[AArch64][PAC] Declare FPAC subtarget feature

[atrosinenko]

Summary

In some situations, such as re-signing pointers or performing tail
calls, the code generator has to authenticate a signed pointer that will
not be dereferenced immediately. In such cases it may be necessary to
emit extra code to make sure that the authentication succeeded to prevent
introducing authentication/signing oracles.

If the target CPU is known to support FEAT_FPAC, this extra code can be
skipped as AUT* instructions are known to fault on invalid PAC by
themselves.

Note that unlike many other features, FEAT_FPAC does not add any new
supported instructions, but changes the semantics of several existing
ones. Thus, care should be taken to not enable FPAC when not actually
supported as it does not make code fail explicitly under normal
operation, but makes it less secure on unsupported CPUs.

[atrosinenko]

Looks like adding FeatureFPAC may require changes in more places - need to investigate whether I have to add something like AEK_FPAC constant, etc.

[atrosinenko]

Updated the patch:

• added FPAC to Extensions array in AArch64TargetParser.h, so it can be used in -march=...+fpac command line option. Adding one more feature seems mostly harmless after PR 65423 was merged
• dropped changes to clang/lib/Basic/Targets/AArch64.(h|cpp) as I don't actually use them to set any C defines or so (I don't see any mentioning of FPAC in ACLE 2023Q2)
• not adding FPAC to ExtensionMap in AArch64AsmParser.cpp as it doesn't look relevant for assembler (maybe it would be relevant someday for storing the set of expected features to object files)

[atrosinenko]

As discussed in D156716, it is not clear if I have to add FeatureFPAC to every relevant CPU. Maybe it is worth conservatively assuming that this feature should only be enabled manually by the user as a precaution against "I have CPU core X but it is not listed, so let's use cpu=Y because X supports all the instructions supported by Y (but not FEAT_FPAC)" - that would not cause any obvious run-time crashes under normal operation, but would make the code less secure.

[chill]

In D156784#4653741, @atrosinenko wrote:

As discussed in D156716, it is not clear if I have to add FeatureFPAC to every relevant CPU.

I would say, yes, it has to be added to each CPU that has that feature - that's what a subtarget feature is for. If we need to a way to alter code generation
as a response to a user choice, that ought to be done with a specific command line option and TargetOptions and/or function and module level
attributes.

Maybe it is worth conservatively assuming that this feature should only be enabled manually by the user as a precaution against "I have CPU core X but it is not listed, so let's use cpu=Y because X supports all the instructions supported by Y (but not FEAT_FPAC)" - that would not cause any obvious run-time crashes under normal operation, but would make the code less secure.

As far as I can tell, the existing practice for security-related code generation is to have it disabled by default
and enable it explicitly by clang command line options (c.f -mbranch-protection=..., -mharden-sls=..., -fstack-clash-protection, -fsanitize=memtag, ...).

In that spirit, I would suggest not using target features to alter code generation in a rather obscure way but being quite explicit about it.
For example, have an option -mauth-ret-check=default|force where:

• the presence of the option enables LR check before tail calls
• default (or enable) would mean FEAT_FPAC takes precedence
• force would mean FEAT_FPAC is ignored

Alternatively, maybe even better, these could be options to -mbranch-protection=....

llvm/include/llvm/TargetParser/AArch64TargetParser.h

enum ArchExtKind : unsigned {
   AEK_RCPC3 =         50, // FEAT_LRCPC3
   AEK_THE =           51, // FEAT_THE
   AEK_D128 =          52, // FEAT_D128
   AEK_LSE128 =        53, // FEAT_LSE128
   AEK_SPECRES2 =      54, // FEAT_SPECRES2
   AEK_RASv2 =         55, // FEAT_RASv2
   AEK_ITE =           56, // FEAT_ITE
   AEK_GCS =           57, // FEAT_GCS
-  AEK_NUM_EXTENSIONS =  AEK_GCS + 1
+  AEK_FPAC =          58, // FEAT_FPAC
+  AEK_NUM_EXTENSIONS =  AEK_FPAC + 1
 };
 using ExtensionBitset = Bitset<AEK_NUM_EXTENSIONS>;
 // clang-format on
 
 // Represents an extension that can be enabled with -march=<arch>+<extension>.
 // Typically these correspond to Arm Architecture extensions, unlike
 // SubtargetFeature which may represent either an actual extension or some
 // internal LLVM property.
inline constexpr ExtensionInfo Extensions[] = {
     {"sve2-sha3", AArch64::AEK_SVE2SHA3, "+sve2-sha3", "-sve2-sha3", FEAT_SVE_SHA3, "+sve2,+sve,+sve2-sha3,+fullfp16,+fp-armv8,+neon", 410},
     {"sve2-sm4", AArch64::AEK_SVE2SM4, "+sve2-sm4", "-sve2-sm4", FEAT_SVE_SM4, "+sve2,+sve,+sve2-sm4,+fullfp16,+fp-armv8,+neon", 420},
     {"sve2", AArch64::AEK_SVE2, "+sve2", "-sve2", FEAT_SVE2, "+sve2,+sve,+fullfp16,+fp-armv8,+neon", 370},
     {"sve2p1", AArch64::AEK_SVE2p1, "+sve2p1", "-sve2p1", FEAT_MAX, "+sve2p1,+sve2,+sve,+fullfp16,+fp-armv8,+neon", 0},
     {"the", AArch64::AEK_THE, "+the", "-the", FEAT_MAX, "", 0},
     {"tme", AArch64::AEK_TME, "+tme", "-tme", FEAT_MAX, "", 0},
     {"wfxt", AArch64::AEK_NONE, {}, {}, FEAT_WFXT, "+wfxt", 550},
     {"gcs", AArch64::AEK_GCS, "+gcs", "-gcs", FEAT_MAX, "", 0},
+    {"fpac", AArch64::AEK_FPAC, "+fpac", "-fpac", FEAT_MAX, "", 0},
     // Special cases
     {"none", AArch64::AEK_NONE, {}, {}, FEAT_MAX, "", ExtensionInfo::MaxFMVPriority},
 };
 // clang-format on
 
 enum ArchProfile { AProfile = 'A', RProfile = 'R', InvalidProfile = '?' };
 
 // Information about a specific architecture, e.g. V8.1-A

llvm/lib/Target/AArch64/AArch64.td

 def FeatureDotProd : SubtargetFeature<
     "dotprod", "HasDotProd", "true",
     "Enable dot product support (FEAT_DotProd)">;
 
 def FeaturePAuth : SubtargetFeature<
     "pauth", "HasPAuth", "true",
     "Enable v8.3-A Pointer Authentication extension (FEAT_PAuth)">;
 
+def FeatureFPAC : SubtargetFeature<
+    "fpac", "HasFPAC", "true",
+    "Assume AUT* instructions generate fault on invalid PAC (FEAT_FPAC)">;
+
 def FeatureJS : SubtargetFeature<
     "jsconv", "HasJS", "true",
     "Enable v8.3-A JavaScript FP conversion instructions (FEAT_JSCVT)",
     [FeatureFPARMv8]>;
 
 def FeatureCCIDX : SubtargetFeature<
     "ccidx", "HasCCIDX", "true",
     "Enable v8.3-A Extend of the CCSIDR number of sets (FEAT_CCIDX)">;

llvm/unittests/TargetParser/TargetParserTest.cpp

std::vector<uint64_t> Extensions = {
       AArch64::AEK_F64MM,   AArch64::AEK_TME,       AArch64::AEK_LS64,
       AArch64::AEK_BRBE,    AArch64::AEK_PAUTH,     AArch64::AEK_FLAGM,
       AArch64::AEK_SME,     AArch64::AEK_SMEF64F64, AArch64::AEK_SMEI16I64,
       AArch64::AEK_SME2,    AArch64::AEK_HBC,       AArch64::AEK_MOPS,
       AArch64::AEK_PERFMON, AArch64::AEK_SVE2p1,    AArch64::AEK_SME2p1,
       AArch64::AEK_B16B16,  AArch64::AEK_SMEF16F16, AArch64::AEK_CSSC,
       AArch64::AEK_RCPC3,   AArch64::AEK_THE,       AArch64::AEK_D128,
       AArch64::AEK_LSE128,  AArch64::AEK_SPECRES2,  AArch64::AEK_RASv2,
-      AArch64::AEK_ITE,     AArch64::AEK_GCS,
+      AArch64::AEK_ITE,     AArch64::AEK_GCS,       AArch64::AEK_FPAC,
   };
 
   std::vector<StringRef> Features;
 
   AArch64::ExtensionBitset ExtVal;
   for (auto Ext : Extensions)
     ExtVal.set(Ext);
 
TEST(TargetParserTest, AArch64ExtensionFeatures) {
   EXPECT_TRUE(llvm::is_contained(Features, "+cssc"));
   EXPECT_TRUE(llvm::is_contained(Features, "+rcpc3"));
   EXPECT_TRUE(llvm::is_contained(Features, "+the"));
   EXPECT_TRUE(llvm::is_contained(Features, "+d128"));
   EXPECT_TRUE(llvm::is_contained(Features, "+lse128"));
   EXPECT_TRUE(llvm::is_contained(Features, "+specres2"));
   EXPECT_TRUE(llvm::is_contained(Features, "+ite"));
   EXPECT_TRUE(llvm::is_contained(Features, "+gcs"));
+  EXPECT_TRUE(llvm::is_contained(Features, "+fpac"));
 
   // Assuming we listed every extension above, this should produce the same
   // result. (note that AEK_NONE doesn't have a name so it won't be in the
   // result despite its bit being set)
   std::vector<StringRef> AllFeatures;
   EXPECT_TRUE(AArch64::getExtensionFeatures(ExtVal, AllFeatures));
   EXPECT_THAT(Features, ::testing::ContainerEq(AllFeatures));
 }
const char *ArchExt[][4] = {
       {"sme2", "nosme2", "+sme2", "-sme2"},
       {"sme2p1", "nosme2p1", "+sme2p1", "-sme2p1"},
       {"hbc", "nohbc", "+hbc", "-hbc"},
       {"mops", "nomops", "+mops", "-mops"},
       {"pmuv3", "nopmuv3", "+perfmon", "-perfmon"},
       {"predres2", "nopredres2", "+specres2", "-specres2"},
       {"rasv2", "norasv2", "+rasv2", "-rasv2"},
       {"gcs", "nogcs", "+gcs", "-gcs"},
+      {"fpac", "nofpac", "+fpac", "-fpac"},
   };
 
   for (unsigned i = 0; i < std::size(ArchExt); i++) {
     EXPECT_EQ(StringRef(ArchExt[i][2]),
               AArch64::getArchExtFeature(ArchExt[i][0]));
     EXPECT_EQ(StringRef(ArchExt[i][3]),
               AArch64::getArchExtFeature(ArchExt[i][1]));
   }