[AArch64] Unwinding support for return address signing

[LukeCheeseman]

Summary

• When return address signing is enabled, the LR may be signed on function entry
• When an exception is thrown the return address is inspected used to unwind the call stack
• Before this happens, the return address must be correctly authenticated to avoid causing an abort by dereferencing the signed pointer

[olista01]

src/DwarfInstructions.hpp

210

I don't think this will work for cross-unwinding builds: for them, _LIBUNWIND_TARGET_AARCH64 is defined even when the compilation target is not AArch64, so this instruction won't exist.

Fully supporting cross-unwinding looks non-trivial: we'd need to either provide some way to ask the client to authenticate a pointer on the target, or strip the high bits of the pointer (which requires knowing the virtual address size of the target). For now, I think it's OK to not support cross-unwinding.

src/Registers.hpp

1837–1838

When regNum == UNW_ARM64_RA_SIGN_STATE, the index into __x is out of range. We'll need to add new storage to hold this value, I'd suggest replacing the current padding value in the GPRs struct, as that will avoid changing the layout expected by the context save/restore functions.

1849

Ditto.

[LukeCheeseman]

src/Registers.hpp

1837–1838

Good catch. Thanks, I didn't check the struct definition.

[LukeCheeseman]

return an error code when trying to sign return addresses and cross unwinding

[olista01]

LGTM, thanks!

include/libunwind.h

enum {
   UNW_EBADREG       = -6542, /* bad register number */
   UNW_EREADONLYREG  = -6543, /* attempt to write read-only register */
   UNW_ESTOPUNWIND   = -6544, /* stop unwinding */
   UNW_EINVALIDIP    = -6545, /* invalid IP */
   UNW_EBADFRAME     = -6546, /* bad frame */
   UNW_EINVAL        = -6547, /* unsupported operation or bad value */
   UNW_EBADVERSION   = -6548, /* unwind info has unsupported version */
   UNW_ENOINFO       = -6549  /* no unwind info found */
+#if defined(_LIBUNWIND_TARGET_AARCH64) && !defined(_LIBUNWIND_IS_NATIVE_ONLY)
+  , UNW_ECROSSRASIGNING = -6550 /* cross unwind with return address signing */
+#endif
 };
 
 struct unw_context_t {
   uint64_t data[_LIBUNWIND_CONTEXT_SIZE];
 };
 typedef struct unw_context_t unw_context_t;
 
 struct unw_cursor_t {
enum {
   UNW_ARM64_X28 = 28,
   UNW_ARM64_X29 = 29,
   UNW_ARM64_FP  = 29,
   UNW_ARM64_X30 = 30,
   UNW_ARM64_LR  = 30,
   UNW_ARM64_X31 = 31,
   UNW_ARM64_SP  = 31,
   // reserved block
+  UNW_ARM64_RA_SIGN_STATE = 34,
+  // reserved block
   UNW_ARM64_D0  = 64,
   UNW_ARM64_D1  = 65,
   UNW_ARM64_D2  = 66,
   UNW_ARM64_D3  = 67,
   UNW_ARM64_D4  = 68,
   UNW_ARM64_D5  = 69,
   UNW_ARM64_D6  = 70,
   UNW_ARM64_D7  = 71,

src/DwarfInstructions.hpp

if (CFI_Parser<A>::parseFDEInstructions(addressSpace, fdeInfo, cieInfo, pc,
             return UNW_EBADREG;
         }
       }
 
       // By definition, the CFA is the stack pointer at the call site, so
       // restoring SP means setting it to CFA.
       newRegisters.setSP(cfa);
 
+#if defined(_LIBUNWIND_TARGET_AARCH64)
+      // If the target is aarch64 then the return address may have been signed
+      // using the v8.3 pointer authentication extensions. The original
+      // return address needs to be authenticated before the return address is
+      // restored. autia1716 is used instead of autia as autia1716 assembles
+      // to a NOP on pre-v8.3a architectures.
+      if (prolog.savedRegisters[UNW_ARM64_RA_SIGN_STATE].value) {
+#if !defined(_LIBUNWIND_IS_NATIVE_ONLY)
+        return UNW_ECROSSRASIGNING;
+#else
+        register unsigned long long x17 __asm("x17") = returnAddress;
+        register unsigned long long x16 __asm("x16") = cfa;
+        asm("autia1716": "+r"(x17): "r"(x16));
+        returnAddress = x17;
+#endif
+      }
+#endif
+
       // Return address is address after call site instruction, so setting IP to
       // that does simualates a return.
       newRegisters.setIP(returnAddress);
 
       // Simulate the step by replacing the register set with the new ones.
       registers = newRegisters;
 
       return UNW_STEP_SUCCESS;

src/DwarfParser.hpp

case DW_CFA_GNU_negative_offset_extended:
       }
       offset = (int64_t)addressSpace.getULEB128(p, instructionsEnd)
                                                     * cieInfo.dataAlignFactor;
       results->savedRegisters[reg].location = kRegisterInCFA;
       results->savedRegisters[reg].value = -offset;
       _LIBUNWIND_TRACE_DWARF(
           "DW_CFA_GNU_negative_offset_extended(%" PRId64 ")\n", offset);
       break;
+
+#if defined(_LIBUNWIND_TARGET_AARCH64)
+    case DW_CFA_AARCH64_negate_ra_state:
+      results->savedRegisters[UNW_ARM64_RA_SIGN_STATE].value ^= 0x1;
+      _LIBUNWIND_TRACE_DWARF("DW_CFA_AARCH64_negate_ra_state\n");
+      break;
+#endif
+
     default:
       operand = opcode & 0x3F;
       switch (opcode & 0xC0) {
       case DW_CFA_offset:
         reg = operand;
         if (reg > kMaxRegisterNumber) {
           _LIBUNWIND_LOG("malformed DW_CFA_offset DWARF unwind, reg (%" PRIu64
                          ") out of range",

src/Registers.hpp

 
 private:
   struct GPRs {
     uint64_t __x[29]; // x0-x28
     uint64_t __fp;    // Frame pointer x29
     uint64_t __lr;    // Link register x30
     uint64_t __sp;    // Stack pointer x31
     uint64_t __pc;    // Program counter
-    uint64_t padding; // 16-byte align
+    uint64_t __ra_sign_state; // RA sign state register
   };
 
   GPRs    _registers;
   double  _vectorHalfRegisters[32];
   // Currently only the lower double in 128-bit vectore registers
   // is perserved during unwinding.  We could define new register
   // numbers (> 96) which mean whole vector registers, then this
   // struct would need to change to contain whole vector registers.
inline bool Registers_arm64::validRegister(int regNum) const {
   if (regNum == UNW_REG_IP)
     return true;
   if (regNum == UNW_REG_SP)
     return true;
   if (regNum < 0)
     return false;
   if (regNum > 95)
     return false;
+  if (regNum == UNW_ARM64_RA_SIGN_STATE)
+    return true;
   if ((regNum > 31) && (regNum < 64))
     return false;
   return true;
 }
 
 inline uint64_t Registers_arm64::getRegister(int regNum) const {
   if (regNum == UNW_REG_IP)
     return _registers.__pc;
   if (regNum == UNW_REG_SP)
     return _registers.__sp;
+  if (regNum == UNW_ARM64_RA_SIGN_STATE)
+    return _registers.__ra_sign_state;
   if ((regNum >= 0) && (regNum < 32))
     return _registers.__x[regNum];
+
   _LIBUNWIND_ABORT("unsupported arm64 register");
 }
 
 inline void Registers_arm64::setRegister(int regNum, uint64_t value) {
   if (regNum == UNW_REG_IP)
     _registers.__pc = value;
   else if (regNum == UNW_REG_SP)
     _registers.__sp = value;
+  else if (regNum == UNW_ARM64_RA_SIGN_STATE)
+    _registers.__ra_sign_state = value;
   else if ((regNum >= 0) && (regNum < 32))
     _registers.__x[regNum] = value;
   else
     _LIBUNWIND_ABORT("unsupported arm64 register");
 }
 
 inline const char *Registers_arm64::getRegisterName(int regNum) {
   switch (regNum) {
   case UNW_REG_IP:

src/dwarf2.h

enum {
   DW_CFA_val_expression     = 0x16,
   DW_CFA_advance_loc        = 0x40, // high 2 bits are 0x1, lower 6 bits are delta
   DW_CFA_offset             = 0x80, // high 2 bits are 0x2, lower 6 bits are register
   DW_CFA_restore            = 0xC0, // high 2 bits are 0x3, lower 6 bits are register
 
   // GNU extensions
   DW_CFA_GNU_window_save              = 0x2D,
   DW_CFA_GNU_args_size                = 0x2E,
-  DW_CFA_GNU_negative_offset_extended = 0x2F
+  DW_CFA_GNU_negative_offset_extended = 0x2F,
+
+  // AARCH64 extensions
+  DW_CFA_AARCH64_negate_ra_state      = 0x2D
 };
 
 
 // FSF exception handling Pointer-Encoding constants
 // Used in CFI augmentation by GCC
 enum {
   DW_EH_PE_ptr       = 0x00,
   DW_EH_PE_uleb128   = 0x01,