From: Mark Kettenis <mark.kettenis@xs4all.nl>
Subject: Re: glxgears BTI SIGILL, arm64
To: Mark Kettenis <mark.kettenis@xs4all.nl>
Cc: jsg@jsg.id.au, tech@openbsd.org
Date: Thu, 21 Mar 2024 00:31:57 +0100

> Date: Sun, 17 Mar 2024 21:09:08 +0100
> From: Mark Kettenis <mark.kettenis@xs4all.nl>
> 
> > Date: Sun, 17 Mar 2024 17:08:14 +1100
> > From: Jonathan Gray <jsg@jsg.id.au>
> > Content-Type: text/plain; charset=us-ascii
> > Content-Disposition: inline
> > 
> > On Sat, Mar 16, 2024 at 12:10:19PM +0000, Stuart Henderson wrote:
> > >  10913 glxgears PSIG  SIGILL SIG_DFL code=ILL_BTCFI addr=0x21ca5a3000 trapno=905969666
> > > 
> > > Anyone have suggestions as to how to track this down any further?
> > 
> > This is on an apple machine?  If so it will be using llvmpipe.
> > To avoid the jit you can use:
> > 
> > LIBGL_ALWAYS_SOFTWARE=1 GALLIUM_DRIVER=softpipe glxgears
> > 
> > Do you still see it with that?
> 
> Diff below seems to fix llvmpipe.  At least I can run glxgears now.
> 
> As far as I can tell there isn't an option that can be passed to the
> core llvm code that turns it on.  What clang does is pass a function
> attribute or module flag that turns it on.  So I made Mesa do the
> same.
> 
> Not sure if this is the correct way to do things, but there is a
> precedent in overriding module parameters.

The proposed diff has been committed.  But we can do a little bit
better by also enabling PAC.  The diff below brings us in line with
the default BTI/PAC options in base clang.

I've lightly tested this myself, but some more testing on an x13s or
an Apple laptop would be appreciated.



Index: lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_init.c
===================================================================
RCS file: /cvs/xenocara/lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_init.c,v
retrieving revision 1.16
diff -u -p -r1.16 lp_bld_init.c
--- lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_init.c	18 Mar 2024 00:15:10 -0000	1.16
+++ lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_init.c	20 Mar 2024 23:23:51 -0000
@@ -361,7 +361,7 @@ init_gallivm_state(struct gallivm_state 
 #endif
 
 #if DETECT_ARCH_AARCH64
-   lp_set_module_branch_target_enforcement(gallivm->module);
+   lp_set_module_branch_protection(gallivm->module);
 #endif
 
    gallivm->builder = LLVMCreateBuilderInContext(gallivm->context);
Index: lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_misc.cpp
===================================================================
RCS file: /cvs/xenocara/lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_misc.cpp,v
retrieving revision 1.18
diff -u -p -r1.18 lp_bld_misc.cpp
--- lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_misc.cpp	18 Mar 2024 00:15:10 -0000	1.18
+++ lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_misc.cpp	20 Mar 2024 23:23:51 -0000
@@ -621,8 +621,10 @@ lp_set_module_stack_alignment_override(L
 }
 
 extern "C" void
-lp_set_module_branch_target_enforcement(LLVMModuleRef MRef)
+lp_set_module_branch_protection(LLVMModuleRef MRef)
 {
+   /* Enable standard (bti+pac-ret) branch protection */
    llvm::Module *M = llvm::unwrap(MRef);
    M->addModuleFlag(llvm::Module::Override, "branch-target-enforcement", 1);
+   M->addModuleFlag(llvm::Module::Override, "sign-return-address", 1);
 }
Index: lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_misc.h
===================================================================
RCS file: /cvs/xenocara/lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_misc.h,v
retrieving revision 1.11
diff -u -p -r1.11 lp_bld_misc.h
--- lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_misc.h	18 Mar 2024 00:15:10 -0000	1.11
+++ lib/mesa/src/gallium/auxiliary/gallivm/lp_bld_misc.h	20 Mar 2024 23:23:51 -0000
@@ -96,7 +96,7 @@ void
 lp_set_module_stack_alignment_override(LLVMModuleRef M, unsigned align);
 
 void
-lp_set_module_branch_target_enforcement(LLVMModuleRef M);
+lp_set_module_branch_protection(LLVMModuleRef M);
 
 #ifdef __cplusplus
 }