Skip to content

Commit b0343a3

Browse files
DanielKristofKissDanielKristofKiss
committed
Support the min of module flags when linking, use for AArch64 BTI/PAC-RET
LTO objects might compiled with different `mbranch-protection` flags which will cause an error in the linker. Such a setup is allowed in the normal build with this change that is possible. Reviewed By: pcc Differential Revision: https://reviews.llvm.org/D123493
1 parent e500062 commit b0343a3

File tree

56 files changed

+294
-160
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+294
-160
lines changed

‎clang/lib/CodeGen/CodeGenModule.cpp‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -729,7 +729,10 @@ void CodeGenModule::Release() {
729729
// attributes, but we use module metadata to emit build attributes. This is
730730
// needed for LTO, where the function attributes are inside bitcode
731731
// serialised into a global variable by the time build attributes are
732-
// emitted, so we can't access them.
732+
// emitted, so we can't access them. LTO objects could be compiled with
733+
// different flags therefore module flags are set to "Min" behavior to achieve
734+
// the same end result of the normal build where e.g BTI is off if any object
735+
// doesn't support it.
733736
if (Context.getTargetInfo().hasFeature("ptrauth") &&
734737
LangOpts.getSignReturnAddressScope() !=
735738
LangOptions::SignReturnAddressScopeKind::None)
@@ -743,16 +746,16 @@ void CodeGenModule::Release() {
743746
Arch == llvm::Triple::arm || Arch == llvm::Triple::armeb ||
744747
Arch == llvm::Triple::aarch64 || Arch == llvm::Triple::aarch64_32 ||
745748
Arch == llvm::Triple::aarch64_be) {
746-
getModule().addModuleFlag(llvm::Module::Error, "branch-target-enforcement",
749+
getModule().addModuleFlag(llvm::Module::Min, "branch-target-enforcement",
747750
LangOpts.BranchTargetEnforcement);
748751

749-
getModule().addModuleFlag(llvm::Module::Error, "sign-return-address",
752+
getModule().addModuleFlag(llvm::Module::Min, "sign-return-address",
750753
LangOpts.hasSignReturnAddress());
751754

752-
getModule().addModuleFlag(llvm::Module::Error, "sign-return-address-all",
755+
getModule().addModuleFlag(llvm::Module::Min, "sign-return-address-all",
753756
LangOpts.isSignReturnAddressScopeAll());
754757

755-
getModule().addModuleFlag(llvm::Module::Error,
758+
getModule().addModuleFlag(llvm::Module::Min,
756759
"sign-return-address-with-bkey",
757760
!LangOpts.isSignReturnAddressWithAKey());
758761
}

‎clang/test/CodeGen/aarch64-sign-return-address.c‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -19,28 +19,28 @@
1919

2020
// Check module attributes
2121

22-
// NONE: !{i32 1, !"branch-target-enforcement", i32 0}
23-
// ALL: !{i32 1, !"branch-target-enforcement", i32 0}
24-
// PART: !{i32 1, !"branch-target-enforcement", i32 0}
25-
// BTE: !{i32 1, !"branch-target-enforcement", i32 1}
26-
// B-KEY: !{i32 1, !"branch-target-enforcement", i32 0}
27-
28-
// NONE: !{i32 1, !"sign-return-address", i32 0}
29-
// ALL: !{i32 1, !"sign-return-address", i32 1}
30-
// PART: !{i32 1, !"sign-return-address", i32 1}
31-
// BTE: !{i32 1, !"sign-return-address", i32 0}
32-
// B-KEY: !{i32 1, !"sign-return-address", i32 1}
33-
34-
// NONE: !{i32 1, !"sign-return-address-all", i32 0}
35-
// ALL: !{i32 1, !"sign-return-address-all", i32 1}
36-
// PART: !{i32 1, !"sign-return-address-all", i32 0}
37-
// BTE: !{i32 1, !"sign-return-address-all", i32 0}
38-
// B-KEY: !{i32 1, !"sign-return-address-all", i32 0}
39-
40-
// NONE: !{i32 1, !"sign-return-address-with-bkey", i32 0}
41-
// ALL: !{i32 1, !"sign-return-address-with-bkey", i32 0}
42-
// PART: !{i32 1, !"sign-return-address-with-bkey", i32 0}
43-
// BTE: !{i32 1, !"sign-return-address-with-bkey", i32 0}
44-
// B-KEY: !{i32 1, !"sign-return-address-with-bkey", i32 1}
22+
// NONE: !{i32 8, !"branch-target-enforcement", i32 0}
23+
// ALL: !{i32 8, !"branch-target-enforcement", i32 0}
24+
// PART: !{i32 8, !"branch-target-enforcement", i32 0}
25+
// BTE: !{i32 8, !"branch-target-enforcement", i32 1}
26+
// B-KEY: !{i32 8, !"branch-target-enforcement", i32 0}
27+
28+
// NONE: !{i32 8, !"sign-return-address", i32 0}
29+
// ALL: !{i32 8, !"sign-return-address", i32 1}
30+
// PART: !{i32 8, !"sign-return-address", i32 1}
31+
// BTE: !{i32 8, !"sign-return-address", i32 0}
32+
// B-KEY: !{i32 8, !"sign-return-address", i32 1}
33+
34+
// NONE: !{i32 8, !"sign-return-address-all", i32 0}
35+
// ALL: !{i32 8, !"sign-return-address-all", i32 1}
36+
// PART: !{i32 8, !"sign-return-address-all", i32 0}
37+
// BTE: !{i32 8, !"sign-return-address-all", i32 0}
38+
// B-KEY: !{i32 8, !"sign-return-address-all", i32 0}
39+
40+
// NONE: !{i32 8, !"sign-return-address-with-bkey", i32 0}
41+
// ALL: !{i32 8, !"sign-return-address-with-bkey", i32 0}
42+
// PART: !{i32 8, !"sign-return-address-with-bkey", i32 0}
43+
// BTE: !{i32 8, !"sign-return-address-with-bkey", i32 0}
44+
// B-KEY: !{i32 8, !"sign-return-address-with-bkey", i32 1}
4545

4646
void foo() {}

‎clang/test/CodeGen/arm-branch-protection-attr-2.c‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,19 @@
1515

1616
// Check module attributes
1717

18-
// NONE: !{i32 1, !"branch-target-enforcement", i32 0}
19-
// PART: !{i32 1, !"branch-target-enforcement", i32 0}
20-
// ALL: !{i32 1, !"branch-target-enforcement", i32 0}
21-
// BTE: !{i32 1, !"branch-target-enforcement", i32 1}
22-
23-
// NONE: !{i32 1, !"sign-return-address", i32 0}
24-
// PART: !{i32 1, !"sign-return-address", i32 1}
25-
// ALL: !{i32 1, !"sign-return-address", i32 1}
26-
// BTE: !{i32 1, !"sign-return-address", i32 0}
27-
28-
// NONE: !{i32 1, !"sign-return-address-all", i32 0}
29-
// PART: !{i32 1, !"sign-return-address-all", i32 0}
30-
// ALL: !{i32 1, !"sign-return-address-all", i32 1}
31-
// BTE: !{i32 1, !"sign-return-address-all", i32 0}
18+
// NONE: !{i32 8, !"branch-target-enforcement", i32 0}
19+
// PART: !{i32 8, !"branch-target-enforcement", i32 0}
20+
// ALL: !{i32 8, !"branch-target-enforcement", i32 0}
21+
// BTE: !{i32 8, !"branch-target-enforcement", i32 1}
22+
23+
// NONE: !{i32 8, !"sign-return-address", i32 0}
24+
// PART: !{i32 8, !"sign-return-address", i32 1}
25+
// ALL: !{i32 8, !"sign-return-address", i32 1}
26+
// BTE: !{i32 8, !"sign-return-address", i32 0}
27+
28+
// NONE: !{i32 8, !"sign-return-address-all", i32 0}
29+
// PART: !{i32 8, !"sign-return-address-all", i32 0}
30+
// ALL: !{i32 8, !"sign-return-address-all", i32 1}
31+
// BTE: !{i32 8, !"sign-return-address-all", i32 0}
3232

3333
void foo() {}

‎clang/test/Frontend/arm-ignore-branch-protection-option.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@ __attribute__((target("arch=cortex-m0"))) void f() {}
1515
// CHECK-NOT: attributes { {{.*}} "branch-target-enforcement"
1616

1717
/// Check that there are branch protection module attributes despite the warning.
18-
// CHECK: !{i32 1, !"branch-target-enforcement", i32 1}
18+
// CHECK: !{i32 8, !"branch-target-enforcement", i32 1}

‎llvm/include/llvm/IR/Module.h‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,9 +146,12 @@ class LLVM_EXTERNAL_VISIBILITY Module {
146146
/// Takes the max of the two values, which are required to be integers.
147147
Max = 7,
148148

149+
/// Takes the min of the two values, which are required to be integers.
150+
Min = 8,
151+
149152
// Markers:
150153
ModFlagBehaviorFirstVal = Error,
151-
ModFlagBehaviorLastVal = Max
154+
ModFlagBehaviorLastVal = Min
152155
};
153156

154157
/// Checks if Metadata represents a valid ModFlagBehavior, and stores the

‎llvm/lib/IR/AutoUpgrade.cpp‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4388,6 +4388,24 @@ bool llvm::UpgradeModuleFlags(Module &M) {
43884388
}
43894389
}
43904390
}
4391+
4392+
// Upgrade branch protection and return address signing module flags. The
4393+
// module flag behavior for these fields were Error and now they are Min.
4394+
if (ID->getString() == "branch-target-enforcement" ||
4395+
ID->getString().startswith("sign-return-address")) {
4396+
if (auto *Behavior =
4397+
mdconst::dyn_extract_or_null<ConstantInt>(Op->getOperand(0))) {
4398+
if (Behavior->getLimitedValue() == Module::Error) {
4399+
Type *Int32Ty = Type::getInt32Ty(M.getContext());
4400+
Metadata *Ops[3] = {
4401+
ConstantAsMetadata::get(ConstantInt::get(Int32Ty, Module::Min)),
4402+
Op->getOperand(1), Op->getOperand(2)};
4403+
ModFlags->setOperand(I, MDNode::get(M.getContext(), Ops));
4404+
Changed = true;
4405+
}
4406+
}
4407+
}
4408+
43914409
// Upgrade Objective-C Image Info Section. Removed the whitespce in the
43924410
// section name so that llvm-lto will not complain about mismatching
43934411
// module flags that is functionally the same.

‎llvm/lib/IR/Verifier.cpp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1623,6 +1623,13 @@ Verifier::visitModuleFlag(const MDNode *Op,
16231623
// These behavior types accept any value.
16241624
break;
16251625

1626+
case Module::Min: {
1627+
Check(mdconst::dyn_extract_or_null<ConstantInt>(Op->getOperand(2)),
1628+
"invalid value for 'min' module flag (expected constant integer)",
1629+
Op->getOperand(2));
1630+
break;
1631+
}
1632+
16261633
case Module::Max: {
16271634
Check(mdconst::dyn_extract_or_null<ConstantInt>(Op->getOperand(2)),
16281635
"invalid value for 'max' module flag (expected constant integer)",

‎llvm/lib/Linker/IRMover.cpp‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
#include "llvm/ADT/SmallPtrSet.h"
1313
#include "llvm/ADT/SmallString.h"
1414
#include "llvm/ADT/Triple.h"
15+
#include "llvm/IR/AutoUpgrade.h"
1516
#include "llvm/IR/Constants.h"
1617
#include "llvm/IR/DebugInfoMetadata.h"
1718
#include "llvm/IR/DiagnosticPrinter.h"
@@ -1256,6 +1257,9 @@ Error IRLinker::linkModuleFlagsMetadata() {
12561257
if (!SrcModFlags)
12571258
return Error::success();
12581259

1260+
// Check for module flag for updates before do anything.
1261+
UpgradeModuleFlags(*SrcM);
1262+
12591263
// If the destination module doesn't have module flags yet, then just copy
12601264
// over the source module's flags.
12611265
NamedMDNode *DstModFlags = DstM.getOrInsertModuleFlagsMetadata();
@@ -1338,11 +1342,15 @@ Error IRLinker::linkModuleFlagsMetadata() {
13381342

13391343
// Diagnose inconsistent merge behavior types.
13401344
if (SrcBehaviorValue != DstBehaviorValue) {
1345+
bool MinAndWarn = (SrcBehaviorValue == Module::Min &&
1346+
DstBehaviorValue == Module::Warning) ||
1347+
(DstBehaviorValue == Module::Min &&
1348+
SrcBehaviorValue == Module::Warning);
13411349
bool MaxAndWarn = (SrcBehaviorValue == Module::Max &&
13421350
DstBehaviorValue == Module::Warning) ||
13431351
(DstBehaviorValue == Module::Max &&
13441352
SrcBehaviorValue == Module::Warning);
1345-
if (!MaxAndWarn)
1353+
if (!(MaxAndWarn || MinAndWarn))
13461354
return stringErr("linking module flags '" + ID->getString() +
13471355
"': IDs have conflicting behaviors in '" +
13481356
SrcM->getModuleIdentifier() + "' and '" +
@@ -1371,6 +1379,25 @@ Error IRLinker::linkModuleFlagsMetadata() {
13711379
emitWarning(Str);
13721380
}
13731381

1382+
// Choose the minimum if either source or destination request Min behavior.
1383+
if (DstBehaviorValue == Module::Min || SrcBehaviorValue == Module::Min) {
1384+
ConstantInt *DstValue =
1385+
mdconst::extract<ConstantInt>(DstOp->getOperand(2));
1386+
ConstantInt *SrcValue =
1387+
mdconst::extract<ConstantInt>(SrcOp->getOperand(2));
1388+
1389+
// The resulting flag should have a Min behavior, and contain the minimum
1390+
// value from between the source and destination values.
1391+
Metadata *FlagOps[] = {
1392+
(DstBehaviorValue != Module::Min ? SrcOp : DstOp)->getOperand(0), ID,
1393+
(SrcValue->getZExtValue() < DstValue->getZExtValue() ? SrcOp : DstOp)
1394+
->getOperand(2)};
1395+
MDNode *Flag = MDNode::get(DstM.getContext(), FlagOps);
1396+
DstModFlags->setOperand(DstIndex, Flag);
1397+
Flags[ID].first = Flag;
1398+
continue;
1399+
}
1400+
13741401
// Choose the maximum if either source or destination request Max behavior.
13751402
if (DstBehaviorValue == Module::Max || SrcBehaviorValue == Module::Max) {
13761403
ConstantInt *DstValue =

‎llvm/test/Bitcode/upgrade-branch-protection.ll‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
;; Test that module flags "branch-target-enforcement" and "sign-return-address" can be upgraded to
2+
;; are upgraded from Error to Min.
3+
4+
; RUN: llvm-as %s -o - | llvm-dis - | FileCheck %s
5+
6+
!llvm.module.flags = !{!0, !1, !2, !3}
7+
8+
!0 = !{i32 1, !"branch-target-enforcement", i32 1}
9+
!1 = !{i32 1, !"sign-return-address", i32 1}
10+
!2 = !{i32 1, !"sign-return-address-all", i32 1}
11+
!3 = !{i32 1, !"sign-return-address-with-bkey", i32 1}
12+
13+
;CHECK: !0 = !{i32 8, !"branch-target-enforcement", i32 1}
14+
;CHECK: !1 = !{i32 8, !"sign-return-address", i32 1}
15+
;CHECK: !2 = !{i32 8, !"sign-return-address-all", i32 1}
16+
;CHECK: !3 = !{i32 8, !"sign-return-address-with-bkey", i32 1}

‎llvm/test/CodeGen/AArch64/debug-info-sve-dbg-declare.mir‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -89,10 +89,10 @@
8989
!3 = !{i32 7, !"Dwarf Version", i32 4}
9090
!4 = !{i32 2, !"Debug Info Version", i32 3}
9191
!5 = !{i32 1, !"wchar_size", i32 4}
92-
!6 = !{i32 1, !"branch-target-enforcement", i32 0}
93-
!7 = !{i32 1, !"sign-return-address", i32 0}
94-
!8 = !{i32 1, !"sign-return-address-all", i32 0}
95-
!9 = !{i32 1, !"sign-return-address-with-bkey", i32 0}
92+
!6 = !{i32 8, !"branch-target-enforcement", i32 0}
93+
!7 = !{i32 8, !"sign-return-address", i32 0}
94+
!8 = !{i32 8, !"sign-return-address-all", i32 0}
95+
!9 = !{i32 8, !"sign-return-address-with-bkey", i32 0}
9696
!10 = !{!"clang version 12.0.0 (https://github.com/llvm/llvm-project.git b19275ba870a06c5ef0428af6264ffd28c7cde9e)"}
9797
!11 = distinct !DISubprogram(name: "foo", scope: !1, file: !1, line: 4, type: !12, scopeLine: 4, flags: DIFlagPrototyped, spFlags: DISPFlagDefinition, unit: !0, retainedNodes: !2)
9898
!12 = !DISubroutineType(types: !13)

0 commit comments

Comments
 (0)