[AArch64] Generate SEH info for PAC instructions

[efriedma]

For the following example:

int f(void g(), int a) { g(); return a; }

If I compile with the following command:

cl /c a.c /d2guardsignret

llvm-readobj gives me the following:

File: a.obj
Format: COFF-ARM64
Arch: aarch64
AddressSize: 64bit
UnwindInformation [
  RuntimeFunction {
    Function: f (0x0)
    ExceptionRecord: $unwind$f (0x0)
    ExceptionData {
      FunctionLength: 40
      Version: 0
      ExceptionData: No
      EpiloguePacked: Yes
      EpilogueOffset: 0
      ByteCodeLength: 8
      Prologue [
        0xd600              ; stp x19, lr, [sp, #0]
        0x01                ; sub sp, #16
        0xfc                ; Bad opcode!
        0xe4                ; end
      ]
    }
  }
]

So apparently there is, in fact, a way to encode this, using the undocumented opcode 0xfc. Why this isn't documented, I have no idea.

---

Mapping BTI instructions to no-ops seems fine; I can't imagine any other encoding makes sense, even if Microsoft does implement it at some point.

[mstorsjo]

In D135103#3832085, @efriedma wrote:

For the following example:

int f(void g(), int a) { g(); return a; }

If I compile with the following command:

cl /c a.c /d2guardsignret

llvm-readobj gives me the following:

File: a.obj
Format: COFF-ARM64
Arch: aarch64
AddressSize: 64bit
UnwindInformation [
  RuntimeFunction {
    Function: f (0x0)
    ExceptionRecord: $unwind$f (0x0)
    ExceptionData {
      FunctionLength: 40
      Version: 0
      ExceptionData: No
      EpiloguePacked: Yes
      EpilogueOffset: 0
      ByteCodeLength: 8
      Prologue [
        0xd600              ; stp x19, lr, [sp, #0]
        0x01                ; sub sp, #16
        0xfc                ; Bad opcode!
        0xe4                ; end
      ]
    }
  }
]

So apparently there is, in fact, a way to encode this, using the undocumented opcode 0xfc. Why this isn't documented, I have no idea.

Oh, interesting. I guess we can try to add that one then, to cover this case.

[mstorsjo]

In D135103#3832085, @efriedma wrote:

For the following example:

int f(void g(), int a) { g(); return a; }

If I compile with the following command:

cl /c a.c /d2guardsignret

llvm-readobj gives me the following:

File: a.obj
Format: COFF-ARM64
Arch: aarch64
AddressSize: 64bit
UnwindInformation [
  RuntimeFunction {
    Function: f (0x0)
    ExceptionRecord: $unwind$f (0x0)
    ExceptionData {
      FunctionLength: 40
      Version: 0
      ExceptionData: No
      EpiloguePacked: Yes
      EpilogueOffset: 0
      ByteCodeLength: 8
      Prologue [
        0xd600              ; stp x19, lr, [sp, #0]
        0x01                ; sub sp, #16
        0xfc                ; Bad opcode!
        0xe4                ; end
      ]
    }
  }
]

So apparently there is, in fact, a way to encode this, using the undocumented opcode 0xfc. Why this isn't documented, I have no idea.

I tried this out - apparently this option has been around since some time in MSVC 2019 at least. And apparently it's also possible to invoke this with /guard:signret. This generates the pacibsp instruction - I wonder if there's a way to make it generate paciasp instead - which I presume would require a separate unwinding opcode to distinguish from pacibsp?

However, curiously, I don't get the output you got, if I compile with the same command - I have to build with /O2 for it to produce this unwind info. Without /O2, I get packed unwind, with CR=2 (which is defined as reserved) - which apparently is a way to handle signed return addresses in packed unwind info too.

I filed https://github.com/MicrosoftDocs/cpp-docs/pull/4202 as an initial attempt to document this (and hopefully poke the right people to document it publicly).

[efriedma]

However, curiously, I don't get the output you got, if I compile with the same command - I have to build with /O2 for it to produce this unwind info. Without /O2, I get packed unwind, with CR=2 (which is defined as reserved) - which apparently is a way to handle signed return addresses in packed unwind info too.

Sorry, I think I confused the commands when I posted.

[mstorsjo]

Split out BTI to a separate patch, generating the new opcode for PAC.

[mstorsjo]

Updated with the real name of the opcode.

[efriedma]

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

1881

Technically we could support this; we can represent it as "end_c; pac_sign_return_address; end". But we can leave that as a followup.

Probably worth adding a testcase for this, in any case.

[mstorsjo]

Added a testcase which builds with "target-features"="+v8.3a", to test that we avoid generating "retab" at the moment.

[efriedma]

LGTM

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

1021 ↗

(On Diff #467084)

The original whitespace is right here. (This whole switch is over-indented.)

llvm/lib/Target/AArch64/AArch64BranchTargets.cpp

 public:
   static char ID;
   AArch64BranchTargets() : MachineFunctionPass(ID) {}
   void getAnalysisUsage(AnalysisUsage &AU) const override;
   bool runOnMachineFunction(MachineFunction &MF) override;
   StringRef getPassName() const override { return AARCH64_BRANCH_TARGETS_NAME; }
 
 private:
-  void addBTI(MachineBasicBlock &MBB, bool CouldCall, bool CouldJump);
+  void addBTI(MachineBasicBlock &MBB, bool CouldCall, bool CouldJump,
+              bool NeedsWinCFI);
 };
 } // end anonymous namespace
 
 char AArch64BranchTargets::ID = 0;
 
 INITIALIZE_PASS(AArch64BranchTargets, "aarch64-branch-targets",
                 AARCH64_BRANCH_TARGETS_NAME, false, false)
 
bool AArch64BranchTargets::runOnMachineFunction(MachineFunction &MF) {
   // used for indirect branches, so need BTI instructions.
   SmallPtrSet<MachineBasicBlock *, 8> JumpTableTargets;
   if (auto *JTI = MF.getJumpTableInfo())
     for (auto &JTE : JTI->getJumpTables())
       for (auto *MBB : JTE.MBBs)
         JumpTableTargets.insert(MBB);
 
   bool MadeChange = false;
+  bool HasWinCFI = MF.hasWinCFI();
   for (MachineBasicBlock &MBB : MF) {
     bool CouldCall = false, CouldJump = false;
     // Even in cases where a function has internal linkage and is only called
     // directly in its translation unit, it can still be called indirectly if
     // the linker decides to add a thunk to it for whatever reason (say, for
     // example, if it is finally placed far from its call site and a BL is not
     // long-range enough). PLT entries and tail-calls use BR, but when they are
     // are in guarded pages should all use x16 or x17 to hold the called
     // address, so we don't need to set CouldJump here. BR instructions in
     // non-guarded pages (which might be non-BTI-aware code) are allowed to
     // branch to a "BTI c" using any register.
     if (&MBB == &*MF.begin())
       CouldCall = true;
 
     // If the block itself is address-taken, it could be indirectly branched
     // to, but not called.
     if (MBB.hasAddressTaken() || JumpTableTargets.count(&MBB))
       CouldJump = true;
 
     if (CouldCall || CouldJump) {
-      addBTI(MBB, CouldCall, CouldJump);
+      addBTI(MBB, CouldCall, CouldJump, HasWinCFI);
       MadeChange = true;
     }
   }
 
   return MadeChange;
 }
 
 void AArch64BranchTargets::addBTI(MachineBasicBlock &MBB, bool CouldCall,
-                                  bool CouldJump) {
+                                  bool CouldJump, bool HasWinCFI) {
   LLVM_DEBUG(dbgs() << "Adding BTI " << (CouldJump ? "j" : "")
                     << (CouldCall ? "c" : "") << " to " << MBB.getName()
                     << "\n");
 
   const AArch64InstrInfo *TII = static_cast<const AArch64InstrInfo *>(
       MBB.getParent()->getSubtarget().getInstrInfo());
 
   unsigned HintNum = 32;
void AArch64BranchTargets::addBTI(MachineBasicBlock &MBB, bool CouldCall,
 
   // SCTLR_EL1.BT[01] is set to 0 by default which means
   // PACI[AB]SP are implicitly BTI C so no BTI C instruction is needed there.
   if (MBBI != MBB.end() && HintNum == 34 &&
       (MBBI->getOpcode() == AArch64::PACIASP ||
        MBBI->getOpcode() == AArch64::PACIBSP))
     return;
 
+  if (HasWinCFI && MBBI->getFlag(MachineInstr::FrameSetup)) {
+    BuildMI(MBB, MBB.begin(), MBB.findDebugLoc(MBB.begin()),
+            TII->get(AArch64::SEH_Nop));
+  }
   BuildMI(MBB, MBB.begin(), MBB.findDebugLoc(MBB.begin()),
           TII->get(AArch64::HINT))
       .addImm(HintNum);
 }

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

if (needsShadowCallStackPrologueEpilogue(MF))
     emitShadowCallStackPrologue(*TII, MF, MBB, MBBI, DL, NeedsWinCFI,
                                 MFnI.needsDwarfUnwindInfo());
 
   if (MFnI.shouldSignReturnAddress()) {
     unsigned PACI;
     if (MFnI.shouldSignWithBKey()) {
       BuildMI(MBB, MBBI, DL, TII->get(AArch64::EMITBKEY))
           .setMIFlag(MachineInstr::FrameSetup);
+      // No SEH_Nop for this one
       PACI = Subtarget.hasPAuth() ? AArch64::PACIB : AArch64::PACIBSP;
     } else {
       PACI = Subtarget.hasPAuth() ? AArch64::PACIA : AArch64::PACIASP;
     }
 
     auto MI = BuildMI(MBB, MBBI, DL, TII->get(PACI));
     if (Subtarget.hasPAuth())
       MI.addReg(AArch64::LR, RegState::Define)
           .addReg(AArch64::LR)
           .addReg(AArch64::SP, RegState::InternalRead);
     MI.setMIFlag(MachineInstr::FrameSetup);
     if (EmitCFI) {
       unsigned CFIIndex =
           MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
       BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
           .addCFIIndex(CFIIndex)
           .setMIFlags(MachineInstr::FrameSetup);
+    } else if (NeedsWinCFI) {
+      HasWinCFI = true;
+      BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_Nop))
+          .setMIFlag(MachineInstr::FrameSetup);
     }
   }
   if (EmitCFI && MFnI.isMTETagged()) {
     BuildMI(MBB, MBBI, DL, TII->get(AArch64::EMITMTETAGGED))
         .setMIFlag(MachineInstr::FrameSetup);
+    if (NeedsWinCFI) {
+      HasWinCFI = true;
+      BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_Nop))
+          .setMIFlag(MachineInstr::FrameSetup);
+    }
   }
 
   // We signal the presence of a Swift extended frame to external tools by
   // storing FP with 0b0001 in bits 63:60. In normal userland operation a simple
   // ORR is sufficient, it is assumed a Swift kernel would initialize the TBI
   // bits so that is still true.
   if (HasFP && AFI->hasSwiftAsyncContext()) {
     switch (MF.getTarget().Options.SwiftAsyncFramePointer) {
if (isAsynchronousEHPersonality(Per)) {
           .addReg(AArch64::X1)
           .setMIFlag(MachineInstr::FrameSetup);
       MBB.addLiveIn(AArch64::X1);
     }
   }
 }
 
 static void InsertReturnAddressAuth(MachineFunction &MF,
-                                    MachineBasicBlock &MBB) {
+                                    MachineBasicBlock &MBB, bool NeedsWinCFI,
+                                    bool *HasWinCFI) {
   const auto &MFI = *MF.getInfo<AArch64FunctionInfo>();
   if (!MFI.shouldSignReturnAddress())
     return;
   const AArch64Subtarget &Subtarget = MF.getSubtarget<AArch64Subtarget>();
   const TargetInstrInfo *TII = Subtarget.getInstrInfo();
 
   MachineBasicBlock::iterator MBBI = MBB.getFirstTerminator();
   DebugLoc DL;
   if (MBBI != MBB.end())
     DL = MBBI->getDebugLoc();
 
   // The AUTIASP instruction assembles to a hint instruction before v8.3a so
   // this instruction can safely used for any v8a architecture.
   // From v8.3a onwards there are optimised authenticate LR and return
   // instructions, namely RETA{A,B}, that can be used instead. In this case the
   // DW_CFA_AARCH64_negate_ra_state can't be emitted.
   if (Subtarget.hasPAuth() &&
       !MF.getFunction().hasFnAttribute(Attribute::ShadowCallStack) &&
       MBBI != MBB.end() && MBBI->getOpcode() == AArch64::RET_ReallyLR) {
     BuildMI(MBB, MBBI, DL,
             TII->get(MFI.shouldSignWithBKey() ? AArch64::RETAB : AArch64::RETAA))
         .copyImplicitOps(*MBBI);
+    if (NeedsWinCFI) {
+      *HasWinCFI = true;
+      BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_Nop))
+          .setMIFlag(MachineInstr::FrameSetup);
+    }
     MBB.erase(MBBI);
   } else {
     BuildMI(
         MBB, MBBI, DL,
         TII->get(MFI.shouldSignWithBKey() ? AArch64::AUTIBSP : AArch64::AUTIASP))
         .setMIFlag(MachineInstr::FrameDestroy);
 
     unsigned CFIIndex =
         MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
     BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
         .addCFIIndex(CFIIndex)
         .setMIFlags(MachineInstr::FrameDestroy);
+    if (NeedsWinCFI) {
+      *HasWinCFI = true;
+      BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_Nop))
+          .setMIFlag(MachineInstr::FrameSetup);
+    }
   }
 }
 
 static bool isFuncletReturnInstr(const MachineInstr &MI) {
   switch (MI.getOpcode()) {
   default:
     return false;
   case AArch64::CATCHRET:
void AArch64FrameLowering::emitEpilogue(MachineFunction &MF,
   auto WinCFI = make_scope_exit([&]() { assert(HasWinCFI == MF.hasWinCFI()); });
 
   if (MBB.end() != MBBI) {
     DL = MBBI->getDebugLoc();
     IsFunclet = isFuncletReturnInstr(*MBBI);
   }
 
   auto FinishingTouches = make_scope_exit([&]() {
-    InsertReturnAddressAuth(MF, MBB);
+    InsertReturnAddressAuth(MF, MBB, NeedsWinCFI, &HasWinCFI);
     if (needsShadowCallStackPrologueEpilogue(MF))
       emitShadowCallStackEpilogue(*TII, MF, MBB, MBB.getFirstTerminator(), DL);
     if (EmitCFI)
       emitCalleeSavedGPRRestores(MBB, MBB.getFirstTerminator());
+    if (HasWinCFI)
+      BuildMI(MBB, MBB.getFirstTerminator(), DL, TII->get(AArch64::SEH_EpilogEnd))
+          .setMIFlag(MachineInstr::FrameDestroy);
   });
 
   int64_t NumBytes = IsFunclet ? getWinEHFuncletFrameSize(MF)
                                : MFI.getStackSize();
   AArch64FunctionInfo *AFI = MF.getInfo<AArch64FunctionInfo>();
 
   // All calls are tail calls in GHC calling conv, and functions have no
   // prologue/epilogue.
if (EmitCFI && hasFP(MF)) {
           .addCFIIndex(CFIIndex)
           .setMIFlags(MachineInstr::FrameDestroy);
     }
 
     emitFrameOffset(MBB, MBB.getFirstTerminator(), DL, AArch64::SP, AArch64::SP,
                     StackOffset::getFixed(NumBytes + (int64_t)AfterCSRPopSize),
                     TII, MachineInstr::FrameDestroy, false, NeedsWinCFI,
                     &HasWinCFI, EmitCFI, StackOffset::getFixed(NumBytes));
-    if (HasWinCFI)
-      BuildMI(MBB, MBB.getFirstTerminator(), DL,
-              TII->get(AArch64::SEH_EpilogEnd))
-          .setMIFlag(MachineInstr::FrameDestroy);
     return;
   }
 
   NumBytes -= PrologueSaveSize;
   assert(NumBytes >= 0 && "Negative stack allocation size!?");
 
   // Process the SVE callee-saves to determine what space needs to be
   // deallocated.
emitFrameOffset(
         MBB, LastPopI, DL, AArch64::SP, AArch64::SP,
         StackOffset::getFixed(StackRestoreBytes), TII,
         MachineInstr::FrameDestroy, false, NeedsWinCFI, &HasWinCFI, EmitCFI,
         StackOffset::getFixed((RedZone ? 0 : NumBytes) + PrologueSaveSize));
 
     // If we were able to combine the local stack pop with the argument pop,
     // then we're done.
     if (NoCalleeSaveRestore || AfterCSRPopSize == 0) {
-      if (HasWinCFI) {
-        BuildMI(MBB, MBB.getFirstTerminator(), DL,
-                TII->get(AArch64::SEH_EpilogEnd))
-            .setMIFlag(MachineInstr::FrameDestroy);
-      }
       return;
     }
 
     NumBytes = 0;
   }
 
   // Restore the original stack pointer.
   // FIXME: Rather than doing the math here, we should instead just use
assert(AfterCSRPopSize > 0 && "attempting to reallocate arg stack that an "
                                   "interrupt may have clobbered");
 
     emitFrameOffset(
         MBB, MBB.getFirstTerminator(), DL, AArch64::SP, AArch64::SP,
         StackOffset::getFixed(AfterCSRPopSize), TII, MachineInstr::FrameDestroy,
         false, NeedsWinCFI, &HasWinCFI, EmitCFI,
         StackOffset::getFixed(CombineAfterCSRBump ? PrologueSaveSize : 0));
   }
-  if (HasWinCFI)
-    BuildMI(MBB, MBB.getFirstTerminator(), DL, TII->get(AArch64::SEH_EpilogEnd))
-        .setMIFlag(MachineInstr::FrameDestroy);
 }
 
 /// getFrameIndexReference - Provide a base+offset reference to an FI slot for
 /// debug info.  It's the same as what we use for resolving the code-gen
 /// references for now.  FIXME: This can go wrong when references are
 /// SP-relative and simple call frames aren't used.
 StackOffset
 AArch64FrameLowering::getFrameIndexReference(const MachineFunction &MF, int FI,