[binutils-gdb] gdb/arm: Fix M-profile EXC_RETURN

[binutils-gdb] gdb/arm: Fix M-profile EXC_RETURN

[Luis Machado]

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=23295de1317433210cb0303ef304e68763607c78

commit 23295de1317433210cb0303ef304e68763607c78
Author: Luis Machado <luis.machado@arm.com>
Date:   Wed Oct 26 13:00:50 2022 +0100

    gdb/arm: Fix M-profile EXC_RETURN
    
    Arm v8-M Architecture Reference Manual,
    D1.2.95 EXC_RETURN, Exception Return Payload
    describes ES bit:
    
    "ES, bit [0]
         Exception Secure. The security domain the exception was taken to.
         The possible values of this bit are:
           0 Non-secure.
           1 Secure"
    
    arm-tdep.c:3443, arm_m_exception_cache () function tests this bit:
    
      exception_domain_is_secure = (bit (lr, 0) == 0);
    
    The test is negated!
    
    Later on line 3553, the condition evaluates if an additional state
    context is stacked:
    
      /* With the Security extension, the hardware saves R4..R11 too.  */
      if (tdep->have_sec_ext && secure_stack_used
          && (!default_callee_register_stacking || exception_domain_is_secure))
    
    RM, B3.19 Exception entry, context stacking
    reads:
    RPLHM "In a PE with the Security Extension, on taking an exception,
    the PE hardware:
      ...
      2. If exception entry requires a transition from Secure state to
         Non-secure state, the PE hardware extends the stack frame and also
         saves additional state context."
    
    So we should test for !exception_domain_is_secure instead of non-negated
    value!
    These two bugs compensate each other so unstacking works correctly.
    
    But another test of exception_domain_is_secure (negated due to the
    first bug) prevents arm_unwind_secure_frames to work as expected:
    
      /* Unwinding from non-secure to secure can trip security
         measures.  In order to avoid the debugger being
         intrusive, rely on the user to configure the requested
         mode.  */
      if (secure_stack_used && !exception_domain_is_secure
          && !arm_unwind_secure_frames)
    
    Test with GNU gdb (GDB) 13.0.50.20221016-git.
    Stopped in a non-secure handler:
    
     (gdb) set arm unwind-secure-frames 0
     (gdb) bt
     #0  HAL_SYSTICK_Callback () at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/NonSecure/Src/nsmain.c:490
     #1  0x0804081c in SysTick_Handler ()
         at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/NonSecure/Src/nsstm32l5xx_it.c:134
     #2  <signal handler called>
     #3  HAL_GPIO_ReadPin (GPIOx=0x52020800, GPIO_Pin=8192)
         at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/Drivers/STM32L5xx_HAL_Driver/Src/stm32l5xx_hal_gpio.c:386
     #4  0x0c000338 in SECURE_Mode () at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/Secure/Src/main.c:86
     #5  0x080403f2 in main () at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/NonSecure/Src/nsmain.c:278
     Backtrace stopped: previous frame inner to this frame (corrupt stack?)
    
    The frames #3 and #4 are secure. backtrace should stop before #3.
    
    Stopped in a secure handler:
    
     (gdb) bt
     #0  HAL_SYSTICK_Callback () at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/Secure/Src/main.c:425
     #1  0x0c000b6a in SysTick_Handler ()
         at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/Secure/Src/stm32l5xx_it.c:234
     warning: Non-secure to secure stack unwinding disabled.
     #2  <signal handler called>
    
    The exception from secure to secure erroneously stops unwinding. It should
    continue as far as the security unlimited backtrace:
    
     (gdb) set arm unwind-secure-frames 1
     (gdb) si <-- used to rebuild frame cache after change of unwind-secure-frames
     0x0c0008e6      425       if (SecureTimingDelay != 0U)
     (gdb) bt
     #0  0x0c0008e6 in HAL_SYSTICK_Callback () at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/Secure/Src/main.c:425
     #1  0x0c000b6a in SysTick_Handler ()
         at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/Secure/Src/stm32l5xx_it.c:234
     #2  <signal handler called>
     #3  0x0c000328 in SECURE_Mode () at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/Secure/Src/main.c:88
     #4  0x080403f2 in main () at C:/dvl/stm32l5trustzone/GPIO_IOToggle_TrustZone/NonSecure/Src/nsmain.c:278
    
     Backtrace stopped: previous frame inner to this frame (corrupt stack?)
    
    Set exception_domain_is_secure to the value expected by its name.
    Fix exception_domain_is_secure usage in the additional state context
    stacking condition.
    
    Signed-off-by: Tomas Vanek <vanekt@fbl.cz>

Diff:
---
 gdb/arm-tdep.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gdb/arm-tdep.c b/gdb/arm-tdep.c
index 247e5522b8e..7cb3f5f3050 100644
--- a/gdb/arm-tdep.c
+++ b/gdb/arm-tdep.c
@@ -3489,7 +3489,7 @@ arm_m_exception_cache (frame_info_ptr this_frame)
 	{
 	  secure_stack_used = (bit (lr, 6) != 0);
 	  default_callee_register_stacking = (bit (lr, 5) != 0);
-	  exception_domain_is_secure = (bit (lr, 0) == 0);
+	  exception_domain_is_secure = (bit (lr, 0) != 0);
 
 	  /* Unwinding from non-secure to secure can trip security
 	     measures.  In order to avoid the debugger being
@@ -3599,7 +3599,7 @@ arm_m_exception_cache (frame_info_ptr this_frame)
 
       /* With the Security extension, the hardware saves R4..R11 too.  */
       if (tdep->have_sec_ext && secure_stack_used
-	  && (!default_callee_register_stacking || exception_domain_is_secure))
+	  && (!default_callee_register_stacking || !exception_domain_is_secure))
 	{
 	  /* Read R4..R11 from the integer callee registers.  */
 	  cache->saved_regs[4].set_addr (unwound_sp + 0x08);