diff options
author | Simon Marchi <simon.marchi@efficios.com> | 2020-05-06 12:01:37 -0400 |
---|---|---|
committer | Simon Marchi <simon.marchi@efficios.com> | 2020-05-06 12:01:37 -0400 |
commit | ac4a4f1cd7dceeeb17d0b8c077c874f2247acbf0 (patch) | |
tree | 0aa3683d1c66821080e879431df322ecdbd0b793 /gdb/testsuite/gdb.arch | |
parent | bfeaed386d6bf2372ce869fa13f022aafb8869b4 (diff) | |
download | gdb-ac4a4f1cd7dceeeb17d0b8c077c874f2247acbf0.zip gdb-ac4a4f1cd7dceeeb17d0b8c077c874f2247acbf0.tar.gz gdb-ac4a4f1cd7dceeeb17d0b8c077c874f2247acbf0.tar.bz2 |
gdb: handle endbr64 instruction in amd64_analyze_prologue
v2:
- test: build full executable instead of object
- test: add and use supports_fcf_protection
- test: use gdb_test_multiple's -wrap option
- test: don't execute gdb_assert if failed to get breakpoint address
Some GCCs now enable -fcf-protection by default. This is the case, for
example, with GCC 9.3.0 on Ubuntu 20.04. Enabling it causes the
`endbr64` instruction to be inserted at the beginning of all functions
and that breaks GDB's prologue analysis.
I noticed this because it gives many failures in gdb.base/break.exp.
But let's take this dummy program and put a breakpoint on main:
int main(void)
{
return 0;
}
Without -fcf-protection, the breakpoint is correctly put after the prologue:
$ gcc test.c -g3 -O0 -fcf-protection=none
$ ./gdb -q -nx --data-directory=data-directory a.out
Reading symbols from a.out...
(gdb) disassemble main
Dump of assembler code for function main:
0x0000000000001129 <+0>: push %rbp
0x000000000000112a <+1>: mov %rsp,%rbp
0x000000000000112d <+4>: mov $0x0,%eax
0x0000000000001132 <+9>: pop %rbp
0x0000000000001133 <+10>: retq
End of assembler dump.
(gdb) b main
Breakpoint 1 at 0x112d: file test.c, line 3.
With -fcf-protection, the breakpoint is incorrectly put on the first
byte of the function:
$ gcc test.c -g3 -O0 -fcf-protection=full
$ ./gdb -q -nx --data-directory=data-directory a.out
Reading symbols from a.out...
(gdb) disassemble main
Dump of assembler code for function main:
0x0000000000001129 <+0>: endbr64
0x000000000000112d <+4>: push %rbp
0x000000000000112e <+5>: mov %rsp,%rbp
0x0000000000001131 <+8>: mov $0x0,%eax
0x0000000000001136 <+13>: pop %rbp
0x0000000000001137 <+14>: retq
End of assembler dump.
(gdb) b main
Breakpoint 1 at 0x1129: file test.c, line 2.
Stepping in amd64_skip_prologue, we can see that the prologue analysis,
for GCC-compiled programs, is done in amd64_analyze_prologue by decoding
the instructions and looking for typical patterns. This patch changes
the analysis to check for a prologue starting with the `endbr64`
instruction, and skip it if it's there.
gdb/ChangeLog:
* amd64-tdep.c (amd64_analyze_prologue): Check for `endbr64`
instruction, skip it if it's there.
gdb/testsuite/ChangeLog:
* gdb.arch/amd64-prologue-skip-cf-protection.exp: New file.
* gdb.arch/amd64-prologue-skip-cf-protection.c: New file.
Diffstat (limited to 'gdb/testsuite/gdb.arch')
-rw-r--r-- | gdb/testsuite/gdb.arch/amd64-prologue-skip-cf-protection.c | 21 | ||||
-rw-r--r-- | gdb/testsuite/gdb.arch/amd64-prologue-skip-cf-protection.exp | 65 |
2 files changed, 86 insertions, 0 deletions
diff --git a/gdb/testsuite/gdb.arch/amd64-prologue-skip-cf-protection.c b/gdb/testsuite/gdb.arch/amd64-prologue-skip-cf-protection.c new file mode 100644 index 0000000..a650585 --- /dev/null +++ b/gdb/testsuite/gdb.arch/amd64-prologue-skip-cf-protection.c @@ -0,0 +1,21 @@ +/* This testcase is part of GDB, the GNU debugger. + + Copyright 2020 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. */ + +int main (void) +{ + return 0; +} diff --git a/gdb/testsuite/gdb.arch/amd64-prologue-skip-cf-protection.exp b/gdb/testsuite/gdb.arch/amd64-prologue-skip-cf-protection.exp new file mode 100644 index 0000000..3c51fd3 --- /dev/null +++ b/gdb/testsuite/gdb.arch/amd64-prologue-skip-cf-protection.exp @@ -0,0 +1,65 @@ +# Copyright 2020 Free Software Foundation, Inc. + +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +# Test skipping a prologue that was generated with gcc's -fcf-protection=full +# (control flow protection) option. +# +# This option places an `endbr64` instruction at the start of all functions, +# which can interfere with prologue analysis. + +standard_testfile .c +set binfile ${binfile} + +if { ![istarget x86_64-*-* ] || ![is_lp64_target] } { + verbose "Skipping ${testfile}." + return +} + +if { ![supports_fcf_protection] } { + untested "-fcf-protection not supported" + return +} + +set opts {debug additional_flags=-fcf-protection=full} + +if { [gdb_compile "${srcdir}/${subdir}/${srcfile}" "${binfile}" executable $opts] != "" } { + untested "failed to compile" + return +} + +clean_restart ${binfile} + +# Get start address of function main. +set main_addr [get_integer_valueof &main -1] +gdb_assert {$main_addr != -1} + +set bp_addr -1 + +# Put breakpoint on main, get the address where the breakpoint was installed. +gdb_test_multiple "break main" "break on main, get address" { + -re -wrap "Breakpoint $decimal at ($hex).*" { + set bp_addr $expect_out(1,string) + + # Convert to decimal. + set bp_addr [expr $bp_addr] + + pass $gdb_test_name + } +} + +if { $bp_addr != -1 } { + # Make sure some prologue was skipped. + gdb_assert {$bp_addr > $main_addr} +} |