[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-07-14 Thread Anatoly Trosinenko via cfe-commits 

atrosinenko wrote:

I have rebased this PR onto current `main` branch and moved the new test to 
`AArch64/` subdirectory. There are no unresolved comments anymore, as far as I 
can see.

https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-07-14 Thread Anatoly Trosinenko via cfe-commits 


@@ -0,0 +1,25 @@
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s

atrosinenko wrote:

Updated in 23a5407776bb7aa27b4fd07f5221c265fb080b1e, thank you!

https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-07-14 Thread Anatoly Trosinenko via cfe-commits 

https://github.com/atrosinenko updated 
https://github.com/llvm/llvm-project/pull/141573

>From 3e625155a44a88ec8f276f8c25379bec1a153e38 Mon Sep 17 00:00:00 2001
From: Anatoly Trosinenko 
Date: Mon, 26 May 2025 22:28:55 +0300
Subject: [PATCH 1/4] [AArch64][FMV] Enable PAuth and BTI hardening of resolver
 functions

---
 clang/lib/CodeGen/CodeGenModule.cpp   |  9 +++
 .../CodeGen/ptrauth-resolver-attributes.c | 25 +++
 2 files changed, 34 insertions(+)
 create mode 100644 clang/test/CodeGen/ptrauth-resolver-attributes.c

diff --git a/clang/lib/CodeGen/CodeGenModule.cpp 
b/clang/lib/CodeGen/CodeGenModule.cpp
index c8866f15745c2..e3ca1761cf85a 100644
--- a/clang/lib/CodeGen/CodeGenModule.cpp
+++ b/clang/lib/CodeGen/CodeGenModule.cpp
@@ -4757,6 +4757,13 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   if (FD->isTargetMultiVersion() || FD->isTargetClonesMultiVersion())
 AddDeferredMultiVersionResolverToEmit(GD);
 
+  auto SetResolverAttrs = [&](llvm::Function &Resolver) {
+TargetInfo::BranchProtectionInfo BPI(getLangOpts());
+TargetCodeGenInfo::setBranchProtectionFnAttributes(BPI, Resolver);
+TargetCodeGenInfo::setPointerAuthFnAttributes(CodeGenOpts.PointerAuth,
+  Resolver);
+  };
+
   // For cpu_specific, don't create an ifunc yet because we don't know if the
   // cpu_dispatch will be emitted in this translation unit.
   if (ShouldReturnIFunc) {
@@ -4771,6 +4778,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   "", Resolver, &getModule());
 GIF->setName(ResolverName);
 SetCommonAttributes(FD, GIF);
+SetResolverAttrs(cast(*Resolver));
 if (ResolverGV)
   replaceDeclarationWith(ResolverGV, GIF);
 return GIF;
@@ -4781,6 +4789,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   assert(isa(Resolver) && !ResolverGV &&
  "Resolver should be created for the first time");
   SetCommonAttributes(FD, cast(Resolver));
+  SetResolverAttrs(cast(*Resolver));
   return Resolver;
 }
 
diff --git a/clang/test/CodeGen/ptrauth-resolver-attributes.c 
b/clang/test/CodeGen/ptrauth-resolver-attributes.c
new file mode 100644
index 0..8bdedd2c549be
--- /dev/null
+++ b/clang/test/CodeGen/ptrauth-resolver-attributes.c
@@ -0,0 +1,25 @@
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+
+// Check that resolver functions generated by clang have the correct 
attributes.
+
+int __attribute__((target_clones("crc", "default"))) ftc(void) { return 0; }
+
+int __attribute__((target_version("crc"))) fmv(void) { return 0; }
+int __attribute__((target_version("default"))) fmv(void) { return 0; }
+
+// CHECK: define{{.*}} i32 @ftc._Mcrc() #0
+// CHECK: define{{.*}} ptr @ftc.resolver() #1
+// CHECK: define{{.*}} i32 @fmv._Mcrc() #0
+// CHECK: define{{.*}} i32 @fmv.default() #2
+// CHECK: define{{.*}} i32 @ftc.default() #2
+// CHECK: define{{.*}} ptr @fmv.resolver() #1
+
+// BTI-SIGNRA: attributes #0 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #1 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #2 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// PAUTHTEST: attributes #0 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #1 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #2 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }

>From 6d63e7e1a9b5399d4c6478acc3cad03b0e0ff583 Mon Sep 17 00:00:00 2001
From: Anatoly Trosinenko 
Date: Wed, 4 Jun 2025 16:34:47 +0300
Subject: [PATCH 2/4] Use setTargetAttributes function

---
 clang/lib/CodeGen/CodeGenModule.cpp | 14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/clang/lib/CodeGen/CodeGenModule.cpp 
b/clang/lib/CodeGen/CodeGenModule.cpp
index e3ca1761cf85a..51f9f85c7f561 100644
--- a/clang/lib/CodeGen/CodeGenModule.cpp
+++ b/clang/lib/CodeGen/CodeGenModule.cpp
@@ -4757,11 +4757,11 @@ llvm::Constant

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-07-14 Thread Anton Korobeynikov via cfe-commits 

https://github.com/asl milestoned 
https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-06-05 Thread Alexandros Lamprineas via cfe-commits 


@@ -0,0 +1,25 @@
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s

labrinea wrote:

No, I am not asking existing tests to be moved, but when we add new ones they 
ought to be in the right place. An attempt to move existing CodeGen tests under 
the AArch64 folder was here https://github.com/llvm/llvm-project/pull/115818

https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-06-05 Thread Oliver Hunt via cfe-commits 


@@ -0,0 +1,25 @@
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s

ojhunt wrote:

none of the other ptrauth tests are in a subdirectory, are you wanting all the 
ptrauth tests to be moved?

https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-06-05 Thread Alexandros Lamprineas via cfe-commits 


@@ -0,0 +1,25 @@
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s

labrinea wrote:

Can we move this file under the AArch64 directory?

https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-06-04 Thread Jon Roelofs via cfe-commits 


@@ -4652,6 +4659,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   "", Resolver, &getModule());
 GIF->setName(ResolverName);
 SetCommonAttributes(FD, GIF);
+SetResolverAttrs(cast(Resolver));

jroelofs wrote:

`GlobalIFunc` instructions in the IR currently require that the resolver be a 
`Function` with a definition.

https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-06-04 Thread Eli Friedman via cfe-commits 


@@ -4652,6 +4659,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   "", Resolver, &getModule());
 GIF->setName(ResolverName);
 SetCommonAttributes(FD, GIF);
+SetResolverAttrs(cast(Resolver));

efriedma-quic wrote:

Is Resolver actually guaranteed to be a function?  GetOrCreateLLVMFunction can 
return other kinds of GlobalValues in some cases.

Should we be calling SetCommonAttributes/setGVProperties to set the 
linkage/visibility of the resolver?

https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-06-04 Thread Eli Friedman via cfe-commits 


@@ -4652,6 +4659,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   "", Resolver, &getModule());
 GIF->setName(ResolverName);
 SetCommonAttributes(FD, GIF);
+SetResolverAttrs(cast(*Resolver));

efriedma-quic wrote:

That's fine.

https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-06-04 Thread Anatoly Trosinenko via cfe-commits 

https://github.com/atrosinenko updated 
https://github.com/llvm/llvm-project/pull/141573

>From c5a7fea9925c9d4aebf948c9e3d7f0af47893fb7 Mon Sep 17 00:00:00 2001
From: Anatoly Trosinenko 
Date: Mon, 26 May 2025 22:28:55 +0300
Subject: [PATCH 1/3] [AArch64][FMV] Enable PAuth and BTI hardening of resolver
 functions

---
 clang/lib/CodeGen/CodeGenModule.cpp   |  9 +++
 .../CodeGen/ptrauth-resolver-attributes.c | 25 +++
 2 files changed, 34 insertions(+)
 create mode 100644 clang/test/CodeGen/ptrauth-resolver-attributes.c

diff --git a/clang/lib/CodeGen/CodeGenModule.cpp 
b/clang/lib/CodeGen/CodeGenModule.cpp
index 16e010adbeb5f..af8d4cc60de57 100644
--- a/clang/lib/CodeGen/CodeGenModule.cpp
+++ b/clang/lib/CodeGen/CodeGenModule.cpp
@@ -4638,6 +4638,13 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   if (FD->isTargetMultiVersion() || FD->isTargetClonesMultiVersion())
 AddDeferredMultiVersionResolverToEmit(GD);
 
+  auto SetResolverAttrs = [&](llvm::Function &Resolver) {
+TargetInfo::BranchProtectionInfo BPI(getLangOpts());
+TargetCodeGenInfo::setBranchProtectionFnAttributes(BPI, Resolver);
+TargetCodeGenInfo::setPointerAuthFnAttributes(CodeGenOpts.PointerAuth,
+  Resolver);
+  };
+
   // For cpu_specific, don't create an ifunc yet because we don't know if the
   // cpu_dispatch will be emitted in this translation unit.
   if (ShouldReturnIFunc) {
@@ -4652,6 +4659,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   "", Resolver, &getModule());
 GIF->setName(ResolverName);
 SetCommonAttributes(FD, GIF);
+SetResolverAttrs(cast(*Resolver));
 if (ResolverGV)
   replaceDeclarationWith(ResolverGV, GIF);
 return GIF;
@@ -4662,6 +4670,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   assert(isa(Resolver) && !ResolverGV &&
  "Resolver should be created for the first time");
   SetCommonAttributes(FD, cast(Resolver));
+  SetResolverAttrs(cast(*Resolver));
   return Resolver;
 }
 
diff --git a/clang/test/CodeGen/ptrauth-resolver-attributes.c 
b/clang/test/CodeGen/ptrauth-resolver-attributes.c
new file mode 100644
index 0..8bdedd2c549be
--- /dev/null
+++ b/clang/test/CodeGen/ptrauth-resolver-attributes.c
@@ -0,0 +1,25 @@
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+
+// Check that resolver functions generated by clang have the correct 
attributes.
+
+int __attribute__((target_clones("crc", "default"))) ftc(void) { return 0; }
+
+int __attribute__((target_version("crc"))) fmv(void) { return 0; }
+int __attribute__((target_version("default"))) fmv(void) { return 0; }
+
+// CHECK: define{{.*}} i32 @ftc._Mcrc() #0
+// CHECK: define{{.*}} ptr @ftc.resolver() #1
+// CHECK: define{{.*}} i32 @fmv._Mcrc() #0
+// CHECK: define{{.*}} i32 @fmv.default() #2
+// CHECK: define{{.*}} i32 @ftc.default() #2
+// CHECK: define{{.*}} ptr @fmv.resolver() #1
+
+// BTI-SIGNRA: attributes #0 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #1 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #2 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// PAUTHTEST: attributes #0 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #1 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #2 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }

>From 54976a03e10c3f2a58d89aec16923919cc40b5ec Mon Sep 17 00:00:00 2001
From: Anatoly Trosinenko 
Date: Wed, 4 Jun 2025 16:34:47 +0300
Subject: [PATCH 2/3] Use setTargetAttributes function

---
 clang/lib/CodeGen/CodeGenModule.cpp | 14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/clang/lib/CodeGen/CodeGenModule.cpp 
b/clang/lib/CodeGen/CodeGenModule.cpp
index af8d4cc60de57..c30bf42cb569d 100644
--- a/clang/lib/CodeGen/CodeGenModule.cpp
+++ b/clang/lib/CodeGen/CodeGenModule.cpp
@@ -4638,11 +4638,11 @@ llvm::Constant

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-06-04 Thread Anatoly Trosinenko via cfe-commits 


@@ -4652,6 +4659,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   "", Resolver, &getModule());
 GIF->setName(ResolverName);
 SetCommonAttributes(FD, GIF);
+SetResolverAttrs(cast(*Resolver));

atrosinenko wrote:

Reused `setTargetAttributes`, thank you! If I understand it correctly, it 
should be safer not to pass any `Decl` to `setTargetAttributes`, as otherwise 
the implementation might inspect target-specific function attributes and use 
them for the resolver (which can correspond to one or multiple declarations), 
and we want to only set the bare minimum attributes instead.

https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-06-04 Thread Anatoly Trosinenko via cfe-commits 

https://github.com/atrosinenko updated 
https://github.com/llvm/llvm-project/pull/141573

>From c5a7fea9925c9d4aebf948c9e3d7f0af47893fb7 Mon Sep 17 00:00:00 2001
From: Anatoly Trosinenko 
Date: Mon, 26 May 2025 22:28:55 +0300
Subject: [PATCH 1/2] [AArch64][FMV] Enable PAuth and BTI hardening of resolver
 functions

---
 clang/lib/CodeGen/CodeGenModule.cpp   |  9 +++
 .../CodeGen/ptrauth-resolver-attributes.c | 25 +++
 2 files changed, 34 insertions(+)
 create mode 100644 clang/test/CodeGen/ptrauth-resolver-attributes.c

diff --git a/clang/lib/CodeGen/CodeGenModule.cpp 
b/clang/lib/CodeGen/CodeGenModule.cpp
index 16e010adbeb5f..af8d4cc60de57 100644
--- a/clang/lib/CodeGen/CodeGenModule.cpp
+++ b/clang/lib/CodeGen/CodeGenModule.cpp
@@ -4638,6 +4638,13 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   if (FD->isTargetMultiVersion() || FD->isTargetClonesMultiVersion())
 AddDeferredMultiVersionResolverToEmit(GD);
 
+  auto SetResolverAttrs = [&](llvm::Function &Resolver) {
+TargetInfo::BranchProtectionInfo BPI(getLangOpts());
+TargetCodeGenInfo::setBranchProtectionFnAttributes(BPI, Resolver);
+TargetCodeGenInfo::setPointerAuthFnAttributes(CodeGenOpts.PointerAuth,
+  Resolver);
+  };
+
   // For cpu_specific, don't create an ifunc yet because we don't know if the
   // cpu_dispatch will be emitted in this translation unit.
   if (ShouldReturnIFunc) {
@@ -4652,6 +4659,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   "", Resolver, &getModule());
 GIF->setName(ResolverName);
 SetCommonAttributes(FD, GIF);
+SetResolverAttrs(cast(*Resolver));
 if (ResolverGV)
   replaceDeclarationWith(ResolverGV, GIF);
 return GIF;
@@ -4662,6 +4670,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   assert(isa(Resolver) && !ResolverGV &&
  "Resolver should be created for the first time");
   SetCommonAttributes(FD, cast(Resolver));
+  SetResolverAttrs(cast(*Resolver));
   return Resolver;
 }
 
diff --git a/clang/test/CodeGen/ptrauth-resolver-attributes.c 
b/clang/test/CodeGen/ptrauth-resolver-attributes.c
new file mode 100644
index 0..8bdedd2c549be
--- /dev/null
+++ b/clang/test/CodeGen/ptrauth-resolver-attributes.c
@@ -0,0 +1,25 @@
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+
+// Check that resolver functions generated by clang have the correct 
attributes.
+
+int __attribute__((target_clones("crc", "default"))) ftc(void) { return 0; }
+
+int __attribute__((target_version("crc"))) fmv(void) { return 0; }
+int __attribute__((target_version("default"))) fmv(void) { return 0; }
+
+// CHECK: define{{.*}} i32 @ftc._Mcrc() #0
+// CHECK: define{{.*}} ptr @ftc.resolver() #1
+// CHECK: define{{.*}} i32 @fmv._Mcrc() #0
+// CHECK: define{{.*}} i32 @fmv.default() #2
+// CHECK: define{{.*}} i32 @ftc.default() #2
+// CHECK: define{{.*}} ptr @fmv.resolver() #1
+
+// BTI-SIGNRA: attributes #0 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #1 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #2 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// PAUTHTEST: attributes #0 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #1 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #2 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }

>From 54976a03e10c3f2a58d89aec16923919cc40b5ec Mon Sep 17 00:00:00 2001
From: Anatoly Trosinenko 
Date: Wed, 4 Jun 2025 16:34:47 +0300
Subject: [PATCH 2/2] Use setTargetAttributes function

---
 clang/lib/CodeGen/CodeGenModule.cpp | 14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/clang/lib/CodeGen/CodeGenModule.cpp 
b/clang/lib/CodeGen/CodeGenModule.cpp
index af8d4cc60de57..c30bf42cb569d 100644
--- a/clang/lib/CodeGen/CodeGenModule.cpp
+++ b/clang/lib/CodeGen/CodeGenModule.cpp
@@ -4638,11 +4638,11 @@ llvm::Constant

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-06-03 Thread Alexandros Lamprineas via cfe-commits 

labrinea wrote:

Seems somewhat related to https://github.com/llvm/llvm-project/pull/84704. 
@jroelofs mind taking a look?

https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-05-27 Thread via cfe-commits 

llvmbot wrote:




@llvm/pr-subscribers-clang

Author: Anatoly Trosinenko (atrosinenko)


Changes



---
Full diff: https://github.com/llvm/llvm-project/pull/141573.diff


2 Files Affected:

- (modified) clang/lib/CodeGen/CodeGenModule.cpp (+9) 
- (added) clang/test/CodeGen/ptrauth-resolver-attributes.c (+25) 


``diff
diff --git a/clang/lib/CodeGen/CodeGenModule.cpp 
b/clang/lib/CodeGen/CodeGenModule.cpp
index 16e010adbeb5f..af8d4cc60de57 100644
--- a/clang/lib/CodeGen/CodeGenModule.cpp
+++ b/clang/lib/CodeGen/CodeGenModule.cpp
@@ -4638,6 +4638,13 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   if (FD->isTargetMultiVersion() || FD->isTargetClonesMultiVersion())
 AddDeferredMultiVersionResolverToEmit(GD);
 
+  auto SetResolverAttrs = [&](llvm::Function &Resolver) {
+TargetInfo::BranchProtectionInfo BPI(getLangOpts());
+TargetCodeGenInfo::setBranchProtectionFnAttributes(BPI, Resolver);
+TargetCodeGenInfo::setPointerAuthFnAttributes(CodeGenOpts.PointerAuth,
+  Resolver);
+  };
+
   // For cpu_specific, don't create an ifunc yet because we don't know if the
   // cpu_dispatch will be emitted in this translation unit.
   if (ShouldReturnIFunc) {
@@ -4652,6 +4659,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   "", Resolver, &getModule());
 GIF->setName(ResolverName);
 SetCommonAttributes(FD, GIF);
+SetResolverAttrs(cast(*Resolver));
 if (ResolverGV)
   replaceDeclarationWith(ResolverGV, GIF);
 return GIF;
@@ -4662,6 +4670,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   assert(isa(Resolver) && !ResolverGV &&
  "Resolver should be created for the first time");
   SetCommonAttributes(FD, cast(Resolver));
+  SetResolverAttrs(cast(*Resolver));
   return Resolver;
 }
 
diff --git a/clang/test/CodeGen/ptrauth-resolver-attributes.c 
b/clang/test/CodeGen/ptrauth-resolver-attributes.c
new file mode 100644
index 0..8bdedd2c549be
--- /dev/null
+++ b/clang/test/CodeGen/ptrauth-resolver-attributes.c
@@ -0,0 +1,25 @@
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+
+// Check that resolver functions generated by clang have the correct 
attributes.
+
+int __attribute__((target_clones("crc", "default"))) ftc(void) { return 0; }
+
+int __attribute__((target_version("crc"))) fmv(void) { return 0; }
+int __attribute__((target_version("default"))) fmv(void) { return 0; }
+
+// CHECK: define{{.*}} i32 @ftc._Mcrc() #0
+// CHECK: define{{.*}} ptr @ftc.resolver() #1
+// CHECK: define{{.*}} i32 @fmv._Mcrc() #0
+// CHECK: define{{.*}} i32 @fmv.default() #2
+// CHECK: define{{.*}} i32 @ftc.default() #2
+// CHECK: define{{.*}} ptr @fmv.resolver() #1
+
+// BTI-SIGNRA: attributes #0 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #1 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #2 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// PAUTHTEST: attributes #0 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #1 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #2 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }

``




https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-05-27 Thread Anatoly Trosinenko via cfe-commits 

https://github.com/atrosinenko ready_for_review 
https://github.com/llvm/llvm-project/pull/141573
___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-05-27 Thread Anatoly Trosinenko via cfe-commits 

https://github.com/atrosinenko updated 
https://github.com/llvm/llvm-project/pull/141573

>From c5a7fea9925c9d4aebf948c9e3d7f0af47893fb7 Mon Sep 17 00:00:00 2001
From: Anatoly Trosinenko 
Date: Mon, 26 May 2025 22:28:55 +0300
Subject: [PATCH] [AArch64][FMV] Enable PAuth and BTI hardening of resolver
 functions

---
 clang/lib/CodeGen/CodeGenModule.cpp   |  9 +++
 .../CodeGen/ptrauth-resolver-attributes.c | 25 +++
 2 files changed, 34 insertions(+)
 create mode 100644 clang/test/CodeGen/ptrauth-resolver-attributes.c

diff --git a/clang/lib/CodeGen/CodeGenModule.cpp 
b/clang/lib/CodeGen/CodeGenModule.cpp
index 16e010adbeb5f..af8d4cc60de57 100644
--- a/clang/lib/CodeGen/CodeGenModule.cpp
+++ b/clang/lib/CodeGen/CodeGenModule.cpp
@@ -4638,6 +4638,13 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   if (FD->isTargetMultiVersion() || FD->isTargetClonesMultiVersion())
 AddDeferredMultiVersionResolverToEmit(GD);
 
+  auto SetResolverAttrs = [&](llvm::Function &Resolver) {
+TargetInfo::BranchProtectionInfo BPI(getLangOpts());
+TargetCodeGenInfo::setBranchProtectionFnAttributes(BPI, Resolver);
+TargetCodeGenInfo::setPointerAuthFnAttributes(CodeGenOpts.PointerAuth,
+  Resolver);
+  };
+
   // For cpu_specific, don't create an ifunc yet because we don't know if the
   // cpu_dispatch will be emitted in this translation unit.
   if (ShouldReturnIFunc) {
@@ -4652,6 +4659,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   "", Resolver, &getModule());
 GIF->setName(ResolverName);
 SetCommonAttributes(FD, GIF);
+SetResolverAttrs(cast(*Resolver));
 if (ResolverGV)
   replaceDeclarationWith(ResolverGV, GIF);
 return GIF;
@@ -4662,6 +4670,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   assert(isa(Resolver) && !ResolverGV &&
  "Resolver should be created for the first time");
   SetCommonAttributes(FD, cast(Resolver));
+  SetResolverAttrs(cast(*Resolver));
   return Resolver;
 }
 
diff --git a/clang/test/CodeGen/ptrauth-resolver-attributes.c 
b/clang/test/CodeGen/ptrauth-resolver-attributes.c
new file mode 100644
index 0..8bdedd2c549be
--- /dev/null
+++ b/clang/test/CodeGen/ptrauth-resolver-attributes.c
@@ -0,0 +1,25 @@
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+
+// Check that resolver functions generated by clang have the correct 
attributes.
+
+int __attribute__((target_clones("crc", "default"))) ftc(void) { return 0; }
+
+int __attribute__((target_version("crc"))) fmv(void) { return 0; }
+int __attribute__((target_version("default"))) fmv(void) { return 0; }
+
+// CHECK: define{{.*}} i32 @ftc._Mcrc() #0
+// CHECK: define{{.*}} ptr @ftc.resolver() #1
+// CHECK: define{{.*}} i32 @fmv._Mcrc() #0
+// CHECK: define{{.*}} i32 @fmv.default() #2
+// CHECK: define{{.*}} i32 @ftc.default() #2
+// CHECK: define{{.*}} ptr @fmv.resolver() #1
+
+// BTI-SIGNRA: attributes #0 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #1 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #2 = { {{.*}}"branch-target-enforcement" 
{{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// PAUTHTEST: attributes #0 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #1 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #2 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }

___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits

[clang] [AArch64][FMV] Enable PAuth and BTI hardening of resolver functions (PR #141573)

2025-05-27 Thread Anatoly Trosinenko via cfe-commits 

https://github.com/atrosinenko created 
https://github.com/llvm/llvm-project/pull/141573

None

>From 93eca6d9b68619766b7897c41dcc318ef54be73d Mon Sep 17 00:00:00 2001
From: Anatoly Trosinenko 
Date: Mon, 26 May 2025 22:28:55 +0300
Subject: [PATCH] [AArch64][FMV] Enable PAuth and BTI hardening of resolver
 functions

---
 clang/lib/CodeGen/CodeGenModule.cpp   |  9 +++
 .../CodeGen/ptrauth-resolver-attributes.c | 25 +++
 2 files changed, 34 insertions(+)
 create mode 100644 clang/test/CodeGen/ptrauth-resolver-attributes.c

diff --git a/clang/lib/CodeGen/CodeGenModule.cpp 
b/clang/lib/CodeGen/CodeGenModule.cpp
index 16e010adbeb5f..af8d4cc60de57 100644
--- a/clang/lib/CodeGen/CodeGenModule.cpp
+++ b/clang/lib/CodeGen/CodeGenModule.cpp
@@ -4638,6 +4638,13 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   if (FD->isTargetMultiVersion() || FD->isTargetClonesMultiVersion())
 AddDeferredMultiVersionResolverToEmit(GD);
 
+  auto SetResolverAttrs = [&](llvm::Function &Resolver) {
+TargetInfo::BranchProtectionInfo BPI(getLangOpts());
+TargetCodeGenInfo::setBranchProtectionFnAttributes(BPI, Resolver);
+TargetCodeGenInfo::setPointerAuthFnAttributes(CodeGenOpts.PointerAuth,
+  Resolver);
+  };
+
   // For cpu_specific, don't create an ifunc yet because we don't know if the
   // cpu_dispatch will be emitted in this translation unit.
   if (ShouldReturnIFunc) {
@@ -4652,6 +4659,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   "", Resolver, &getModule());
 GIF->setName(ResolverName);
 SetCommonAttributes(FD, GIF);
+SetResolverAttrs(cast(*Resolver));
 if (ResolverGV)
   replaceDeclarationWith(ResolverGV, GIF);
 return GIF;
@@ -4662,6 +4670,7 @@ llvm::Constant 
*CodeGenModule::GetOrCreateMultiVersionResolver(GlobalDecl GD) {
   assert(isa(Resolver) && !ResolverGV &&
  "Resolver should be created for the first time");
   SetCommonAttributes(FD, cast(Resolver));
+  SetResolverAttrs(cast(*Resolver));
   return Resolver;
 }
 
diff --git a/clang/test/CodeGen/ptrauth-resolver-attributes.c 
b/clang/test/CodeGen/ptrauth-resolver-attributes.c
new file mode 100644
index 0..af6a97fa52781
--- /dev/null
+++ b/clang/test/CodeGen/ptrauth-resolver-attributes.c
@@ -0,0 +1,25 @@
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -mbranch-target-enforce 
-msign-return-address=all  -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,BTI-SIGNRA %s
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+// RUN: %clang_cc1 -triple arm64-apple-ios   -fptrauth-calls -fptrauth-returns 
-fptrauth-auth-traps -emit-llvm %s -o - | FileCheck 
--check-prefixes=CHECK,PAUTHTEST %s
+
+// Check that resolver functions generated by clang have the correct 
attributes.
+
+int __attribute__((target_clones("crc", "default"))) ftc(void) { return 0; }
+
+int __attribute__((target_version("crc"))) fmv(void) { return 0; }
+int __attribute__((target_version("default"))) fmv(void) { return 0; }
+
+// CHECK: define{{.*}} i32 @ftc._Mcrc() #0
+// CHECK: define{{.*}} ptr @ftc.resolver() #1
+// CHECK: define{{.*}} i32 @fmv._Mcrc() #0
+// CHECK: define{{.*}} i32 @fmv.default() #2
+// CHECK: define{{.*}} i32 @ftc.default() #2
+// CHECK: define{{.*}} ptr @fmv.resolver() #1
+
+// BTI-SIGNRA: attributes #0 = { {{.*}}"branch-target-enforcement" 
{{.*}}""sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #1 = { {{.*}}"branch-target-enforcement" 
{{.*}}""sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// BTI-SIGNRA: attributes #2 = { {{.*}}"branch-target-enforcement" 
{{.*}}""sign-return-address"="all" "sign-return-address-key"="a_key"{{.*}} }
+// PAUTHTEST: attributes #0 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #1 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }
+// PAUTHTEST: attributes #2 = { {{.*}}"ptrauth-auth-traps" "ptrauth-calls" 
"ptrauth-returns"{{.*}} }

___
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits