1//===-- AArch64PointerAuth.cpp -- Harden code using PAuth ------------------==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include "AArch64PointerAuth.h"
10
11#include "AArch64.h"
12#include "AArch64FrameLowering.h"
13#include "AArch64InstrInfo.h"
14#include "AArch64MachineFunctionInfo.h"
15#include "AArch64Subtarget.h"
16#include "MCTargetDesc/AArch64AddressingModes.h"
17#include "llvm/CodeGen/CFIInstBuilder.h"
18#include "llvm/CodeGen/MachineBasicBlock.h"
19#include "llvm/CodeGen/MachineInstrBuilder.h"
20#include "llvm/CodeGen/MachineModuleInfo.h"
21
22using namespace llvm;
23using namespace llvm::AArch64PAuth;
24
25#define AARCH64_POINTER_AUTH_NAME "AArch64 Pointer Authentication"
26
27namespace {
28
29/// Control the emission of .cfi_set_ra_state, which replaces the
30/// deprecated .cfi_negate_ra_state_with_pc [1].
31///
32/// The latter is fundamentally unable to express some program orders [2], as
33/// the dwarf 'program' reads functions in a linear scan of their addresses to
34/// reconstruct the state of the frame, whereas control flow may enter and exit
35/// such regions arbitrarily (such as in hot-cold-split, and shrinkwrapped
36/// fucntions), and thus the negate-based cfi is unable to encode the address of
37/// the signing instruciton in all program orders.
38///
39/// Since .cfi_negate_ra_state is still sufficient for describing
40/// ptrauth-returns=pauth, we default to using the new CFI only for PAuth_LR, as
41/// DW_CFA_AARCH64_negate_ra_state has a smaller encoding than
42/// DW_CFA_AARCH64_set_ra_state.
43///
44/// 1: https://github.com/ARM-software/abi-aa/pull/346
45/// 2: https://github.com/ARM-software/abi-aa/issues/327
46enum class SetRAStateMode {
47 Never, // Always use .cfi_negate_ra_state(_with_pc)
48 PAuthLR, // Use .cfi_set_ra_state only for PAuth_LR
49 Always, // Use .cfi_set_ra_state for both PAuth and PAuth_LR
50};
51cl::opt<SetRAStateMode> CFILLVMSetRASignStateMode(
52 "aarch64-cfi-llvm-set-ra-sign-state", cl::init(Val: SetRAStateMode::PAuthLR),
53 cl::desc("Control emission of .cfi_set_ra_state for PAC return address "
54 "signing CFI"),
55 cl::values(clEnumValN(SetRAStateMode::Never, "never",
56 "Always use legacy .cfi_negate_ra_state[_with_pc]"),
57 clEnumValN(SetRAStateMode::PAuthLR, "pauth-lr",
58 "Use new CFI only for PAuth_LR (default)"),
59 clEnumValN(SetRAStateMode::Always, "always",
60 "Use new CFI for both PAuth and PAuth_LR")),
61 cl::Hidden);
62
63class AArch64PointerAuthImpl {
64public:
65 bool run(MachineFunction &MF);
66
67private:
68 const AArch64Subtarget *Subtarget = nullptr;
69 const AArch64InstrInfo *TII = nullptr;
70
71 void signLR(MachineFunction &MF, MachineBasicBlock::iterator MBBI) const;
72
73 void authenticateLR(MachineFunction &MF,
74 MachineBasicBlock::iterator MBBI) const;
75};
76
77class AArch64PointerAuthLegacy : public MachineFunctionPass {
78public:
79 static char ID;
80
81 AArch64PointerAuthLegacy() : MachineFunctionPass(ID) {}
82
83 bool runOnMachineFunction(MachineFunction &MF) override;
84
85 StringRef getPassName() const override { return AARCH64_POINTER_AUTH_NAME; }
86};
87
88} // end anonymous namespace
89
90INITIALIZE_PASS(AArch64PointerAuthLegacy, "aarch64-ptrauth",
91 AARCH64_POINTER_AUTH_NAME, false, false)
92
93FunctionPass *llvm::createAArch64PointerAuthPass() {
94 return new AArch64PointerAuthLegacy();
95}
96
97char AArch64PointerAuthLegacy::ID = 0;
98
99static void emitEpiloguePACSymOffsetIntoReg(const TargetInstrInfo &TII,
100 MachineBasicBlock &MBB,
101 MachineBasicBlock::iterator I,
102 DebugLoc DL, MCSymbol *PACSym,
103 Register Reg) {
104 BuildMI(BB&: MBB, I, MIMD: DL, MCID: TII.get(Opcode: AArch64::ADRP), DestReg: Reg)
105 .addSym(Sym: PACSym, TargetFlags: AArch64II::MO_PAGE)
106 .setMIFlag(MachineInstr::FrameDestroy);
107 BuildMI(BB&: MBB, I, MIMD: DL, MCID: TII.get(Opcode: AArch64::ADDXri), DestReg: Reg)
108 .addReg(RegNo: Reg)
109 .addSym(Sym: PACSym, TargetFlags: AArch64II::MO_PAGEOFF | AArch64II::MO_NC)
110 .addImm(Val: 0)
111 .setMIFlag(MachineInstr::FrameDestroy);
112}
113
114// Wrap a given PAC instruction in CFI that describes it.
115//
116// Depending on the type of CFI required, we may need to emit the directive
117// either before or after the instruction, so that unwinders can correctly
118// interpret the location of the signing instruction.
119//
120// As a general rule, CFI opcodes describe the actions needed to recover the
121// register state leading up to a not-yet-retired instruction, with one
122// exception: .cfi_negate_ra_state_with_pc always comes before the paci[ab]sppc,
123// since the unwinder uses the location of the CFI itself to derive the address
124// of the signing instruction [1].
125// 1: https://github.com/llvm/llvm-project/pull/137795#issuecomment-2838779129
126template <typename BuildPACMIFn>
127static void decoratePACWithCFI(MachineBasicBlock &MBB,
128 MachineBasicBlock::iterator MBBI, bool EmitCFI,
129 BuildPACMIFn BuildPACMI) {
130 if (!EmitCFI) {
131 BuildPACMI();
132 return;
133 }
134
135 auto &MF = *MBB.getParent();
136 auto &MFnI = *MF.getInfo<AArch64FunctionInfo>();
137 CFIInstBuilder CFIBuilder(MBB, MBBI, MachineInstr::FrameSetup);
138 const Triple &TT = MF.getTarget().getTargetTriple();
139
140 if (MFnI.branchProtectionPAuthLR()) {
141 switch (CFILLVMSetRASignStateMode) {
142 case SetRAStateMode::Never:
143 CFIBuilder.buildNegateRAStateWithPC();
144 BuildPACMI();
145 break;
146 case SetRAStateMode::PAuthLR:
147 case SetRAStateMode::Always: {
148 BuildPACMI();
149 MCSymbol *PACSym = MFnI.getSigningInstrLabel();
150 assert(PACSym && "No PAC instruction to refer to");
151 CFIBuilder.buildSetRAState(State: 2, PACSym);
152 break;
153 }
154 }
155 } else {
156 switch (CFILLVMSetRASignStateMode) {
157 case SetRAStateMode::Never:
158 case SetRAStateMode::PAuthLR:
159 BuildPACMI();
160 if (!TT.isOSBinFormatMachO()) {
161 CFIBuilder.buildNegateRAState();
162 }
163 break;
164 case SetRAStateMode::Always:
165 BuildPACMI();
166 CFIBuilder.buildSetRAState(State: 1, PACSym: nullptr);
167 break;
168 }
169 }
170}
171
172static void emitAUTCFI(MachineBasicBlock &MBB, MachineBasicBlock::iterator MBBI,
173 bool EmitCFI) {
174 if (!EmitCFI)
175 return;
176
177 auto &MF = *MBB.getParent();
178 auto &MFnI = *MF.getInfo<AArch64FunctionInfo>();
179 CFIInstBuilder CFIBuilder(MBB, MBBI, MachineInstr::FrameDestroy);
180 const Triple &TT = MF.getTarget().getTargetTriple();
181
182 if (MFnI.branchProtectionPAuthLR()) {
183 switch (CFILLVMSetRASignStateMode) {
184 case SetRAStateMode::Never:
185 // DW_CFA_AARCH64_negate_ra_state_with_pc is semantically broken for
186 // functions where shrinkwrapping places signing/authenticating pairs on
187 // distinct CFG paths.
188 //
189 // DWARF CFI is evaluated linearly over the byte stream, not along control
190 // flow edges. The toggle semantics of this directive therefore cannot
191 // faithfully represent the signed/unsigned RA state for all possible CFG
192 // paths. The added complexity versus DW_CFA_AARCH64_negate_ra_state is
193 // that an unwinder must also reconstruct the PC of the PACI[AB]SPPC in
194 // order to verify the signed LR, and that address is derived from the
195 // location of this directive in the linear CFI stream.
196 //
197 // The correct fix is to use DW_CFA_AARCH64_set_ra_state_with_pc, which
198 // sets the RA state and signing address absolutely rather than toggling
199 // them. An unwinder that supports this directive can reconstruct the
200 // correct state on any CFG path, regardless of how many
201 // signing/authenticating pairs exist in the function. However, not all
202 // unwinders support this directive, so we cannot rely on it exclusively.
203 //
204 // For unwinders that only support DW_CFA_AARCH64_negate_ra_state_with_pc,
205 // libunwind exploits a loophole: it records the address at the
206 // DW_CFA_AARCH64_negate_ra_state_with_pc site to authenticate the LR, but
207 // does not care that the CFI state remains "signed with pc" after
208 // authentication has occurred. This means we can safely omit the
209 // FrameDestroy emission of this directive, treating it solely as a marker
210 // for the signing site, as long as each function has at most one such
211 // signing location. That invariant holds today because shrinkwrapping
212 // does not yet hoist or sink PAuth_LR frame code across CFG join/split
213 // points; once it does, we must avoid those transformations on platforms
214 // that have this limitation.
215 //
216 // https://github.com/ARM-software/abi-aa/issues/327
217 // https://github.com/ARM-software/abi-aa/pull/346
218 break;
219 case SetRAStateMode::PAuthLR:
220 case SetRAStateMode::Always:
221 CFIBuilder.buildSetRAState(State: 0, PACSym: nullptr);
222 break;
223 }
224 } else if (!TT.isOSBinFormatMachO()) {
225 switch (CFILLVMSetRASignStateMode) {
226 case SetRAStateMode::Never:
227 case SetRAStateMode::PAuthLR:
228 CFIBuilder.buildNegateRAState();
229 break;
230 case SetRAStateMode::Always:
231 CFIBuilder.buildSetRAState(State: 0, PACSym: nullptr);
232 break;
233 }
234 }
235}
236
237void AArch64PointerAuthImpl::signLR(MachineFunction &MF,
238 MachineBasicBlock::iterator MBBI) const {
239 auto &MFnI = *MF.getInfo<AArch64FunctionInfo>();
240 bool UseBKey = MFnI.shouldSignWithBKey();
241 bool EmitCFI = MFnI.needsDwarfUnwindInfo(MF);
242 bool NeedsWinCFI = MF.hasWinCFI();
243
244 MachineBasicBlock &MBB = *MBBI->getParent();
245
246 // Debug location must be unknown, see AArch64FrameLowering::emitPrologue.
247 DebugLoc DL;
248
249 if (UseBKey && !MF.getTarget().getTargetTriple().isOSBinFormatMachO()) {
250 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AArch64::EMITBKEY))
251 .setMIFlag(MachineInstr::FrameSetup);
252 }
253
254 // PAuthLR authentication instructions need to know the value of PC at the
255 // point of signing (PACI*).
256 if (MFnI.branchProtectionPAuthLR()) {
257 MCSymbol *PACSym = MF.getContext().createTempSymbol();
258 MFnI.setSigningInstrLabel(PACSym);
259 }
260
261 // No SEH opcode for this one; it doesn't materialize into an
262 // instruction on Windows.
263 if (MFnI.branchProtectionPAuthLR() && Subtarget->hasPAuthLR()) {
264 decoratePACWithCFI(MBB, MBBI, EmitCFI, BuildPACMI: [&]() {
265 BuildMI(BB&: MBB, I: MBBI, MIMD: DL,
266 MCID: TII->get(Opcode: UseBKey ? AArch64::PACIBSPPC : AArch64::PACIASPPC))
267 .setMIFlag(MachineInstr::FrameSetup)
268 ->setPreInstrSymbol(MF, Symbol: MFnI.getSigningInstrLabel());
269 });
270 } else {
271 if (MFnI.branchProtectionPAuthLR()) {
272 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AArch64::PACM))
273 .setMIFlag(MachineInstr::FrameSetup);
274 }
275 decoratePACWithCFI(MBB, MBBI, EmitCFI, BuildPACMI: [&]() {
276 BuildMI(BB&: MBB, I: MBBI, MIMD: DL,
277 MCID: TII->get(Opcode: UseBKey ? AArch64::PACIBSP : AArch64::PACIASP))
278 .setMIFlag(MachineInstr::FrameSetup)
279 ->setPreInstrSymbol(MF, Symbol: MFnI.getSigningInstrLabel());
280 });
281 }
282
283 if (!EmitCFI && NeedsWinCFI) {
284 assert(UseBKey &&
285 "Windows SEH PAC unwind info only supports B-key signing");
286 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AArch64::SEH_PACSignLR))
287 .setMIFlag(MachineInstr::FrameSetup);
288 }
289}
290
291void AArch64PointerAuthImpl::authenticateLR(
292 MachineFunction &MF, MachineBasicBlock::iterator MBBI) const {
293 const AArch64FunctionInfo *MFnI = MF.getInfo<AArch64FunctionInfo>();
294 bool UseBKey = MFnI->shouldSignWithBKey();
295 bool EmitAsyncCFI = MFnI->needsAsyncDwarfUnwindInfo(MF);
296 bool NeedsWinCFI = MF.hasWinCFI();
297
298 MachineBasicBlock &MBB = *MBBI->getParent();
299 DebugLoc DL = MBBI->getDebugLoc();
300 // MBBI points to a PAUTH_EPILOGUE instruction to be replaced and
301 // TI points to a terminator instruction that may or may not be combined.
302 // Note that inserting new instructions "before MBBI" and "before TI" is
303 // not the same because if ShadowCallStack is enabled, its instructions
304 // are placed between MBBI and TI.
305 MachineBasicBlock::iterator TI = MBB.getFirstInstrTerminator();
306
307 MCSymbol *PACSym = MFnI->getSigningInstrLabel();
308 auto &AFL = *static_cast<const AArch64FrameLowering *>(
309 MF.getSubtarget().getFrameLowering());
310 int64_t ArgumentStackToRestore = AFL.getArgumentStackToRestore(MF, MBB);
311
312 // When ArgumentStackToRestore > 0, this function received more argument
313 // space than the tail callee pops. The epilogue contains an SP adjustment
314 // (e.g. "add sp, sp, #N") to discard the leftover argument space. We must
315 // authenticate *before* that adjustment so that AUTI[AB]SP sees the entry
316 // SP discriminator. Move any such SP-adjusting instructions to after the
317 // authentication instruction.
318 //
319 // When ArgumentStackToRestore < 0, the tail callee pops more argument space
320 // than this function received, so after the frame teardown, SP is below the
321 // entry SP used as the signing modifier.
322 //
323 // We cannot simply bump SP first and then use AUTI[AB]SP with the bumped
324 // value, because the live arguments would fall below SP and potentially
325 // outside the red-zone. Collect those SP adjustments in case we need to move
326 // them after the AUT.
327 int64_t Offset = -ArgumentStackToRestore;
328 SmallVector<MachineInstr *, 2> SPMods;
329 if (ArgumentStackToRestore > 0) {
330 for (MachineInstr &MI : make_range(x: MBBI.getReverse(), y: MBB.rend())) {
331 if (!MI.getFlag(Flag: MachineInstr::FrameDestroy))
332 break;
333 if ((MI.getOpcode() == AArch64::ADDXri ||
334 MI.getOpcode() == AArch64::SUBXri) &&
335 MI.getOperand(i: 0).getReg() == AArch64::SP &&
336 MI.getOperand(i: 1).getReg() == AArch64::SP) {
337 SPMods.push_back(Elt: &MI);
338 int64_t Imm = MI.getOperand(i: 2).getImm()
339 << AArch64_AM::getShiftValue(Imm: MI.getOperand(i: 3).getImm());
340 Offset += MI.getOpcode() == AArch64::ADDXri ? Imm : -Imm;
341 }
342 }
343 }
344
345 // If there will not be an SP bump afterward, we can use an AUT or RET form
346 // with a hardcoded SP discriminator.
347 if (!Offset) {
348 // The AUTIASP instruction assembles to a hint instruction before v8.3a so
349 // this instruction can safely be used for any v8a architecture.
350 // From v8.3a onwards there are optimised authenticate LR and return
351 // instructions, namely RETA{A,B}, that can be used instead. In this case
352 // the DW_CFA_AARCH64_negate_ra_state can't be emitted. Additionally,
353 // RET{A,B} requires the SP to match its incoming value on entry to the
354 // function.
355 bool TerminatorIsCombinable = TI != MBB.end() &&
356 TI->getOpcode() == AArch64::RET &&
357 ArgumentStackToRestore == 0;
358
359 if (Subtarget->hasPAuth() && TerminatorIsCombinable && !NeedsWinCFI &&
360 !MF.getFunction().hasFnAttribute(Kind: Attribute::ShadowCallStack)) {
361 if (MFnI->branchProtectionPAuthLR() && Subtarget->hasPAuthLR()) {
362 assert(PACSym && "No PAC instruction to refer to");
363 BuildMI(BB&: MBB, I: TI, MIMD: DL,
364 MCID: TII->get(Opcode: UseBKey ? AArch64::RETABSPPCi : AArch64::RETAASPPCi))
365 .addSym(Sym: PACSym)
366 .copyImplicitOps(OtherMI: *MBBI)
367 .setMIFlag(MachineInstr::FrameDestroy);
368 } else {
369 if (MFnI->branchProtectionPAuthLR()) {
370 emitEpiloguePACSymOffsetIntoReg(TII: *TII, MBB, I: MBBI, DL, PACSym,
371 Reg: AArch64::X16);
372 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AArch64::PACM))
373 .setMIFlag(MachineInstr::FrameDestroy);
374 }
375 BuildMI(BB&: MBB, I: TI, MIMD: DL,
376 MCID: TII->get(Opcode: UseBKey ? AArch64::RETAB : AArch64::RETAA))
377 .copyImplicitOps(OtherMI: *MBBI)
378 .setMIFlag(MachineInstr::FrameDestroy);
379 }
380 MBB.erase(I: TI);
381 return;
382 }
383
384 for (auto *MI : SPMods)
385 MI->removeFromParent();
386
387 if (MFnI->branchProtectionPAuthLR() && Subtarget->hasPAuthLR()) {
388 assert(PACSym && "No PAC instruction to refer to");
389 BuildMI(BB&: MBB, I: MBBI, MIMD: DL,
390 MCID: TII->get(Opcode: UseBKey ? AArch64::AUTIBSPPCi : AArch64::AUTIASPPCi))
391 .addSym(Sym: PACSym)
392 .setMIFlag(MachineInstr::FrameDestroy);
393 emitAUTCFI(MBB, MBBI, EmitCFI: EmitAsyncCFI);
394 } else {
395 if (MFnI->branchProtectionPAuthLR()) {
396 emitEpiloguePACSymOffsetIntoReg(TII: *TII, MBB, I: MBBI, DL, PACSym,
397 Reg: AArch64::X16);
398
399 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AArch64::PACM))
400 .setMIFlag(MachineInstr::FrameDestroy);
401 }
402 BuildMI(BB&: MBB, I: MBBI, MIMD: DL,
403 MCID: TII->get(Opcode: UseBKey ? AArch64::AUTIBSP : AArch64::AUTIASP))
404 .setMIFlag(MachineInstr::FrameDestroy);
405 emitAUTCFI(MBB, MBBI, EmitCFI: EmitAsyncCFI);
406 }
407
408 if (NeedsWinCFI) {
409 assert(UseBKey &&
410 "Windows SEH PAC unwind info only supports B-key signing");
411 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AArch64::SEH_PACSignLR))
412 .setMIFlag(MachineInstr::FrameDestroy);
413 }
414
415 for (auto *MI : SPMods)
416 MBB.insert(I: MBBI, MI);
417
418 return;
419 }
420
421 for (auto *MI : SPMods)
422 MI->removeFromParent();
423
424 // Otherwise there is an offset to the incoming SP, and we can't use the aut
425 // variants that hard-code SP. Reconstruct entry SP in x16 and authenticate
426 // using AUTI[AB]1716 (x17=LR, x16=entry_SP).
427 emitFrameOffset(MBB, MBBI, DL, DestReg: AArch64::X16, SrcReg: AArch64::SP,
428 Offset: StackOffset::getFixed(Fixed: Offset), TII,
429 MachineInstr::FrameDestroy);
430
431 auto emitMOV = [&](Register Dst, Register Src) {
432 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AArch64::ORRXrs), DestReg: Dst)
433 .addReg(RegNo: AArch64::XZR)
434 .addReg(RegNo: Src)
435 .addImm(Val: 0)
436 .setMIFlag(MachineInstr::FrameDestroy);
437 };
438
439 if (MFnI->branchProtectionPAuthLR() && Subtarget->hasPAuthLR()) {
440 emitMOV(AArch64::X17, AArch64::LR);
441
442 assert(PACSym && "No PAC instruction to refer to");
443 emitEpiloguePACSymOffsetIntoReg(TII: *TII, MBB, I: MBBI, DL, PACSym, Reg: AArch64::X15);
444
445 unsigned AutOpc = UseBKey ? AArch64::AUTIB171615 : AArch64::AUTIA171615;
446 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AutOpc))
447 .setMIFlag(MachineInstr::FrameDestroy);
448 emitAUTCFI(MBB, MBBI, EmitCFI: EmitAsyncCFI);
449
450 emitMOV(AArch64::LR, AArch64::X17);
451 } else if (MFnI->branchProtectionPAuthLR()) {
452 emitMOV(AArch64::X17, AArch64::LR);
453
454 assert(PACSym && "No PAC instruction to refer to");
455 emitEpiloguePACSymOffsetIntoReg(TII: *TII, MBB, I: MBBI, DL, PACSym, Reg: AArch64::X15);
456
457 // The PACM hint-space instruction modifies the following AUTI[AB]1716
458 // to optionally take x15 as an extra operand depending on the
459 // presence of +pauth-lr at runtime. On machines without +pauth-lr, it
460 // behaves as a nop, and the address of the PACI[AB]SP in x15 is
461 // ignored.
462 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AArch64::PACM))
463 .setMIFlag(MachineInstr::FrameDestroy);
464
465 unsigned AutOpc = UseBKey ? AArch64::AUTIB1716 : AArch64::AUTIA1716;
466 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AutOpc))
467 .setMIFlag(MachineInstr::FrameDestroy);
468 emitAUTCFI(MBB, MBBI, EmitCFI: EmitAsyncCFI);
469
470 emitMOV(AArch64::LR, AArch64::X17);
471 } else if (Subtarget->hasPAuth()) {
472 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: UseBKey ? AArch64::AUTIB : AArch64::AUTIA),
473 DestReg: AArch64::LR)
474 .addUse(RegNo: AArch64::LR)
475 .addUse(RegNo: AArch64::X16)
476 .setMIFlag(MachineInstr::FrameDestroy);
477 emitAUTCFI(MBB, MBBI, EmitCFI: EmitAsyncCFI);
478 } else {
479 emitMOV(AArch64::X17, AArch64::LR);
480
481 unsigned AutOpc = UseBKey ? AArch64::AUTIB1716 : AArch64::AUTIA1716;
482 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AutOpc))
483 .setMIFlag(MachineInstr::FrameDestroy);
484 emitAUTCFI(MBB, MBBI, EmitCFI: EmitAsyncCFI);
485
486 emitMOV(AArch64::LR, AArch64::X17);
487 }
488
489 if (NeedsWinCFI) {
490 assert(UseBKey &&
491 "Windows SEH PAC unwind info only supports B-key signing");
492 BuildMI(BB&: MBB, I: MBBI, MIMD: DL, MCID: TII->get(Opcode: AArch64::SEH_PACSignLR))
493 .setMIFlag(MachineInstr::FrameDestroy);
494 }
495
496 for (auto *MI : SPMods)
497 MBB.insert(I: MBBI, MI);
498}
499
500unsigned llvm::AArch64PAuth::getCheckerSizeInBytes(AuthCheckMethod Method) {
501 switch (Method) {
502 case AuthCheckMethod::None:
503 return 0;
504 case AuthCheckMethod::DummyLoad:
505 return 4;
506 case AuthCheckMethod::HighBitsNoTBI:
507 return 12;
508 case AuthCheckMethod::XPACHint:
509 case AuthCheckMethod::XPAC:
510 return 20;
511 }
512 llvm_unreachable("Unknown AuthCheckMethod enum");
513}
514
515bool AArch64PointerAuthImpl::run(MachineFunction &MF) {
516 Subtarget = &MF.getSubtarget<AArch64Subtarget>();
517 TII = Subtarget->getInstrInfo();
518
519 SmallVector<MachineBasicBlock::instr_iterator> PAuthPseudoInstrs;
520
521 bool Modified = false;
522
523 for (auto &MBB : MF) {
524 for (auto &MI : MBB) {
525 switch (MI.getOpcode()) {
526 default:
527 break;
528 case AArch64::PAUTH_PROLOGUE:
529 case AArch64::PAUTH_EPILOGUE:
530 PAuthPseudoInstrs.push_back(Elt: MI.getIterator());
531 break;
532 }
533 }
534 }
535
536 for (auto It : PAuthPseudoInstrs) {
537 switch (It->getOpcode()) {
538 case AArch64::PAUTH_PROLOGUE:
539 signLR(MF, MBBI: It);
540 break;
541 case AArch64::PAUTH_EPILOGUE:
542 authenticateLR(MF, MBBI: It);
543 break;
544 default:
545 llvm_unreachable("Unhandled opcode");
546 }
547 It->eraseFromParent();
548 Modified = true;
549 }
550
551 return Modified;
552}
553
554bool AArch64PointerAuthLegacy::runOnMachineFunction(MachineFunction &MF) {
555 return AArch64PointerAuthImpl().run(MF);
556}
557
558PreservedAnalyses
559AArch64PointerAuthPass::run(MachineFunction &MF,
560 MachineFunctionAnalysisManager &MFAM) {
561 const bool Changed = AArch64PointerAuthImpl().run(MF);
562 if (!Changed)
563 return PreservedAnalyses::all();
564 PreservedAnalyses PA = getMachineFunctionPassPreservedAnalyses();
565 PA.preserveSet<CFGAnalyses>();
566 return PA;
567}
568