Captures shadow stack registers for x64 Windows contexts

Windows extended contexts must be allocated by InitializeContext2 and
may not be aligned. This means we cannot simply store a struct in
our thread snapshot object, but must instead store enough memory
and alias our struct onto this backing memory.

Note that shadow stack pointers are not yet recorded for the initial
exception - this cannot be determined using LocateXStateFeature in
the capturing process and will be added in a future CL by plumbing
through client messages when a crashed process requests a dump.

See crash/32bd2c53a252705c for an example dump with this baked into
chrome, that has passed through breakpad without breaking it. Local
testing shows this creates valid dumps when built into Chrome, but
that the referenced memory limits may need to be increased to allow
for ssp referenced memory to be included.

See "MANAGING STATE USING THE XSAVE FEATURE SET" Chapter 13 in the
Intel SDM[0]. Many of the offsets and sizes of the extended features
are provided by cpu specific values. We can access these in Windows
using the SDK, and transfer these to the saved extended context
which in turn is understandable by windbg.

Further information is available from AMD Ch. 18 "Shadow Stacks"[1].

    [0] https://software.intel.com/content/www/us/en/develop/download/intel-64-and-ia-32-architectures-sdm-combined-volumes-1-2a-2b-2c-2d-3a-3b-3c-3d-and-4.html.
    [1] https://www.amd.com/system/files/TechDocs/24593.pdf

Bug: 1250098
Change-Id: I4b13bcb023e9d5fba257044abfd7e251d66a9329
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3300992
Reviewed-by: Joshua Peraza <jperaza@chromium.org>
Commit-Queue: Alex Gough <ajgo@chromium.org>

snapshot/capture_memory.cc

@@ -15,6 +15,10 @@
 #include "snapshot/capture_memory.h"
 
 #include <stdint.h>
+#include <windows.h>
+
+// dbghelp must be after windows.h.
+#include <dbghelp.h>
 
 #include <iterator>
 #include <limits>
@@ -86,6 +90,10 @@ void CaptureMemory::PointedToByContext(const CPUContext& context,
     MaybeCaptureMemoryAround(delegate, context.x86_64->r14);
     MaybeCaptureMemoryAround(delegate, context.x86_64->r15);
     MaybeCaptureMemoryAround(delegate, context.x86_64->rip);
+    // Shadow stack region.
+    if (context.x86_64->xstate.enabled_features & XSTATE_MASK_CET_U) {
+      MaybeCaptureMemoryAround(delegate, context.x86_64->xstate.cet_u.ssp);
+    }
   } else {
     MaybeCaptureMemoryAround(delegate, context.x86->eax);
     MaybeCaptureMemoryAround(delegate, context.x86->ebx);

snapshot/win/cpu_context_win.cc

@@ -124,6 +124,19 @@ void CommonInitializeX86Context(const T* context, CPUContextX86* out) {
   }
 }
 
+#if defined(ARCH_CPU_X86_64)
+DWORD64 CallGetEnabledXStateFeatures() {
+  // GetEnabledXStateFeatures needs Windows 7 SP1.
+  HINSTANCE kernel32 = GetModuleHandle(L"Kernel32.dll");
+  decltype(GetEnabledXStateFeatures)* get_enabled_xstate_features =
+      reinterpret_cast<decltype(GetEnabledXStateFeatures)*>(
+          GetProcAddress(kernel32, "GetEnabledXStateFeatures"));
+  if (!get_enabled_xstate_features)
+    return 0;
+  return get_enabled_xstate_features();
+}
+#endif  // defined(ARCH_CPU_X64)
+
 }  // namespace
 
 #if defined(ARCH_CPU_X86)
@@ -198,6 +211,23 @@ void InitializeX64Context(const CONTEXT* context, CPUContextX86_64* out) {
   }
 }
 
+void InitializeX64XStateCet(const CONTEXT* context,
+                            XSAVE_CET_U_FORMAT* cet_u,
+                            CPUContextX86_64* out) {
+  if (HasContextPart(context, CONTEXT_XSTATE)) {
+    if (cet_u) {
+      out->xstate.enabled_features |= XSTATE_MASK_CET_U;
+      out->xstate.cet_u.cetmsr = cet_u->Ia32CetUMsr;
+      out->xstate.cet_u.ssp = cet_u->Ia32Pl3SspMsr;
+    }
+  }
+}
+
+bool IsXStateFeatureEnabled(DWORD64 features) {
+  static DWORD64 flags = CallGetEnabledXStateFeatures();
+  return (flags & features) == features;
+}
+
 #elif defined(ARCH_CPU_ARM64)
 
 void InitializeARM64Context(const CONTEXT* context, CPUContextARM64* out) {

snapshot/win/cpu_context_win.h

@@ -44,6 +44,16 @@ void InitializeX86Context(const WOW64_CONTEXT* context, CPUContextX86* out);
 //! Only reads a max of sizeof(CONTEXT) so will not initialize extended values.
 void InitializeX64Context(const CONTEXT* context, CPUContextX86_64* out);
 
+//! \brief Initializes CET fields of a CPUContextX86_64 structure from
+//!     an xsave location if |context| flags support cet_u values.
+void InitializeX64XStateCet(const CONTEXT* context,
+                            XSAVE_CET_U_FORMAT* cet_u,
+                            CPUContextX86_64* out);
+
+//! \brief Wraps GetXStateEnabledFeatures(), returns true if the specified set
+//!     of flags are all supported.
+bool IsXStateFeatureEnabled(DWORD64 feature);
+
 #endif  // ARCH_CPU_X86_64
 
 #if defined(ARCH_CPU_ARM64) || DOXYGEN

snapshot/win/exception_snapshot_win.cc

@@ -52,7 +52,19 @@ void NativeContextToCPUContext64(const CONTEXT* context_record,
 #if defined(ARCH_CPU_X86_64)
   context->architecture = kCPUArchitectureX86_64;
   context->x86_64 = &context_union->x86_64;
+  // Note that the context here is not extended, even if the flags suggest so,
+  // as we only copied in sizeof(CONTEXT).
   InitializeX64Context(context_record, context->x86_64);
+  // TODO(1250098) plumb through ssp via message from crashed process. For now
+  // we zero this if CET is available in the capturing process as otherwise
+  // WinDBG will show the relevant thread's ssp for the exception which will
+  // likely be more confusing than showing a zero value.
+  if (IsXStateFeatureEnabled(XSTATE_MASK_CET_U)) {
+    XSAVE_CET_U_FORMAT cet_u_fake;
+    cet_u_fake.Ia32CetUMsr = 0;
+    cet_u_fake.Ia32Pl3SspMsr = 0;
+    InitializeX64XStateCet(context_record, &cet_u_fake, context->x86_64);
+  }
 #elif defined(ARCH_CPU_ARM64)
   context->architecture = kCPUArchitectureARM64;
   context->arm64 = &context_union->arm64;

snapshot/win/process_reader_win.cc

@@ -19,7 +19,9 @@
 
 #include <memory>
 
+#include "base/notreached.h"
 #include "base/numerics/safe_conversions.h"
+#include "snapshot/win/cpu_context_win.h"
 #include "util/misc/capture_context.h"
 #include "util/misc/time.h"
 #include "util/win/nt_internals.h"
@@ -163,18 +165,20 @@ bool FillThreadContextAndSuspendCount(HANDLE thread_handle,
     }
 
 #if defined(ARCH_CPU_32_BITS)
-    const bool is_native = true;
+    if (!thread->context.InitializeNative(thread_handle))
+      return false;
 #elif defined(ARCH_CPU_64_BITS)
-    const bool is_native = !is_64_reading_32;
     if (is_64_reading_32) {
       if (!thread->context.InitializeWow64(thread_handle))
         return false;
-    }
-#endif
-    if (is_native) {
+    } else if (IsXStateFeatureEnabled(XSTATE_MASK_CET_U)) {
+      if (!thread->context.InitializeXState(thread_handle, XSTATE_MASK_CET_U))
+        return false;
+    } else {
       if (!thread->context.InitializeNative(thread_handle))
         return false;
     }
+#endif
 
     if (!ResumeThread(thread_handle)) {
       PLOG(ERROR) << "ResumeThread";
@@ -220,6 +224,52 @@ bool ProcessReaderWin::ThreadContext::InitializeWow64(HANDLE thread_handle) {
 }
 #endif
 
+#if defined(ARCH_CPU_64_BITS)
+bool ProcessReaderWin::ThreadContext::InitializeXState(
+    HANDLE thread_handle,
+    ULONG64 XStateCompactionMask) {
+  static auto initialize_context_2 = []() {
+    // InitializeContext2 needs Windows 10 build 20348.
+    HINSTANCE kernel32 = GetModuleHandle(L"Kernel32.dll");
+    return reinterpret_cast<decltype(InitializeContext2)*>(
+        GetProcAddress(kernel32, "InitializeContext2"));
+  }();
+  if (!initialize_context_2)
+    return false;
+  // We want CET_U xstate to get the ssp, only possible when supported.
+  PCONTEXT ret_context = nullptr;
+  DWORD context_size = 0;
+  if (!initialize_context_2(nullptr,
+                            CONTEXT_ALL | CONTEXT_XSTATE,
+                            &ret_context,
+                            &context_size,
+                            XStateCompactionMask) &&
+      GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
+    PLOG(ERROR) << "InitializeContext2 - getting required size";
+    return false;
+  }
+  // NB: ret_context may not be data.begin().
+  data_.resize(context_size);
+  if (!initialize_context_2(data_.data(),
+                            CONTEXT_ALL | CONTEXT_XSTATE,
+                            &ret_context,
+                            &context_size,
+                            XStateCompactionMask)) {
+    PLOG(ERROR) << "InitializeContext2 - initializing";
+    return false;
+  }
+  offset_ = reinterpret_cast<unsigned char*>(ret_context) - data_.data();
+  initialized_ = true;
+
+  if (!GetThreadContext(thread_handle, ret_context)) {
+    PLOG(ERROR) << "GetThreadContext";
+    return false;
+  }
+
+  return true;
+}
+#endif  // defined(ARCH_CPU_64_BITS)
+
 ProcessReaderWin::Thread::Thread()
     : context(),
       id(0),

snapshot/win/process_reader_win.h

@@ -54,6 +54,8 @@ class ProcessReaderWin {
     }
 #if defined(ARCH_CPU_64_BITS)
     bool InitializeWow64(HANDLE thread_handle);
+    // Initializes internal structures for extended compacted contexts.
+    bool InitializeXState(HANDLE thread_handle, ULONG64 XStateCompactionMask);
 #endif
     void InitializeFromCurrentThread();
     bool InitializeNative(HANDLE thread_handle);

snapshot/win/thread_snapshot_win.cc

@@ -26,6 +26,25 @@
 namespace crashpad {
 namespace internal {
 
+namespace {
+#if defined(ARCH_CPU_X86_64)
+XSAVE_CET_U_FORMAT* LocateXStateCetU(CONTEXT* context) {
+  // GetEnabledXStateFeatures needs Windows 7 SP1.
+  static auto locate_xstate_feature = []() {
+    HINSTANCE kernel32 = GetModuleHandle(L"Kernel32.dll");
+    return reinterpret_cast<decltype(LocateXStateFeature)*>(
+        GetProcAddress(kernel32, "LocateXStateFeature"));
+  }();
+  if (!locate_xstate_feature)
+    return nullptr;
+
+  DWORD cet_u_size = 0;
+  return reinterpret_cast<XSAVE_CET_U_FORMAT*>(
+      locate_xstate_feature(context, XSTATE_CET_U, &cet_u_size));
+}
+#endif  // defined(ARCH_CPU_X86_64)
+}  // namespace
+
 ThreadSnapshotWin::ThreadSnapshotWin()
     : ThreadSnapshot(),
       context_(),
@@ -73,8 +92,16 @@ bool ThreadSnapshotWin::Initialize(
   if (process_reader->Is64Bit()) {
     context_.architecture = kCPUArchitectureX86_64;
     context_.x86_64 = &context_union_.x86_64;
-    InitializeX64Context(process_reader_thread.context.context<CONTEXT>(),
-                         context_.x86_64);
+    CONTEXT* context = process_reader_thread.context.context<CONTEXT>();
+    InitializeX64Context(context, context_.x86_64);
+    // Capturing process must have CET enabled. If captured process does not,
+    // then this will not set any state in the context snapshot.
+    if (IsXStateFeatureEnabled(XSTATE_MASK_CET_U)) {
+      XSAVE_CET_U_FORMAT* cet_u = LocateXStateCetU(context);
+      if (cet_u) {
+        InitializeX64XStateCet(context, cet_u, context_.x86_64);
+      }
+    }
   } else {
     context_.architecture = kCPUArchitectureX86;
     context_.x86 = &context_union_.x86;