* [AArch64][3/6] DWARF unwinder support for signed return address
[not found] <c8484136-c4f2-cda2-6a0d-f8293b111cdd@foss.arm.com>
@ 2017-08-09 12:17 ` Jiong Wang
2017-08-10 11:08 ` Pedro Alves
2017-08-09 12:18 ` [AArch64][5/6] Implement gdbarch_core_read_description Jiong Wang
2017-08-09 12:18 ` [AArch64][4/6] Prologue scan unwinder support for signed return address Jiong Wang
2 siblings, 1 reply; 10+ messages in thread
From: Jiong Wang @ 2017-08-09 12:17 UTC (permalink / raw)
To: GDB
[-- Attachment #1: Type: text/plain, Size: 2049 bytes --]
This patch add DWARF unwinder support for signed (mangled) return address on
AArch64.
If return address is signed, GDB unwinders will be affected, as GDB won't be
able to unwind to previous frame use the signed address. Therefore, GDB needs
a mechanism to restore the original value of return address accurately.
Currently, the mechanism on AArch64 is:
1. DW_CFA_AARCH64_negate_ra_state (multiplexing with DW_CFA_GNU_window_save)
is generated whenever return address (LR register) is signed (mangled) or
authenticated (unmangled). The unwinder can know the signing status of
return address at any point after finishing scaning function FDE.
2. A new DWARF pseudo register "ra_state" is introduced, the signing status
is kept in this register after unwinders finishing scaning function FDE.
3. When the unwinders unwinding PC, the value of "ra_state" needs to be
referenced. If the value is "1" which means true, unwinders need to mask
off the pointer signature to restore the original pointer value. The mask
for return address which is a code pointer is available at "pauth_cmask"
register.
gdb/
2017-08-09 Jiong Wang<jiong.wang@arm.com>
Yao Qi<yao.qi@linaro.org>
* aarch64-tdep.c: Include dwarf2.h.
(aarch64_dwarf2_prev_register): Mask off signature if LR is
signed.
(aarch64_dwarf2_frame_init_reg): Initialize DWARF unwinding rule
for "pauth" registers.
(aarch64_execute_dwarf_cfa_vendor_op): New function.
(aarch64_dwarf_reg_to_regnum): Map "pauth" DWARF registers.
(aarch64_pseudo_register_name): Handle "pauth" registers.
(aarch64_pseudo_register_type): Likewise.
(aarch64_pseudo_register_reggroup_p): Likewise.
(aarch64_gdbarch_init): Support the new "ra_state" pseudo
register. Register execute_dwarf_cfa_vendor_op method.
* aarch64-tdep.h (AARCH64_DWARF_PAUTH_RA_STATE): New define.
(AARCH64_DWARF_PAUTH_DMASK): Likewise.
(AARCH64_DWARF_PAUTH_CMASK): Likewise.
(struct aarch64_optional_regnum) <pauth_ra_state_regnum>: New
field.
[-- Attachment #2: gdb-3.patch --]
[-- Type: text/x-patch, Size: 10293 bytes --]
diff --git a/gdb/aarch64-tdep.c b/gdb/aarch64-tdep.c
index 7a3493c..b505013 100644
--- a/gdb/aarch64-tdep.c
+++ b/gdb/aarch64-tdep.c
@@ -35,6 +35,7 @@
#include "frame-base.h"
#include "trad-frame.h"
#include "objfiles.h"
+#include "dwarf2.h"
#include "dwarf2-frame.h"
#include "gdbtypes.h"
#include "prologue-value.h"
@@ -1046,12 +1047,30 @@ static struct value *
aarch64_dwarf2_prev_register (struct frame_info *this_frame,
void **this_cache, int regnum)
{
+ struct gdbarch *gdbarch = get_frame_arch (this_frame);
CORE_ADDR lr;
switch (regnum)
{
case AARCH64_PC_REGNUM:
lr = frame_unwind_register_unsigned (this_frame, AARCH64_LR_REGNUM);
+ /* Also fetch return address signing status, mask off the signature bits
+ if it's signed. */
+ if (aarch64_tdep_has_pauth_p (gdbarch_tdep (gdbarch)))
+ {
+ struct gdbarch_tdep *tdep = gdbarch_tdep (gdbarch);
+ int ra_state_column
+ = tdep->regnum.pauth_ra_state_regnum + gdbarch_num_regs (gdbarch);
+ CORE_ADDR ra_state = frame_unwind_register_unsigned (this_frame,
+ ra_state_column);
+ if (ra_state)
+ {
+ int cmask_num = tdep->regnum.pauth_reg_base + 1;
+ CORE_ADDR cmask
+ = frame_unwind_register_unsigned (this_frame, cmask_num);
+ lr = lr & ~cmask;
+ }
+ }
return frame_unwind_got_constant (this_frame, regnum, lr);
default:
@@ -1067,6 +1086,33 @@ aarch64_dwarf2_frame_init_reg (struct gdbarch *gdbarch, int regnum,
struct dwarf2_frame_state_reg *reg,
struct frame_info *this_frame)
{
+ struct gdbarch_tdep *tdep = gdbarch_tdep (gdbarch);
+
+ /* Init pauth registers. */
+ if (aarch64_tdep_has_pauth_p (tdep))
+ {
+ int ra_state_num
+ = tdep->regnum.pauth_ra_state_regnum + gdbarch_num_regs (gdbarch);
+ int dmask_num = tdep->regnum.pauth_reg_base;
+ int cmask_num = tdep->regnum.pauth_reg_base + 1;
+
+ if (regnum == ra_state_num)
+ {
+ /* Initialize RA_STATE column to zero. */
+ static unsigned char exp_0 = 0x30; /* DW_OP_lit0. */
+
+ reg->how = DWARF2_FRAME_REG_SAVED_VAL_EXP;
+ reg->loc.exp = &exp_0;
+ reg->exp_len = 1;
+ return;
+ }
+ else if (regnum == cmask_num || regnum == dmask_num)
+ {
+ reg->how = DWARF2_FRAME_REG_SAME_VALUE;
+ return;
+ }
+ }
+
switch (regnum)
{
case AARCH64_PC_REGNUM:
@@ -1079,6 +1125,40 @@ aarch64_dwarf2_frame_init_reg (struct gdbarch *gdbarch, int regnum,
}
}
+/* Implement the execute_dwarf_cfa_vendor_op method. */
+
+static bool
+aarch64_execute_dwarf_cfa_vendor_op (struct gdbarch *gdbarch, gdb_byte op,
+ struct dwarf2_frame_state *fs)
+{
+ struct dwarf2_frame_state_reg *ra_state_column;
+ static unsigned char exp_0 = 0x30; /* DW_OP_lit0. */
+ static unsigned char exp_1 = 0x31; /* DW_OP_lit1. */
+
+ /* Only DW_CFA_GNU_window_save is expected on AArch64. */
+ if (op != DW_CFA_GNU_window_save)
+ return false;
+
+
+ /* Allocate RA_STATE column if it's not allocated yet. */
+ dwarf2_frame_state_alloc_regs (&fs->regs, AARCH64_DWARF_PAUTH_RA_STATE + 1);
+
+ /* Toggle the status of RA_STATE column between 0 and 1. This column is
+ therefore using value expression rule as currently it's the only rule to
+ represent constant. */
+ ra_state_column = &(fs->regs.reg[AARCH64_DWARF_PAUTH_RA_STATE]);
+ ra_state_column->how = DWARF2_FRAME_REG_SAVED_VAL_EXP;
+
+ if (ra_state_column->loc.exp == NULL || ra_state_column->loc.exp == &exp_0)
+ ra_state_column->loc.exp = &exp_1;
+ else
+ ra_state_column->loc.exp = &exp_0;
+
+ ra_state_column->exp_len = 1;
+
+ return true;
+}
+
/* When arguments must be pushed onto the stack, they go on in reverse
order. The code below implements a FILO (stack) to do this. */
@@ -1777,6 +1857,8 @@ aarch64_vnb_type (struct gdbarch *gdbarch)
static int
aarch64_dwarf_reg_to_regnum (struct gdbarch *gdbarch, int reg)
{
+ struct gdbarch_tdep *tdep = gdbarch_tdep (gdbarch);
+
if (reg >= AARCH64_DWARF_X0 && reg <= AARCH64_DWARF_X0 + 30)
return AARCH64_X0_REGNUM + reg - AARCH64_DWARF_X0;
@@ -1786,6 +1868,16 @@ aarch64_dwarf_reg_to_regnum (struct gdbarch *gdbarch, int reg)
if (reg >= AARCH64_DWARF_V0 && reg <= AARCH64_DWARF_V0 + 31)
return AARCH64_V0_REGNUM + reg - AARCH64_DWARF_V0;
+ if (aarch64_tdep_has_pauth_p (tdep))
+ {
+ if (reg >= AARCH64_DWARF_PAUTH_DMASK && reg <= AARCH64_DWARF_PAUTH_CMASK)
+ return tdep->regnum.pauth_reg_base + reg - AARCH64_DWARF_PAUTH_DMASK;
+
+ if (reg == AARCH64_DWARF_PAUTH_RA_STATE)
+ /* AARCH64_PAUTH_RA_STATE_REGNUM is a pseudo register. */
+ return tdep->regnum.pauth_ra_state_regnum + gdbarch_num_regs (gdbarch);
+ }
+
return -1;
}
\f
@@ -2120,6 +2212,8 @@ aarch64_gen_return_address (struct gdbarch *gdbarch,
static const char *
aarch64_pseudo_register_name (struct gdbarch *gdbarch, int regnum)
{
+ struct gdbarch_tdep *tdep = gdbarch_tdep (gdbarch);
+
static const char *const q_name[] =
{
"q0", "q1", "q2", "q3",
@@ -2197,6 +2291,21 @@ aarch64_pseudo_register_name (struct gdbarch *gdbarch, int regnum)
if (regnum >= AARCH64_B0_REGNUM && regnum < AARCH64_B0_REGNUM + 32)
return b_name[regnum - AARCH64_B0_REGNUM];
+ if (aarch64_tdep_has_pauth_p (tdep))
+ {
+ /* RA_STATE is the first pseudo register for pointer authentication
+ feature. */
+ int ra_state = tdep->regnum.pauth_ra_state_regnum;
+
+ /* RA_STATE is a pseudo register whose value will be initialized and
+ referenced only during frame unwinding. GDB should not read its
+ value from low level methods. In some functions, GDB will read a
+ register if it has a name. For example, mi_cmd_trace_frame_collected.
+ Therefore, we make RA_STATE anonymous to avoid such reading. */
+ if (regnum == ra_state)
+ return "";
+ }
+
internal_error (__FILE__, __LINE__,
_("aarch64_pseudo_register_name: bad register number %d"),
regnum);
@@ -2207,6 +2316,8 @@ aarch64_pseudo_register_name (struct gdbarch *gdbarch, int regnum)
static struct type *
aarch64_pseudo_register_type (struct gdbarch *gdbarch, int regnum)
{
+ struct gdbarch_tdep *tdep = gdbarch_tdep (gdbarch);
+
regnum -= gdbarch_num_regs (gdbarch);
if (regnum >= AARCH64_Q0_REGNUM && regnum < AARCH64_Q0_REGNUM + 32)
@@ -2224,6 +2335,10 @@ aarch64_pseudo_register_type (struct gdbarch *gdbarch, int regnum)
if (regnum >= AARCH64_B0_REGNUM && regnum < AARCH64_B0_REGNUM + 32)
return aarch64_vnb_type (gdbarch);
+ if (aarch64_tdep_has_pauth_p (tdep)
+ && regnum == tdep->regnum.pauth_ra_state_regnum)
+ return builtin_type (gdbarch)->builtin_uint64;
+
internal_error (__FILE__, __LINE__,
_("aarch64_pseudo_register_type: bad register number %d"),
regnum);
@@ -2235,6 +2350,8 @@ static int
aarch64_pseudo_register_reggroup_p (struct gdbarch *gdbarch, int regnum,
struct reggroup *group)
{
+ struct gdbarch_tdep *tdep = gdbarch_tdep (gdbarch);
+
regnum -= gdbarch_num_regs (gdbarch);
if (regnum >= AARCH64_Q0_REGNUM && regnum < AARCH64_Q0_REGNUM + 32)
@@ -2249,6 +2366,11 @@ aarch64_pseudo_register_reggroup_p (struct gdbarch *gdbarch, int regnum,
return group == all_reggroup || group == vector_reggroup;
else if (regnum >= AARCH64_B0_REGNUM && regnum < AARCH64_B0_REGNUM + 32)
return group == all_reggroup || group == vector_reggroup;
+ /* Don't assign RA_STATE to any group. This pseudo register is supposed to be
+ used during unwinding only. Don't display it for "info register". */
+ if (aarch64_tdep_has_pauth_p (tdep)
+ && regnum == tdep->regnum.pauth_ra_state_regnum)
+ return 0;
return group == all_reggroup;
}
@@ -2891,6 +3013,7 @@ aarch64_gdbarch_init (struct gdbarch_info info, struct gdbarch_list *arches)
int num_pseudo_regs = 0;
struct aarch64_optional_regnum *regnum;
int first_pauth_regnum = -1;
+ int pauth_ra_state_regnum = -1;
/* Ensure we always have a target descriptor. */
if (!tdesc_has_registers (tdesc))
@@ -2939,6 +3062,7 @@ aarch64_gdbarch_init (struct gdbarch_info info, struct gdbarch_list *arches)
if (feature_pauth)
{
first_pauth_regnum = num_regs;
+ pauth_ra_state_regnum = num_pseudo_regs;
/* Validate the descriptor provides the mandatory PAUTH registers
and allocate their numbers. */
for (i = 0; i < ARRAY_SIZE (aarch64_pauth_register_names); i++)
@@ -2948,6 +3072,7 @@ aarch64_gdbarch_init (struct gdbarch_info info, struct gdbarch_list *arches)
aarch64_pauth_register_names[i]);
num_regs += i;
+ num_pseudo_regs += 1; /* Count RA_STATE pseudo register. */
}
if (!valid_p)
@@ -2988,6 +3113,7 @@ aarch64_gdbarch_init (struct gdbarch_info info, struct gdbarch_list *arches)
tdep->jb_pc = -1; /* Longjump support not enabled by default. */
tdep->jb_elt_size = 8;
tdep->regnum.pauth_reg_base = first_pauth_regnum;
+ tdep->regnum.pauth_ra_state_regnum = pauth_ra_state_regnum;
set_gdbarch_push_dummy_call (gdbarch, aarch64_push_dummy_call);
set_gdbarch_frame_align (gdbarch, aarch64_frame_align);
@@ -3059,6 +3185,9 @@ aarch64_gdbarch_init (struct gdbarch_info info, struct gdbarch_list *arches)
gdbarch_init_osabi (info, gdbarch);
dwarf2_frame_set_init_reg (gdbarch, aarch64_dwarf2_frame_init_reg);
+ /* Register DWARF CFA vendor handler. */
+ set_gdbarch_execute_dwarf_cfa_vendor_op (gdbarch,
+ aarch64_execute_dwarf_cfa_vendor_op);
/* Add some default predicates. */
frame_unwind_append_unwinder (gdbarch, &aarch64_stub_unwind);
diff --git a/gdb/aarch64-tdep.h b/gdb/aarch64-tdep.h
index 5ece079..88b77b8 100644
--- a/gdb/aarch64-tdep.h
+++ b/gdb/aarch64-tdep.h
@@ -29,6 +29,9 @@ struct regset;
/* AArch64 Dwarf register numbering. */
#define AARCH64_DWARF_X0 0
#define AARCH64_DWARF_SP 31
+#define AARCH64_DWARF_PAUTH_RA_STATE 34
+#define AARCH64_DWARF_PAUTH_DMASK 35
+#define AARCH64_DWARF_PAUTH_CMASK 36
#define AARCH64_DWARF_V0 64
/* Register numbers of various important registers. */
@@ -80,6 +83,8 @@ struct aarch64_optional_regnum
{
/* First pauth register number. */
int pauth_reg_base;
+ /* pauth ra_state register number. */
+ int pauth_ra_state_regnum;
};
/* Target-dependent structure in gdbarch. */
^ permalink raw reply [flat|nested] 10+ messages in thread* [AArch64][4/6] Prologue scan unwinder support for signed return address
[not found] <c8484136-c4f2-cda2-6a0d-f8293b111cdd@foss.arm.com>
2017-08-09 12:17 ` [AArch64][3/6] DWARF unwinder support for signed return address Jiong Wang
2017-08-09 12:18 ` [AArch64][5/6] Implement gdbarch_core_read_description Jiong Wang
@ 2017-08-09 12:18 ` Jiong Wang
2 siblings, 0 replies; 10+ messages in thread
From: Jiong Wang @ 2017-08-09 12:18 UTC (permalink / raw)
To: GDB
[-- Attachment #1: Type: text/plain, Size: 1021 bytes --]
This patch add prologue scan unwinder support for signed (mangled) return
address on AArch64.
aarch64_analyze_prologue is taught about the new "paciasp" and "autiasp"
instructions which are used to sign and authenticate return address. Prologue
scan unwinder scan their existence to record the signing status of return
address in "ra_state" register which will be used in register unwind method to
restore original value of return address.
I have checked "autiasp" in prologue scanner although it is supposed to be in
epilogue only if the debuggee is compiled from GCC.
gdb/
2017-08-09 Jiong Wang<jiong.wang@arm.com>
* aarch64-tdep.c (aarch64_analyze_prologue): Recognize "paciasp"
and "autiasp". Record signing status of return address in
"ra_state".
(aarch64_prologue_prev_register): Mask off signature from return
address if it's signed.
(aarch64_analyze_prologue_test): Add new unit test for return
address signing instruction.
[-- Attachment #2: gdb-4.patch --]
[-- Type: text/x-patch, Size: 4203 bytes --]
commit 221194ec9eaa7113ff90632adbb68e0881f07467
Author: Jiong Wang <jiong.wang@arm.com>
Date: Fri Aug 4 17:14:15 2017 +0100
[Patch 4]
diff --git a/gdb/aarch64-tdep.c b/gdb/aarch64-tdep.c
index b505013..5f7a5a2 100644
--- a/gdb/aarch64-tdep.c
+++ b/gdb/aarch64-tdep.c
@@ -453,6 +453,40 @@ aarch64_analyze_prologue (struct gdbarch *gdbarch,
/* Stop analysis on branch. */
break;
}
+ else if (inst.opcode->iclass == ic_system)
+ {
+ struct gdbarch_tdep *tdep = gdbarch_tdep (gdbarch);
+ /* Record the state of return address.
+ 1 means it is mangled, otherwise 0. */
+ int ra_state_val = 0;
+
+ /* PACIASP (HINT 25).
+ we can't match the name because PACIASP is an alias of HINT while
+ we are passing a TRUE noaliases_p to aarch64_decode_insn. */
+ if (insn == 0xd503233f)
+ ra_state_val = 1;
+ /* AUTIASP (HINT 29). */
+ else if (insn == 0xd50323bf)
+ ra_state_val = 0;
+ else
+ {
+ if (aarch64_debug)
+ {
+ debug_printf ("aarch64: prologue analysis gave up addr=%s"
+ " opcode=0x%x\n",
+ core_addr_to_string_nz (start), insn);
+ }
+ break;
+ }
+
+ if (aarch64_tdep_has_pauth_p (tdep) && cache != NULL)
+ {
+ int ra_state = (tdep->regnum.pauth_ra_state_regnum
+ + gdbarch_num_regs (gdbarch));
+
+ trad_frame_set_value (cache->saved_regs, ra_state, ra_state_val);
+ }
+ }
else
{
if (aarch64_debug)
@@ -644,6 +678,58 @@ aarch64_analyze_prologue_test (void)
== -1);
}
}
+
+ /* Test a prologue in which there is return address signing instruction. */
+ {
+ struct aarch64_prologue_cache cache;
+ cache.saved_regs = trad_frame_alloc_saved_regs (gdbarch);
+
+ struct gdbarch_info info;
+
+ gdbarch_info_init (&info);
+ info.bfd_arch_info = bfd_scan_arch ("aarch64");
+ info.target_desc = tdesc_aarch64_pauth;
+
+ struct gdbarch *gdbarch = gdbarch_find_by_info (info);
+ SELF_CHECK (gdbarch != NULL);
+
+ int ra_state = (gdbarch_tdep (gdbarch)->regnum.pauth_ra_state_regnum
+ + gdbarch_num_regs (gdbarch));
+
+ static const uint32_t insns[] = {
+ 0xd503233f, /* paciasp (hint 25) */
+ 0xa9bd7bfd, /* stp x29, x30, [sp, #-48]! */
+ 0x910003fd, /* mov x29, sp */
+ 0xf801c3f3, /* str x19, [sp, #28] */
+ 0xb9401fa0, /* ldr x19, [x29, #28] */
+ };
+ instruction_reader_test reader (insns);
+
+ CORE_ADDR end = aarch64_analyze_prologue (gdbarch, 0, 128, &cache, reader);
+
+ SELF_CHECK (end == 4 * 4);
+
+ SELF_CHECK (cache.framereg == AARCH64_FP_REGNUM);
+ SELF_CHECK (cache.framesize == 48);
+
+ for (int i = 0; i < AARCH64_X_REGISTER_COUNT; i++)
+ {
+ if (i == 19)
+ SELF_CHECK (cache.saved_regs[i].addr == -20);
+ else if (i == AARCH64_FP_REGNUM)
+ SELF_CHECK (cache.saved_regs[i].addr == -48);
+ else if (i == AARCH64_LR_REGNUM)
+ SELF_CHECK (cache.saved_regs[i].addr == -40);
+ else
+ SELF_CHECK (cache.saved_regs[i].addr == -1);
+ }
+
+ if (aarch64_tdep_has_pauth_p (gdbarch_tdep (gdbarch)))
+ {
+ SELF_CHECK (trad_frame_value_p (cache.saved_regs, ra_state));
+ SELF_CHECK (cache.saved_regs[ra_state].addr == 1);
+ }
+ }
}
} // namespace selftests
#endif /* GDB_SELF_TEST */
@@ -853,8 +939,30 @@ aarch64_prologue_prev_register (struct frame_info *this_frame,
if (prev_regnum == AARCH64_PC_REGNUM)
{
CORE_ADDR lr;
+ struct gdbarch *gdbarch = get_frame_arch (this_frame);
+ struct gdbarch_tdep *tdep = gdbarch_tdep (gdbarch);
lr = frame_unwind_register_unsigned (this_frame, AARCH64_LR_REGNUM);
+
+ if (aarch64_tdep_has_pauth_p (tdep))
+ {
+ int ra_state_regno = (tdep->regnum.pauth_ra_state_regnum
+ + gdbarch_num_regs (gdbarch));
+ if (trad_frame_value_p (cache->saved_regs, ra_state_regno))
+ {
+ CORE_ADDR ra_state
+ = frame_unwind_register_unsigned (this_frame, ra_state_regno);
+
+ if (ra_state)
+ {
+ int cmask_num = tdep->regnum.pauth_reg_base + 1;
+ CORE_ADDR cmask
+ = frame_unwind_register_unsigned (this_frame, cmask_num);
+ lr = lr & ~cmask;
+ }
+ }
+ }
+
return frame_unwind_got_constant (this_frame, prev_regnum, lr);
}
^ permalink raw reply [flat|nested] 10+ messages in thread