abi-aa icon indicating copy to clipboard operation
abi-aa copied to clipboard

DW_CFA_AARCH64_negate_ra_state_with_pc is fundamentally flawed

Open smithp35 opened this issue 8 months ago • 0 comments

The DW_CFA_AARCH64_negate_ra_state_with_pc https://github.com/ARM-software/abi-aa/blob/main/aadwarf64/aadwarf64.rst#44call-frame-instructions

A dwarf 'program' reads linearly through a file from a start location and needs to recreate the frame status that the CPU would see if it were to execute to that point. Most importantly, it does not follow the flow-graph of the program that the CPU executes.

The following program shows how control flow could lead to an incorrect location being saved.

  .cfi_startproc 
func:
   // Frame setup
   .cfi_save ...
   .cfi_negate_ra_with_pc  // Save auth state and remember location
   some code
   CBZ L0
   some more code
   // Restore frame
   .cfi_negate_ra_with_pc  // Restore state (using previously stored location)
   .cfi_restore ...
   RET
L0:
   .cfi_save ...
   .cfi_negate_ra_with_pc  // ERROR - this saves the wrong location
   Some additional code
   .cfi_negate_ra_with_pc     // Uses wrong location.
   RET
...  

It is not sufficient to define that the first .cfi_negate_ra_with_pc does the save as this may not be the first directive executed by the control flow, and we do not want to restrict the control flow of a program so that this directive can work.

A proposal will be made for a replacement for .cfi_negate_ra_with_pc and this directive will be deprecated.

smithp35 avatar Apr 29 '25 13:04 smithp35