[Bug gdb/29421] New: Extend aarch64 pauth xml for gdbstub and kernel mode

[Bug gdb/29421] New: Extend aarch64 pauth xml for gdbstub and kernel mode

[rth at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

            Bug ID: 29421
           Summary: Extend aarch64 pauth xml for gdbstub and kernel mode
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: enhancement
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: rth at gcc dot gnu.org
  Target Milestone: ---

The current definition of org.gnu.gdb.aarch64.pauth only applies
to TTBR0, which is sufficient for native user-mode debugging. It
would be nice to extend this to TTBR1, so that it may be used for
gdbstub debugging, and the cpu is in EL[12].

My suggestion is simply to add pauth_{d,c}mask1 (possibly within
a different feature name).  These values would be -1 when the
active translation regime does not have two VA ranges, i.e.
EL2 but not EL2&0, and EL3.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

Luis Machado <luis.machado at arm dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at sourceware dot org   |luis.machado at arm dot com
                 CC|                            |luis.machado at arm dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #1 from Luis Machado <luis.machado at arm dot com> ---
Just assigning to myself so I don't lose this.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #2 from Luis Machado <luis.machado at arm dot com> ---
Is my understanding correct that we also want to handle pauth for bare-metal
debugging?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[rth at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

Richard Henderson <rth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://gitlab.com/qemu-pro
                   |                            |ject/qemu/-/issues/1105

--- Comment #3 from Richard Henderson <rth at gcc dot gnu.org> ---
Yes.  The corresponding QEMU issue, linked in the URL field above,
indicates that the user is using pauth in an embedded context.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #4 from Luis Machado <luis.machado at arm dot com> ---
I have a WIP patch...

(gdb) bt
#0  bar () at hello.c:35
#1  0x0000000000400344 in baz () at hello.c:40
#2  0x0000000000400360 [PAC] in foo () at hello.c:45
#3  0x0000000000400388 [PAC] in main (argc=1, argv=0x55007fffe0) at hello.c:52
#4  0x0000000000400294 [PAC] in _start ()
#5  0x0040000000400294 in ?? ()

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

Luis Machado <luis.machado at arm dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

--- Comment #5 from Luis Machado <luis.machado at arm dot com> ---
I'm not sure the TTBR0/TTBR1 knowledge would be very useful for GDB. For native
Linux programs, GDB just uses the exposed pauth_{d,c}mask registers to remove
the signature from LR, for example.

In the case of bare metal, I'm considering making GDB understand we have
support for Pointer Authentication if it sees a particular set of registers
(APIAKEYLO_EL1, APIAKEYHI_EL1, for example), and then conveniently remove the
address signature so we can do a proper backtrace.

The part where functions get marked with [PAC] is done through DWARF, so it is
up to the compiler to generate this.

The backtrace I provided in the previous comment is what I get when I implement
the suggestion above.

Would that work?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #6 from Luis Machado <luis.machado at arm dot com> ---
Given we have multiple PAC registers for bare metal, it may be tricky for GDB
to decide which one of those registers to use to remove non-address bits (and
thus allow GDB to produce a proper backtrace).

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #7 from Luis Machado <luis.machado at arm dot com> ---
Created attachment 14317
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14317&action=edit
Improve PAC support for bare metal aarch64

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #8 from Luis Machado <luis.machado at arm dot com> ---
Could you please give the attached patch a try?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[rth at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #9 from Richard Henderson <rth at gcc dot gnu.org> ---
Comment on attachment 14317
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14317
Improve PAC support for bare metal aarch64

>-      int cmask_num = AARCH64_PAUTH_CMASK_REGNUM (tdep->pauth_reg_base);
>-      CORE_ADDR cmask = frame_unwind_register_unsigned (this_frame, cmask_num);
>+      /* Default bare metal case.  We remove the top 16 bits.  */
>+      CORE_ADDR cmask = 0xffff000000000000;

This is incorrect.  It's the most common memory configuration, sure,
but it's certainly not the only one.

The mask that the native linux case has been providing is built from a
combination of fields in TCR_EL1: T0SZ, TBI0, TG0.

This is why I suggested that qemu provide the same information build
from the corresponding fields for the high-half of the address space:
T1SZ, TBI1, TG1.  And the similar but different fields in TCR_EL{2,3}
when the cpu is in those modes.

Note that bit 55 of the address may *always* be used to select the
"high" or "low" half of the address space.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #10 from Luis Machado <luis.machado at arm dot com> ---
Hi,

Yes, the hardcoded mask was just a quick hack to get things going. I didn't
have enough information to teach GDB how to properly extract the correct mask
from QEMU's system registers.

The goal of this patch is to make things work without having to patch QEMU. If
there isn't a good way to do that, then making QEMU provide the mask would be a
reasonable. Of course that means we need to patch QEMU's debugging stub.

Any thoughts on this?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #11 from Luis Machado <luis.machado at arm dot com> ---
Sorry... *would be a reasonable approach*

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #12 from Luis Machado <luis.machado at arm dot com> ---
Sorry... *would be a reasonable approach*

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[rth at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #13 from Richard Henderson <rth at gcc dot gnu.org> ---
FWIW,

https://gitlab.com/rth7680/qemu/-/commits/tgt-arm-gdb

adds org.gnu.gdb.aarch64.pauth support to qemu.

Run with gdb master, with any linux-user guest binary,
leads to a gdb internal abort.

(gdb) target remote :1234
Remote debugging using :1234
../../git-src/gdb/aarch64-tdep.c:2704: internal-error:
aarch64_pseudo_register_type: bad register number 192

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #14 from Luis Machado <luis.machado at arm dot com> ---
Yeah, that's expected, due to a bad mix of sysregs and pseudo registers. I'll
give it a try. Thanks for the quick patch.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #15 from Luis Machado <luis.machado at arm dot com> ---
Is there a handy way to try the case with VA range select enabled?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

Luis Machado <luis.machado at arm dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends on|                            |28947

--- Comment #16 from Luis Machado <luis.machado at arm dot com> ---
Adding dependency on a patch for a bug that is waiting for upstream approval.


Referenced Bugs:

https://sourceware.org/bugzilla/show_bug.cgi?id=28947
[Bug 28947] GDB does not remove AArch64 pointer signatures before doing memory
accesses
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #17 from Luis Machado <luis.machado at arm dot com> ---
Still waiting for reviews.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421
Bug 29421 depends on bug 28947, which changed state.

Bug 28947 Summary: GDB does not remove AArch64 pointer signatures before doing memory accesses
https://sourceware.org/bugzilla/show_bug.cgi?id=28947

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

--- Comment #18 from Luis Machado <luis.machado at arm dot com> ---
Dependency out of the way. Patch is under review here:
https://inbox.sourceware.org/gdb-patches/20221216105722.1413765-1-luis.machado@arm.com/T/#u

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/29421] Extend aarch64 pauth xml for gdbstub and kernel mode

[luis.machado at arm dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29421

Luis Machado <luis.machado at arm dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #19 from Luis Machado <luis.machado at arm dot com> ---
Pushed here:
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=6d0020873deb2f2c4e0965dc2ebf227bc1db3140

-- 
You are receiving this mail because:
You are on the CC list for the bug.