[AArch64] fix bug #55005 handle DW_CFA_GNU_window_save

[sebpop]

Summary

GCC on AArch64 uses DW_CFA_GNU_window_save for return address signing.

In architecture revisions prior to ARMv8.3-A the pointer authentication
HINT instructions operate as NOPs.

[danielkiss]

bolt/lib/Core/Exceptions.cpp

630

on AArch64 I'd call the createNegateRAState. DW_CFA_GNU_window_save and DW_CFA_GNU_NegateRAState just use the same id but mean different things.

[ayermolo]

test?

[sebpop]

I added a testcase, however I was not able to check if the test catches the issue.

I need some help on how to run the bolt tests.
I did a make check-all in a build with -DLLVM_ENABLE_PROJECTS="clang;bolt" however that did not include the test that I added, as it is supposed to fail without the current patch.
I also tried to run the test directly with lit, and that failed as well.
Could somebody point me to the docs that describe how to run the bolt tests?

Thank you.

[yota9]

Please try make check-bolt. Although test seems to be too easy, I doubt that it could check the problem..

[sebpop]

Recommended check-bolt fails with:

$ make check-bolt
make: *** No rule to make target 'check-bolt'.  Stop.

If I execute the following sequence before the patch, the test will fail (also as described in the bug report https://github.com/llvm/llvm-project/issues/55005 )

$ clang -O2 -Wl,-q -o a.out dw_cfa_gnu_window_save.cc
$ llvm-bolt a.out -o a.bolt
BOLT-INFO: Target architecture: aarch64
BOLT-INFO: BOLT version: 5de6b94f856f696832ce7df167e1dbc096fbe598
BOLT-INFO: first alloc address is 0x400000
BOLT-INFO: creating new program header table at address 0x600000, offset 0x200000
BOLT-INFO: enabling relocation mode
BOLT-INFO: disabling -align-macro-fusion on non-x86 platform
=======================================
BOLT is unable to proceed because it couldn't properly understand this function.
If you are running the most recent version of BOLT, you may want to report this and paste this dump.
Please check that there is no sensitive contents being shared in this dump.

Offending function: __do_global_dtors_aux/1(*2)

Function contents (
  0000: 3F2303D5 FD7BBEA9 FD030091 F30B00F9  |?#...{..........|
  0010: 93010090 60824039 80000035 DEFFFF97  |....`.@9...5....|
  0020: 20008052 60820039 F30B40F9 FD7BC2A8  | ..R`..9..@..{..|
  0030: BF2303D5 C0035FD6                    |.#...._.|
)

Binary Function "__do_global_dtors_aux/1(*2)"  {
  All names   : __do_global_dtors_aux/1
                __do_global_dtors_aux/crtstuff.c/1
  Number      : 8
  State       : disassembled
  Address     : 0x41014c
  Size        : 0x38
  MaxSize     : 0x38
  Offset      : 0x1014c
  Section     : .text
  Orc Section : .local.text.__do_global_dtors_aux/1
  LSDA        : 0x0
  IsSimple    : 1
  IsMultiEntry: 0
  IsSplit     : 0
  BB Count    : 0
}
.LBB07:
    00000000: 	paciasp
    00000004: 	stp	x29, x30, [sp, #-0x20]!
    00000008: 	mov	x29, sp
    0000000c: 	str	x19, [sp, #0x10]
    00000010: 	adrp	x19, "__TMC_LIST__/1"
    00000014: 	ldrb	w0, [x19, :lo12:"__TMC_LIST__/1"]
    00000018: 	cbnz	w0, .Ltmp4 # Offset: 24
    0000001c: 	bl	"deregister_tm_clones/1" # Offset: 28
    00000020: 	mov	w0, #0x1
    00000024: 	strb	w0, [x19, :lo12:"__TMC_LIST__/1"]
.Ltmp4:
    00000028: 	ldr	x19, [sp, #0x10]
    0000002c: 	ldp	x29, x30, [sp], #0x20
    00000030: 	autiasp
    00000034: 	ret	x30 # Offset: 52
DWARF CFI Instructions:
    <empty>
End of Function "__do_global_dtors_aux/1(*2)"

ERROR: unable to fill CFI.
=======================================

[yota9]

I'm not sure why check-bolt doesn't work for you, it works fine for me..
Plus we've got more complicated tests than this one, probably it is something in env causes the problem. I don't say that there is no problem, but I would say that probably we need another test or maybe pre-built binary in yaml format, we have some tests like that. Also be aware that %cflags contains nostdlib, so no startup files (that seems to have a problem) would be linked in...

[Amir]

In D142572#4083109, @sebpop wrote:

I added a testcase, however I was not able to check if the test catches the issue.

I need some help on how to run the bolt tests.
I did a make check-all in a build with -DLLVM_ENABLE_PROJECTS="clang;bolt" however that did not include the test that I added, as it is supposed to fail without the current patch.
I also tried to run the test directly with lit, and that failed as well.
Could somebody point me to the docs that describe how to run the bolt tests?

Thank you.

Please also enable lld project.

[sebpop]

Added testcase that passes with the patch.
Tested on arm64-linux (Graviton3 Neoverse-V1.)

[sebpop]

Thanks Amir for the tip, configuring with -DLLVM_ENABLE_PROJECTS="clang;bolt;lld" enabled check-bolt target.
Thanks yota9 for pointing out the format for the test "pre-built binary in yaml format", I adapted my test following one of your previous tests.

[rafauler]

bolt/lib/Core/Exceptions.cpp

629

Can you add a comment here explaining why you're calling createNegateRAState? Something like

"DW_CFA_GNU_window_save and DW_CFA_GNU_NegateRAState just use the same id but mean different things. The latter is used in AArch64".

Also, guard this code under AArch64 (from what I understand, this is an AArch64-only thing)

if (Function.getBinaryContext().isAArch64)

bolt/test/AArch64/dw_cfa_gnu_window_save.cc

1 ↗

(On Diff #492954)

I guess we can drop this test? Since you already added the yaml file and another test

[yota9]

Overall LGTM, although usually we have a policy to minimise yaml tests as much as we can, removing unneeded for the tests sections, symbols, data & etc.

[sebpop]

Reduced yaml input file.
Tested with and without the patch for the pattern.

[ayermolo]

bolt/lib/Core/Exceptions.cpp

636

small nit. I don't think {} is necessary here according to coding style guide.

[yota9]

LGTM

bolt/lib/Core/Exceptions.cpp

case DW_CFA_expression: {
           Offset, MCCFIInstruction::createEscape(nullptr, OS.str()));
       break;
     }
     case DW_CFA_MIPS_advance_loc8:
       if (opts::Verbosity >= 1)
         errs() << "BOLT-WARNING: DW_CFA_MIPS_advance_loc unimplemented\n";
       return false;
     case DW_CFA_GNU_window_save:
+      // DW_CFA_GNU_window_save and DW_CFA_GNU_NegateRAState just use the same
+      // id but mean different things. The latter is used in AArch64.
+      if (Function.getBinaryContext().isAArch64()) {
+        Function.addCFIInstruction(
+            Offset, MCCFIInstruction::createNegateRAState(nullptr));
+        break;
+      }
+      if (opts::Verbosity >= 1)
+        errs() << "BOLT-WARNING: DW_CFA_GNU_window_save unimplemented\n";
+      return false;
     case DW_CFA_lo_user:
     case DW_CFA_hi_user:
-      if (opts::Verbosity >= 1) {
-        errs() << "BOLT-WARNING: DW_CFA_GNU_* and DW_CFA_*_user "
-                  "unimplemented\n";
-      }
+      if (opts::Verbosity >= 1)
+        errs() << "BOLT-WARNING: DW_CFA_*_user unimplemented\n";
       return false;
     default:
-      if (opts::Verbosity >= 1) {
+      if (opts::Verbosity >= 1)
         errs() << "BOLT-WARNING: Unrecognized CFI instruction: " << Instr.Opcode
                << '\n';
-      }
       return false;
     }
 
     return true;
   };
 
   for (const CFIProgram::Instruction &Instr : CurFDE.getLinkedCIE()->cfis())
     if (!decodeFrameInstruction(Instr))

bolt/test/AArch64/Inputs/dw_cfa_gnu_window_save.yaml

+--- !ELF
+FileHeader:
+  Class:           ELFCLASS64
+  Data:            ELFDATA2LSB
+  Type:            ET_EXEC
+  Machine:         EM_AARCH64
+  Entry:           0x4100C0
+ProgramHeaders:
+  - Type:            PT_LOAD
+    Flags:           [ PF_X, PF_R ]
+    FirstSec:        .init
+    LastSec:         .fini
+    VAddr:           0x410000
+    Align:           0x10000
+Sections:
+  - Name:            .init
+    Type:            SHT_PROGBITS
+    Flags:           [ SHF_ALLOC, SHF_EXECINSTR ]
+    Address:         0x410000
+    AddressAlign:    0x4
+    Offset:          0x10000
+    Content:         3F2303D5FD7BBFA9FD0300913F000094FD7BC1A8BF2303D5C0035FD6
+  - Name:            .plt
+    Type:            SHT_PROGBITS
+    Flags:           [ SHF_ALLOC, SHF_EXECINSTR ]
+    Address:         0x410020
+    AddressAlign:    0x10
+    Content:         F07BBFA9700100F011FE47F910E23F9120021FD61F2003D51F2003D51F2003D590010090110240F91002009120021FD690010090110640F91022009120021FD690010090110A40F91042009120021FD6
+  - Name:            .text
+    Type:            SHT_PROGBITS
+    Flags:           [ SHF_ALLOC, SHF_EXECINSTR ]
+    Address:         0x410080
+    AddressAlign:    0x40
+    Content:         00008052C0035FD61F2003D51F2003D51F2003D51F2003D51F2003D51F2003D51F2003D51F2003D51F2003D51F2003D51F2003D51F2003D51F2003D51F2003D55F2403D51D0080D21E0080D2E50300AAE10340F9E2230091E60300910000009000D00391030080D2040080D2D5FFFF97D8FFFF975F2403D5E2FFFF171F2003D55F2403D5C0035FD6600100F000F047F9400000B4D3FFFF17C0035FD61F2003D5800100908101009000800091218000913F0000EBC000005481000090210840F9610000B4F00301AA00021FD6C0035FD680010090810100900080009121800091210000CB22FC7FD3410C818B21FC4193C10000B482000090420C40F9620000B4F00302AA00021FD6C0035FD63F2303D5FD7BBEA9FD030091F30B00F9930100906082403980000035DEFFFF972000805260820039F30B40F9FD7BC2A8BF2303D5C0035FD65F2403D5E2FFFF17
+  - Name:            .fini
+    Type:            SHT_PROGBITS
+    Flags:           [ SHF_ALLOC, SHF_EXECINSTR ]
+    Address:         0x4101CC
+    AddressAlign:    0x4
+    Content:         3F2303D5FD7BBFA9FD030091FD7BC1A8BF2303D5C0035FD6
+  - Name:            .eh_frame
+    Type:            SHT_PROGBITS
+    Flags:           [ SHF_ALLOC ]
+    Address:         0x420068
+    AddressAlign:    0x8
+    Content:         1000000000000000017A520004781E011B0C1F0010000000180000003C00FFFF3C0000000041071E140000002C0000006800FFFF08000000000000000000000010000000440000007000FFFF300000000000000010000000580000008C00FFFF3C00000000000000240000006C000000B400FFFF3800000000412D410E209D049E0342930248DEDDD30E00412D0000001400000094000000C400FFFF08000000000000000000000010000000AC00000068FFFEFF080000000000000000000000
+  - Name:            .rela.text
+    Type:            SHT_RELA
+    Flags:           [ SHF_INFO_LINK ]
+    Link:            .symtab
+    AddressAlign:    0x8
+    Info:            .text
+Symbols:
+  - Name:            .text
+    Type:            STT_SECTION
+    Section:         .text
+    Value:           0x410080
+  - Name:            _ITM_deregisterTMCloneTable
+    Binding:         STB_WEAK
+  - Name:            _ITM_registerTMCloneTable
+    Binding:         STB_WEAK
+...

bolt/test/AArch64/dw_cfa_gnu_window_save.test

+# Check that llvm-bolt can handle DW_CFA_GNU_window_save on AArch64.
+
+RUN: yaml2obj %p/Inputs/dw_cfa_gnu_window_save.yaml &> %t.exe
+RUN: llvm-bolt %t.exe -o %t.bolt 2>&1 | FileCheck %s
+
+CHECK-NOT: paciasp
+CHECK-NOT: autiasp
+CHECK-NOT: ERROR: unable to fill CFI.