diff options
Diffstat (limited to 'src')
8 files changed, 107 insertions, 0 deletions
diff --git a/src/doc/unstable-book/src/compiler-flags/branch-protection.md b/src/doc/unstable-book/src/compiler-flags/branch-protection.md new file mode 100644 index 00000000000..85403748e1d --- /dev/null +++ b/src/doc/unstable-book/src/compiler-flags/branch-protection.md @@ -0,0 +1,18 @@ +# `branch-protection` + +This option lets you enable branch authentication instructions on AArch64. +This option is ignored for non-AArch64 architectures. +It takes some combination of the following values, separated by a `,`. + +- `pac-ret` - Enable pointer authentication for non-leaf functions. +- `leaf` - Enable pointer authentication for all functions, including leaf functions. +- `b-key` - Sign return addresses with key B, instead of the default key A. +- `bti` - Enable branch target identification. + +`leaf` and `b-key` are only valid if `pac-ret` was previously specified. +For example, `-Z branch-protection=bti,pac-ret,leaf` is valid, but +`-Z branch-protection=bti,leaf,pac-ret` is not. + +Rust's standard library does not ship with BTI or pointer authentication enabled by default. +In Cargo projects the standard library can be recompiled with pointer authentication using the nightly +[build-std](https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#build-std) feature. diff --git a/src/test/assembly/aarch64-pointer-auth.rs b/src/test/assembly/aarch64-pointer-auth.rs new file mode 100644 index 00000000000..27e289086b9 --- /dev/null +++ b/src/test/assembly/aarch64-pointer-auth.rs @@ -0,0 +1,22 @@ +// Test that PAC instructions are emitted when branch-protection is specified. + +// min-llvm-version: 10.0.1 +// assembly-output: emit-asm +// compile-flags: --target aarch64-unknown-linux-gnu +// compile-flags: -Z branch-protection=pac-ret,leaf +// needs-llvm-components: aarch64 + +#![feature(no_core, lang_items)] +#![no_std] +#![no_core] +#![crate_type = "lib"] + +#[lang = "sized"] +trait Sized {} + +// CHECK: hint #25 +// CHECK: hint #29 +#[no_mangle] +pub fn test() -> u8 { + 42 +} diff --git a/src/test/codegen/branch-protection.rs b/src/test/codegen/branch-protection.rs new file mode 100644 index 00000000000..106c9b148ee --- /dev/null +++ b/src/test/codegen/branch-protection.rs @@ -0,0 +1,41 @@ +// Test that the correct module flags are emitted with different branch protection flags. + +// revisions: bti pac-ret leaf b-key +// min-llvm-version: 12.0.0 +// needs-llvm-components: aarch64 +// [bti] compile-flags: -Z branch-protection=bti +// [pac-ret] compile-flags: -Z branch-protection=pac-ret +// [leaf] compile-flags: -Z branch-protection=pac-ret,leaf +// [b-key] compile-flags: -Z branch-protection=pac-ret,b-key +// compile-flags: --target aarch64-unknown-linux-gnu + +#![crate_type = "lib"] +#![feature(no_core, lang_items)] +#![no_core] + +#[lang="sized"] +trait Sized { } + +// A basic test function. +pub fn test() { +} + +// bti: !"branch-target-enforcement", i32 1 +// bti: !"sign-return-address", i32 0 +// bti: !"sign-return-address-all", i32 0 +// bti: !"sign-return-address-with-bkey", i32 0 + +// pac-ret: !"branch-target-enforcement", i32 0 +// pac-ret: !"sign-return-address", i32 1 +// pac-ret: !"sign-return-address-all", i32 0 +// pac-ret: !"sign-return-address-with-bkey", i32 0 + +// leaf: !"branch-target-enforcement", i32 0 +// leaf: !"sign-return-address", i32 1 +// leaf: !"sign-return-address-all", i32 1 +// leaf: !"sign-return-address-with-bkey", i32 0 + +// b-key: !"branch-target-enforcement", i32 0 +// b-key: !"sign-return-address", i32 1 +// b-key: !"sign-return-address-all", i32 0 +// b-key: !"sign-return-address-with-bkey", i32 1 diff --git a/src/test/run-make-fulldeps/pointer-auth-link-with-c/Makefile b/src/test/run-make-fulldeps/pointer-auth-link-with-c/Makefile new file mode 100644 index 00000000000..d0e22cfef4c --- /dev/null +++ b/src/test/run-make-fulldeps/pointer-auth-link-with-c/Makefile @@ -0,0 +1,14 @@ +-include ../tools.mk + +# only-aarch64 + +all: + $(COMPILE_OBJ) $(TMPDIR)/test.o test.c + $(AR) rcs $(TMPDIR)/libtest.a $(TMPDIR)/test.o + $(RUSTC) -Z branch-protection=bti,pac-ret,leaf test.rs + $(call RUN,test) + + $(COMPILE_OBJ) $(TMPDIR)/test.o test.c -mbranch-protection=bti+pac-ret+leaf + $(AR) rcs $(TMPDIR)/libtest.a $(TMPDIR)/test.o + $(RUSTC) -Z branch-protection=bti,pac-ret,leaf test.rs + $(call RUN,test) diff --git a/src/test/run-make-fulldeps/pointer-auth-link-with-c/test.c b/src/test/run-make-fulldeps/pointer-auth-link-with-c/test.c new file mode 100644 index 00000000000..9fe07f82f9e --- /dev/null +++ b/src/test/run-make-fulldeps/pointer-auth-link-with-c/test.c @@ -0,0 +1 @@ +int foo() { return 0; } diff --git a/src/test/run-make-fulldeps/pointer-auth-link-with-c/test.rs b/src/test/run-make-fulldeps/pointer-auth-link-with-c/test.rs new file mode 100644 index 00000000000..615ad0aeb3d --- /dev/null +++ b/src/test/run-make-fulldeps/pointer-auth-link-with-c/test.rs @@ -0,0 +1,8 @@ +#[link(name = "test")] +extern "C" { + fn foo() -> i32; +} + +fn main() { + unsafe {foo();} +} diff --git a/src/test/ui/invalid-compile-flags/branch-protection-missing-pac-ret.rs b/src/test/ui/invalid-compile-flags/branch-protection-missing-pac-ret.rs new file mode 100644 index 00000000000..4f39d223a2e --- /dev/null +++ b/src/test/ui/invalid-compile-flags/branch-protection-missing-pac-ret.rs @@ -0,0 +1 @@ +// compile-flags: -Z branch-protection=leaf diff --git a/src/test/ui/invalid-compile-flags/branch-protection-missing-pac-ret.stderr b/src/test/ui/invalid-compile-flags/branch-protection-missing-pac-ret.stderr new file mode 100644 index 00000000000..5528d2a0729 --- /dev/null +++ b/src/test/ui/invalid-compile-flags/branch-protection-missing-pac-ret.stderr @@ -0,0 +1,2 @@ +error: incorrect value `leaf` for debugging option `branch-protection` - a `,` separated combination of `bti`, `b-key`, `pac-ret`, or `leaf` was expected + |