Blame SOURCES/gcc8-rh1512529-aarch64.patch

f56e54
--- gcc/config/aarch64/aarch64.c
f56e54
+++ gcc/config/aarch64/aarch64.c
f56e54
@@ -3799,7 +3799,14 @@ aarch64_output_probe_stack_range (rtx reg1, rtx reg2)
f56e54
   output_asm_insn ("sub\t%0, %0, %1", xops);
f56e54
 
f56e54
   /* Probe at TEST_ADDR.  */
f56e54
-  output_asm_insn ("str\txzr, [%0]", xops);
f56e54
+  if (flag_stack_clash_protection)
f56e54
+    {
f56e54
+      gcc_assert (xops[0] == stack_pointer_rtx);
f56e54
+      xops[1] = GEN_INT (PROBE_INTERVAL - 8);
f56e54
+      output_asm_insn ("str\txzr, [%0, %1]", xops);
f56e54
+    }
f56e54
+  else
f56e54
+    output_asm_insn ("str\txzr, [%0]", xops);
f56e54
 
f56e54
   /* Test if TEST_ADDR == LAST_ADDR.  */
f56e54
   xops[1] = reg2;
f56e54
@@ -4589,6 +4596,133 @@ aarch64_set_handled_components (sbitmap components)
f56e54
       cfun->machine->reg_is_wrapped_separately[regno] = true;
f56e54
 }
f56e54
 
f56e54
+/* Allocate POLY_SIZE bytes of stack space using TEMP1 and TEMP2 as scratch
f56e54
+   registers.  */
f56e54
+
f56e54
+static void
f56e54
+aarch64_allocate_and_probe_stack_space (rtx temp1, rtx temp2,
f56e54
+					poly_int64 poly_size)
f56e54
+{
f56e54
+  HOST_WIDE_INT size;
f56e54
+  if (!poly_size.is_constant (&size))
f56e54
+    {
f56e54
+      sorry ("stack probes for SVE frames");
f56e54
+      return;
f56e54
+    }
f56e54
+
f56e54
+  HOST_WIDE_INT probe_interval
f56e54
+    = 1 << PARAM_VALUE (PARAM_STACK_CLASH_PROTECTION_PROBE_INTERVAL);
f56e54
+  HOST_WIDE_INT guard_size
f56e54
+    = 1 << PARAM_VALUE (PARAM_STACK_CLASH_PROTECTION_GUARD_SIZE);
f56e54
+  HOST_WIDE_INT guard_used_by_caller = 1024;
f56e54
+
f56e54
+  /* SIZE should be large enough to require probing here.  ie, it
f56e54
+     must be larger than GUARD_SIZE - GUARD_USED_BY_CALLER.
f56e54
+
f56e54
+     We can allocate GUARD_SIZE - GUARD_USED_BY_CALLER as a single chunk
f56e54
+     without any probing.  */
f56e54
+  gcc_assert (size >= guard_size - guard_used_by_caller);
f56e54
+  aarch64_sub_sp (temp1, temp2, guard_size - guard_used_by_caller, true);
f56e54
+  HOST_WIDE_INT orig_size = size;
f56e54
+  size -= (guard_size - guard_used_by_caller);
f56e54
+
f56e54
+  HOST_WIDE_INT rounded_size = size & -probe_interval;
f56e54
+  HOST_WIDE_INT residual = size - rounded_size;
f56e54
+
f56e54
+  /* We can handle a small number of allocations/probes inline.  Otherwise
f56e54
+     punt to a loop.  */
f56e54
+  if (rounded_size && rounded_size <= 4 * probe_interval)
f56e54
+    {
f56e54
+      /* We don't use aarch64_sub_sp here because we don't want to
f56e54
+	 repeatedly load TEMP1.  */
f56e54
+      rtx step = GEN_INT (-probe_interval);
f56e54
+      if (probe_interval > ARITH_FACTOR)
f56e54
+	{
f56e54
+	  emit_move_insn (temp1, step);
f56e54
+	  step = temp1;
f56e54
+	}
f56e54
+
f56e54
+      for (HOST_WIDE_INT i = 0; i < rounded_size; i += probe_interval)
f56e54
+	{
f56e54
+	  rtx_insn *insn = emit_insn (gen_add2_insn (stack_pointer_rtx, step));
f56e54
+          add_reg_note (insn, REG_STACK_CHECK, const0_rtx);
f56e54
+
f56e54
+	  if (probe_interval > ARITH_FACTOR)
f56e54
+	    {
f56e54
+	      RTX_FRAME_RELATED_P (insn) = 1;
f56e54
+	      rtx adj = plus_constant (Pmode, stack_pointer_rtx, -probe_interval);
f56e54
+	      add_reg_note (insn, REG_CFA_ADJUST_CFA,
f56e54
+			    gen_rtx_SET (stack_pointer_rtx, adj));
f56e54
+	    }
f56e54
+
f56e54
+	  emit_stack_probe (plus_constant (Pmode, stack_pointer_rtx,
f56e54
+					   (probe_interval
f56e54
+					    - GET_MODE_SIZE (word_mode))));
f56e54
+	  emit_insn (gen_blockage ());
f56e54
+	}
f56e54
+      dump_stack_clash_frame_info (PROBE_INLINE, size != rounded_size);
f56e54
+    }
f56e54
+  else if (rounded_size)
f56e54
+    {
f56e54
+      /* Compute the ending address.  */
f56e54
+      unsigned int scratchreg = REGNO (temp1);
f56e54
+      emit_move_insn (temp1, GEN_INT (-rounded_size));
f56e54
+      rtx_insn *insn
f56e54
+	 = emit_insn (gen_add3_insn (temp1, stack_pointer_rtx, temp1));
f56e54
+
f56e54
+      /* For the initial allocation, we don't have a frame pointer
f56e54
+	 set up, so we always need CFI notes.  If we're doing the
f56e54
+	 final allocation, then we may have a frame pointer, in which
f56e54
+	 case it is the CFA, otherwise we need CFI notes.
f56e54
+
f56e54
+	 We can determine which allocation we are doing by looking at
f56e54
+	 the temporary register.  IP0 is the initial allocation, IP1
f56e54
+	 is the final allocation.  */
f56e54
+      if (scratchreg == IP0_REGNUM || !frame_pointer_needed)
f56e54
+	{
f56e54
+	  /* We want the CFA independent of the stack pointer for the
f56e54
+	     duration of the loop.  */
f56e54
+	  add_reg_note (insn, REG_CFA_DEF_CFA,
f56e54
+			plus_constant (Pmode, temp1,
f56e54
+				       (rounded_size + (orig_size - size))));
f56e54
+	  RTX_FRAME_RELATED_P (insn) = 1;
f56e54
+	}
f56e54
+
f56e54
+      /* This allocates and probes the stack.
f56e54
+
f56e54
+	 It also probes at a 4k interval regardless of the value of
f56e54
+	 PARAM_STACK_CLASH_PROTECTION_PROBE_INTERVAL.  */
f56e54
+      insn = emit_insn (gen_probe_stack_range (stack_pointer_rtx,
f56e54
+					       stack_pointer_rtx, temp1));
f56e54
+
f56e54
+      /* Now reset the CFA register if needed.  */
f56e54
+      if (scratchreg == IP0_REGNUM || !frame_pointer_needed)
f56e54
+	{
f56e54
+	  add_reg_note (insn, REG_CFA_DEF_CFA,
f56e54
+			plus_constant (Pmode, stack_pointer_rtx,
f56e54
+				       (rounded_size + (orig_size - size))));
f56e54
+	  RTX_FRAME_RELATED_P (insn) = 1;
f56e54
+	}
f56e54
+
f56e54
+      emit_insn (gen_blockage ());
f56e54
+      dump_stack_clash_frame_info (PROBE_LOOP, size != rounded_size);
f56e54
+    }
f56e54
+  else
f56e54
+    dump_stack_clash_frame_info (PROBE_INLINE, size != rounded_size);
f56e54
+
f56e54
+  /* Handle any residuals.
f56e54
+     Note that any residual must be probed.  */
f56e54
+  if (residual)
f56e54
+    {
f56e54
+      aarch64_sub_sp (temp1, temp2, residual, true);
f56e54
+      add_reg_note (get_last_insn (), REG_STACK_CHECK, const0_rtx);
f56e54
+      emit_stack_probe (plus_constant (Pmode, stack_pointer_rtx,
f56e54
+				       (residual - GET_MODE_SIZE (word_mode))));
f56e54
+      emit_insn (gen_blockage ());
f56e54
+    }
f56e54
+  return;
f56e54
+}
f56e54
+
f56e54
 /* Add a REG_CFA_EXPRESSION note to INSN to say that register REG
f56e54
    is saved at BASE + OFFSET.  */
f56e54
 
f56e54
@@ -4686,7 +4820,54 @@ aarch64_expand_prologue (void)
f56e54
   rtx ip0_rtx = gen_rtx_REG (Pmode, IP0_REGNUM);
f56e54
   rtx ip1_rtx = gen_rtx_REG (Pmode, IP1_REGNUM);
f56e54
 
f56e54
-  aarch64_sub_sp (ip0_rtx, ip1_rtx, initial_adjust, true);
f56e54
+  /* We do not fully protect aarch64 against stack clash style attacks
f56e54
+     as doing so would be prohibitively expensive with less utility over
f56e54
+     time as newer compilers are deployed.
f56e54
+
f56e54
+     We assume the guard is at least 64k.  Furthermore, we assume that
f56e54
+     the caller has not pushed the stack pointer more than 1k into
f56e54
+     the guard.  A caller that pushes the stack pointer than 1k into
f56e54
+     the guard is considered invalid.
f56e54
+
f56e54
+     Note that the caller's ability to push the stack pointer into the
f56e54
+     guard is a function of the number and size of outgoing arguments and/or
f56e54
+     dynamic stack allocations due to the mandatory save of the link register
f56e54
+     in the caller's frame.
f56e54
+
f56e54
+     With those assumptions the callee can allocate up to 63k of stack
f56e54
+     space without probing.
f56e54
+
f56e54
+     When probing is needed, we emit a probe at the start of the prologue
f56e54
+     and every PARAM_STACK_CLASH_PROTECTION_PROBE_INTERVAL bytes thereafter.
f56e54
+
f56e54
+     We have to track how much space has been allocated, but we do not
f56e54
+     track stores into the stack as implicit probes except for the
f56e54
+     fp/lr store.  */
f56e54
+  HOST_WIDE_INT guard_size
f56e54
+    = 1 << PARAM_VALUE (PARAM_STACK_CLASH_PROTECTION_GUARD_SIZE);
f56e54
+  HOST_WIDE_INT guard_used_by_caller = 1024;
f56e54
+  if (flag_stack_clash_protection)
f56e54
+    {
f56e54
+      if (known_eq (frame_size, 0))
f56e54
+	dump_stack_clash_frame_info (NO_PROBE_NO_FRAME, false);
f56e54
+      else if (known_lt (initial_adjust, guard_size - guard_used_by_caller)
f56e54
+	       && known_lt (final_adjust, guard_size - guard_used_by_caller))
f56e54
+	dump_stack_clash_frame_info (NO_PROBE_SMALL_FRAME, true);
f56e54
+    }
f56e54
+
f56e54
+  /* In theory we should never have both an initial adjustment
f56e54
+     and a callee save adjustment.  Verify that is the case since the
f56e54
+     code below does not handle it for -fstack-clash-protection.  */
f56e54
+  gcc_assert (known_eq (initial_adjust, 0) || callee_adjust == 0);
f56e54
+
f56e54
+  /* Only probe if the initial adjustment is larger than the guard
f56e54
+     less the amount of the guard reserved for use by the caller's
f56e54
+     outgoing args.  */
f56e54
+  if (flag_stack_clash_protection
f56e54
+      && maybe_ge (initial_adjust, guard_size - guard_used_by_caller))
f56e54
+    aarch64_allocate_and_probe_stack_space (ip0_rtx, ip1_rtx, initial_adjust);
f56e54
+  else
f56e54
+    aarch64_sub_sp (ip0_rtx, ip1_rtx, initial_adjust, true);
f56e54
 
f56e54
   if (callee_adjust != 0)
f56e54
     aarch64_push_regs (reg1, reg2, callee_adjust);
f56e54
@@ -4742,7 +4923,31 @@ aarch64_expand_prologue (void)
f56e54
 			     callee_adjust != 0 || emit_frame_chain);
f56e54
   aarch64_save_callee_saves (DFmode, callee_offset, V0_REGNUM, V31_REGNUM,
f56e54
 			     callee_adjust != 0 || emit_frame_chain);
f56e54
-  aarch64_sub_sp (ip1_rtx, ip0_rtx, final_adjust, !frame_pointer_needed);
f56e54
+
f56e54
+  /* We may need to probe the final adjustment as well.  */
f56e54
+  if (flag_stack_clash_protection && maybe_ne (final_adjust, 0))
f56e54
+    {
f56e54
+      /* First probe if the final adjustment is larger than the guard size
f56e54
+	 less the amount of the guard reserved for use by the caller's
f56e54
+	 outgoing args.  */
f56e54
+      if (maybe_ge (final_adjust, guard_size - guard_used_by_caller))
f56e54
+	aarch64_allocate_and_probe_stack_space (ip1_rtx, ip0_rtx,
f56e54
+						final_adjust);
f56e54
+      else
f56e54
+	aarch64_sub_sp (ip1_rtx, ip0_rtx, final_adjust, !frame_pointer_needed);
f56e54
+
f56e54
+      /* We must also probe if the final adjustment is larger than the guard
f56e54
+	 that is assumed used by the caller.  This may be sub-optimal.  */
f56e54
+      if (maybe_ge (final_adjust, guard_used_by_caller))
f56e54
+	{
f56e54
+	  if (dump_file)
f56e54
+	    fprintf (dump_file,
f56e54
+		     "Stack clash aarch64 large outgoing arg, probing\n");
f56e54
+	  emit_stack_probe (stack_pointer_rtx);
f56e54
+	}
f56e54
+    }
f56e54
+  else
f56e54
+    aarch64_sub_sp (ip1_rtx, ip0_rtx, final_adjust, !frame_pointer_needed);
f56e54
 }
f56e54
 
f56e54
 /* Return TRUE if we can use a simple_return insn.
f56e54
@@ -10476,6 +10681,12 @@ aarch64_override_options_internal (struct gcc_options *opts)
f56e54
       && opts->x_optimize >= aarch64_tune_params.prefetch->default_opt_level)
f56e54
     opts->x_flag_prefetch_loop_arrays = 1;
f56e54
 
f56e54
+  /* We assume the guard page is 64k.  */
f56e54
+  maybe_set_param_value (PARAM_STACK_CLASH_PROTECTION_GUARD_SIZE,
f56e54
+			 16,
f56e54
+			 opts->x_param_values,
f56e54
+			 global_options_set.x_param_values);
f56e54
+
f56e54
   aarch64_override_options_after_change_1 (opts);
f56e54
 }
f56e54
 
f56e54
@@ -17161,6 +17372,28 @@ aarch64_sched_can_speculate_insn (rtx_insn *insn)
f56e54
     }
f56e54
 }
f56e54
 
f56e54
+/* It has been decided that to allow up to 1kb of outgoing argument
f56e54
+   space to be allocated w/o probing.  If more than 1kb of outgoing
f56e54
+   argment space is allocated, then it must be probed and the last
f56e54
+   probe must occur no more than 1kbyte away from the end of the
f56e54
+   allocated space.
f56e54
+
f56e54
+   This implies that the residual part of an alloca allocation may
f56e54
+   need probing in cases where the generic code might not otherwise
f56e54
+   think a probe is needed.
f56e54
+
f56e54
+   This target hook returns TRUE when allocating RESIDUAL bytes of
f56e54
+   alloca space requires an additional probe, otherwise FALSE is
f56e54
+   returned.  */
f56e54
+
f56e54
+static bool
f56e54
+aarch64_stack_clash_protection_final_dynamic_probe (rtx residual)
f56e54
+{
f56e54
+  return (residual == CONST0_RTX (Pmode)
f56e54
+	  || GET_CODE (residual) != CONST_INT
f56e54
+	  || INTVAL (residual) >= 1024);
f56e54
+}
f56e54
+
f56e54
 /* Implement TARGET_COMPUTE_PRESSURE_CLASSES.  */
f56e54
 
f56e54
 static int
f56e54
@@ -17669,6 +17902,10 @@ aarch64_libgcc_floating_mode_supported_p
f56e54
 #undef TARGET_CONSTANT_ALIGNMENT
f56e54
 #define TARGET_CONSTANT_ALIGNMENT aarch64_constant_alignment
f56e54
 
f56e54
+#undef TARGET_STACK_CLASH_PROTECTION_FINAL_DYNAMIC_PROBE
f56e54
+#define TARGET_STACK_CLASH_PROTECTION_FINAL_DYNAMIC_PROBE \
f56e54
+  aarch64_stack_clash_protection_final_dynamic_probe
f56e54
+
f56e54
 #undef TARGET_COMPUTE_PRESSURE_CLASSES
f56e54
 #define TARGET_COMPUTE_PRESSURE_CLASSES aarch64_compute_pressure_classes
f56e54
 
f56e54
--- gcc/config/aarch64/aarch64.md
f56e54
+++ gcc/config/aarch64/aarch64.md
f56e54
@@ -5812,7 +5812,7 @@
f56e54
 )
f56e54
 
f56e54
 (define_insn "probe_stack_range"
f56e54
-  [(set (match_operand:DI 0 "register_operand" "=r")
f56e54
+  [(set (match_operand:DI 0 "register_operand" "=rk")
f56e54
 	(unspec_volatile:DI [(match_operand:DI 1 "register_operand" "0")
f56e54
 			     (match_operand:DI 2 "register_operand" "r")]
f56e54
 			      UNSPECV_PROBE_STACK_RANGE))]
f56e54
--- gcc/testsuite/gcc.target/aarch64/stack-check-12.c
f56e54
+++ gcc/testsuite/gcc.target/aarch64/stack-check-12.c
f56e54
@@ -0,0 +1,20 @@
f56e54
+/* { dg-do compile } */
f56e54
+/* { dg-options "-O2 -fstack-clash-protection --param stack-clash-protection-guard-size=12" } */
f56e54
+/* { dg-require-effective-target supports_stack_clash_protection } */
f56e54
+
f56e54
+extern void arf (unsigned long int *, unsigned long int *);
f56e54
+void
f56e54
+frob ()
f56e54
+{
f56e54
+  unsigned long int num[1000];
f56e54
+  unsigned long int den[1000];
f56e54
+  arf (den, num);
f56e54
+}
f56e54
+
f56e54
+/* This verifies that the scheduler did not break the dependencies
f56e54
+   by adjusting the offsets within the probe and that the scheduler
f56e54
+   did not reorder around the stack probes.  */
f56e54
+/* { dg-final { scan-assembler-times "sub\\tsp, sp, #4096\\n\\tstr\\txzr, .sp, 4088." 3 } } */
f56e54
+
f56e54
+
f56e54
+
f56e54
--- gcc/testsuite/gcc.target/aarch64/stack-check-13.c
f56e54
+++ gcc/testsuite/gcc.target/aarch64/stack-check-13.c
f56e54
@@ -0,0 +1,28 @@
f56e54
+/* { dg-do compile } */
f56e54
+/* { dg-options "-O2 -fstack-clash-protection --param stack-clash-protection-guard-size=12" } */
f56e54
+/* { dg-require-effective-target supports_stack_clash_protection } */
f56e54
+
f56e54
+#define ARG32(X) X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X,X
f56e54
+#define ARG192(X) ARG32(X),ARG32(X),ARG32(X),ARG32(X),ARG32(X),ARG32(X)
f56e54
+void out1(ARG192(__int128));
f56e54
+int t1(int);
f56e54
+
f56e54
+int t3(int x)
f56e54
+{
f56e54
+  if (x < 1000)
f56e54
+    return t1 (x) + 1;
f56e54
+
f56e54
+  out1 (ARG192(1));
f56e54
+  return 0;
f56e54
+}
f56e54
+
f56e54
+
f56e54
+
f56e54
+/* This test creates a large (> 1k) outgoing argument area that needs
f56e54
+   to be probed.  We don't test the exact size of the space or the
f56e54
+   exact offset to make the test a little less sensitive to trivial
f56e54
+   output changes.  */
f56e54
+/* { dg-final { scan-assembler-times "sub\\tsp, sp, #....\\n\\tstr\\txzr, \\\[sp" 1 } } */
f56e54
+
f56e54
+
f56e54
+
f56e54
--- gcc/testsuite/gcc.target/aarch64/stack-check-14.c
f56e54
+++ gcc/testsuite/gcc.target/aarch64/stack-check-14.c
f56e54
@@ -0,0 +1,25 @@
f56e54
+/* { dg-do compile } */
f56e54
+/* { dg-options "-O2 -fstack-clash-protection --param stack-clash-protection-guard-size=12" } */
f56e54
+/* { dg-require-effective-target supports_stack_clash_protection } */
f56e54
+
f56e54
+int t1(int);
f56e54
+
f56e54
+int t2(int x)
f56e54
+{
f56e54
+  char *p = __builtin_alloca (4050);
f56e54
+  x = t1 (x);
f56e54
+  return p[x];
f56e54
+}
f56e54
+
f56e54
+
f56e54
+/* This test has a constant sized alloca that is smaller than the
f56e54
+   probe interval.  But it actually requires two probes instead
f56e54
+   of one because of the optimistic assumptions we made in the
f56e54
+   aarch64 prologue code WRT probing state. 
f56e54
+
f56e54
+   The form can change quite a bit so we just check for two
f56e54
+   probes without looking at the actual address.  */
f56e54
+/* { dg-final { scan-assembler-times "str\\txzr," 2 } } */
f56e54
+
f56e54
+
f56e54
+
f56e54
--- gcc/testsuite/gcc.target/aarch64/stack-check-15.c
f56e54
+++ gcc/testsuite/gcc.target/aarch64/stack-check-15.c
f56e54
@@ -0,0 +1,24 @@
f56e54
+/* { dg-do compile } */
f56e54
+/* { dg-options "-O2 -fstack-clash-protection --param stack-clash-protection-guard-size=12" } */
f56e54
+/* { dg-require-effective-target supports_stack_clash_protection } */
f56e54
+
f56e54
+int t1(int);
f56e54
+
f56e54
+int t2(int x)
f56e54
+{
f56e54
+  char *p = __builtin_alloca (x);
f56e54
+  x = t1 (x);
f56e54
+  return p[x];
f56e54
+}
f56e54
+
f56e54
+
f56e54
+/* This test has a variable sized alloca.  It requires 3 probes.
f56e54
+   One in the loop, one for the residual and at the end of the
f56e54
+   alloca area. 
f56e54
+
f56e54
+   The form can change quite a bit so we just check for two
f56e54
+   probes without looking at the actual address.  */
f56e54
+/* { dg-final { scan-assembler-times "str\\txzr," 3 } } */
f56e54
+
f56e54
+
f56e54
+
f56e54
--- gcc/testsuite/lib/target-supports.exp
f56e54
+++ gcc/testsuite/lib/target-supports.exp
f56e54
@@ -9201,14 +9201,9 @@ proc check_effective_target_autoincdec { } {
f56e54
 # 
f56e54
 proc check_effective_target_supports_stack_clash_protection { } {
f56e54
 
f56e54
-   # Temporary until the target bits are fully ACK'd.
f56e54
-#  if { [istarget aarch*-*-*] } {
f56e54
-#	return 1
f56e54
-#  }
f56e54
-
f56e54
     if { [istarget x86_64-*-*] || [istarget i?86-*-*] 
f56e54
 	  || [istarget powerpc*-*-*] || [istarget rs6000*-*-*]
f56e54
-	  || [istarget s390*-*-*] } {
f56e54
+	  || [istarget aarch64*-**] || [istarget s390*-*-*] } {
f56e54
 	return 1
f56e54
     }
f56e54
   return 0
f56e54
@@ -9217,9 +9212,9 @@ proc check_effective_target_supports_stack_clash_protection { } {
f56e54
 # Return 1 if the target creates a frame pointer for non-leaf functions
f56e54
 # Note we ignore cases where we apply tail call optimization here.
f56e54
 proc check_effective_target_frame_pointer_for_non_leaf { } {
f56e54
-  if { [istarget aarch*-*-*] } {
f56e54
-	return 1
f56e54
-  }
f56e54
+#  if { [istarget aarch*-*-*] } {
f56e54
+#	return 1
f56e54
+#  }
f56e54
 
f56e54
   # Solaris/x86 defaults to -fno-omit-frame-pointer.
f56e54
   if { [istarget i?86-*-solaris*] || [istarget x86_64-*-solaris*] } {