::SignReturnAddressScopeKind::None) {
138-
Fn->addFnAttr("sign-return-address-key",
139-
BPI.SignKey == LangOptions::SignReturnAddressKeyKind::AKey
140-
? "a_key"
141-
: "b_key");
119+
TargetInfo::BranchProtectionInfo BPI(CGM.getLangOpts());
120+
121+
if (const auto *TA = FD->getAttr<TargetAttr>()) {
122+
ParsedTargetAttr Attr =
123+
CGM.getTarget().parseTargetAttr(TA->getFeaturesStr());
124+
if (!Attr.BranchProtection.empty()) {
125+
StringRef Error;
126+
(void)CGM.getTarget().validateBranchProtection(Attr.BranchProtection,
127+
Attr.CPU, BPI, Error);
128+
#ifndef NDEBUG
129+
assert(Error.empty());
130+
#endif
131+
}
142132
}
143-
144-
Fn->addFnAttr("branch-target-enforcement",
145-
BPI.BranchTargetEnforcement ? "true" : "false");
146-
Fn->addFnAttr("branch-protection-pauth-lr",
147-
BPI.BranchProtectionPAuthLR ? "true" : "false");
148-
Fn->addFnAttr("guarded-control-stack",
149-
BPI.GuardedControlStack ? "true" : "false");
133+
auto *Fn = cast<llvm::Function>(GV);
134+
BPI.setFnAttributes(*Fn);
150135
}
151136

152137
bool isScalarizableAsmOperand(CodeGen::CodeGenFunction &CGF,

‎clang/lib/CodeGen/Targets/ARM.cpp

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -152,9 +152,7 @@ class ARMTargetCodeGenInfo : public TargetCodeGenInfo {
152152
diag::warn_target_unsupported_branch_protection_attribute)
153153
<< Arch;
154154
} else {
155-
Fn->addFnAttr("sign-return-address", BPI.getSignReturnAddrStr());
156-
Fn->addFnAttr("branch-target-enforcement",
157-
BPI.BranchTargetEnforcement ? "true" : "false");
155+
BPI.setFnAttributes(*Fn);
158156
}
159157
} else if (CGM.getLangOpts().BranchTargetEnforcement ||
160158
CGM.getLangOpts().hasSignReturnAddress()) {
@@ -167,6 +165,10 @@ class ARMTargetCodeGenInfo : public TargetCodeGenInfo {
167165
diag::warn_target_unsupported_branch_protection_attribute)
168166
<< Attr.CPU;
169167
}
168+
} else if (CGM.getTarget().isBranchProtectionSupportedArch(
169+
CGM.getTarget().getTargetOpts().CPU)) {
170+
TargetInfo::BranchProtectionInfo BPI(CGM.getLangOpts());
171+
BPI.setFnAttributes(*Fn);
170172
}
171173

172174
const ARMInterruptAttr *Attr = FD->getAttr<ARMInterruptAttr>();

‎clang/test/CodeGen/aarch64-branch-protection-attr.c

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -67,29 +67,29 @@ __attribute__ ((target("branch-protection=gcs")))
6767
void gcs() {}
6868
// CHECK: define{{.*}} void @gcs() #[[#GCS:]]
6969

70-
// CHECK-DAG: attributes #[[#NONE]] = { {{.*}} "branch-target-enforcement"="false" "guarded-control-stack"="false" {{.*}} "sign-return-address"="none"
70+
// CHECK-DAG: attributes #[[#NONE]] = { {{.*}}
7171

7272
// CHECK-DAG: attributes #[[#STD]] = { {{.*}} "branch-target-enforcement"="true" "guarded-control-stack"="true" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
7373

74-
// CHECK-DAG: attributes #[[#BTI]] = { {{.*}} "branch-target-enforcement"="true" "guarded-control-stack"="false" {{.*}} "sign-return-address"="none"
74+
// CHECK-DAG: attributes #[[#BTI]] = { {{.*}} "branch-target-enforcement"="true"
7575

76-
// CHECK-DAG: attributes #[[#PAC]] = { {{.*}} "branch-target-enforcement"="false" "guarded-control-stack"="false" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
76+
// CHECK-DAG: attributes #[[#PAC]] = { {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
7777

78-
// CHECK-DAG: attributes #[[#PACLEAF]] = { {{.*}} "branch-target-enforcement"="false" "guarded-control-stack"="false" {{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"
78+
// CHECK-DAG: attributes #[[#PACLEAF]] = { {{.*}} "sign-return-address"="all" "sign-return-address-key"="a_key"
7979

80-
// CHECK-DAG: attributes #[[#PACBKEY]] = { {{.*}}"branch-target-enforcement"="false" "guarded-control-stack"="false" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="b_key"
80+
// CHECK-DAG: attributes #[[#PACBKEY]] = { {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="b_key"
8181

82-
// CHECK-DAG: attributes #[[#PACBKEYLEAF]] = { {{.*}} "branch-target-enforcement"="false" "guarded-control-stack"="false" {{.*}}"sign-return-address"="all" "sign-return-address-key"="b_key"
82+
// CHECK-DAG: attributes #[[#PACBKEYLEAF]] = { {{.*}} "sign-return-address"="all" "sign-return-address-key"="b_key"
8383

84-
// CHECK-DAG: attributes #[[#BTIPACLEAF]] = { {{.*}}"branch-target-enforcement"="true" "guarded-control-stack"="false" {{.*}} "sign-return-address"="all" "sign-return-address-key"="a_key"
84+
// CHECK-DAG: attributes #[[#BTIPACLEAF]] = { {{.*}} "branch-target-enforcement"="true" {{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"
8585

8686

87-
// CHECK-DAG: attributes #[[#PAUTHLR]] = { {{.*}}"branch-protection-pauth-lr"="true" {{.*}}"branch-target-enforcement"="false" "guarded-control-stack"="false" {{.*}}"sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
87+
// CHECK-DAG: attributes #[[#PAUTHLR]] = { {{.*}} "branch-protection-pauth-lr"="true" {{.*}}"sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
8888

89-
// CHECK-DAG: attributes #[[#PAUTHLR_BKEY]] = { {{.*}}"branch-protection-pauth-lr"="true" {{.*}}"branch-target-enforcement"="false" "guarded-control-stack"="false" {{.*}}"sign-return-address"="non-leaf" "sign-return-address-key"="b_key"
89+
// CHECK-DAG: attributes #[[#PAUTHLR_BKEY]] = { {{.*}} "branch-protection-pauth-lr"="true" {{.*}}"sign-return-address"="non-leaf" "sign-return-address-key"="b_key"
9090

91-
// CHECK-DAG: attributes #[[#PAUTHLR_LEAF]] = { {{.*}}"branch-protection-pauth-lr"="true" {{.*}}"branch-target-enforcement"="false" "guarded-control-stack"="false" {{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"
91+
// CHECK-DAG: attributes #[[#PAUTHLR_LEAF]] = { {{.*}} "branch-protection-pauth-lr"="true" {{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"
9292

93-
// CHECK-DAG: attributes #[[#PAUTHLR_BTI]] = { {{.*}}"branch-protection-pauth-lr"="true" {{.*}}"branch-target-enforcement"="true" "guarded-control-stack"="false" {{.*}}"sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
93+
// CHECK-DAG: attributes #[[#PAUTHLR_BTI]] = { {{.*}} "branch-protection-pauth-lr"="true" {{.*}}"branch-target-enforcement"="true" {{.*}}"sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
9494

95-
// CHECK-DAG: attributes #[[#GCS]] = { {{.*}}"branch-target-enforcement"="false" "guarded-control-stack"="true" {{.*}} "sign-return-address"="none"
95+
// CHECK-DAG: attributes #[[#GCS]] = { {{.*}} "guarded-control-stack"="true"

‎clang/test/CodeGen/aarch64-sign-return-address.c

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,15 @@
1313

1414
// CHECK-LABEL: @foo() #[[#ATTR:]]
1515

16-
// CHECK-NOT: attributes #[[#ATTR]] = { {{.*}} "sign-return-address"
17-
// CHECK-NOT: attributes #[[#ATTR]] = { {{.*}} "sign-return-address-key"
18-
// CHECK-NOT: attributes #[[#ATTR]] = { {{.*}} "branch-target-enforcement"
16+
// NONE-NOT: attributes #[[#ATTR]] = { {{.*}} "sign-return-address"
17+
// NONE-NOT: attributes #[[#ATTR]] = { {{.*}} "sign-return-address-key"
18+
// NONE-NOT: attributes #[[#ATTR]] = { {{.*}} "branch-target-enforcement"
19+
20+
// ALL: attributes #[[#ATTR]] = { {{.*}} "sign-return-address"
21+
// PART: attributes #[[#ATTR]] = { {{.*}} "sign-return-address-key"="a_key"
22+
// B-KEY: attributes #[[#ATTR]] = { {{.*}} "sign-return-address-key"="b_key"
23+
// BTE: attributes #[[#ATTR]] = { {{.*}} "branch-target-enforcement"
24+
1925

2026
// Check module attributes
2127

@@ -43,4 +49,4 @@
4349
// BTE-NOT: !"sign-return-address-with-bkey"
4450
// B-KEY: !{i32 8, !"sign-return-address-with-bkey", i32 1}
4551

46-
void foo() {}
52+
void foo() {}

‎clang/test/CodeGen/arm-branch-protection-attr-1.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,14 @@ __attribute__((target("branch-protection=pac-ret+leaf"))) void leaf() {}
2929
__attribute__((target("branch-protection=pac-ret+leaf+bti"))) void btileaf() {}
3030
// CHECK: define{{.*}} void @btileaf() #[[#BTIPACLEAF:]]
3131

32-
// CHECK-DAG: attributes #[[#NONE]] = { {{.*}} "branch-target-enforcement"="false" {{.*}} "sign-return-address"="none"
32+
// CHECK-DAG: attributes #[[#NONE]] = { {{.*}}
3333

3434
// CHECK-DAG: attributes #[[#STD]] = { {{.*}} "branch-target-enforcement"="true" {{.*}} "sign-return-address"="non-leaf"
3535

36-
// CHECK-DAG: attributes #[[#BTI]] = { {{.*}} "branch-target-enforcement"="true" {{.*}} "sign-return-address"="none"
36+
// CHECK-DAG: attributes #[[#BTI]] = { {{.*}} "branch-target-enforcement"="true"
3737

38-
// CHECK-DAG: attributes #[[#PAC]] = { {{.*}} "branch-target-enforcement"="false" {{.*}} "sign-return-address"="non-leaf"
38+
// CHECK-DAG: attributes #[[#PAC]] = { {{.*}} "sign-return-address"="non-leaf"
3939

40-
// CHECK-DAG: attributes #[[#PACLEAF]] = { {{.*}} "branch-target-enforcement"="false" {{.*}}"sign-return-address"="all"
40+
// CHECK-DAG: attributes #[[#PACLEAF]] = { {{.*}} "sign-return-address"="all"
4141

42-
// CHECK-DAG: attributes #[[#BTIPACLEAF]] = { {{.*}}"branch-target-enforcement"="true" {{.*}} "sign-return-address"="all"
42+
// CHECK-DAG: attributes #[[#BTIPACLEAF]] = { {{.*}} "branch-target-enforcement"="true" {{.*}} "sign-return-address"="all"

‎clang/test/CodeGen/arm-branch-protection-attr-2.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,18 @@
55
// RUN: %clang -target arm-arm-none-eabi -march=armv8.1-m.main -S -emit-llvm -o - -mbranch-protection=pac-ret+b-key %s | FileCheck %s --check-prefix=CHECK --check-prefix=PART
66
// RUN: %clang -target arm-arm-none-eabi -march=armv8.1-m.main -S -emit-llvm -o - -mbranch-protection=bti %s | FileCheck %s --check-prefix=CHECK --check-prefix=BTE
77

8-
// Check there are no branch protection function attributes
8+
// Check there is branch protection function attributes
99

1010
// CHECK-LABEL: @foo() #[[#ATTR:]]
1111

12-
// CHECK-NOT: attributes #[[#ATTR]] = { {{.*}} "sign-return-address"
13-
// CHECK-NOT: attributes #[[#ATTR]] = { {{.*}} "sign-return-address-key"
14-
// CHECK-NOT: attributes #[[#ATTR]] = { {{.*}} "branch-target-enforcement"
12+
// NONE-NOT: attributes #[[#ATTR]] = { {{.*}} "sign-return-address"
13+
// NONE-NOT: attributes #[[#ATTR]] = { {{.*}} "sign-return-address-key"
14+
// NONE-NOT: attributes #[[#ATTR]] = { {{.*}} "branch-target-enforcement"
15+
16+
// ALL: attributes #[[#ATTR]] = { {{.*}} "sign-return-address"="all"
17+
// PART: attributes #[[#ATTR]] = { {{.*}} "sign-return-address"="non-leaf"
18+
// BTE: attributes #[[#ATTR]] = { {{.*}} "branch-target-enforcement"
19+
1520

1621
// Check module attributes
1722

‎clang/test/Frontend/arm-branch-protection-lto.c

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// REQUIRES: arm-registered-target
2+
3+
// RUN: %clang_cc1 -triple=thumbv7m-unknown-unknown-eabi -msign-return-address=non-leaf %s -S -emit-llvm -o - 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=SIGN
4+
// RUN: %clang_cc1 -triple=thumbv7m-unknown-unknown-eabi -mbranch-target-enforce %s -S -emit-llvm -o - 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=BTE
5+
// RUN: %clang_cc1 -triple=thumbv7m-unknown-unknown-eabi -mbranch-target-enforce -msign-return-address=all %s -S -emit-llvm -o - 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=ALL
6+
7+
// RUN: %clang_cc1 -flto -triple=thumbv7m-unknown-unknown-eabi -msign-return-address=non-leaf %s -S -emit-llvm -o - 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=SIGN
8+
// RUN: %clang_cc1 -flto -triple=thumbv7m-unknown-unknown-eabi -mbranch-target-enforce %s -S -emit-llvm -o - 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=BTE
9+
// RUN: %clang_cc1 -flto -triple=thumbv7m-unknown-unknown-eabi -mbranch-target-enforce -msign-return-address=all %s -S -emit-llvm -o - 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=ALL
10+
11+
// RUN: %clang_cc1 -flto=thin -triple=thumbv7m-unknown-unknown-eabi -msign-return-address=non-leaf %s -S -emit-llvm -o - 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=SIGN
12+
// RUN: %clang_cc1 -flto=thin -triple=thumbv7m-unknown-unknown-eabi -mbranch-target-enforce %s -S -emit-llvm -o - 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=BTE
13+
// RUN: %clang_cc1 -flto=thin -triple=thumbv7m-unknown-unknown-eabi -mbranch-target-enforce -msign-return-address=all %s -S -emit-llvm -o - 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=ALL
14+
15+
void foo() {}
16+
17+
// Check there are branch protection function attributes.
18+
// CHECK-LABEL: @foo() #[[#ATTR:]]
19+
20+
// SIGN: attributes #[[#ATTR]] = { {{.*}} "sign-return-address"="non-leaf"
21+
// BTE: attributes #[[#ATTR]] = { {{.*}} "branch-target-enforcement"
22+
// ALL: attributes #[[#ATTR]] = { {{.*}} "branch-target-enforcement"{{.*}} "sign-return-address"="all"

0 commit comments

Comments
 (0)