Skip to content

Commit 1f1a20b

Browse files
atrosinenkotru
atrosinenko
authored and
tru
committed
[AArch64][PAC] Do not execute AUT instructions speculatively (#155372)
A generic authentication instruction may crash the process on failure. Furthermore, it can be executed conditionally and/or its signing schema can be chosen dynamically. For this reason, while it may be beneficial to permit DCE to remove AUTx16x17 or AUTxMxN instructions unless their results have any uses (at least fake ones, if we just want to check the signature), AUT instructions are not safe to be executed speculatively. As a quick fix for miscompilation possibility, this patch marks AUTxMxN pseudo instruction as having unmodelled side effects. (cherry picked from commit ab3c0ca)
1 parent d69907d commit 1f1a20b

File tree

2 files changed

+124
-1
lines changed

2 files changed

+124
-1
lines changed

‎llvm/lib/Target/AArch64/AArch64InstrInfo.td‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2148,7 +2148,7 @@ let Predicates = [HasPAuth] in {
21482148
i64imm:$Disc, GPR64:$AddrDisc),
21492149
[], "$AuthVal = $Val">, Sched<[WriteI, ReadI]> {
21502150
let isCodeGenOnly = 1;
2151-
let hasSideEffects = 0;
2151+
let hasSideEffects = 1;
21522152
let mayStore = 0;
21532153
let mayLoad = 0;
21542154
let Size = 32;

‎llvm/test/CodeGen/AArch64/ptrauth-intrinsic-auth-resign.ll‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -755,5 +755,128 @@ define i64 @test_auth_ia_swapped(i64 %arg, i64 %arg1) {
755755
ret i64 %tmp
756756
}
757757

758+
; Authentications should not be speculated, as they crash on failure and it is
759+
; perfectly correct to dynamically choose the signing schema or whether to
760+
; perform authentication at all.
761+
define ptr @auth_speculation(i64 %signed, i1 %cond) {
762+
; UNCHECKED-LABEL: auth_speculation:
763+
; UNCHECKED: %bb.0:
764+
; UNCHECKED-DARWIN-NEXT: mov x16, x0
765+
; UNCHECKED-DARWIN-NEXT: tbz w1, #0, [[BB_ELSE:[A-Za-z0-9_.]+]]
766+
; UNCHECKED-DARWIN-NEXT: %bb.1:
767+
; UNCHECKED-DARWIN-NEXT: autdza x16
768+
; UNCHECKED-DARWIN-NEXT: b [[BB_RETURN:[A-Za-z0-9_.]+]]
769+
; UNCHECKED-DARWIN-NEXT: [[BB_ELSE]]:
770+
; UNCHECKED-DARWIN-NEXT: autdzb x16
771+
; UNCHECKED-DARWIN-NEXT: [[BB_RETURN]]:
772+
; UNCHECKED-DARWIN-NEXT: ldr x8, [x16]
773+
; UNCHECKED-ELF-NEXT: tbz w1, #0, [[BB_ELSE:[A-Za-z0-9_.]+]]
774+
; UNCHECKED-ELF-NEXT: %bb.1:
775+
; UNCHECKED-ELF-NEXT: autdza x0
776+
; UNCHECKED-ELF-NEXT: b [[BB_RETURN:[A-Za-z0-9_.]+]]
777+
; UNCHECKED-ELF-NEXT: [[BB_ELSE]]:
778+
; UNCHECKED-ELF-NEXT: autdzb x0
779+
; UNCHECKED-ELF-NEXT: [[BB_RETURN]]:
780+
; UNCHECKED-ELF-NEXT: ldr x8, [x0]
781+
; UNCHECKED-NEXT: ldr x8, [x8]
782+
; UNCHECKED-NEXT: ldr x8, [x8]
783+
; UNCHECKED-NEXT: ldr x0, [x8]
784+
; UNCHECKED-NEXT: ret
785+
;
786+
; CHECKED-LABEL: auth_speculation:
787+
; CHECKED: %bb.0:
788+
; CHECKED-DARWIN-NEXT: mov x16, x0
789+
; CHECKED-DARWIN-NEXT: tbz w1, #0, [[BB_ELSE:[A-Za-z0-9_.]+]]
790+
; CHECKED-DARWIN-NEXT: %bb.1:
791+
; CHECKED-DARWIN-NEXT: autdza x16
792+
; CHECKED-DARWIN-NEXT: b [[BB_RETURN:[A-Za-z0-9_.]+]]
793+
; CHECKED-DARWIN-NEXT: [[BB_ELSE]]:
794+
; CHECKED-DARWIN-NEXT: autdzb x16
795+
; CHECKED-DARWIN-NEXT: [[BB_RETURN]]:
796+
; CHECKED-DARWIN-NEXT: ldr x8, [x16]
797+
; CHECKED-ELF-NEXT: tbz w1, #0, [[BB_ELSE:[A-Za-z0-9_.]+]]
798+
; CHECKED-ELF-NEXT: %bb.1:
799+
; CHECKED-ELF-NEXT: autdza x0
800+
; CHECKED-ELF-NEXT: b [[BB_RETURN:[A-Za-z0-9_.]+]]
801+
; CHECKED-ELF-NEXT: [[BB_ELSE]]:
802+
; CHECKED-ELF-NEXT: autdzb x0
803+
; CHECKED-ELF-NEXT: [[BB_RETURN]]:
804+
; CHECKED-ELF-NEXT: ldr x8, [x0]
805+
; CHECKED-NEXT: ldr x8, [x8]
806+
; CHECKED-NEXT: ldr x8, [x8]
807+
; CHECKED-NEXT: ldr x0, [x8]
808+
; CHECKED-NEXT: ret
809+
;
810+
; TRAP-LABEL: auth_speculation:
811+
; TRAP: %bb.0:
812+
; TRAP-DARWIN-NEXT: mov x16, x0
813+
; TRAP-DARWIN-NEXT: tbz w1, #0, [[BB_ELSE:[A-Za-z0-9_.]+]]
814+
; TRAP-DARWIN-NEXT: %bb.1:
815+
; TRAP-DARWIN-NEXT: autdza x16
816+
; TRAP-DARWIN-NEXT: mov x17, x16
817+
; TRAP-DARWIN-NEXT: xpacd x17
818+
; TRAP-DARWIN-NEXT: cmp x16, x17
819+
; TRAP-DARWIN-NEXT: b.eq [[L]]auth_success_18
820+
; TRAP-DARWIN-NEXT: brk #0xc472
821+
; TRAP-DARWIN-NEXT: [[L]]auth_success_18:
822+
; TRAP-DARWIN-NEXT: b [[BB_RETURN:[A-Za-z0-9_.]+]]
823+
; TRAP-DARWIN-NEXT: [[BB_ELSE]]:
824+
; TRAP-DARWIN-NEXT: autdzb x16
825+
; TRAP-DARWIN-NEXT: mov x17, x16
826+
; TRAP-DARWIN-NEXT: xpacd x17
827+
; TRAP-DARWIN-NEXT: cmp x16, x17
828+
; TRAP-DARWIN-NEXT: b.eq [[L]]auth_success_19
829+
; TRAP-DARWIN-NEXT: brk #0xc473
830+
; TRAP-DARWIN-NEXT: [[L]]auth_success_19:
831+
; TRAP-DARWIN-NEXT: [[BB_RETURN]]:
832+
; TRAP-DARWIN-NEXT: ldr x8, [x16]
833+
; TRAP-ELF-NEXT: tbz w1, #0, [[BB_ELSE:[A-Za-z0-9_.]+]]
834+
; TRAP-ELF-NEXT: %bb.1:
835+
; TRAP-ELF-NEXT: autdza x0
836+
; TRAP-ELF-NEXT: mov x8, x0
837+
; TRAP-ELF-NEXT: xpacd x8
838+
; TRAP-ELF-NEXT: cmp x0, x8
839+
; TRAP-ELF-NEXT: b.eq [[L]]auth_success_18
840+
; TRAP-ELF-NEXT: brk #0xc472
841+
; TRAP-ELF-NEXT: [[L]]auth_success_18:
842+
; TRAP-ELF-NEXT: b [[BB_RETURN:[A-Za-z0-9_.]+]]
843+
; TRAP-ELF-NEXT: [[BB_ELSE]]:
844+
; TRAP-ELF-NEXT: autdzb x0
845+
; TRAP-ELF-NEXT: mov x8, x0
846+
; TRAP-ELF-NEXT: xpacd x8
847+
; TRAP-ELF-NEXT: cmp x0, x8
848+
; TRAP-ELF-NEXT: b.eq [[L]]auth_success_19
849+
; TRAP-ELF-NEXT: brk #0xc473
850+
; TRAP-ELF-NEXT: [[L]]auth_success_19:
851+
; TRAP-ELF-NEXT: [[BB_RETURN]]:
852+
; TRAP-ELF-NEXT: ldr x8, [x0]
853+
; TRAP-NEXT: ldr x8, [x8]
854+
; TRAP-NEXT: ldr x8, [x8]
855+
; TRAP-NEXT: ldr x0, [x8]
856+
; TRAP-NEXT: ret
857+
entry:
858+
br i1 %cond, label %if.then, label %if.else
859+
860+
if.then:
861+
%auted.then = tail call i64 @llvm.ptrauth.auth(i64 %signed, i32 2, i64 0)
862+
br label %return
863+
864+
if.else:
865+
%auted.else = tail call i64 @llvm.ptrauth.auth(i64 %signed, i32 3, i64 0)
866+
br label %return
867+
868+
return:
869+
%auted = phi i64 [ %auted.then, %if.then ], [ %auted.else, %if.else ]
870+
871+
; A sequence of instructions that is common to both "then" and "else"
872+
; branches and is expensive to duplicate.
873+
%ptr.0 = inttoptr i64 %auted to ptr
874+
%ptr.1 = load ptr, ptr %ptr.0
875+
%ptr.2 = load ptr, ptr %ptr.1
876+
%ptr.3 = load ptr, ptr %ptr.2
877+
%ptr.4 = load ptr, ptr %ptr.3
878+
ret ptr %ptr.4
879+
}
880+
758881
declare i64 @llvm.ptrauth.auth(i64, i32, i64)
759882
declare i64 @llvm.ptrauth.resign(i64, i32, i64, i32, i64)

0 commit comments

Comments
 (0)