From 3d31bc39e655ea39721754fa0ea539a8a0c9b26c Mon Sep 17 00:00:00 2001 From: Alan Hayward Date: Wed, 7 Aug 2019 09:47:57 +0100 Subject: AArch64 pauth: Indicate unmasked addresses in backtrace Armv8.3-a Pointer Authentication causes the function return address to be obfuscated on entry to some functions. GDB must unmask the link register in order to produce a backtrace. The following patch adds markers of [PAC] to the bracktrace, to indicate which addresses needed unmasking. This includes the backtrace when using MI. For example, consider the following backtrace: (gdb) bt 0 0x0000000000400490 in puts@plt () 1 0x00000000004005dc in foo ("hello") at cbreak-lib.c:6 2 0x0000000000400604 [PAC] in bar () at cbreak-lib.c:12 3 0x0000000000400620 [PAC] in main2 () at cbreak.c:17 4 0x00000000004005b4 in main () at cbreak-3.c:10 The functions in cbreak-lib use pointer auth, which masks the return address to the previous function, causing the addresses of bar (in the library) and main2 (in the main binary) to require unmasking in order to unwind the backtrace. An extra bool is added alongside the prev_pc in the frame structure. At the point at which the link register is unmasked, the AArch64 port calls into frame to sets the bool. This is the most efficient way of doing it. The marker is also added to the python frame printer, which is always printed if set. The marker is not explicitly exposed to the python code. I expect this will potentially cause issues with some tests in the testsuite when Armv8.3 pointer authentication is used. This should be fixed up in the the future once real hardware is available for full testsuite testing. gdb/ChangeLog: * NEWS: Expand the Pointer Authentication entry. * aarch64-tdep.c (aarch64_frame_unmask_address): Rename from this. (aarch64_frame_unmask_lr): ... to this. (aarch64_prologue_prev_register, aarch64_dwarf2_prev_register): Call aarch64_frame_unmask_lr. * frame.c (struct frame_info): Add "masked" variable. (frame_set_previous_pc_masked) (frame_get_pc_masked): New functions. (fprint_frame): Check for masked pc. * frame.h (frame_set_previous_pc_masked) (frame_get_pc_masked): New declarations. * python/py-framefilter.c (py_print_frame): Check for masked pc. * stack.c (print_frame): Check for masked pc. gdb/doc/ChangeLog: * gdb.texinfo (AArch64 Pointer Authentication): New subsection. --- gdb/NEWS | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'gdb/NEWS') diff --git a/gdb/NEWS b/gdb/NEWS index b4c59e4..fa01adf 100644 --- a/gdb/NEWS +++ b/gdb/NEWS @@ -16,7 +16,9 @@ architectures require kernel changes. TLS is not yet supported for amd64 and i386 process core dumps. -* Support for Pointer Authentication on AArch64 Linux. +* Support for Pointer Authentication (PAC) on AArch64 Linux. Return + addresses that required unmasking are shown in the backtrace with the + postfix [PAC]. * Two new convenience functions $_cimag and $_creal that extract the imaginary and real parts respectively from complex numbers. -- cgit v1.1