[Bug breakpoints/25901] New: Intel CET / control flow instruction `endbr64` breaks prologue analysis

[Bug breakpoints/25901] New: Intel CET / control flow instruction `endbr64` breaks prologue analysis

[simark at simark dot ca]

https://sourceware.org/bugzilla/show_bug.cgi?id=25901

            Bug ID: 25901
           Summary: Intel CET / control flow instruction `endbr64` breaks
                    prologue analysis
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: breakpoints
          Assignee: unassigned at sourceware dot org
          Reporter: simark at simark dot ca
  Target Milestone: ---

I get failures when running a simple `make check TESTS="gdb.base/break.exp"` on
Ubuntu 20.04.

FAIL: gdb.base/break.exp: breakpoint at start of multi line if conditional
FAIL: gdb.base/break.exp: breakpoint at start of multi line while conditional
FAIL: gdb.base/break.exp: breakpoint info
FAIL: gdb.base/break.exp: info break 3-5
FAIL: gdb.base/break.exp: check disable with history values
FAIL: gdb.base/break.exp: check disable with convenience values
FAIL: gdb.base/break.exp: run until function breakpoint
FAIL: gdb.base/break.exp: run until file:function(6) breakpoint
FAIL: gdb.base/break.exp: run until file:function(5) breakpoint
FAIL: gdb.base/break.exp: run until file:function(4) breakpoint
FAIL: gdb.base/break.exp: run until file:function(3) breakpoint
FAIL: gdb.base/break.exp: run until file:function(2) breakpoint
FAIL: gdb.base/break.exp: run until file:function(1) breakpoint
FAIL: gdb.base/break.exp: run until quoted breakpoint
FAIL: gdb.base/break.exp: Temporary breakpoint info
FAIL: gdb.base/break.exp: run to factorial(6)
FAIL: gdb.base/break.exp: continue to factorial(5)
FAIL: gdb.base/break.exp: backtrace from factorial(5)
FAIL: gdb.base/break.exp: next to recursive call
FAIL: gdb.base/break.exp: next over recursive call
FAIL: gdb.base/break.exp: backtrace from factorial(5.1)

The underlying issue is that control flow protection is enabled in the distro's
gcc 9.3.0 compiler.  Running:

  make check TESTS="gdb.base/break.exp"
RUNTESTFLAGS="--target_board=unix/-fcf-protection=none"

does not show failures.

Let's take this dummy program:

int main(void)
{
  return 0;
}

and build it without control flow protection:

$ gcc test.c -g3 -O0 -fcf-protection=none
$ readelf --debug-dump=decodedline a.out                               
Contents of the .debug_line section:

CU: ./test.c:
File name                            Line number    Starting address    View   
Stmt
test.c                                         2              0x1129           
   x
test.c                                         3              0x112d           
   x
test.c                                         4              0x1132           
   x
test.c                                         4              0x1134           
   x

$ ./gdb -q -nx --data-directory=data-directory a.out
Reading symbols from a.out...
(gdb) disassemble main
Dump of assembler code for function main:
   0x0000000000001129 <+0>:     push   %rbp
   0x000000000000112a <+1>:     mov    %rsp,%rbp
   0x000000000000112d <+4>:     mov    $0x0,%eax
   0x0000000000001132 <+9>:     pop    %rbp
   0x0000000000001133 <+10>:    retq   
End of assembler dump.
(gdb) b main
Breakpoint 1 at 0x112d: file test.c, line 3.

The breakpoint is correctly put after the prologue.

Let's now build it with control flow protection:

$ gcc test.c -g3 -O0 -fcf-protection=full
$ readelf --debug-dump=decodedline a.out            
Contents of the .debug_line section:

CU: ./test.c:
File name                            Line number    Starting address    View   
Stmt
test.c                                         2              0x1129           
   x
test.c                                         3              0x1131           
   x
test.c                                         4              0x1136           
   x
test.c                                         4              0x1138           
   x
$ ./gdb -q -nx --data-directory=data-directory a.out
Reading symbols from a.out...
(gdb) disassemble main
Dump of assembler code for function main:
   0x0000000000001129 <+0>:     endbr64 
   0x000000000000112d <+4>:     push   %rbp
   0x000000000000112e <+5>:     mov    %rsp,%rbp
   0x0000000000001131 <+8>:     mov    $0x0,%eax
   0x0000000000001136 <+13>:    pop    %rbp
   0x0000000000001137 <+14>:    retq   
End of assembler dump.
(gdb) b main
Breakpoint 1 at 0x1129: file test.c, line 2.

The breakpoint is wrongfully put at the first byte of the function.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug breakpoints/25901] Intel CET / control flow instruction `endbr64` breaks prologue analysis

[simark at simark dot ca]

https://sourceware.org/bugzilla/show_bug.cgi?id=25901

--- Comment #1 from Simon Marchi <simark at simark dot ca> ---
This was fixed by

 
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ac4a4f1cd7dceeeb17d0b8c077c874f2247acbf0

But I'll leave the bug open, as the same issue is present with i386.  There is
a proposed patch series for it here:

  https://sourceware.org/pipermail/gdb-patches/2020-June/169847.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug breakpoints/25901] Intel CET / control flow instruction `endbr64` breaks prologue analysis

[ssbssa at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=25901

Hannes Domani <ssbssa at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ssbssa at sourceware dot org
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED
   Target Milestone|---                         |11.1

--- Comment #2 from Hannes Domani <ssbssa at sourceware dot org> ---
(In reply to Simon Marchi from comment #1)
> But I'll leave the bug open, as the same issue is present with i386.  There
> is a proposed patch series for it here:
> 
>   https://sourceware.org/pipermail/gdb-patches/2020-June/169847.html

This series landed here:
https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=14f9473ca225290680c8b21240cdca49f8d3b332

So I'm closing this.

-- 
You are receiving this mail because:
You are on the CC list for the bug.