[AArch64] Add support for the SEH opcode for return address signing

[mstorsjo]

Summary

See https://github.com/MicrosoftDocs/cpp-docs/pull/4202 for
progress on trying to get it documented upstream.

The external facing assembler directive ".seh_sign_ra" should be
considered experimental until proper naming for the opcode has been
settled upstream.

This opcode can be expressed in packed unwind too, but I'm not
implementing that packing until documentation for these cases have
settled.

[mstorsjo]

@efriedma - Do you have access to Windows running on HW that actually supports the PAC instructions? Can you check what happens when unwinding through a call frame that is built with PAC enabled today (where the unwind info lacks the opcode that corresponds to the signing) - does the unwind fail, or does the unwinder leniently strip out the pointer authentication before stepping to the next function?

[efriedma]

As far as I know, there isn't any publicly released hardware running Windows that supports PAC.

[mstorsjo]

In D135276#3837965, @efriedma wrote:

As far as I know, there isn't any publicly released hardware running Windows that supports PAC.

Yeah, that's my understanding too.

(I kinda wondered that you might have access to such HW though, but if you have, you're of course also not allowed to comment on it. Although for this case, it wouldn't really reveal anything about the HW itself, other than that it exists, only about the Windows unwinder implementation.)

The reason I'm asking is for assessing the impact of the bug that we're currently willingly generated PAC instructions without matching unwind info. In https://code.videolan.org/videolan/vlc/-/merge_requests/2662 I suggested stopping using -mbranch-protection=standard for Windows targets (so current binaries won't start misbehaving on future HW) until this is implemented properly in LLVM. However, I'm getting counterarguments for preferring keeping the added security (even though no current HW benefits from it, only future HW), and that the lacking unwind info shouldn't have any notable runtime effect.

[efriedma]

I guess if you run Windows in a virtual machine on a computer with PAC instructions (like a Mac), you might theoretically have access to them? I don't currently have a setup like that, though.

[mstorsjo]

In D135276#3838355, @efriedma wrote:

I guess if you run Windows in a virtual machine on a computer with PAC instructions (like a Mac), you might theoretically have access to them? I don't currently have a setup like that, though.

Oh, thanks, that's a good hint, I'll try to dig around to see if I can find someone with such a setup to run some tests for me.

[mstorsjo]

Updated with the real name of the opcode.

[mstorsjo]

In D135276#3838357, @mstorsjo wrote:

In D135276#3838355, @efriedma wrote:

I guess if you run Windows in a virtual machine on a computer with PAC instructions (like a Mac), you might theoretically have access to them? I don't currently have a setup like that, though.

Oh, thanks, that's a good hint, I'll try to dig around to see if I can find someone with such a setup to run some tests for me.

I did get hold of a person with such a setup, but apparently either the PAC extensions weren't visible in the VM guest, or the OS hadn't set up the signing keys, so after either paciasp or pacibsp, the return address was unchanged - so the experiment didn't teach us anything about how this bug affects code on future devices. :-( (I did verify that the same test binaries do show the expected changes if I run them in Wine on Linux on Graviton 3 though.)

[mstorsjo]

In D135276#3845051, @mstorsjo wrote:

In D135276#3838357, @mstorsjo wrote:

In D135276#3838355, @efriedma wrote:

I guess if you run Windows in a virtual machine on a computer with PAC instructions (like a Mac), you might theoretically have access to them? I don't currently have a setup like that, though.

Oh, thanks, that's a good hint, I'll try to dig around to see if I can find someone with such a setup to run some tests for me.

I did get hold of a person with such a setup, but apparently either the PAC extensions weren't visible in the VM guest, or the OS hadn't set up the signing keys, so after either paciasp or pacibsp, the return address was unchanged - so the experiment didn't teach us anything about how this bug affects code on future devices. :-( (I did verify that the same test binaries do show the expected changes if I run them in Wine on Linux on Graviton 3 though.)

The PR to add public docs about this was merged - and I did get a clarification that unwinding through a signed return address without this opcode doesn't work: https://github.com/MicrosoftDocs/cpp-docs/pull/4202#issuecomment-1273849028 So with that settled, any binaries built with current versions of LLVM, with -mbranch-protection=standard (or similar), will be sublty broken in the future once this feature is taken into use, if those binaries expect to do any unwinding.

So in hindsight, it would have been better to have errored out on this combination for previous releases, but there's not much we can do about that now, and sneaking that into 15.0.3 is a bit late too, and the best we can do probably is just to fix this. Too bad that we can't really test run the generated unwind info here for now, but we can at least match MSVC.

[mstorsjo]

Fixed a typo in the testcase.

No other changes were needed on this one now that it is properly documented upstream.

[efriedma]

LGTM

llvm/include/llvm/Support/Win64EH.h

enum UnwindOpcodes {
   UOP_SetFP,
   UOP_AddFP,
   UOP_Nop,
   UOP_End,
   UOP_SaveNext,
   UOP_TrapFrame,
   UOP_Context,
   UOP_ClearUnwoundToCall,
+  UOP_PACSignReturnAddress,
   // The following set of unwind opcodes is for ARM.  They are documented at
   // https://docs.microsoft.com/en-us/cpp/build/arm-exception-handling
 
   // Stack allocations use UOP_AllocSmall, UOP_AllocLarge from above, plus
   // the following. AllocSmall, AllocLarge and AllocHuge represent a 16 bit
   // instruction, while the WideAlloc* opcodes represent a 32 bit instruction.
   // Small can represent a stack offset of 0x7f*4 (252) bytes, Medium can
   // represent up to 0x3ff*4 (4092) bytes, Large up to 0xffff*4 (262140) bytes,

llvm/lib/MC/MCWin64EH.cpp

case Win64EH::UOP_PushMachFrame:
       Count += 1;
       break;
     case Win64EH::UOP_Context:
       Count += 1;
       break;
     case Win64EH::UOP_ClearUnwoundToCall:
       Count += 1;
       break;
+    case Win64EH::UOP_PACSignReturnAddress:
+      Count += 1;
+      break;
     }
   }
   return Count;
 }
 
 // Unwind opcode encodings and restrictions are documented at
 // https://docs.microsoft.com/en-us/cpp/build/arm64-exception-handling
 static void ARM64EmitUnwindCode(MCStreamer &streamer,
static void ARM64EmitUnwindCode(MCStreamer &streamer,
   case Win64EH::UOP_Context:
     b = 0xEA;
     streamer.emitInt8(b);
     break;
   case Win64EH::UOP_ClearUnwoundToCall:
     b = 0xEC;
     streamer.emitInt8(b);
     break;
+  case Win64EH::UOP_PACSignReturnAddress:
+    b = 0xFC;
+    streamer.emitInt8(b);
+    break;
   }
 }
 
 // Returns the epilog symbol of an epilog with the exact same unwind code
 // sequence, if it exists.  Otherwise, returns nullptr.
 // EpilogInstrs - Unwind codes for the current epilog.
 // Epilogs - Epilogs that potentialy match the current epilog.
 static MCSymbol*

llvm/lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp

private:
   bool parseDirectiveSEHNop(SMLoc L);
   bool parseDirectiveSEHSaveNext(SMLoc L);
   bool parseDirectiveSEHEpilogStart(SMLoc L);
   bool parseDirectiveSEHEpilogEnd(SMLoc L);
   bool parseDirectiveSEHTrapFrame(SMLoc L);
   bool parseDirectiveSEHMachineFrame(SMLoc L);
   bool parseDirectiveSEHContext(SMLoc L);
   bool parseDirectiveSEHClearUnwoundToCall(SMLoc L);
+  bool parseDirectiveSEHPACSignReturnAddress(SMLoc L);
 
   bool validateInstruction(MCInst &Inst, SMLoc &IDLoc,
                            SmallVectorImpl<SMLoc> &Loc);
   bool MatchAndEmitInstruction(SMLoc IDLoc, unsigned &Opcode,
                                OperandVector &Operands, MCStreamer &Out,
                                uint64_t &ErrorInfo,
                                bool MatchingInlineAsm) override;
 /// @name Auto-generated Match Functions
else if (IsMachO) {
     else if (IDVal == ".seh_trap_frame")
       parseDirectiveSEHTrapFrame(Loc);
     else if (IDVal == ".seh_pushframe")
       parseDirectiveSEHMachineFrame(Loc);
     else if (IDVal == ".seh_context")
       parseDirectiveSEHContext(Loc);
     else if (IDVal == ".seh_clear_unwound_to_call")
       parseDirectiveSEHClearUnwoundToCall(Loc);
+    else if (IDVal == ".seh_pac_sign_return_address")
+      parseDirectiveSEHPACSignReturnAddress(Loc);
     else
       return true;
   } else
     return true;
   return false;
 }
 
 static void ExpandCryptoAEK(AArch64::ArchKind ArchKind,

 
 /// parseDirectiveSEHClearUnwoundToCall
 /// ::= .seh_clear_unwound_to_call
 bool AArch64AsmParser::parseDirectiveSEHClearUnwoundToCall(SMLoc L) {
   getTargetStreamer().emitARM64WinCFIClearUnwoundToCall();
   return false;
 }
 
+/// parseDirectiveSEHPACSignReturnAddress
+/// ::= .seh_pac_sign_return_address
+bool AArch64AsmParser::parseDirectiveSEHPACSignReturnAddress(SMLoc L) {
+  getTargetStreamer().emitARM64WinCFIPACSignReturnAddress();
+  return false;
+}
+
 bool
 AArch64AsmParser::classifySymbolRef(const MCExpr *Expr,
                                     AArch64MCExpr::VariantKind &ELFRefKind,
                                     MCSymbolRefExpr::VariantKind &DarwinRefKind,
                                     int64_t &Addend) {
   ELFRefKind = AArch64MCExpr::VK_INVALID;
   DarwinRefKind = MCSymbolRefExpr::VK_None;
   Addend = 0;

llvm/lib/Target/AArch64/MCTargetDesc/AArch64ELFStreamer.cpp

class AArch64TargetAsmStreamer : public AArch64TargetStreamer {
   void emitARM64WinCFIEpilogStart() override { OS << "\t.seh_startepilogue\n"; }
   void emitARM64WinCFIEpilogEnd() override { OS << "\t.seh_endepilogue\n"; }
   void emitARM64WinCFITrapFrame() override { OS << "\t.seh_trap_frame\n"; }
   void emitARM64WinCFIMachineFrame() override { OS << "\t.seh_pushframe\n"; }
   void emitARM64WinCFIContext() override { OS << "\t.seh_context\n"; }
   void emitARM64WinCFIClearUnwoundToCall() override {
     OS << "\t.seh_clear_unwound_to_call\n";
   }
+  void emitARM64WinCFIPACSignReturnAddress() override {
+    OS << "\t.seh_pac_sign_return_address\n";
+  }
 
 public:
   AArch64TargetAsmStreamer(MCStreamer &S, formatted_raw_ostream &OS);
 };
 
 AArch64TargetAsmStreamer::AArch64TargetAsmStreamer(MCStreamer &S,
                                                    formatted_raw_ostream &OS)
   : AArch64TargetStreamer(S), OS(OS) {}

llvm/lib/Target/AArch64/MCTargetDesc/AArch64TargetStreamer.h

public:
   virtual void emitARM64WinCFISaveNext() {}
   virtual void emitARM64WinCFIPrologEnd() {}
   virtual void emitARM64WinCFIEpilogStart() {}
   virtual void emitARM64WinCFIEpilogEnd() {}
   virtual void emitARM64WinCFITrapFrame() {}
   virtual void emitARM64WinCFIMachineFrame() {}
   virtual void emitARM64WinCFIContext() {}
   virtual void emitARM64WinCFIClearUnwoundToCall() {}
+  virtual void emitARM64WinCFIPACSignReturnAddress() {}
 
 private:
   std::unique_ptr<AssemblerConstantPools> ConstantPools;
 };
 
 class AArch64TargetELFStreamer : public AArch64TargetStreamer {
 private:
   AArch64ELFStreamer &getStreamer();
public:
   void emitARM64WinCFISaveNext() override;
   void emitARM64WinCFIPrologEnd() override;
   void emitARM64WinCFIEpilogStart() override;
   void emitARM64WinCFIEpilogEnd() override;
   void emitARM64WinCFITrapFrame() override;
   void emitARM64WinCFIMachineFrame() override;
   void emitARM64WinCFIContext() override;
   void emitARM64WinCFIClearUnwoundToCall() override;
+  void emitARM64WinCFIPACSignReturnAddress() override;
 
 private:
   void emitARM64WinUnwindCode(unsigned UnwindCode, int Reg, int Offset);
 };
 
 MCTargetStreamer *
 createAArch64ObjectTargetStreamer(MCStreamer &S, const MCSubtargetInfo &STI);
 
 } // end namespace llvm
 
 #endif

llvm/lib/Target/AArch64/MCTargetDesc/AArch64WinCOFFStreamer.cpp

 void AArch64TargetWinCOFFStreamer::emitARM64WinCFIContext() {
   emitARM64WinUnwindCode(Win64EH::UOP_Context, -1, 0);
 }
 
 void AArch64TargetWinCOFFStreamer::emitARM64WinCFIClearUnwoundToCall() {
   emitARM64WinUnwindCode(Win64EH::UOP_ClearUnwoundToCall, -1, 0);
 }
 
+void AArch64TargetWinCOFFStreamer::emitARM64WinCFIPACSignReturnAddress() {
+  emitARM64WinUnwindCode(Win64EH::UOP_PACSignReturnAddress, -1, 0);
+}
+
 MCWinCOFFStreamer *llvm::createAArch64WinCOFFStreamer(
     MCContext &Context, std::unique_ptr<MCAsmBackend> MAB,
     std::unique_ptr<MCObjectWriter> OW, std::unique_ptr<MCCodeEmitter> Emitter,
     bool RelaxAll, bool IncrementalLinkerCompatible) {
   auto *S = new AArch64WinCOFFStreamer(Context, std::move(MAB),
                                        std::move(Emitter), std::move(OW));
   S->getAssembler().setIncrementalLinkerCompatible(IncrementalLinkerCompatible);
   return S;
 }

llvm/test/MC/AArch64/seh.s

 // CHECK-NEXT:       ALIGN_4BYTES
 // CHECK-NEXT:       CNT_CODE
 // CHECK-NEXT:       MEM_EXECUTE
 // CHECK-NEXT:       MEM_READ
 // CHECK-NEXT:     ]
 // CHECK-NEXT:   }
 // CHECK:        Section {
 // CHECK:          Name: .xdata
-// CHECK:          RawDataSize: 52
+// CHECK:          RawDataSize: 56
 // CHECK:          RelocationCount: 1
 // CHECK:          Characteristics [
 // CHECK-NEXT:       ALIGN_4BYTES
 // CHECK-NEXT:       CNT_INITIALIZED_DATA
 // CHECK-NEXT:       MEM_READ
 // CHECK-NEXT:     ]
 // CHECK-NEXT:   }
 // CHECK:        Section {
 // CHECK:          Name: .pdata
 // CHECK:          RelocationCount: 2
 // CHECK:          Characteristics [
 // CHECK-NEXT:       ALIGN_4BYTES
 // CHECK-NEXT:       CNT_INITIALIZED_DATA
 // CHECK-NEXT:       MEM_READ
 // CHECK-NEXT:     ]
 // CHECK-NEXT:   }
 // CHECK-NEXT: ]
 
 // CHECK-NEXT: Relocations [
 // CHECK-NEXT:   Section (4) .xdata {
-// CHECK-NEXT:     0x28 IMAGE_REL_ARM64_ADDR32NB __C_specific_handler
+// CHECK-NEXT:     0x2C IMAGE_REL_ARM64_ADDR32NB __C_specific_handler
 // CHECK-NEXT:   }
 // CHECK-NEXT:   Section (5) .pdata {
 // CHECK-NEXT:     0x0 IMAGE_REL_ARM64_ADDR32NB .text
 // CHECK-NEXT:     0x4 IMAGE_REL_ARM64_ADDR32NB .xdata
 // CHECK-NEXT:   }
 // CHECK-NEXT: ]
 
 // CHECK-NEXT: UnwindInformation [
 // CHECK-NEXT:   RuntimeFunction {
 // CHECK-NEXT:     Function: func
 // CHECK-NEXT:     ExceptionRecord: .xdata
 // CHECK-NEXT:     ExceptionData {
-// CHECK-NEXT:       FunctionLength: 100
+// CHECK-NEXT:       FunctionLength: 104
 // CHECK:            Prologue [
+// CHECK-NEXT:         0xfc                ; pacibsp
 // CHECK-NEXT:         0xec                ; clear unwound to call
 // CHECK-NEXT:         0xea                ; context
 // CHECK-NEXT:         0xe9                ; machine frame
 // CHECK-NEXT:         0xe8                ; trap frame
 // CHECK-NEXT:         0xe3                ; nop
 // CHECK-NEXT:         0xe202              ; add fp, sp, #16
 // CHECK-NEXT:         0xdd41              ; str d13, [sp, #8]
 // CHECK-NEXT:         0xde83              ; str d12, [sp, #-32]!
 // CHECK-NEXT:         0xd884              ; stp d10, d11, [sp, #32]
 // CHECK-NEXT:         0xda05              ; stp d8, d9, [sp, #-48]!
 // CHECK-NEXT:         0x83                ; stp x29, x30, [sp, #-32]!
 // CHECK-NEXT:         0x46                ; stp x29, x30, [sp, #48]
 // CHECK-NEXT:         0xd141              ; str x24, [sp, #8]
 // CHECK-NEXT:         0xd483              ; str x23, [sp, #-32]!
 // CHECK-NEXT:         0xe6                ; save next
 // CHECK-NEXT:         0xc882              ; stp x21, x22, [sp, #16]
 // CHECK-NEXT:         0xd6c2              ; stp x25, lr, [sp, #16]
 // CHECK-NEXT:         0x24                ; stp x19, x20, [sp, #-32]!
 // CHECK-NEXT:         0xcc83              ; stp x21, x22, [sp, #-32]!
 // CHECK-NEXT:         0x83                ; stp x29, x30, [sp, #-32]!
 // CHECK-NEXT:         0xe1                ; mov fp, sp
 // CHECK-NEXT:         0x01                ; sub sp, #16
 // CHECK-NEXT:         0xe4                ; end
 // CHECK-NEXT:       ]
-// CHECK-NEXT:       Epilogue [
-// CHECK-NEXT:         0x01                ; add sp, #16
-// CHECK-NEXT:         0xe4                ; end
-// CHECK-NEXT:       ]
+// CHECK-NEXT:       EpilogueScopes [
+// CHECK-NEXT:         EpilogueScope {
+// CHECK-NEXT:           StartOffset: 24
+// CHECK-NEXT:           EpilogueStartIndex: 32
+// CHECK-NEXT:           Opcodes [
+// CHECK-NEXT:             0x01                ; add sp, #16
+// CHECK-NEXT:             0xe4                ; end
+// CHECK-NEXT:           ]
+// CHECK-NEXT:         }
+// CHECK-NEXT:       ]
 // CHECK-NEXT:       ExceptionHandler [
 // CHECK-NEXT:         Routine: __C_specific_handler (0x0)
 // CHECK-NEXT:         Parameter: 0x0
 // CHECK-NEXT:       ]
 // CHECK-NEXT:     }
 // CHECK-NEXT:   }
 // CHECK-NEXT: ]
 
func:
     nop
     .seh_trap_frame
     nop
     .seh_pushframe
     nop
     .seh_context
     nop
     .seh_clear_unwound_to_call
-    .seh_endprologue
     nop
+    .seh_pac_sign_return_address
+    .seh_endprologue
+    pacibsp
     .seh_startepilogue
     add sp, sp, #24
     .seh_stackalloc 24
     .seh_endepilogue
     ret
     .seh_handler __C_specific_handler, @except
     .seh_handlerdata
     .long 0