[ARM][libunwind] add PACBTI-M support for libunwind

[stuij]

Summary

This patch implements the following:

• Emit PACBTI-M build attributes in libunwind asm files

• Authenticate LR in DWARF32 using PACBTI

Use Armv8.1-M.Main PACBTI extension to authenticate the return address
(stored in the LR register) before moving it to the PC (IP) register.

The AUTG instruction is used with the candidate return address, the CFA,
and the authentication code that is retrieved from the saved
pseudo-register RA_AUTH_CODE.

• Authenticate LR in EHABI using PACBTI

Authenticate the contents of the LR register using Armv8.1-M.Main PACBTI
extension.

A new frame unwinding instruction is introduced (0xb4). This
instruction pops out of the stack the return address authentication
code, which is then used in conjunction with the SP and the next-to-be
instruction pointer to perform authentication.

This authentication code is popped into a new register,
UNW_ARM_PSEUDO_PAC, which is a pseudo-register.

This patch is part of a series that adds support for the PACBTI-M extension of
the Armv8.1-M architecture, as detailed here:

https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/armv8-1-m-pointer-authentication-and-branch-target-identification-extension

The PACBTI-M specification can be found in the Armv8-M Architecture Reference
Manual:

https://developer.arm.com/documentation/ddi0553/latest

The following people contributed to this patch:

• Momchil Velikov
• Victor Campos
• Ties Stuij

[danielkiss]

libunwind/src/Registers.hpp

2245–2246

Maybe we could gate this on __ARM_FEATURE_PAUTH because it won't work anyway without the feature enabled for libunwind.

2276–2277

ditto, maybe better to run into a _LIBUNWIND_ABORT instead debugging a silently skipping the authentication.

[stuij]

addressed review comments

[danielkiss]

LGTM, Thanks.

[mstorsjo]

Looks overall ok, without diving in very deep, except for this one change that seemed unrelated.

libunwind/src/Unwind-EHABI.cpp

317

This particular change looks unrelated to the rest, on a quick glance

[chill]

libunwind/src/Unwind-EHABI.cpp

317

Indeed, that change is a leftover from when the encoding of the instruction to pop return address authentication code was <0xb1,0x00>

[stuij]

address review comments

[mstorsjo]

I guess this is ok then. I can't say I've followed every bit in detail, but it looks sensible overall.

[ldionne]

Please rebase onto main and re-upload before submitting, so that the CI runs. There was a flaky failure previously, but I'd like to see it run before merging.

[stuij]

uploading after rebase as per reviewer request (no changes in the patch itself)

clang/lib/Headers/unwind.h

 typedef _Unwind_Reason_Code (*_Unwind_Trace_Fn)(struct _Unwind_Context *,
                                                 void *);
 
 #if defined(__arm__) && !(defined(__USING_SJLJ_EXCEPTIONS__) || defined(__ARM_DWARF_EH__))
 typedef enum {
   _UVRSC_CORE = 0,        /* integer register */
   _UVRSC_VFP = 1,         /* vfp */
   _UVRSC_WMMXD = 3,       /* Intel WMMX data register */
-  _UVRSC_WMMXC = 4        /* Intel WMMX control register */
+  _UVRSC_WMMXC = 4,       /* Intel WMMX control register */
+  _UVRSC_PSEUDO = 5       /* Special purpose pseudo register */
 } _Unwind_VRS_RegClass;
 
 typedef enum {
   _UVRSD_UINT32 = 0,
   _UVRSD_VFPX = 1,
   _UVRSD_UINT64 = 3,
   _UVRSD_FLOAT = 4,
   _UVRSD_DOUBLE = 5

libunwind/include/libunwind.h

enum {
   UNW_ARM_WR9 = 121,
   UNW_ARM_WR10 = 122,
   UNW_ARM_WR11 = 123,
   UNW_ARM_WR12 = 124,
   UNW_ARM_WR13 = 125,
   UNW_ARM_WR14 = 126,
   UNW_ARM_WR15 = 127,
   // 128-133 -- SPSR, SPSR_{FIQ|IRQ|ABT|UND|SVC}
-  // 134-143 -- Reserved
+  // 134-142 -- Reserved
+  UNW_ARM_RA_AUTH_CODE = 143,
   // 144-150 -- R8_USR-R14_USR
   // 151-157 -- R8_FIQ-R14_FIQ
   // 158-159 -- R13_IRQ-R14_IRQ
   // 160-161 -- R13_ABT-R14_ABT
   // 162-163 -- R13_UND-R14_UND
   // 164-165 -- R13_SVC-R14_SVC
   // 166-191 -- Reserved
   UNW_ARM_WC0 = 192,

libunwind/include/unwind_arm_ehabi.h

 #else
 extern _Unwind_Reason_Code
     _Unwind_RaiseException(_Unwind_Exception *exception_object);
 extern void _Unwind_Resume(_Unwind_Exception *exception_object);
 #endif
 extern void _Unwind_DeleteException(_Unwind_Exception *exception_object);
 
 typedef enum {
-  _UVRSC_CORE = 0, /* integer register */
-  _UVRSC_VFP = 1, /* vfp */
+  _UVRSC_CORE = 0,  /* integer register */
+  _UVRSC_VFP = 1,   /* vfp */
   _UVRSC_WMMXD = 3, /* Intel WMMX data register */
-  _UVRSC_WMMXC = 4 /* Intel WMMX control register */
+  _UVRSC_WMMXC = 4, /* Intel WMMX control register */
+  _UVRSC_PSEUDO = 5 /* Special purpose pseudo register */
 } _Unwind_VRS_RegClass;
 
 typedef enum {
   _UVRSD_UINT32 = 0,
   _UVRSD_VFPX = 1,
   _UVRSD_UINT64 = 3,
   _UVRSD_FLOAT = 4,
   _UVRSD_DOUBLE = 5

libunwind/src/DwarfInstructions.hpp

#else
           asm("hint 0xe" : "+r"(x17) : "r"(x16)); // autib1716
         else
           asm("hint 0xc" : "+r"(x17) : "r"(x16)); // autia1716
         returnAddress = x17;
 #endif
       }
 #endif
 
+#if defined(_LIBUNWIND_IS_NATIVE_ONLY) && defined(_LIBUNWIND_TARGET_ARM) &&    \
+    defined(__ARM_FEATURE_PAUTH)
+      if ((R::getArch() == REGISTERS_ARM) &&
+          prolog.savedRegisters[UNW_ARM_RA_AUTH_CODE].value) {
+        pint_t pac =
+            getSavedRegister(addressSpace, registers, cfa,
+                             prolog.savedRegisters[UNW_ARM_RA_AUTH_CODE]);
+        __asm__ __volatile__("autg %0, %1, %2"
+                             :
+                             : "r"(pac), "r"(returnAddress), "r"(cfa)
+                             :);
+      }
+#endif
+
 #if defined(_LIBUNWIND_TARGET_SPARC)
       if (R::getArch() == REGISTERS_SPARC) {
         // Skip call site instruction and delay slot
         returnAddress += 8;
         // Skip unimp instruction if function returns a struct
         if ((addressSpace.get32(returnAddress) & 0xC1C00000) == 0)
           returnAddress += 4;
       }

libunwind/src/Registers.hpp

 private:
   struct GPRs {
     uint32_t __r[13]; // r0-r12
     uint32_t __sp;    // Stack pointer r13
     uint32_t __lr;    // Link register r14
     uint32_t __pc;    // Program counter r15
   };
 
+  struct PseudoRegisters {
+    uint32_t __pac; // Return Authentication Code (PAC)
+  };
+
   static void saveVFPWithFSTMD(void*);
   static void saveVFPWithFSTMX(void*);
   static void saveVFPv3(void*);
   static void restoreVFPWithFLDMD(void*);
   static void restoreVFPWithFLDMX(void*);
   static void restoreVFPv3(void*);
 #if defined(__ARM_WMMX)
   static void saveiWMMX(void*);
   static void saveiWMMXControl(uint32_t*);
   static void restoreiWMMX(void*);
   static void restoreiWMMXControl(uint32_t*);
 #endif
   void restoreCoreAndJumpTo();
 
   // ARM registers
   GPRs _registers;
+  PseudoRegisters _pseudo_registers;
 
   // We save floating point registers lazily because we can't know ahead of
   // time which ones are used. See EHABI #4.7.
 
   // Whether D0-D15 are saved in the FTSMX instead of FSTMD format.
   //
   // See EHABI #7.5 that explains how matching instruction sequences for load
   // and store need to be used to correctly restore the exact register bits.

 inline Registers_arm::Registers_arm(const void *registers)
   : _use_X_for_vfp_save(false),
     _saved_vfp_d0_d15(false),
     _saved_vfp_d16_d31(false) {
   static_assert((check_fit<Registers_arm, unw_context_t>::does_fit),
                 "arm registers do not fit into unw_context_t");
   // See __unw_getcontext() note about data.
   memcpy(&_registers, registers, sizeof(_registers));
+  memset(&_pseudo_registers, 0, sizeof(_pseudo_registers));
   memset(&_vfp_d0_d15_pad, 0, sizeof(_vfp_d0_d15_pad));
   memset(&_vfp_d16_d31, 0, sizeof(_vfp_d16_d31));
 #if defined(__ARM_WMMX)
   _saved_iwmmx = false;
   _saved_iwmmx_control = false;
   memset(&_iwmmx, 0, sizeof(_iwmmx));
   memset(&_iwmmx_control, 0, sizeof(_iwmmx_control));
 #endif
 }
 
 inline Registers_arm::Registers_arm()
   : _use_X_for_vfp_save(false),
     _saved_vfp_d0_d15(false),
     _saved_vfp_d16_d31(false) {
   memset(&_registers, 0, sizeof(_registers));
+  memset(&_pseudo_registers, 0, sizeof(_pseudo_registers));
   memset(&_vfp_d0_d15_pad, 0, sizeof(_vfp_d0_d15_pad));
   memset(&_vfp_d16_d31, 0, sizeof(_vfp_d16_d31));
 #if defined(__ARM_WMMX)
   _saved_iwmmx = false;
   _saved_iwmmx_control = false;
   memset(&_iwmmx, 0, sizeof(_iwmmx));
   memset(&_iwmmx_control, 0, sizeof(_iwmmx_control));
 #endif
inline bool Registers_arm::validRegister(int regNum) const {
   if (regNum >= UNW_ARM_R0 && regNum <= UNW_ARM_R15)
     return true;
 
 #if defined(__ARM_WMMX)
   if (regNum >= UNW_ARM_WC0 && regNum <= UNW_ARM_WC3)
     return true;
 #endif
 
+#ifdef __ARM_FEATURE_PAUTH
+  if (regNum == UNW_ARM_RA_AUTH_CODE)
+    return true;
+#endif
+
   return false;
 }
 
 inline uint32_t Registers_arm::getRegister(int regNum) const {
   if (regNum == UNW_REG_SP || regNum == UNW_ARM_SP)
     return _registers.__sp;
 
   if (regNum == UNW_ARM_LR)
if (regNum >= UNW_ARM_WC0 && regNum <= UNW_ARM_WC3) {
     if (!_saved_iwmmx_control) {
       _saved_iwmmx_control = true;
       saveiWMMXControl(_iwmmx_control);
     }
     return _iwmmx_control[regNum - UNW_ARM_WC0];
   }
 #endif
 
+#ifdef __ARM_FEATURE_PAUTH
+  if (regNum == UNW_ARM_RA_AUTH_CODE)
+    return _pseudo_registers.__pac;
+#endif
+
   _LIBUNWIND_ABORT("unsupported arm register");
 }
 
 inline void Registers_arm::setRegister(int regNum, uint32_t value) {
   if (regNum == UNW_REG_SP || regNum == UNW_ARM_SP) {
     _registers.__sp = value;
     return;
   }
if (!_saved_iwmmx_control) {
       _saved_iwmmx_control = true;
       saveiWMMXControl(_iwmmx_control);
     }
     _iwmmx_control[regNum - UNW_ARM_WC0] = value;
     return;
   }
 #endif
 
+  if (regNum == UNW_ARM_RA_AUTH_CODE) {
+    _pseudo_registers.__pac = value;
+    return;
+  }
+
   _LIBUNWIND_ABORT("unsupported arm register");
 }
 
 inline const char *Registers_arm::getRegisterName(int regNum) {
   switch (regNum) {
   case UNW_REG_IP:
   case UNW_ARM_IP: // UNW_ARM_R15 is alias
     return "pc";

libunwind/src/Unwind-EHABI.cpp

decode_eht_entry(const uint32_t* data, size_t* off, size_t* len) {
   return data;
 }
 
 _LIBUNWIND_EXPORT _Unwind_Reason_Code
 _Unwind_VRS_Interpret(_Unwind_Context *context, const uint32_t *data,
                       size_t offset, size_t len) {
   bool wrotePC = false;
   bool finish = false;
+  bool hasReturnAddrAuthCode = false;
   while (offset < len && !finish) {
     uint8_t byte = getByte(data, offset++);
     if ((byte & 0x80) == 0) {
       uint32_t sp;
       _Unwind_VRS_Get(context, _UVRSC_CORE, UNW_ARM_SP, _UVRSD_UINT32, &sp);
       if (byte & 0x40)
         sp -= (((uint32_t)byte & 0x3f) << 2) + 4;
       else
if ((byte & 0x80) == 0) {
           switch (byte) {
             case 0xb0:
               finish = true;
               break;
             case 0xb1: {
               if (offset >= len)
                 return _URC_FAILURE;
               uint8_t registers = getByte(data, offset++);
               if (registers & 0xf0 || !registers)
                 return _URC_FAILURE;
               _Unwind_VRS_Pop(context, _UVRSC_CORE, registers, _UVRSD_UINT32);
               break;
             }
             case 0xb2: {
               uint32_t addend = 0;
               uint32_t shift = 0;
               // This decodes a uleb128 value.
if ((byte & 0x80) == 0) {
             case 0xb3: {
               uint8_t v = getByte(data, offset++);
               _Unwind_VRS_Pop(context, _UVRSC_VFP,
                               RegisterRange(static_cast<uint8_t>(v >> 4),
                                             v & 0x0f), _UVRSD_VFPX);
               break;
             }
             case 0xb4:
+              hasReturnAddrAuthCode = true;
+              _Unwind_VRS_Pop(context, _UVRSC_PSEUDO,
+                              0 /* Return Address Auth Code */, _UVRSD_UINT32);
+              break;
             case 0xb5:
             case 0xb6:
             case 0xb7:
               return _URC_FAILURE;
             default:
               _Unwind_VRS_Pop(context, _UVRSC_VFP,
                               RegisterRange(8, byte & 0x07), _UVRSD_VFPX);
               break;
#endif
         default:
           return _URC_FAILURE;
       }
     }
   }
   if (!wrotePC) {
     uint32_t lr;
     _Unwind_VRS_Get(context, _UVRSC_CORE, UNW_ARM_LR, _UVRSD_UINT32, &lr);
+#ifdef __ARM_FEATURE_PAUTH
+    if (hasReturnAddrAuthCode) {
+      uint32_t sp;
+      uint32_t pac;
+      _Unwind_VRS_Get(context, _UVRSC_CORE, UNW_ARM_SP, _UVRSD_UINT32, &sp);
+      _Unwind_VRS_Get(context, _UVRSC_PSEUDO, UNW_ARM_RA_AUTH_CODE,
+                      _UVRSD_UINT32, &pac);
+      __asm__ __volatile__("autg %0, %1, %2" : : "r"(pac), "r"(lr), "r"(sp) :);
+    }
+#endif
     _Unwind_VRS_Set(context, _UVRSC_CORE, UNW_ARM_IP, _UVRSD_UINT32, &lr);
   }
   return _URC_CONTINUE_UNWIND;
 }
 
 extern "C" _LIBUNWIND_EXPORT _Unwind_Reason_Code
 __aeabi_unwind_cpp_pr0(_Unwind_State state, _Unwind_Control_Block *ucbp,
                        _Unwind_Context *context) {
case _UVRSC_WMMXD:
                              *(unw_fpreg_t *)valuep) == UNW_ESUCCESS
                  ? _UVRSR_OK
                  : _UVRSR_FAILED;
 #else
     case _UVRSC_WMMXC:
     case _UVRSC_WMMXD:
       break;
 #endif
+    case _UVRSC_PSEUDO:
+      // There's only one pseudo-register, PAC, with regno == 0.
+      if (representation != _UVRSD_UINT32 || regno != 0)
+        return _UVRSR_FAILED;
+      return __unw_set_reg(cursor, (unw_regnum_t)(UNW_ARM_RA_AUTH_CODE),
+                           *(unw_word_t *)valuep) == UNW_ESUCCESS
+                 ? _UVRSR_OK
+                 : _UVRSR_FAILED;
+      break;
   }
   _LIBUNWIND_ABORT("unsupported register class");
 }
 
 static _Unwind_VRS_Result
 _Unwind_VRS_Get_Internal(_Unwind_Context *context,
                          _Unwind_VRS_RegClass regclass, uint32_t regno,
                          _Unwind_VRS_DataRepresentation representation,
case _UVRSC_WMMXD:
                              (unw_fpreg_t *)valuep) == UNW_ESUCCESS
                  ? _UVRSR_OK
                  : _UVRSR_FAILED;
 #else
     case _UVRSC_WMMXC:
     case _UVRSC_WMMXD:
       break;
 #endif
+    case _UVRSC_PSEUDO:
+      // There's only one pseudo-register, PAC, with regno == 0.
+      if (representation != _UVRSD_UINT32 || regno != 0)
+        return _UVRSR_FAILED;
+      return __unw_get_reg(cursor, (unw_regnum_t)(UNW_ARM_RA_AUTH_CODE),
+                           (unw_word_t *)valuep) == UNW_ESUCCESS
+                 ? _UVRSR_OK
+                 : _UVRSR_FAILED;
+      break;
   }
   _LIBUNWIND_ABORT("unsupported register class");
 }
 
 _LIBUNWIND_EXPORT _Unwind_VRS_Result
 _Unwind_VRS_Get(_Unwind_Context *context, _Unwind_VRS_RegClass regclass,
                 uint32_t regno, _Unwind_VRS_DataRepresentation representation,
                 void *valuep) {
#endif
             _UVRSR_OK)
           return _UVRSR_FAILED;
       }
       if (representation == _UVRSD_VFPX)
         ++sp;
       return _Unwind_VRS_Set(context, _UVRSC_CORE, UNW_ARM_SP, _UVRSD_UINT32,
                              &sp);
     }
+    case _UVRSC_PSEUDO: {
+      if (representation != _UVRSD_UINT32 || discriminator != 0)
+        return _UVRSR_FAILED;
+      // Return Address Authentication code (PAC) - discriminator 0
+      uint32_t *sp;
+      if (_Unwind_VRS_Get(context, _UVRSC_CORE, UNW_ARM_SP, _UVRSD_UINT32,
+                          &sp) != _UVRSR_OK) {
+        return _UVRSR_FAILED;
+      }
+      uint32_t pac = *sp++;
+      _Unwind_VRS_Set(context, _UVRSC_CORE, UNW_ARM_SP, _UVRSD_UINT32, &sp);
+      return _Unwind_VRS_Set(context, _UVRSC_CORE, UNW_ARM_RA_AUTH_CODE,
+                             _UVRSD_UINT32, &pac);
+    }
   }
   _LIBUNWIND_ABORT("unsupported register class");
 }
 
 /// Not used by C++.
 /// Unwinds stack, calling "stop" function at each frame.
 /// Could be used to implement longjmp().
 _LIBUNWIND_EXPORT _Unwind_Reason_Code

libunwind/src/UnwindCursor.hpp

 
 
 template <typename A, typename R>
 bool UnwindCursor<A, R>::validReg(int regNum) {
   if (regNum == UNW_REG_IP || regNum == UNW_REG_SP) return true;
 #if defined(_LIBUNWIND_TARGET_X86_64)
   if (regNum >= UNW_X86_64_RAX && regNum <= UNW_X86_64_R15) return true;
 #elif defined(_LIBUNWIND_TARGET_ARM)
-  if (regNum >= UNW_ARM_R0 && regNum <= UNW_ARM_R15) return true;
+  if ((regNum >= UNW_ARM_R0 && regNum <= UNW_ARM_R15) ||
+      regNum == UNW_ARM_RA_AUTH_CODE)
+    return true;
 #elif defined(_LIBUNWIND_TARGET_AARCH64)
   if (regNum >= UNW_AARCH64_X0 && regNum <= UNW_ARM64_X30) return true;
 #endif
   return false;
 }
 
 template <typename A, typename R>
 unw_word_t UnwindCursor<A, R>::getReg(int regNum) {

libunwind/src/UnwindRegistersRestore.S

#else
   mov lr, r0
   @ 32bit thumb-2 restrictions for ldm:
   @ . the sp (r13) cannot be in the list
   @ . the pc (r15) and lr (r14) cannot both be in the list in an LDM instruction
   ldm lr, {r0-r12}
   ldr sp, [lr, #52]
   ldr lr, [lr, #60]  @ restore pc into lr
 #endif
+#if defined(__ARM_FEATURE_BTI_DEFAULT) && !defined(__ARM_ARCH_ISA_ARM)
+  // 'bx' is not BTI setting when used with lr, therefore r12 is used instead
+  mov r12, lr
+  JMP(r12)
+#else
   JMP(lr)
+#endif
 
 @
 @ static void libunwind::Registers_arm::restoreVFPWithFLDMD(unw_fpreg_t* values)
 @
 @ On entry:
 @  values pointer is in r0
 @
   .p2align 2

libunwind/src/assembly.h

#define PPC64_OPD2 SEPARATOR \
   .quad 0 SEPARATOR \
   .text SEPARATOR \
 .Lfunc_begin0:
 #else
 #define PPC64_OPD1
 #define PPC64_OPD2
 #endif
 
-#if defined(__ARM_FEATURE_BTI_DEFAULT)
+#if defined(__aarch64__) && defined(__ARM_FEATURE_BTI_DEFAULT)
   .pushsection ".note.gnu.property", "a" SEPARATOR                             \
   .balign 8 SEPARATOR                                                          \
   .long 4 SEPARATOR                                                            \
   .long 0x10 SEPARATOR                                                         \
   .long 0x5 SEPARATOR                                                          \
   .asciz "GNU" SEPARATOR                                                       \
   .long 0xc0000000 SEPARATOR /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */          \
   .long 4 SEPARATOR                                                            \
   .long 3 SEPARATOR /* GNU_PROPERTY_AARCH64_FEATURE_1_BTI AND */               \
                     /* GNU_PROPERTY_AARCH64_FEATURE_1_PAC */                   \
   .long 0 SEPARATOR                                                            \
   .popsection SEPARATOR
 #define AARCH64_BTI  bti c
 #else
 #define AARCH64_BTI
 #endif
 
+#if !defined(__aarch64__)
+#ifdef __ARM_FEATURE_PAC_DEFAULT
+  .eabi_attribute Tag_PAC_extension, 2
+  .eabi_attribute Tag_PACRET_use, 1
+#endif
+#ifdef __ARM_FEATURE_BTI_DEFAULT
+  .eabi_attribute Tag_BTI_extension, 1
+  .eabi_attribute Tag_BTI_use, 1
+#endif
+#endif
+
 #define GLUE2(a, b) a ## b
 #define GLUE(a, b) GLUE2(a, b)
 #define SYMBOL_NAME(name) GLUE(__USER_LABEL_PREFIX__, name)
 
 #if defined(__APPLE__)
 
 #define SYMBOL_IS_FUNC(name)
 #define HIDDEN_SYMBOL(name) .private_extern name