From 6ac83d350604c3e934d5e8a455ba7ec1c1c0240b Mon Sep 17 00:00:00 2001
From: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date: Fri, 24 Apr 2020 17:36:02 +0100
Subject: [PATCH] aarch64: don't emit bti j after NOTE_INSN_DELETED_LABEL
 [PR94748]

It was previously discussed that indirect branches cannot go to
NOTE_INSN_DELETED_LABEL so inserting a landing pad is unnecessary.
See https://gcc.gnu.org/pipermail/gcc-patches/2019-May/522625.html

Before the patch a bti j was inserted after the label in

  __attribute__((target("branch-protection=bti")))
  int foo (void)
  {
  label:
    return 0;
  }

This is not necessary and weakens the security protection.

gcc/ChangeLog:

	PR target/94748
	* config/aarch64/aarch64-bti-insert.c (rest_of_insert_bti): Remove
	the check for NOTE_INSN_DELETED_LABEL.

gcc/testsuite/ChangeLog:

	PR target/94748
	* gcc.target/aarch64/pr94748.c: New test.
---
 gcc/ChangeLog                              |  6 ++++++
 gcc/config/aarch64/aarch64-bti-insert.c    |  8 ++------
 gcc/testsuite/ChangeLog                    |  5 +++++
 gcc/testsuite/gcc.target/aarch64/pr94748.c | 10 ++++++++++
 4 files changed, 23 insertions(+), 6 deletions(-)
 create mode 100644 gcc/testsuite/gcc.target/aarch64/pr94748.c

diff --git a/gcc/ChangeLog b/gcc/ChangeLog
index 5b69334a26b8..c81801f289e9 100644
--- a/gcc/ChangeLog
+++ b/gcc/ChangeLog
@@ -1,3 +1,9 @@
+2020-04-30  Szabolcs Nagy  <szabolcs.nagy@arm.com>
+
+	PR target/94748
+	* config/aarch64/aarch64-bti-insert.c (rest_of_insert_bti): Remove
+	the check for NOTE_INSN_DELETED_LABEL.
+
 2020-04-30  Jakub Jelinek  <jakub@redhat.com>
 
 	* configure.ac (--with-documentation-root-url,
diff --git a/gcc/config/aarch64/aarch64-bti-insert.c b/gcc/config/aarch64/aarch64-bti-insert.c
index aa091c308f61..57663ee23b49 100644
--- a/gcc/config/aarch64/aarch64-bti-insert.c
+++ b/gcc/config/aarch64/aarch64-bti-insert.c
@@ -139,14 +139,10 @@ rest_of_insert_bti (void)
 	   insn = NEXT_INSN (insn))
 	{
 	  /* If a label is marked to be preserved or can be a non-local goto
-	     target, it must be protected with a BTI J.  The same applies to
-	     NOTE_INSN_DELETED_LABEL since they are basically labels that might
-	     be referenced via variables or constant pool.  */
-	  if ((LABEL_P (insn)
+	     target, it must be protected with a BTI J.  */
+	  if (LABEL_P (insn)
 	       && (LABEL_PRESERVE_P (insn)
 		   || bb->flags & BB_NON_LOCAL_GOTO_TARGET))
-	      || (NOTE_P (insn)
-		  && NOTE_KIND (insn) == NOTE_INSN_DELETED_LABEL))
 	    {
 	      bti_insn = gen_bti_j ();
 	      emit_insn_after (bti_insn, insn);
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 9d5944b68866..66ac6705a05d 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2020-04-30  Szabolcs Nagy  <szabolcs.nagy@arm.com>
+
+	PR target/94748
+	* gcc.target/aarch64/pr94748.c: New test.
+
 2020-04-30  Andreas Krebbel  <krebbel@linux.ibm.com>
 
 	* gcc.target/s390/zvector/vec_load_len_r.c: New test.
diff --git a/gcc/testsuite/gcc.target/aarch64/pr94748.c b/gcc/testsuite/gcc.target/aarch64/pr94748.c
new file mode 100644
index 000000000000..2a2850d2fac0
--- /dev/null
+++ b/gcc/testsuite/gcc.target/aarch64/pr94748.c
@@ -0,0 +1,10 @@
+/* { dg-do compile } */
+
+__attribute__ ((target("branch-protection=bti")))
+int foo ()
+{
+label:
+  return 0;
+}
+
+/* { dg-final { scan-assembler-not {hint (36|38) // bti (j|jc)} } } */
-- 
GitLab