[3/12,V2] arm: Add option -mbranch-protection
Commit Message
Richard Earnshaw <Richard.Earnshaw@foss.arm.com> writes:
[...]
> +@item
> +-mbranch-protection=@var{none}|@var{standard}|@var{pac-ret}[+@var{leaf}][+@var{bti}]|@var{bti}[+@var{pac-ret}[+@var{leaf}]]
> +@opindex mbranch-protection
> +Enable branch protection features (armv8.1-m.main only).
> +@samp{none} generate code without branch protection or return address
> +signing.
> +@samp{standard[+@var{leaf}]} generate code with all branch protection
> +features enabled at their standard level.
> +@samp{pac-ret[+@var{leaf}]} generate code with return address signing
> +set to its standard level, which is to sign all functions that save
> +the return address to memory.
> +@samp{leaf} When return address signing is enabled, also sign leaf
> +functions even if they do not write the return address to memory.
> ++@samp{bti} Add landing-pad instructions at the permitted targets of
> +indirect branch instructions.
> +
> +If the @samp{+pacbti} architecture extension is not enabled, then all
> +branch protection and return address signing operations are
> +constrained to use only the instructions defined in the
> +architectural-NOP space. The generated code will remain
> +backwards-compatible with earlier versions of the architecture, but
> +the additional security can be enabled at run time on processors that
> +support the @samp{PACBTI} extension.
> +
> +Branch target enforcement using BTI can only be enabled at runtime if
> +all code in the application has been compiled with at least
> +@samp{-mbranch-protection=bti}.
> +
> +The default is to generate code without branch protection or return
> +address signing.
>
> This needs to make it clear that -mbranch-protection != none is only
> supported on armv8-m.main or later.
>
> R.
Hi Richard,
thanks for reviewing, please find attached the respinned patch.
Ok for trunk (when the rest of the series will be approved)?
Best Regards
Andrea
gcc/ChangeLog:
* config/arm/arm.c (arm_configure_build_target): Parse and validate
-mbranch-protection option and initialize appropriate data structures.
* config/arm/arm.opt (-mbranch-protection): New option.
* doc/invoke.texi (Arm Options): Document it.
Co-Authored-By: Tejas Belagod <tbelagod@arm.com>
Co-Authored-By: Richard Earnshaw <Richard.Earnshaw@arm.com>
Comments
On 04/07/2022 10:27, Andrea Corallo via Gcc-patches wrote:
> Richard Earnshaw <Richard.Earnshaw@foss.arm.com> writes:
>
> [...]
>
>> +@item
>> +-mbranch-protection=@var{none}|@var{standard}|@var{pac-ret}[+@var{leaf}][+@var{bti}]|@var{bti}[+@var{pac-ret}[+@var{leaf}]]
>> +@opindex mbranch-protection
>> +Enable branch protection features (armv8.1-m.main only).
>> +@samp{none} generate code without branch protection or return address
>> +signing.
>> +@samp{standard[+@var{leaf}]} generate code with all branch protection
>> +features enabled at their standard level.
>> +@samp{pac-ret[+@var{leaf}]} generate code with return address signing
>> +set to its standard level, which is to sign all functions that save
>> +the return address to memory.
>> +@samp{leaf} When return address signing is enabled, also sign leaf
>> +functions even if they do not write the return address to memory.
>> ++@samp{bti} Add landing-pad instructions at the permitted targets of
>> +indirect branch instructions.
>> +
>> +If the @samp{+pacbti} architecture extension is not enabled, then all
>> +branch protection and return address signing operations are
>> +constrained to use only the instructions defined in the
>> +architectural-NOP space. The generated code will remain
>> +backwards-compatible with earlier versions of the architecture, but
>> +the additional security can be enabled at run time on processors that
>> +support the @samp{PACBTI} extension.
>> +
>> +Branch target enforcement using BTI can only be enabled at runtime if
>> +all code in the application has been compiled with at least
>> +@samp{-mbranch-protection=bti}.
>> +
>> +The default is to generate code without branch protection or return
>> +address signing.
>>
>> This needs to make it clear that -mbranch-protection != none is only
>> supported on armv8-m.main or later.
>>
>> R.
>
> Hi Richard,
>
> thanks for reviewing, please find attached the respinned patch.
>
> Ok for trunk (when the rest of the series will be approved)?
>
> Best Regards
>
> Andrea
>
> gcc/ChangeLog:
>
> * config/arm/arm.c (arm_configure_build_target): Parse and validate
> -mbranch-protection option and initialize appropriate data structures.
> * config/arm/arm.opt (-mbranch-protection): New option.
> * doc/invoke.texi (Arm Options): Document it.
>
> Co-Authored-By: Tejas Belagod <tbelagod@arm.com>
> Co-Authored-By: Richard Earnshaw <Richard.Earnshaw@arm.com>
>
OK.
R.
@@ -3263,6 +3263,17 @@ arm_configure_build_target (struct arm_build_target *target,
tune_opts = strchr (opts->x_arm_tune_string, '+');
}
+ if (opts->x_arm_branch_protection_string)
+ {
+ aarch_validate_mbranch_protection (opts->x_arm_branch_protection_string);
+
+ if (aarch_ra_sign_key != AARCH_KEY_A)
+ {
+ warning (0, "invalid key type for %<-mbranch-protection=%>");
+ aarch_ra_sign_key = AARCH_KEY_A;
+ }
+ }
+
if (arm_selected_arch)
{
arm_initialize_isa (target->isa, arm_selected_arch->common.isa_bits);
@@ -323,6 +323,10 @@ mbranch-cost=
Target RejectNegative Joined UInteger Var(arm_branch_cost) Init(-1)
Cost to assume for a branch insn.
+mbranch-protection=
+Target RejectNegative Joined Var(arm_branch_protection_string) Save
+Use branch-protection features.
+
mgeneral-regs-only
Target RejectNegative Mask(GENERAL_REGS_ONLY) Save
Generate code which uses the core registers only (r0-r14).
@@ -825,7 +825,9 @@ Objective-C and Objective-C++ Dialects}.
-mcmse @gol
-mfix-cmse-cve-2021-35465 @gol
-mstack-protector-guard=@var{guard} -mstack-protector-guard-offset=@var{offset} @gol
--mfdpic}
+-mfdpic @gol
+-mbranch-protection=@var{none}|@var{standard}|@var{pac-ret}[+@var{leaf}]
+[+@var{bti}]|@var{bti}[+@var{pac-ret}[+@var{leaf}]]}
@emph{AVR Options}
@gccoptlist{-mmcu=@var{mcu} -mabsdata -maccumulate-args @gol
@@ -21521,6 +21523,40 @@ The opposite @option{-mno-fdpic} option is useful (and required) to
build the Linux kernel using the same (@code{arm-*-uclinuxfdpiceabi})
toolchain as the one used to build the userland programs.
+@item
+-mbranch-protection=@var{none}|@var{standard}|@var{pac-ret}[+@var{leaf}][+@var{bti}]|@var{bti}[+@var{pac-ret}[+@var{leaf}]]
+@opindex mbranch-protection
+Enable branch protection features (armv8.1-m.main only).
+@samp{none} generate code without branch protection or return address
+signing.
+@samp{standard[+@var{leaf}]} generate code with all branch protection
+features enabled at their standard level.
+@samp{pac-ret[+@var{leaf}]} generate code with return address signing
+set to its standard level, which is to sign all functions that save
+the return address to memory.
+@samp{leaf} When return address signing is enabled, also sign leaf
+functions even if they do not write the return address to memory.
++@samp{bti} Add landing-pad instructions at the permitted targets of
+indirect branch instructions.
+
+If the @samp{+pacbti} architecture extension is not enabled, then all
+branch protection and return address signing operations are
+constrained to use only the instructions defined in the
+architectural-NOP space. The generated code will remain
+backwards-compatible with earlier versions of the architecture, but
+the additional security can be enabled at run time on processors that
+support the @samp{PACBTI} extension.
+
+Branch target enforcement using BTI can only be enabled at runtime if
+all code in the application has been compiled with at least
+@samp{-mbranch-protection=bti}.
+
+Any setting other than @samp{none} is supported only on armv8-m.main
+or later.
+
+The default is to generate code without branch protection or return
+address signing.
+
@end table
@node AVR Options