Pass pointer authentication code mask from minidump and use to strip pac from pc.

[justincohen]

Summary

Pipe pointer authentication code mask from Crashpad thru minidumps into the ABI plugin.

To work with Crashpad change: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/2773358

[justincohen]

Fix length of crashpad structure / use ulittleXX

[markmentovai]

lldb/source/Plugins/Process/minidump/MinidumpParser.cpp

241–242

Check that crashpad_info->version is 1 before attempting to treat what follows as pointer_authentication_address_mask.

lldb/source/Plugins/Process/minidump/MinidumpTypes.h

113

Ensure alignment is compatible with what Crashpad uses.

[justincohen]

Inverted mask.

[justincohen]

Check CrashpadInfo version.

[justincohen]

lldb/source/Plugins/Process/minidump/MinidumpTypes.h

113

Confirmed manually.

[omjavaid]

lldb/include/lldb/Target/Process.h

79

This function name is too specific to AArch64 architecture. IMO, we should have information on significant address bits rather than PAuth mask. This is because we have to cover for the top byte in case of AArch64 Top Byte Ignore feature as well as any other memory management features.

From user process perspective we should figure out how many bits of the process memory address are significant for addressing while the others store extra information like PAC, Tags or any information inserted by software in top byte.

I propose to add a new variable (may be call it address_bits_in_use) in process class which is populated by default equal to process address width in our case 64 bit. In case a we choose to update address_bits_in_use we may do it on when process is created or through set method during execution as well.

[pcc]

lldb/include/lldb/Target/Process.h

79

I don't think we want to clear the top byte if TBI is enabled. This is because the top byte may contain a pointer tag that is necessary in order to access the pointer with MTE. That is exactly what a mask would let us do. The top byte of the mask is clear when TBI is enabled so that the pointer tag is left unchanged.

[omjavaid]

lldb/include/lldb/Target/Process.h

79

We dont really want to clear the top byte but rather have the information on "address bits used for addressing" vs "address bits used for extra features" and for the purpose of unwinding all extra information from the address needs to cleared.

On top of my head I think this information is needed to ensure LLDB does not use multiple watchpoints for watching a single address which has extra info in some of its top bits. There could be more uses of this in memory reads and breakpoints management as well for code pointers.

lldb/include/lldb/Target/Process.h

 //===-- Process.h -----------------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLDB_TARGET_PROCESS_H
 #define LLDB_TARGET_PROCESS_H
 
 #include "lldb/Host/Config.h"
 
 #include <limits.h>
 
 #include <chrono>
 #include <list>
 #include <memory>
 #include <mutex>
 #include <string>
public:
   ProcessProperties(lldb_private::Process *process);
 
   ~ProcessProperties() override;
 
   bool GetDisableMemoryCache() const;
   uint64_t GetMemoryCacheLineSize() const;
   Args GetExtraStartupCommands() const;
   void SetExtraStartupCommands(const Args &args);
+  uint64_t GetPointerAuthenticationAddressMask() const;
+  void SetPointerAuthenticationAddressMask(const uint64_t mask);
   FileSpec GetPythonOSPluginPath() const;
   void SetPythonOSPluginPath(const FileSpec &file);
   bool GetIgnoreBreakpointsInExpressions() const;
   void SetIgnoreBreakpointsInExpressions(bool ignore);
   bool GetUnwindOnErrorInExpressions() const;
   void SetUnwindOnErrorInExpressions(bool ignore);
   bool GetStopOnSharedLibraryEvents() const;
   void SetStopOnSharedLibraryEvents(bool stop);

lldb/source/Plugins/ABI/AArch64/ABIMacOSX_arm64.h

 //===-- ABIMacOSX_arm64.h ---------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLDB_SOURCE_PLUGINS_ABI_AARCH64_ABIMACOSX_ARM64_H
 #define LLDB_SOURCE_PLUGINS_ABI_AARCH64_ABIMACOSX_ARM64_H
 
 #include "Plugins/ABI/AArch64/ABIAArch64.h"
 #include "lldb/Utility/ConstString.h"
 #include "lldb/lldb-private.h"
 
 class ABIMacOSX_arm64 : public ABIAArch64 {
 public:
   ~ABIMacOSX_arm64() override = default;
 
   size_t GetRedZoneSize() const override;
public:
   bool CodeAddressIsValid(lldb::addr_t pc) override {
     if (pc & (4ull - 1ull))
       return false; // Not 4 byte aligned
 
     // Anything else if fair game..
     return true;
   }
 
+  lldb::addr_t FixCodeAddress(lldb::addr_t pc) override;
+
   // Static Functions
 
   static void Initialize();
 
   static void Terminate();
 
   static lldb::ABISP CreateInstance(lldb::ProcessSP process_sp, const lldb_private::ArchSpec &arch);
 

lldb/source/Plugins/ABI/AArch64/ABIMacOSX_arm64.cpp

if (LoadValueFromConsecutiveGPRRegisters(
             data)) {
       return_valobj_sp = ValueObjectConstResult::Create(
           &thread, return_compiler_type, ConstString(""), data);
     }
   }
   return return_valobj_sp;
 }
 
+lldb::addr_t ABIMacOSX_arm64::FixCodeAddress(lldb::addr_t pc) {
+  uint64_t mask = GetProcessSP()->GetPointerAuthenticationAddressMask();
+  return (pc & (1ULL << 55)) ? (pc | mask) : (pc & ~mask);
+}
+
 void ABIMacOSX_arm64::Initialize() {
   PluginManager::RegisterPlugin(GetPluginNameStatic(), pluginDesc,
                                 CreateInstance);
 }
 
 void ABIMacOSX_arm64::Terminate() {
   PluginManager::UnregisterPlugin(CreateInstance);
 }

lldb/source/Plugins/Process/minidump/MinidumpParser.h

public:
 
   llvm::ArrayRef<uint8_t> GetThreadContextWow64(const minidump::Thread &td);
 
   ArchSpec GetArchitecture();
 
   const MinidumpMiscInfo *GetMiscInfo();
 
   llvm::Optional<LinuxProcStatus> GetLinuxProcStatus();
+  llvm::Optional<uint64_t> GetPointerAuthenticationAddressMask();
 
   llvm::Optional<lldb::pid_t> GetPid();
 
   llvm::ArrayRef<minidump::Module> GetModuleList();
 
   // There are cases in which there is more than one record in the ModuleList
   // for the same module name.(e.g. when the binary has non contiguous segments)
   // So this function returns a filtered module list - if it finds records that

lldb/source/Plugins/Process/minidump/MinidumpParser.cpp

llvm::Optional<LinuxProcStatus> MinidumpParser::GetLinuxProcStatus() {
   llvm::ArrayRef<uint8_t> data = GetStream(StreamType::LinuxProcStatus);
 
   if (data.size() == 0)
     return llvm::None;
 
   return LinuxProcStatus::Parse(data);
 }
 
+llvm::Optional<uint64_t> MinidumpParser::GetPointerAuthenticationAddressMask() {
+  llvm::ArrayRef<uint8_t> data = GetStream(StreamType::CrashpadInfo);
+
+  if (data.size() == 0 || data.size() < sizeof(CrashpadInfo))
+    return llvm::None;
+
+  const CrashpadInfo *crashpad_info =
+      reinterpret_cast<const CrashpadInfo *>(data.data());
+
+  if (crashpad_info->version != 1) {
+    return llvm::None;
+  }
+
+  return static_cast<uint64_t>(
+      crashpad_info->pointer_authentication_address_mask);
+}
+
 llvm::Optional<lldb::pid_t> MinidumpParser::GetPid() {
   const MinidumpMiscInfo *misc_info = GetMiscInfo();
   if (misc_info != nullptr) {
     return misc_info->GetPid();
   }
 
   llvm::Optional<LinuxProcStatus> proc_status = GetLinuxProcStatus();
   if (proc_status.hasValue()) {
switch (stream_type) {
     ENUM_TO_CSTR(ThreadInfoList);
     ENUM_TO_CSTR(HandleOperationList);
     ENUM_TO_CSTR(Token);
     ENUM_TO_CSTR(JavascriptData);
     ENUM_TO_CSTR(SystemMemoryInfo);
     ENUM_TO_CSTR(ProcessVMCounters);
     ENUM_TO_CSTR(LastReserved);
     ENUM_TO_CSTR(BreakpadInfo);
+    ENUM_TO_CSTR(CrashpadInfo);
     ENUM_TO_CSTR(AssertionInfo);
     ENUM_TO_CSTR(LinuxCPUInfo);
     ENUM_TO_CSTR(LinuxProcStatus);
     ENUM_TO_CSTR(LinuxLSBRelease);
     ENUM_TO_CSTR(LinuxCMDLine);
     ENUM_TO_CSTR(LinuxEnviron);
     ENUM_TO_CSTR(LinuxAuxv);
     ENUM_TO_CSTR(LinuxMaps);

lldb/source/Plugins/Process/minidump/MinidumpTypes.h

 //===-- MinidumpTypes.h -----------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLDB_SOURCE_PLUGINS_PROCESS_MINIDUMP_MINIDUMPTYPES_H
 #define LLDB_SOURCE_PLUGINS_PROCESS_MINIDUMP_MINIDUMPTYPES_H
 
 #include "lldb/Utility/Status.h"
 
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/ADT/BitmaskEnum.h"
 #include "llvm/ADT/Optional.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/BinaryFormat/Minidump.h"
 #include "llvm/Support/ConvertUTF.h"
public:
   static llvm::Optional<LinuxProcStatus> Parse(llvm::ArrayRef<uint8_t> &data);
 
   lldb::pid_t GetPid() const;
 
 private:
   LinuxProcStatus() = default;
 };
 
+struct GUID {
+  llvm::support::ulittle32_t data1;
+  llvm::support::ulittle16_t data2;
+  llvm::support::ulittle16_t data3;
+  uint8_t data4[8];
+};
+static_assert(sizeof(GUID) == 16, "");
+
+struct CrashpadInfo {
+  llvm::support::ulittle32_t version;
+  GUID report_id;
+  GUID client_id;
+  LocationDescriptor simple_annotations;
+  LocationDescriptor module_list;
+  llvm::support::ulittle64_t pointer_authentication_address_mask;
+};
+static_assert(sizeof(CrashpadInfo) == 60, "");
+
 } // namespace minidump
 } // namespace lldb_private
 #endif // LLDB_SOURCE_PLUGINS_PROCESS_MINIDUMP_MINIDUMPTYPES_H

lldb/source/Plugins/Process/minidump/ProcessMinidump.cpp

Status ProcessMinidump::DoLoadCore() {
   if (!pid) {
     GetTarget().GetDebugger().GetAsyncErrorStream()->PutCString(
         "Unable to retrieve process ID from minidump file, setting process ID "
         "to 1.\n");
     pid = 1;
   }
   SetID(pid.getValue());
 
+  llvm::Optional<uint64_t> mask =
+      m_minidump_parser->GetPointerAuthenticationAddressMask();
+  if (mask) {
+    SetPointerAuthenticationAddressMask(mask.getValue());
+  }
+
   return error;
 }
 
 ConstString ProcessMinidump::GetPluginName() { return GetPluginNameStatic(); }
 
 uint32_t ProcessMinidump::GetPluginVersion() { return 1; }
 
 Status ProcessMinidump::DoDestroy() { return Status(); }

lldb/source/Target/Process.cpp

 //===-- Process.cpp -------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include <atomic>
 #include <memory>
 #include <mutex>
 
 #include "llvm/Support/ScopedPrinter.h"
 #include "llvm/Support/Threading.h"
 
 #include "lldb/Breakpoint/BreakpointLocation.h"
 #include "lldb/Breakpoint/StoppointCallbackContext.h"
 #include "lldb/Core/Debugger.h"
 #include "lldb/Core/Module.h"
 #include "lldb/Core/ModuleSpec.h"
 #include "lldb/Core/PluginManager.h"
 #include "lldb/Core/StreamFile.h"
 #include "lldb/Expression/DiagnosticManager.h"
 #include "lldb/Expression/DynamicCheckerFunctions.h"
Args ProcessProperties::GetExtraStartupCommands() const {
   return args;
 }
 
 void ProcessProperties::SetExtraStartupCommands(const Args &args) {
   const uint32_t idx = ePropertyExtraStartCommand;
   m_collection_sp->SetPropertyAtIndexFromArgs(nullptr, idx, args);
 }
 
+uint64_t ProcessProperties::GetPointerAuthenticationAddressMask() const {
+  const uint32_t idx = ePropertyPointerAuthenticationAddressMask;
+  return m_collection_sp->GetPropertyAtIndexAsUInt64(
+      nullptr, idx, g_process_properties[idx].default_uint_value);
+}
+
+void ProcessProperties::SetPointerAuthenticationAddressMask(
+    const uint64_t mask) {
+  const uint32_t idx = ePropertyPointerAuthenticationAddressMask;
+  m_collection_sp->SetPropertyAtIndexAsUInt64(nullptr, idx, mask);
+}
+
 FileSpec ProcessProperties::GetPythonOSPluginPath() const {
   const uint32_t idx = ePropertyPythonOSPluginPath;
   return m_collection_sp->GetPropertyAtIndexAsFileSpec(nullptr, idx);
 }
 
 void ProcessProperties::SetPythonOSPluginPath(const FileSpec &file) {
   const uint32_t idx = ePropertyPythonOSPluginPath;
   m_collection_sp->SetPropertyAtIndexAsFileSpec(nullptr, idx, file);

lldb/source/Target/TargetProperties.td

let Definition = "process" in {
   def IgnoreBreakpointsInExpressions: Property<"ignore-breakpoints-in-expressions", "Boolean">,
     Global,
     DefaultTrue,
     Desc<"If true, breakpoints will be ignored during expression evaluation.">;
   def UnwindOnErrorInExpressions: Property<"unwind-on-error-in-expressions", "Boolean">,
     Global,
     DefaultTrue,
     Desc<"If true, errors in expression evaluation will unwind the stack back to the state before the call.">;
+  def PointerAuthenticationAddressMask: Property<"pointer-authentication-address-mask", "UInt64">,
+    DefaultUnsignedValue<0>,
+    Desc<"Specifies which bits need to be cleared from the pointer.  To use the mask, AND with the inverse.">;
   def PythonOSPluginPath: Property<"python-os-plugin-path", "FileSpec">,
     DefaultUnsignedValue<1>,
     Desc<"A path to a python OS plug-in module file that contains a OperatingSystemPlugIn class.">;
   def StopOnSharedLibraryEvents: Property<"stop-on-sharedlibrary-events", "Boolean">,
     Global,
     DefaultFalse,
     Desc<"If true, stop when a shared library is loaded or unloaded.">;
   def DetachKeepsStopped: Property<"detach-keeps-stopped", "Boolean">,

llvm/include/llvm/BinaryFormat/MinidumpConstants.def

 HANDLE_MDMP_STREAM_TYPE(0x000f, MiscInfo)
 HANDLE_MDMP_STREAM_TYPE(0x0010, MemoryInfoList)
 HANDLE_MDMP_STREAM_TYPE(0x0011, ThreadInfoList)
 HANDLE_MDMP_STREAM_TYPE(0x0012, HandleOperationList)
 HANDLE_MDMP_STREAM_TYPE(0x0013, Token)
 HANDLE_MDMP_STREAM_TYPE(0x0014, JavascriptData)
 HANDLE_MDMP_STREAM_TYPE(0x0015, SystemMemoryInfo)
 HANDLE_MDMP_STREAM_TYPE(0x0016, ProcessVMCounters)
+// Crashpad extension types.  0x4350 = "CP"
+HANDLE_MDMP_STREAM_TYPE(0x43500001, CrashpadInfo)
 // Breakpad extension types.  0x4767 = "Gg"
 HANDLE_MDMP_STREAM_TYPE(0x47670001, BreakpadInfo)
 HANDLE_MDMP_STREAM_TYPE(0x47670002, AssertionInfo)
 // These are additional minidump stream values which are specific to the linux
 // breakpad implementation.
 HANDLE_MDMP_STREAM_TYPE(0x47670003, LinuxCPUInfo)    // /proc/cpuinfo
 HANDLE_MDMP_STREAM_TYPE(0x47670004, LinuxProcStatus) // /proc/$x/status
 HANDLE_MDMP_STREAM_TYPE(0x47670005, LinuxLSBRelease) // /etc/lsb-release