[gdb/aarch64] pauth: Create new feature string for pauth to prevent crashing older gdb's

  Older gdb's (9, 10, 11 and 12) have a bug that causes them to crash whenever
a target reports the pauth feature string in the target description and also
provide additional register outside of gdb's known and expected feature
strings.

This was fixed in gdb 13 onwards, but that means we're stuck with gdb's out
there that will crash on connection to the above targets.

QEMU has postponed inclusion of the pauth feature string in version 8, and
instead we agreed to use a new feature name to prevent crashing those older
gdb's.

Initially there was a plan to backport a trivial fix all the way to gdb 9, but
given QEMU's choice, this is no longer needed.

This new feature string is org.gnu.gdb.aarch64.pauth_v2, and should be used
by all targets going forward, except native linux gdb and gdbserver, for
backwards compatibility with older gdb's/gdbserver's.

gdb/gdbserver will still emit the old feature string for Linux since it doesn't
report additional system registers and thus doesn't cause a crash of older
gdb's. We can revisit this in the future once the problematic gdb's are likely
no longer in use.

I've added some documentation to explain the situation.
---
 gdb/aarch64-tdep.c  | 15 ++++++++++++++-
 gdb/doc/gdb.texinfo | 16 ++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)
  

> CC: <alex.bennee@linaro.org>, <richard.henderson@linaro.org>,
>  <peter.maydell@linaro.org>
> Date: Tue, 11 Apr 2023 23:43:27 +0100
> From: Luis Machado via Gdb-patches <gdb-patches@sourceware.org>
> 
> I've added some documentation to explain the situation.
> ---
>  gdb/aarch64-tdep.c  | 15 ++++++++++++++-
>  gdb/doc/gdb.texinfo | 16 ++++++++++++++++
>  2 files changed, 30 insertions(+), 1 deletion(-)

Thanks.

> diff --git a/gdb/doc/gdb.texinfo b/gdb/doc/gdb.texinfo
> index 45a0580bc29..aefeb63f75c 100644
> --- a/gdb/doc/gdb.texinfo
> +++ b/gdb/doc/gdb.texinfo
> @@ -47980,6 +47980,22 @@ has a signed link register value that needs to be unmasked/decoded.
>  Extra registers are allowed in this feature, but they will not affect
>  @value{GDBN}.
>  
> +Due to a bug in previous versions of @value{GDBN} (versions 9, 10, 11 and 12),
> +a new feature string was created to prevent targets causing a @value{GDBN}
> +crash whenever they reported support for Pointer Authentication and also
> +reported additional system registers that were not accounted for by
> +@value{GDBN}.  This is common when using emulators and on bare-metal debugging
> +scenarios.
> +
> +The new feature string is @samp{org.gnu.gdb.aarch64.pauth_v2}, and it has
> +the same contents as feature string @samp{org.gnu.gdb.aarch64.pauth}.
> +
> +Targets reporting Pointer Authentication support via the remote protocol
> +should always use the newer feature string @samp{org.gnu.gdb.aarch64.pauth_v2}.
> +
> +In the future the @samp{org.gnu.gdb.aarch64.pauth} feature string might be
> +deprecated in favor of @samp{org.gnu.gdb.aarch64.pauth_v2}.
> +

Since this is the manual for GDB users, it should describe the feature
first, and explain its use and rationale after that.  So this
description is backwards: it starts with the reason for introduction
of this feature, something that doesn't necessarily make sense to the
reader of the manual.

Instead, we should first say that 'org.gnu.gdb.aarch64.pauth' will be
deprecated in favor of 'org.gnu.gdb.aarch64.pauth_v2', then introduce
'org.gnu.gdb.aarch64.pauth_v2' saying that it has the same contents as
the former, and finally explain that targets should use
'org.gnu.gdb.aarch64.pauth_v2' to avoid the danger of crashing older
GDBs.

OK?

Reviewed-By: Eli Zaretskii <eliz@gnu.org>
  

Hi Eli,

On 4/12/23 07:04, Eli Zaretskii wrote:
>> CC: <alex.bennee@linaro.org>, <richard.henderson@linaro.org>,
>>   <peter.maydell@linaro.org>
>> Date: Tue, 11 Apr 2023 23:43:27 +0100
>> From: Luis Machado via Gdb-patches <gdb-patches@sourceware.org>
>>
>> I've added some documentation to explain the situation.
>> ---
>>   gdb/aarch64-tdep.c  | 15 ++++++++++++++-
>>   gdb/doc/gdb.texinfo | 16 ++++++++++++++++
>>   2 files changed, 30 insertions(+), 1 deletion(-)
> 
> Thanks.
> 
>> diff --git a/gdb/doc/gdb.texinfo b/gdb/doc/gdb.texinfo
>> index 45a0580bc29..aefeb63f75c 100644
>> --- a/gdb/doc/gdb.texinfo
>> +++ b/gdb/doc/gdb.texinfo
>> @@ -47980,6 +47980,22 @@ has a signed link register value that needs to be unmasked/decoded.
>>   Extra registers are allowed in this feature, but they will not affect
>>   @value{GDBN}.
>>   
>> +Due to a bug in previous versions of @value{GDBN} (versions 9, 10, 11 and 12),
>> +a new feature string was created to prevent targets causing a @value{GDBN}
>> +crash whenever they reported support for Pointer Authentication and also
>> +reported additional system registers that were not accounted for by
>> +@value{GDBN}.  This is common when using emulators and on bare-metal debugging
>> +scenarios.
>> +
>> +The new feature string is @samp{org.gnu.gdb.aarch64.pauth_v2}, and it has
>> +the same contents as feature string @samp{org.gnu.gdb.aarch64.pauth}.
>> +
>> +Targets reporting Pointer Authentication support via the remote protocol
>> +should always use the newer feature string @samp{org.gnu.gdb.aarch64.pauth_v2}.
>> +
>> +In the future the @samp{org.gnu.gdb.aarch64.pauth} feature string might be
>> +deprecated in favor of @samp{org.gnu.gdb.aarch64.pauth_v2}.
>> +
> 
> Since this is the manual for GDB users, it should describe the feature
> first, and explain its use and rationale after that.  So this
> description is backwards: it starts with the reason for introduction
> of this feature, something that doesn't necessarily make sense to the
> reader of the manual.
> 
> Instead, we should first say that 'org.gnu.gdb.aarch64.pauth' will be
> deprecated in favor of 'org.gnu.gdb.aarch64.pauth_v2', then introduce
> 'org.gnu.gdb.aarch64.pauth_v2' saying that it has the same contents as
> the former, and finally explain that targets should use
> 'org.gnu.gdb.aarch64.pauth_v2' to avoid the danger of crashing older
> GDBs.
> 
> OK?

It sounds OK.

How about the following flow?

In the future the @samp{org.gnu.gdb.aarch64.pauth} feature string might be
deprecated in favor of feature string @samp{org.gnu.gdb.aarch64.pauth_v2}.

The @samp{org.gnu.gdb.aarch64.pauth_v2} feature has the exact same contents
as feature @samp{org.gnu.gdb.aarch64.pauth}.

Targets reporting Pointer Authentication support via the remote protocol
should always use the newer feature string
@samp{org.gnu.gdb.aarch64.pauth_v2}.

The reason for having feature @samp{org.gnu.gdb.aarch64.pauth_v2} is a bug in
previous versions of @value{GDBN} (versions 9, 10, 11 and 12).  This bug
caused @value{GDBN} to crash whenever the target reported support for Pointer
Authentication (using feature string @samp{org.gnu.gdb.aarch64.pauth}) and also
reported additional system registers that were not accounted for by
@value{GDBN}.  This is common when using emulators and on bare-metal debugging
scenarios.

> 
> Reviewed-By: Eli Zaretskii <eliz@gnu.org>
  

> Date: Wed, 12 Apr 2023 09:46:31 +0100
> Cc: gdb-patches@sourceware.org, alex.bennee@linaro.org,
>  richard.henderson@linaro.org, peter.maydell@linaro.org
> From: Luis Machado <luis.machado@arm.com>
> 
> How about the following flow?
> 
> In the future the @samp{org.gnu.gdb.aarch64.pauth} feature string might be
> deprecated in favor of feature string @samp{org.gnu.gdb.aarch64.pauth_v2}.
> 
> The @samp{org.gnu.gdb.aarch64.pauth_v2} feature has the exact same contents
> as feature @samp{org.gnu.gdb.aarch64.pauth}.
> 
> Targets reporting Pointer Authentication support via the remote protocol
> should always use the newer feature string
> @samp{org.gnu.gdb.aarch64.pauth_v2}.
> 
> The reason for having feature @samp{org.gnu.gdb.aarch64.pauth_v2} is a bug in
> previous versions of @value{GDBN} (versions 9, 10, 11 and 12).  This bug
> caused @value{GDBN} to crash whenever the target reported support for Pointer
> Authentication (using feature string @samp{org.gnu.gdb.aarch64.pauth}) and also
> reported additional system registers that were not accounted for by
> @value{GDBN}.  This is common when using emulators and on bare-metal debugging
> scenarios.

The flow is OK, but the last paragraph is too long.  The main reason
of this text is to tell people to use the v2 feature, not to explain
why it exists.  So the explanation of the reason should be shorter
like

  We recommend always using the @samp{org.gnu.gdb.aarch64.pauth_v2}
  feature because using @samp{org.gnu.gdb.aarch64.pauth} could crash
  older versions of @value{GDBN} due to a known bug in those versions.

Is it really important to say that the bug happens only when
additional system registers are reported?
  

On 4/12/23 10:20, Eli Zaretskii wrote:
>> Date: Wed, 12 Apr 2023 09:46:31 +0100
>> Cc: gdb-patches@sourceware.org, alex.bennee@linaro.org,
>>   richard.henderson@linaro.org, peter.maydell@linaro.org
>> From: Luis Machado <luis.machado@arm.com>
>>
>> How about the following flow?
>>
>> In the future the @samp{org.gnu.gdb.aarch64.pauth} feature string might be
>> deprecated in favor of feature string @samp{org.gnu.gdb.aarch64.pauth_v2}.
>>
>> The @samp{org.gnu.gdb.aarch64.pauth_v2} feature has the exact same contents
>> as feature @samp{org.gnu.gdb.aarch64.pauth}.
>>
>> Targets reporting Pointer Authentication support via the remote protocol
>> should always use the newer feature string
>> @samp{org.gnu.gdb.aarch64.pauth_v2}.
>>
>> The reason for having feature @samp{org.gnu.gdb.aarch64.pauth_v2} is a bug in
>> previous versions of @value{GDBN} (versions 9, 10, 11 and 12).  This bug
>> caused @value{GDBN} to crash whenever the target reported support for Pointer
>> Authentication (using feature string @samp{org.gnu.gdb.aarch64.pauth}) and also
>> reported additional system registers that were not accounted for by
>> @value{GDBN}.  This is common when using emulators and on bare-metal debugging
>> scenarios.
> 
> The flow is OK, but the last paragraph is too long.  The main reason
> of this text is to tell people to use the v2 feature, not to explain
> why it exists.  So the explanation of the reason should be shorter
> like

Though it is documentation for users, it is also one of the only documents providing guidance for developers of debugging stubs (like QEMU's, openOCD etc).

So I feel like it should include a bit more information rather than the bare minimum.

I don't think this particular section (XML target descriptions) is geared towards the common debugger users.

> 
>    We recommend always using the @samp{org.gnu.gdb.aarch64.pauth_v2}
>    feature because using @samp{org.gnu.gdb.aarch64.pauth} could crash
>    older versions of @value{GDBN} due to a known bug in those versions.

I think the above is sane. It just has less detail, which, as explained above, might not be too useful for
developers of debugging stubs.

> 
> Is it really important to say that the bug happens only when
> additional system registers are reported?

We could make it shorter by only mentioning this is only an issue when using emulators.
  

> Date: Wed, 12 Apr 2023 10:25:56 +0100
> Cc: gdb-patches@sourceware.org, alex.bennee@linaro.org,
>  richard.henderson@linaro.org, peter.maydell@linaro.org
> From: Luis Machado <luis.machado@arm.com>
> 
> > The flow is OK, but the last paragraph is too long.  The main reason
> > of this text is to tell people to use the v2 feature, not to explain
> > why it exists.  So the explanation of the reason should be shorter
> > like
> 
> Though it is documentation for users, it is also one of the only documents providing guidance for developers of debugging stubs (like QEMU's, openOCD etc).
> 
> So I feel like it should include a bit more information rather than the bare minimum.
> 
> I don't think this particular section (XML target descriptions) is geared towards the common debugger users.
> 
> > 
> >    We recommend always using the @samp{org.gnu.gdb.aarch64.pauth_v2}
> >    feature because using @samp{org.gnu.gdb.aarch64.pauth} could crash
> >    older versions of @value{GDBN} due to a known bug in those versions.
> 
> I think the above is sane. It just has less detail, which, as explained above, might not be too useful for
> developers of debugging stubs.
> 
> > 
> > Is it really important to say that the bug happens only when
> > additional system registers are reported?
> 
> We could make it shorter by only mentioning this is only an issue when using emulators.

Fine by me, thanks.
  

On Wed, 12 Apr 2023 at 10:26, Luis Machado <luis.machado@arm.com> wrote:
> On 4/12/23 10:20, Eli Zaretskii wrote:
> > Is it really important to say that the bug happens only when
> > additional system registers are reported?
>
> We could make it shorter by only mentioning this is only an issue when using emulators.

It's not emulator-specific, though, is it, if I understand the bug right?
It will happen with any gdb-protocol-speaking stub that reports registers
in XML features that gdb doesn't care about, I think you said? It's just
that the case we know about happens to be with an emulator where the
extra registers reported are system registers.

thanks
-- PMM
  

On 4/12/23 12:48, Peter Maydell wrote:
> On Wed, 12 Apr 2023 at 10:26, Luis Machado <luis.machado@arm.com> wrote:
>> On 4/12/23 10:20, Eli Zaretskii wrote:
>>> Is it really important to say that the bug happens only when
>>> additional system registers are reported?
>>
>> We could make it shorter by only mentioning this is only an issue when using emulators.
> 
> It's not emulator-specific, though, is it, if I understand the bug right?
> It will happen with any gdb-protocol-speaking stub that reports registers
> in XML features that gdb doesn't care about, I think you said? It's just
> that the case we know about happens to be with an emulator where the
> extra registers reported are system registers.

Yes, that's true. That was oversimplifying it. Emulators would be the most common case at the moment, like QEMU users
attempting to use Pointer Authentication support.

It could be potentially anything, as I described before. Even a newer gdbserver talking to an old gdb, if the new gdbserver
sends additional registers the old gdb doesn't care about.

Maybe I should expand on that explanation as well.

> 
> thanks
> -- PMM
  

>>>>> "Luis" == Luis Machado via Gdb-patches <gdb-patches@sourceware.org> writes:

Luis> Though it is documentation for users, it is also one of the only
Luis> documents providing guidance for developers of debugging stubs
Luis> (like QEMU's, openOCD etc).

Luis> So I feel like it should include a bit more information rather
Luis> than the bare minimum.

FWIW, I concur -- in the past I've wished that the documentation about
target XML features had been more complete.

Tom