Skip to content

Commit b31e974

Browse files
DavidSpickettDavidSpickett
authored
[lldb][AArch64] Fix expression evaluation with Guarded Control Stacks (#123918)
When the Guarded Control Stack (GCS) is enabled, returns cause the processor to validate that the address at the location pointed to by gcspr_el0 matches the one in the link register. ``` ret (lr=A) << pc | GCS | +=====+ | A | | B | << gcspr_el0 Fault: tried to return to A when you should have returned to B. ``` Therefore when an expression wrapper function tries to return to the expression return address (usually `_start` if there is a libc), it would fault. ``` ret (lr=_start) << pc | GCS | +============+ | user_func1 | | user_func2 | << gcspr_el0 Fault: tried to return to _start when you should have returned to user_func2. ``` To fix this we must push that return address to the GCS in PrepareTrivialCall. This value is then consumed by the final return and the expression completes as expected. If for some reason that fails, we will manually restore the value of gcspr_el0, because it turns out that PrepareTrivialCall does not restore registers if it fails at all. So for now I am handling gcspr_el0 specifically, but I have filed #124269 to address the general problem. (the other things PrepareTrivialCall does are exceedingly likely to not fail, so we have never noticed this) ``` ret (lr=_start) << pc | GCS | +============+ | user_func1 | | user_func2 | | _start | << gcspr_el0 No fault, we return to _start as normal. ``` The gcspr_el0 register will be restored after expression evaluation so that the program can continue correctly. However, due to restrictions in the Linux GCS ABI, we will not restore the enable bit of gcs_features_enabled. Re-enabling GCS via ptrace is not supported because it requires memory to be allocated by the kernel. We could disable GCS if the expression enabled GCS, however this would use up that state transition that the program might later rely on. And generally it is cleaner to ignore the enable bit, rather than one state transition of it. We will also not restore the GCS entry that was overwritten with the expression's return address. On the grounds that: * This entry will never be used by the program. If the program branches, the entry will be overwritten. If the program returns, gcspr_el0 will point to the entry before the expression return address and that entry will instead be validated. * Any expression that calls functions will overwrite even more entries, so the user needs to be aware of that anyway if they want to preserve the contents of the GCS for inspection. * An expression could leave the program in a state where restoring the value makes the situation worse. Especially if we ever support this in bare metal debugging. I will later document all this on https://lldb.llvm.org/use/aarch64-linux.html. Tests have been added for: * A function call that does not interact with GCS. * A call that does, and disables it (we do not re-enable it). * A call that does, and enables it (we do not disable it again). * Failure to push an entry to the GCS stack.
1 parent d8ad1ee commit b31e974

File tree

4 files changed

+311
-42
lines changed

4 files changed

+311
-42
lines changed

‎lldb/source/Plugins/ABI/AArch64/ABISysV_arm64.cpp

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,69 @@ ABISysV_arm64::CreateInstance(lldb::ProcessSP process_sp, const ArchSpec &arch)
6060
return ABISP();
6161
}
6262

63+
static Status PushToLinuxGuardedControlStack(addr_t return_addr,
64+
RegisterContext *reg_ctx,
65+
Thread &thread) {
66+
Status err;
67+
68+
// If the Guarded Control Stack extension is present we may need to put the
69+
// return address onto that stack.
70+
const RegisterInfo *gcs_features_enabled_info =
71+
reg_ctx->GetRegisterInfoByName("gcs_features_enabled");
72+
if (!gcs_features_enabled_info)
73+
return err;
74+
75+
uint64_t gcs_features_enabled = reg_ctx->ReadRegisterAsUnsigned(
76+
gcs_features_enabled_info, LLDB_INVALID_ADDRESS);
77+
if (gcs_features_enabled == LLDB_INVALID_ADDRESS)
78+
return Status("Could not read GCS features enabled register.");
79+
80+
// Only attempt this if GCS is enabled. If it's not enabled then gcspr_el0
81+
// may point to unmapped memory.
82+
if ((gcs_features_enabled & 1) == 0)
83+
return err;
84+
85+
const RegisterInfo *gcspr_el0_info =
86+
reg_ctx->GetRegisterInfoByName("gcspr_el0");
87+
if (!gcspr_el0_info)
88+
return Status("Could not get register info for gcspr_el0.");
89+
90+
uint64_t gcspr_el0 =
91+
reg_ctx->ReadRegisterAsUnsigned(gcspr_el0_info, LLDB_INVALID_ADDRESS);
92+
if (gcspr_el0 == LLDB_INVALID_ADDRESS)
93+
return Status("Could not read gcspr_el0.");
94+
95+
// A link register entry on the GCS is 8 bytes.
96+
gcspr_el0 -= 8;
97+
if (!reg_ctx->WriteRegisterFromUnsigned(gcspr_el0_info, gcspr_el0))
98+
return Status(
99+
"Attempted to decrement gcspr_el0, but could not write to it.");
100+
101+
Status error;
102+
size_t wrote = thread.GetProcess()->WriteMemory(gcspr_el0, &return_addr,
103+
sizeof(return_addr), error);
104+
if ((wrote != sizeof(return_addr) || error.Fail())) {
105+
// When PrepareTrivialCall fails, the register context is not restored,
106+
// unlike when an expression fails to execute. This is arguably a bug,
107+
// see https://github.com/llvm/llvm-project/issues/124269.
108+
// For now we are handling this here specifically. We can assume this
109+
// write will work as the one to decrement the register did.
110+
reg_ctx->WriteRegisterFromUnsigned(gcspr_el0_info, gcspr_el0 + 8);
111+
return Status("Failed to write new Guarded Control Stack entry.");
112+
}
113+
114+
Log *log = GetLog(LLDBLog::Expressions);
115+
LLDB_LOGF(log,
116+
"Pushed return address 0x%" PRIx64 " to Guarded Control Stack. "
117+
"gcspr_el0 was 0%" PRIx64 ", is now 0x%" PRIx64 ".",
118+
return_addr, gcspr_el0 - 8, gcspr_el0);
119+
120+
// gcspr_el0 will be restored to the original value by lldb-server after
121+
// the call has finished, which serves as the "pop".
122+
123+
return err;
124+
}
125+
63126
bool ABISysV_arm64::PrepareTrivialCall(Thread &thread, addr_t sp,
64127
addr_t func_addr, addr_t return_addr,
65128
llvm::ArrayRef<addr_t> args) const {
@@ -87,6 +150,18 @@ bool ABISysV_arm64::PrepareTrivialCall(Thread &thread, addr_t sp,
87150
if (args.size() > 8)
88151
return false;
89152

153+
// Do this first, as it's got the most chance of failing (though still very
154+
// low).
155+
if (GetProcessSP()->GetTarget().GetArchitecture().GetTriple().isOSLinux()) {
156+
Status err = PushToLinuxGuardedControlStack(return_addr, reg_ctx, thread);
157+
// If we could not manage the GCS, the expression will certainly fail,
158+
// and if we just carried on, that failure would be a lot more cryptic.
159+
if (err.Fail()) {
160+
LLDB_LOGF(log, "Failed to setup Guarded Call Stack: %s", err.AsCString());
161+
return false;
162+
}
163+
}
164+
90165
for (size_t i = 0; i < args.size(); ++i) {
91166
const RegisterInfo *reg_info = reg_ctx->GetRegisterInfo(
92167
eRegisterKindGeneric, LLDB_REGNUM_GENERIC_ARG1 + i);

‎lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux_arm64.cpp

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1063,9 +1063,27 @@ Status NativeRegisterContextLinux_arm64::WriteAllRegisterValues(
10631063
std::bind(&NativeRegisterContextLinux_arm64::WriteFPMR, this));
10641064
break;
10651065
case RegisterSetType::GCS:
1066+
// It is not permitted to enable GCS via ptrace. We can disable it, but
1067+
// to keep things simple we will not revert any change to the
1068+
// PR_SHADOW_STACK_ENABLE bit. Instead patch in the current enable bit
1069+
// into the registers we are about to restore.
1070+
m_gcs_is_valid = false;
1071+
error = ReadGCS();
1072+
if (error.Fail())
1073+
return error;
1074+
1075+
uint64_t enable_bit = m_gcs_regs.features_enabled & 1UL;
1076+
gcs_regs new_gcs_regs = *reinterpret_cast<const gcs_regs *>(src);
1077+
new_gcs_regs.features_enabled =
1078+
(new_gcs_regs.features_enabled & ~1UL) | enable_bit;
1079+
1080+
const uint8_t *new_gcs_src =
1081+
reinterpret_cast<const uint8_t *>(&new_gcs_regs);
10661082
error = RestoreRegisters(
1067-
GetGCSBuffer(), &src, GetGCSBufferSize(), m_gcs_is_valid,
1083+
GetGCSBuffer(), &new_gcs_src, GetGCSBufferSize(), m_gcs_is_valid,
10681084
std::bind(&NativeRegisterContextLinux_arm64::WriteGCS, this));
1085+
src += GetGCSBufferSize();
1086+
10691087
break;
10701088
}
10711089

‎lldb/test/API/linux/aarch64/gcs/TestAArch64LinuxGCS.py

Lines changed: 175 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
extension is enabled.
44
"""
55

6-
76
import lldb
87
from lldbsuite.test.decorators import *
98
from lldbsuite.test.lldbtest import *
@@ -84,6 +83,40 @@ def test_gcs_fault(self):
8483
],
8584
)
8685

86+
def check_gcs_registers(
87+
self,
88+
expected_gcs_features_enabled=None,
89+
expected_gcs_features_locked=None,
90+
expected_gcspr_el0=None,
91+
):
92+
thread = self.dbg.GetSelectedTarget().process.GetThreadAtIndex(0)
93+
registerSets = thread.GetFrameAtIndex(0).GetRegisters()
94+
gcs_registers = registerSets.GetFirstValueByName(
95+
r"Guarded Control Stack Registers"
96+
)
97+
98+
gcs_features_enabled = gcs_registers.GetChildMemberWithName(
99+
"gcs_features_enabled"
100+
).GetValueAsUnsigned()
101+
if expected_gcs_features_enabled is not None:
102+
self.assertEqual(expected_gcs_features_enabled, gcs_features_enabled)
103+
104+
gcs_features_locked = gcs_registers.GetChildMemberWithName(
105+
"gcs_features_locked"
106+
).GetValueAsUnsigned()
107+
if expected_gcs_features_locked is not None:
108+
self.assertEqual(expected_gcs_features_locked, gcs_features_locked)
109+
110+
gcspr_el0 = gcs_registers.GetChildMemberWithName(
111+
"gcspr_el0"
112+
).GetValueAsUnsigned()
113+
if expected_gcspr_el0 is not None:
114+
self.assertEqual(expected_gcspr_el0, gcspr_el0)
115+
116+
return gcs_features_enabled, gcs_features_locked, gcspr_el0
117+
118+
# This helper reads all the GCS registers and optionally compares them
119+
# against a previous state, then returns the current register values.
87120
@skipUnlessArch("aarch64")
88121
@skipUnlessPlatform(["linux"])
89122
def test_gcs_registers(self):
@@ -108,40 +141,7 @@ def test_gcs_registers(self):
108141

109142
self.expect("register read --all", substrs=["Guarded Control Stack Registers:"])
110143

111-
# This helper reads all the GCS registers and optionally compares them
112-
# against a previous state, then returns the current register values.
113-
def check_gcs_registers(
114-
expected_gcs_features_enabled=None,
115-
expected_gcs_features_locked=None,
116-
expected_gcspr_el0=None,
117-
):
118-
thread = self.dbg.GetSelectedTarget().process.GetThreadAtIndex(0)
119-
registerSets = thread.GetFrameAtIndex(0).GetRegisters()
120-
gcs_registers = registerSets.GetFirstValueByName(
121-
r"Guarded Control Stack Registers"
122-
)
123-
124-
gcs_features_enabled = gcs_registers.GetChildMemberWithName(
125-
"gcs_features_enabled"
126-
).GetValueAsUnsigned()
127-
if expected_gcs_features_enabled is not None:
128-
self.assertEqual(expected_gcs_features_enabled, gcs_features_enabled)
129-
130-
gcs_features_locked = gcs_registers.GetChildMemberWithName(
131-
"gcs_features_locked"
132-
).GetValueAsUnsigned()
133-
if expected_gcs_features_locked is not None:
134-
self.assertEqual(expected_gcs_features_locked, gcs_features_locked)
135-
136-
gcspr_el0 = gcs_registers.GetChildMemberWithName(
137-
"gcspr_el0"
138-
).GetValueAsUnsigned()
139-
if expected_gcspr_el0 is not None:
140-
self.assertEqual(expected_gcspr_el0, gcspr_el0)
141-
142-
return gcs_features_enabled, gcs_features_locked, gcspr_el0
143-
144-
enabled, locked, spr_el0 = check_gcs_registers()
144+
enabled, locked, spr_el0 = self.check_gcs_registers()
145145

146146
# Features enabled should have at least the enable bit set, it could have
147147
# others depending on what the C library did, but we can't rely on always
@@ -164,7 +164,7 @@ def check_gcs_registers(
164164
substrs=["stopped", "stop reason = breakpoint"],
165165
)
166166

167-
_, _, spr_el0 = check_gcs_registers(enabled, locked, spr_el0 - 8)
167+
_, _, spr_el0 = self.check_gcs_registers(enabled, locked, spr_el0 - 8)
168168

169169
# Any combination of GCS feature lock bits might have been set by the C
170170
# library, and could be set to 0 or 1. To check that we can modify them,
@@ -235,3 +235,142 @@ def check_gcs_registers(
235235
"exited with status = 0",
236236
],
237237
)
238+
239+
@skipUnlessPlatform(["linux"])
240+
def test_gcs_expression_simple(self):
241+
if not self.isAArch64GCS():
242+
self.skipTest("Target must support GCS.")
243+
244+
self.build()
245+
self.runCmd("file " + self.getBuildArtifact("a.out"), CURRENT_EXECUTABLE_SET)
246+
247+
# Break before GCS has been enabled.
248+
self.runCmd("b main")
249+
# And after it has been enabled.
250+
lldbutil.run_break_set_by_file_and_line(
251+
self,
252+
"main.c",
253+
line_number("main.c", "// Set break point at this line."),
254+
num_expected_locations=1,
255+
)
256+
257+
self.runCmd("run", RUN_SUCCEEDED)
258+
259+
if self.process().GetState() == lldb.eStateExited:
260+
self.fail("Test program failed to run.")
261+
262+
self.expect(
263+
"thread list",
264+
STOPPED_DUE_TO_BREAKPOINT,
265+
substrs=["stopped", "stop reason = breakpoint"],
266+
)
267+
268+
# GCS has not been enabled yet and the ABI plugin should know not to
269+
# attempt pushing to the control stack.
270+
before = self.check_gcs_registers()
271+
expr_cmd = "p get_gcs_status()"
272+
self.expect(expr_cmd, substrs=["(unsigned long) 0"])
273+
self.check_gcs_registers(*before)
274+
275+
# Continue to when GCS has been enabled.
276+
self.runCmd("continue")
277+
self.expect(
278+
"thread list",
279+
STOPPED_DUE_TO_BREAKPOINT,
280+
substrs=["stopped", "stop reason = breakpoint"],
281+
)
282+
283+
# If we fail to setup the GCS entry, we should not leave any of the GCS registers
284+
# changed. The last thing we do is write a new GCS entry to memory and
285+
# to simulate the failure of that, temporarily point the GCS to the zero page.
286+
#
287+
# We use the value 8 here because LLDB will decrement it by 8 so it points to
288+
# what we think will be an empty entry on the guarded control stack.
289+
_, _, original_gcspr = self.check_gcs_registers()
290+
self.runCmd("register write gcspr_el0 8")
291+
before = self.check_gcs_registers()
292+
self.expect(expr_cmd, error=True)
293+
self.check_gcs_registers(*before)
294+
# Point to the valid shadow stack region again.
295+
self.runCmd(f"register write gcspr_el0 {original_gcspr}")
296+
297+
# This time we do need to push to the GCS and having done so, we can
298+
# return from this expression without causing a fault.
299+
before = self.check_gcs_registers()
300+
self.expect(expr_cmd, substrs=["(unsigned long) 1"])
301+
self.check_gcs_registers(*before)
302+
303+
@skipUnlessPlatform(["linux"])
304+
def test_gcs_expression_disable_gcs(self):
305+
if not self.isAArch64GCS():
306+
self.skipTest("Target must support GCS.")
307+
308+
self.build()
309+
self.runCmd("file " + self.getBuildArtifact("a.out"), CURRENT_EXECUTABLE_SET)
310+
311+
# Break after GCS is enabled.
312+
lldbutil.run_break_set_by_file_and_line(
313+
self,
314+
"main.c",
315+
line_number("main.c", "// Set break point at this line."),
316+
num_expected_locations=1,
317+
)
318+
319+
self.runCmd("run", RUN_SUCCEEDED)
320+
321+
if self.process().GetState() == lldb.eStateExited:
322+
self.fail("Test program failed to run.")
323+
324+
self.expect(
325+
"thread list",
326+
STOPPED_DUE_TO_BREAKPOINT,
327+
substrs=["stopped", "stop reason = breakpoint"],
328+
)
329+
330+
# Unlock all features so the expression can enable them again.
331+
self.runCmd("register write gcs_features_locked 0")
332+
# Disable all features, but keep GCS itself enabled.
333+
PR_SHADOW_STACK_ENABLE = 1
334+
self.runCmd(f"register write gcs_features_enabled 0x{PR_SHADOW_STACK_ENABLE:x}")
335+
336+
enabled, locked, spr_el0 = self.check_gcs_registers()
337+
# We restore everything apart GCS being enabled, as we are not allowed to
338+
# go from disabled -> enabled via ptrace.
339+
self.expect("p change_gcs_config(false)", substrs=["true"])
340+
enabled &= ~1
341+
self.check_gcs_registers(enabled, locked, spr_el0)
342+
343+
@skipUnlessPlatform(["linux"])
344+
def test_gcs_expression_enable_gcs(self):
345+
if not self.isAArch64GCS():
346+
self.skipTest("Target must support GCS.")
347+
348+
self.build()
349+
self.runCmd("file " + self.getBuildArtifact("a.out"), CURRENT_EXECUTABLE_SET)
350+
351+
# Break before GCS is enabled.
352+
self.runCmd("b main")
353+
354+
self.runCmd("run", RUN_SUCCEEDED)
355+
356+
if self.process().GetState() == lldb.eStateExited:
357+
self.fail("Test program failed to run.")
358+
359+
self.expect(
360+
"thread list",
361+
STOPPED_DUE_TO_BREAKPOINT,
362+
substrs=["stopped", "stop reason = breakpoint"],
363+
)
364+
365+
# Unlock all features so the expression can enable them again.
366+
self.runCmd("register write gcs_features_locked 0")
367+
# Disable all features. The program needs PR_SHADOW_STACK_PUSH, but it
368+
# will enable that itself.
369+
self.runCmd(f"register write gcs_features_enabled 0")
370+
371+
enabled, locked, spr_el0 = self.check_gcs_registers()
372+
self.expect("p change_gcs_config(true)", substrs=["true"])
373+
# Though we could disable GCS with ptrace, we choose not to to be
374+
# consistent with the disabled -> enabled behaviour.
375+
enabled |= 1
376+
self.check_gcs_registers(enabled, locked, spr_el0)

0 commit comments

Comments
 (0)