public inbox for gcc-cvs@sourceware.org help / color / mirror / Atom feed
From: Szabolcs Nagy <nsz@gcc.gnu.org> To: gcc-cvs@gcc.gnu.org Subject: [gcc(refs/vendors/ARM/heads/gcs-13)] aarch64: Add GCS support to the unwinder Date: Wed, 14 Feb 2024 15:37:50 +0000 (GMT) [thread overview] Message-ID: <20240214153750.11ACE385E02F@sourceware.org> (raw) https://gcc.gnu.org/g:66ba07487449791117b7ba0217f09f91b13d13ea commit 66ba07487449791117b7ba0217f09f91b13d13ea Author: Szabolcs Nagy <szabolcs.nagy@arm.com> Date: Wed Apr 19 14:01:36 2023 +0100 aarch64: Add GCS support to the unwinder TODO: - Follows the current linux ABI that uses single signal entry token and shared shadow stack between thread and alt stack. - Could be behind __ARM_FEATURE_GCS_DEFAULT ifdef (only do anything special with gcs compat codegen) but there is a runtime check anyway. libgcc/ChangeLog: * config/aarch64/aarch64-unwind.h (_Unwind_Frames_Extra): Update. (_Unwind_Frames_Increment): Define. Diff: --- libgcc/config/aarch64/aarch64-unwind.h | 59 +++++++++++++++++++++++++++++++++- 1 file changed, 58 insertions(+), 1 deletion(-) diff --git a/libgcc/config/aarch64/aarch64-unwind.h b/libgcc/config/aarch64/aarch64-unwind.h index df223d8f6bb3..d89d6c581d3a 100644 --- a/libgcc/config/aarch64/aarch64-unwind.h +++ b/libgcc/config/aarch64/aarch64-unwind.h @@ -77,6 +77,9 @@ aarch64_demangle_return_addr (struct _Unwind_Context *context, return addr; } +/* GCS enable flag for chkfeat instruction. */ +#define CHKFEAT_GCS 1 + /* SME runtime function local to libgcc, streaming compatible and preserves more registers than the base PCS requires, but we don't rely on that here. */ @@ -84,12 +87,66 @@ __attribute__ ((visibility ("hidden"))) void __libgcc_arm_za_disable (void); /* Disable the SME ZA state in case an unwound frame used the ZA - lazy saving scheme. */ + lazy saving scheme. And unwind the GCS for EH. */ #undef _Unwind_Frames_Extra #define _Unwind_Frames_Extra(x) \ do \ { \ __libgcc_arm_za_disable (); \ + if (__builtin_aarch64_chkfeat (CHKFEAT_GCS) == 0) \ + { \ + for (_Unwind_Word n = (x); n != 0; n--) \ + __builtin_aarch64_gcspopm (); \ + } \ + } \ + while (0) + +/* On signal entry the OS places a token on the GCS that can be used to + verify the integrity of the GCS pointer on signal return. It also + places the signal handler return address (the restorer that calls the + signal return syscall) on the GCS so the handler can return. + Because of this token, each stack frame visited during unwinding has + exactly one corresponding entry on the GCS, so the frame count is + the number of entries that will have to be popped at EH return time. + + Note: This depends on the GCS signal ABI of the OS. + + When unwinding across a stack frame for each frame the corresponding + entry is checked on the GCS against the computed return address from + the normal stack. If they don't match then _URC_FATAL_PHASE2_ERROR + is returned. This check is omitted if + + 1. GCS is disabled. Note: asynchronous GCS disable is supported here + if GCSPR and the GCS remains readable. + 2. Non-catchable exception where exception_class == 0. Note: the + pthread cancellation implementation in glibc sets exception_class + to 0 when the unwinder is used for cancellation cleanup handling, + so this allows the GCS to get out of sync during cancellation. + This weakens security but avoids an ABI break in glibc. + 3. Zero return address which marks the outermost stack frame. + 4. Signal stack frame, the GCS entry is an OS specific token then + with the top bit set. + */ +#undef _Unwind_Frames_Increment +#define _Unwind_Frames_Increment(exc, context, frames) \ + do \ + { \ + frames++; \ + if (__builtin_aarch64_chkfeat (CHKFEAT_GCS) != 0 \ + || exc->exception_class == 0 \ + || _Unwind_GetIP (context) == 0) \ + break; \ + const _Unwind_Word *gcs = __builtin_aarch64_gcspr (); \ + if (_Unwind_IsSignalFrame (context)) \ + { \ + if (gcs[frames] >> 63 == 0) \ + return _URC_FATAL_PHASE2_ERROR; \ + } \ + else \ + { \ + if (gcs[frames] != _Unwind_GetIP (context)) \ + return _URC_FATAL_PHASE2_ERROR; \ + } \ } \ while (0)
reply other threads:[~2024-02-14 15:37 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20240214153750.11ACE385E02F@sourceware.org \ --to=nsz@gcc.gnu.org \ --cc=gcc-cvs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).