[LLDB] Support AArch64/Linux watchpoint on tagged addresses

[omjavaid]

Summary

AArch64 architecture support virtual addresses with some of the top bits ignored.
These ignored bits can host memory tags or bit masks that can serve to check for
authentication of address integrity. We need to clear away the top ignored bits
from watchpoint address to reliably hit watchpoints as well set watchpoints on
addresses containing tags or masks in their top bits.

This patch adds support to watch tagged addresses on AArch64/Linux.

[DavidSpickett]

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux_arm64.cpp

892

I'm guessing this returns a Status, I think that has a .Success().

lldb/test/API/commands/watchpoints/watch_tagged_addr/TestWatchTaggedAddress.py

35

These docstrings should be more specific. E.g. this test puts a watchpoint on an untagged address, where the one below is tagged.

104

You could remove some of the continues by adding a command to the watchpoint:

(lldb) watchpoint command add 1 -o continue

Then just check the stats at the end after a single continue.

I thought at first this would be bad because you wouldn't know which hit was missed, but we don't know that with the current setup either.

[DavidSpickett]

lldb/source/Plugins/Process/Utility/NativeRegisterContextDBReg_arm64.h

77

This is going to be used by FreeBSD, have you checked if it enables top byte ignore at all?

[omjavaid]

This fixes review comments.

[omjavaid]

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux_arm64.cpp

892

Fixed in current rev.

lldb/source/Plugins/Process/Utility/NativeRegisterContextDBReg_arm64.h

77

In current rev I have moved a default implementation of this function which only ignores top byte. Should work for all other platforms.

lldb/test/API/commands/watchpoints/watch_tagged_addr/TestWatchTaggedAddress.py

35

Fixed in current rev.

104

I would like to avoid this and keep the current version as it makes testcase more readable for newbies.

[DavidSpickett]

@mgorny Does FreeBSD do anything with the top byte ignore feature?

lldb/source/Plugins/Process/Utility/NativeRegisterContextDBReg_arm64.cpp

476

I think it was fine where it was, my point was just to check whether FreeBSD enables TBI at all.

Seems like it should be an OS level query. 99% of the time we'd be fine assuming it's enabled but I don't like the idea of pretending that it is and giving a false impression.

Unless assuming TBI is safe just because the hardware registers don't hold those bits anyway. In which case the comment should justify that.

[omjavaid]

lldb/source/Plugins/Process/Utility/NativeRegisterContextDBReg_arm64.cpp

476

My first choice was to ignore FreeBSD implementation unless someone from FreeBSD does it after testing. The test-case in this patch is also enabled only for Linux/AArch 64.
But as an after thought, to make things uniform across LLDB, I made this change given that we are ignoring top-byte of watchpoint install address from all platforms with ABISysV on host side. Also watchpoint address in DBGWVR is 48 bits in normal VA mode and 52 bits in LVA mode so thought ignoring top byte across all platforms seemed safe.
But lets wait for what @mgorny has to say on this.

[omjavaid]

@labath @mgorny any comments on this rev?

[DavidSpickett]

Since you landed the underlying ABI patch, looking at this again.

Seems like no comments on the BSD side, in which case to be safe we could just have the default FixWatchpointHitAddress make no changes. Then remove TBI and PAC for AArch64 Linux, no surprises that way.

Also should the test case include signing the pointer? Though it is a shame to limit it to only systems with PAC, it is part of what we're testing for so I think it should be included.
(I looked at the nop space instructions but they're only for signing instruction pointers)

I did this in the follow up change https://reviews.llvm.org/D103626#change-luoDAG6B3rHK

[omjavaid]

This update makes native register context changes restricted to Linux/Arm64. Also tweeks test case a little bit.

PS: This test may fail on QEMU. There is QEMU bug that reports wrong watchpoint hit address in case top byte of watched address is tagged.

[DavidSpickett]

For TBI, this looks good as is, I would like to see PAC tested as well.

[omjavaid]

This adds pointer signing before we set watchpoint on the tagged_ptr. LLDB should be able to successfully set a watchpoint on a signed pointer. We can hit the watchpoint on tagged + signed pointer using variable but need to authenticate before increment using tagged pointer.

[DavidSpickett]

lldb/test/API/commands/watchpoints/watch_tagged_addr/main.c

12

Add comments to these inline asm lines to explain the instructions.

[DavidSpickett]

LGTM with the comments added.

[andrew]

FreeBSD doesn't currently support TBI. I'm trying to decide if it will be enabled everywhere, or just when needed (e.g. for HWASAN) due to how it interacts with PAC.

I have a patch in review in the FreeBSD phabricator to add PAC support.

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux_arm64.h

protected:
   // GetGPRBufferSize returns sizeof arm64 GPR ptrace buffer, it is different
   // from GetGPRSize which returns sizeof RegisterInfoPOSIX_arm64::GPR.
   size_t GetGPRBufferSize() { return sizeof(m_gpr_arm64); }
 
   void *GetFPRBuffer() override { return &m_fpr; }
 
   size_t GetFPRSize() override { return sizeof(m_fpr); }
 
+  lldb::addr_t FixWatchpointHitAddress(lldb::addr_t hit_addr) override;
+
 private:
   bool m_gpr_is_valid;
   bool m_fpu_is_valid;
   bool m_sve_buffer_is_valid;
   bool m_mte_ctrl_is_valid;
 
   bool m_sve_header_is_valid;
   bool m_pac_mask_is_valid;

lldb/source/Plugins/Process/Linux/NativeRegisterContextLinux_arm64.cpp

 llvm::Expected<NativeRegisterContextLinux::MemoryTaggingDetails>
 NativeRegisterContextLinux_arm64::GetMemoryTaggingDetails(int32_t type) {
   if (type == MemoryTagManagerAArch64MTE::eMTE_allocation) {
     return MemoryTaggingDetails{std::make_unique<MemoryTagManagerAArch64MTE>(),
                                 PTRACE_PEEKMTETAGS, PTRACE_POKEMTETAGS};
   }
 
   return llvm::createStringError(llvm::inconvertibleErrorCode(),
                                  "Unknown AArch64 memory tag type %d", type);
 }
 
+lldb::addr_t NativeRegisterContextLinux_arm64::FixWatchpointHitAddress(
+    lldb::addr_t hit_addr) {
+  // Linux configures user-space virtual addresses with top byte ignored.
+  // We set default value of mask such that top byte is masked out.
+  lldb::addr_t mask = ~((1ULL << 56) - 1);
+
+  // Try to read pointer authentication data_mask register and calculate a
+  // consolidated data address mask after ignoring the top byte.
+  if (ReadPAuthMask().Success())
+    mask |= m_pac_mask.data_mask;
+
+  return hit_addr & ~mask;
+  ;
+}
+
 #endif // defined (__arm64__) || defined (__aarch64__)

lldb/source/Plugins/Process/Utility/NativeRegisterContextDBReg_arm64.h

protected:
   std::array<struct DREG, 16> m_hbp_regs; // hardware breakpoints
   std::array<struct DREG, 16> m_hwp_regs; // hardware watchpoints
 
   uint32_t m_max_hbp_supported;
   uint32_t m_max_hwp_supported;
 
   virtual llvm::Error ReadHardwareDebugInfo() = 0;
   virtual llvm::Error WriteHardwareDebugRegs(DREGType hwbType) = 0;
+  virtual lldb::addr_t FixWatchpointHitAddress(lldb::addr_t hit_addr) {
+    return hit_addr;
+  }
 };
 
 } // namespace lldb_private
 
 #endif // #ifndef lldb_NativeRegisterContextDBReg_arm64_h

lldb/source/Plugins/Process/Utility/NativeRegisterContextDBReg_arm64.cpp

Status NativeRegisterContextDBReg_arm64::GetWatchpointHitIndex(
   Log *log(lldb_private::GetLogIfAllCategoriesSet(LIBLLDB_LOG_WATCHPOINTS));
   LLDB_LOG(log, "wp_index: {0}, trap_addr: {1:x}", wp_index, trap_addr);
 
   // Read hardware breakpoint and watchpoint information.
   llvm::Error error = ReadHardwareDebugInfo();
   if (error)
     return Status(std::move(error));
 
+  // Mask off ignored bits from watchpoint trap address.
+  trap_addr = FixWatchpointHitAddress(trap_addr);
+
   uint32_t watch_size;
   lldb::addr_t watch_addr;
 
   for (wp_index = 0; wp_index < m_max_hwp_supported; ++wp_index) {
     watch_size = GetWatchpointSize(wp_index);
     watch_addr = m_hwp_regs[wp_index].address;
 
     if (WatchpointIsEnabled(wp_index) && trap_addr >= watch_addr &&
NativeRegisterContextDBReg_arm64::GetWatchpointHitAddress(uint32_t wp_index) {
   LLDB_LOG(log, "wp_index: {0}", wp_index);
 
   if (wp_index >= m_max_hwp_supported)
     return LLDB_INVALID_ADDRESS;
 
   if (WatchpointIsEnabled(wp_index))
     return m_hwp_regs[wp_index].hit_addr;
   return LLDB_INVALID_ADDRESS;
 }

lldb/source/Target/Target.cpp

 #include "lldb/Interpreter/CommandInterpreter.h"
 #include "lldb/Interpreter/CommandReturnObject.h"
 #include "lldb/Interpreter/OptionGroupWatchpoint.h"
 #include "lldb/Interpreter/OptionValues.h"
 #include "lldb/Interpreter/Property.h"
 #include "lldb/Symbol/Function.h"
 #include "lldb/Symbol/ObjectFile.h"
 #include "lldb/Symbol/Symbol.h"
+#include "lldb/Target/ABI.h"
 #include "lldb/Target/Language.h"
 #include "lldb/Target/LanguageRuntime.h"
 #include "lldb/Target/Process.h"
 #include "lldb/Target/SectionLoadList.h"
 #include "lldb/Target/StackFrame.h"
 #include "lldb/Target/StackFrameRecognizer.h"
 #include "lldb/Target/SystemRuntime.h"
 #include "lldb/Target/Thread.h"
if (!CheckIfWatchpointsSupported(this, error))
     return wp_sp;
 
   // Currently we only support one watchpoint per address, with total number of
   // watchpoints limited by the hardware which the inferior is running on.
 
   // Grab the list mutex while doing operations.
   const bool notify = false; // Don't notify about all the state changes we do
                              // on creating the watchpoint.
+
+  // Mask off ignored bits from watchpoint address.
+  if (ABISP abi = m_process_sp->GetABI())
+    addr = abi->FixDataAddress(addr);
+
   std::unique_lock<std::recursive_mutex> lock;
   this->GetWatchpointList().GetListMutex(lock);
   WatchpointSP matched_sp = m_watchpoint_list.FindByAddress(addr);
   if (matched_sp) {
     size_t old_size = matched_sp->GetByteSize();
     uint32_t old_type =
         (matched_sp->WatchpointRead() ? LLDB_WATCH_TYPE_READ : 0) |
         (matched_sp->WatchpointWrite() ? LLDB_WATCH_TYPE_WRITE : 0);

lldb/test/API/commands/watchpoints/watch_tagged_addr/Makefile

+C_SOURCES := main.c
+
+CFLAGS_EXTRAS := -march=armv8.3-a
+
+include Makefile.rules

lldb/test/API/commands/watchpoints/watch_tagged_addr/TestWatchTaggedAddress.py

+"""
+Test LLDB can set and hit watchpoints on tagged addresses
+"""
+
+import lldb
+from lldbsuite.test.decorators import *
+from lldbsuite.test.lldbtest import *
+from lldbsuite.test import lldbutil
+
+class TestWatchTaggedAddresses(TestBase):
+
+    mydir = TestBase.compute_mydir(__file__)
+    NO_DEBUG_INFO_TESTCASE = True
+
+    def setUp(self):
+        # Call super's setUp().
+        TestBase.setUp(self)
+
+        # Set source filename.
+        self.source = 'main.c'
+
+        # Invoke the default build rule.
+        self.build()
+
+        # Get the path of the executable
+        exe = self.getBuildArtifact("a.out")
+
+        # Create a target by the debugger.
+        self.runCmd("file " + exe, CURRENT_EXECUTABLE_SET)
+
+    @skipIf(archs=no_match(["aarch64"]))
+    @skipIf(oslist=no_match(['linux']))
+    def test_watch_hit_tagged_ptr_access(self):
+        """
+        Test that LLDB hits watchpoint installed on an untagged address with
+        memory access by a tagged pointer.
+        """
+        if not self.isAArch64PAuth():
+            self.skipTest('Target must support pointer authentication.')
+
+        # Add a breakpoint to set a watchpoint when stopped on the breakpoint.
+        lldbutil.run_break_set_by_symbol(self, 'main')
+
+        # Run the program.
+        self.runCmd("run", RUN_SUCCEEDED)
+
+        # We should be stopped due to the breakpoint.
+        self.expect("thread list", STOPPED_DUE_TO_BREAKPOINT,
+                    substrs=['stopped',
+                             'stop reason = breakpoint'])
+
+        # Set the watchpoint variable declaration line number.
+        self.decl = line_number(self.source,
+                                '// Watchpoint variable declaration.')
+
+        # Now let's set a watchpoint on 'global_var'.
+        self.expect(
+            "watchpoint set variable global_var",
+            WATCHPOINT_CREATED,
+            substrs=[
+                'Watchpoint created',
+                'size = 4',
+                'type = w',
+                '%s:%d' %
+                (self.source,
+                 self.decl)])
+
+        self.verify_watch_hits()
+
+    @skipIf(archs=no_match(["aarch64"]))
+    @skipIf(oslist=no_match(['linux']))
+    def test_watch_set_on_tagged_ptr(self):
+        """Test that LLDB can install and hit watchpoint on a tagged address"""
+
+        if not self.isAArch64PAuth():
+            self.skipTest('Target must support pointer authentication.')
+
+        # Find the line number to break inside main().
+        self.line = line_number(self.source, '// Set break point at this line.')
+
+        # Add a breakpoint to set a watchpoint when stopped on the breakpoint.
+        lldbutil.run_break_set_by_file_and_line(
+            self, None, self.line, num_expected_locations=1)
+
+        # Run the program.
+        self.runCmd("run", RUN_SUCCEEDED)
+
+        # We should be stopped due to the breakpoint.
+        self.expect("thread list", STOPPED_DUE_TO_BREAKPOINT,
+                    substrs=['stopped',
+                             'stop reason = breakpoint'])
+
+        # Now let's set a expression watchpoint on 'tagged_ptr'.
+        self.expect(
+            "watchpoint set expression -s 4 -- tagged_ptr",
+            WATCHPOINT_CREATED,
+            substrs=[
+                'Watchpoint created',
+                'size = 4',
+                'type = w'])
+
+        self.verify_watch_hits()
+
+    def verify_watch_hits(self):
+        # Use the '-v' option to do verbose listing of the watchpoint.
+        # The hit count should be 0 initially.
+        self.expect("watchpoint list -v",
+                    substrs=['Number of supported hardware watchpoints:',
+                             'hit_count = 0'])
+
+        self.runCmd("process continue")
+
+        # We should be stopped again due to the watchpoint (read_write type).
+        # The stop reason of the thread should be watchpoint.
+        self.expect("thread backtrace", STOPPED_DUE_TO_WATCHPOINT,
+                    substrs=['stop reason = watchpoint'])
+
+        self.runCmd("process continue")
+
+        # We should be stopped again due to the watchpoint (read_write type).
+        # The stop reason of the thread should be watchpoint.
+        self.expect("thread backtrace", STOPPED_DUE_TO_WATCHPOINT,
+                    substrs=['stop reason = watchpoint'])
+
+        self.runCmd("process continue")
+
+        # There should be no more watchpoint hit and the process status should
+        # be 'exited'.
+        self.expect("process status",
+                    substrs=['exited'])
+
+        # Use the '-v' option to do verbose listing of the watchpoint.
+        # The hit count should now be 2.
+        self.expect("watchpoint list -v",
+                    substrs=['hit_count = 2'])

lldb/test/API/commands/watchpoints/watch_tagged_addr/main.c

+#include <stdint.h>
+
+uint32_t global_var = 0; // Watchpoint variable declaration.
+
+int main(int argc, char **argv) {
+  int dummy = 0;
+  // Move address of global variable into tagged_ptr after tagging
+  // Simple tagging scheme where 62nd bit of tagged address is set
+  uint32_t *tagged_ptr = (uint32_t *)((uint64_t)&global_var | (1ULL << 62));
+
+  // pacdza computes and inserts a pointer authentication code for address
+  // stored in tagged_ptr using PAC key A.
+  __asm__ __volatile__("pacdza %0" : "=r"(tagged_ptr) : "r"(tagged_ptr));
+
+  ++dummy; // Set break point at this line.
+
+  // Increment global_var
+  ++global_var;
+
+  ++dummy;
+
+  // autdza authenticates tagged_ptr using PAC key A.
+  __asm__ __volatile__("autdza %0" : "=r"(tagged_ptr) : "r"(tagged_ptr));
+
+  // Increment global_var using tagged_ptr
+  ++*tagged_ptr;
+
+  return 0;
+}