Skip to content

Commit 32b1f83

Browse files
jasonmolendajasonmolenda
committed
[lldb] Provide lr value in faulting frame on arm64 (llvm#138805)
Re-landing this patch with small tweaks to address CI bot failures as it was run on many different configurations. I think the test may run on aarch64 Linux systems now. When a frameless function faults or is interrupted asynchronously, the UnwindPlan MAY have no register location rule for the return address register (lr on arm64); the value is simply live in the lr register when it was interrupted, and the frame below this on the stack -- e.g. sigtramp on a Unix system -- has the full register context, including that register. RegisterContextUnwind::SavedLocationForRegister, when asked to find the caller's pc value, will first see if there is a pc register location. If there isn't, on a Return Address Register architecture like arm/mips/riscv, we rewrite the register request from "pc" to "RA register", and search for a location. On frame 0 (the live frame) and an interrupted frame, the UnwindPlan may have no register location rule for the RA Reg, that is valid. A frameless function that never calls another may simply keep the return address in the live register the whole way. Our instruction emulation unwind plans explicitly add a rule (see Pavel's May 2024 change llvm#91321 ), but an UnwindPlan sourced from debug_frame may not. I've got a case where this exactly happens - clang debug_frame for arm64 where there is no register location for the lr in a frameless function. There is a fault in the middle of this frameless function and we only get the lr value from the fault handler below this frame if lr has a register location of `IsSame`, in line with Pavel's 2024 change. Similar to how we see a request of the RA Reg from frame 0 after failing to find an unwind location for the pc register, the same style of special casing is needed when this is a function that was interrupted. Without this change, we can find the pc of the frame that was executing when it was interrupted, but we need $lr to find its caller, and we don't descend down to the trap handler to get that value, truncating the stack. rdar://145614545 (cherry picked from commit b957cc0)
1 parent b0d6e64 commit 32b1f83

File tree

5 files changed

+299
-4
lines changed

5 files changed

+299
-4
lines changed

‎lldb/source/Target/RegisterContextUnwind.cpp‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,7 @@ void RegisterContextUnwind::InitializeZerothFrame() {
246246
active_row =
247247
m_full_unwind_plan_sp->GetRowForFunctionOffset(m_current_offset);
248248
row_register_kind = m_full_unwind_plan_sp->GetRegisterKind();
249+
PropagateTrapHandlerFlagFromUnwindPlan(m_full_unwind_plan_sp);
249250
if (active_row.get() && log) {
250251
StreamString active_row_strm;
251252
active_row->Dump(active_row_strm, m_full_unwind_plan_sp.get(), &m_thread,
@@ -1400,11 +1401,10 @@ RegisterContextUnwind::SavedLocationForRegister(
14001401
// This is frame 0 and we're retrieving the PC and it's saved in a Return
14011402
// Address register and it hasn't been saved anywhere yet -- that is,
14021403
// it's still live in the actual register. Handle this specially.
1403-
14041404
if (!have_unwindplan_regloc && return_address_reg.IsValid() &&
1405-
IsFrameZero()) {
1406-
if (return_address_reg.GetAsKind(eRegisterKindLLDB) !=
1407-
LLDB_INVALID_REGNUM) {
1405+
return_address_reg.GetAsKind(eRegisterKindLLDB) !=
1406+
LLDB_INVALID_REGNUM) {
1407+
if (IsFrameZero()) {
14081408
lldb_private::UnwindLLDB::ConcreteRegisterLocation new_regloc;
14091409
new_regloc.type = UnwindLLDB::ConcreteRegisterLocation::
14101410
eRegisterInLiveRegisterContext;
@@ -1418,6 +1418,17 @@ RegisterContextUnwind::SavedLocationForRegister(
14181418
return_address_reg.GetAsKind(eRegisterKindLLDB),
14191419
return_address_reg.GetAsKind(eRegisterKindLLDB));
14201420
return UnwindLLDB::RegisterSearchResult::eRegisterFound;
1421+
} else if (BehavesLikeZerothFrame()) {
1422+
// This function was interrupted asynchronously -- it faulted,
1423+
// an async interrupt, a timer fired, a debugger expression etc.
1424+
// The caller's pc is in the Return Address register, but the
1425+
// UnwindPlan for this function may have no location rule for
1426+
// the RA reg.
1427+
// This means that the caller's return address is in the RA reg
1428+
// when the function was interrupted--descend down one stack frame
1429+
// to retrieve it from the trap handler's saved context.
1430+
unwindplan_regloc.SetSame();
1431+
have_unwindplan_regloc = true;
14211432
}
14221433
}
14231434

@@ -1933,6 +1944,7 @@ void RegisterContextUnwind::PropagateTrapHandlerFlagFromUnwindPlan(
19331944
}
19341945

19351946
m_frame_type = eTrapHandlerFrame;
1947+
UnwindLogMsg("This frame is marked as a trap handler via its UnwindPlan");
19361948

19371949
if (m_current_offset_backed_up_one != m_current_offset) {
19381950
// We backed up the pc by 1 to compute the symbol context, but

‎lldb/test/API/functionalities/unwind/frameless-faulted/Makefile‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
C_SOURCES := main.c
2+
3+
interrupt-and-trap-funcs.o: interrupt-and-trap-funcs.s
4+
$(CC) $(CFLAGS) -E -o interrupt-and-trap-funcs.s $(SRCDIR)/interrupt-and-trap-funcs.s
5+
$(CC) $(CFLAGS) -c -o interrupt-and-trap-funcs.o interrupt-and-trap-funcs.s
6+
7+
include Makefile.rules
8+
9+
a.out: interrupt-and-trap-funcs.o
10+
11+
# Needs to come after include
12+
OBJECTS += interrupt-and-trap-funcs.o
13+

‎lldb/test/API/functionalities/unwind/frameless-faulted/TestUnwindFramelessFaulted.py‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
"""Test that lldb backtraces a frameless function that faults correctly."""
2+
3+
import lldbsuite.test.lldbutil as lldbutil
4+
from lldbsuite.test.lldbtest import *
5+
from lldbsuite.test.decorators import *
6+
import shutil
7+
import os
8+
9+
10+
class TestUnwindFramelessFaulted(TestBase):
11+
NO_DEBUG_INFO_TESTCASE = True
12+
13+
@skipIf(oslist=no_match([lldbplatformutil.getDarwinOSTriples(), "linux"]))
14+
@skipIf(archs=no_match(["aarch64", "arm64", "arm64e"]))
15+
16+
# The static linker in Xcode 15.0-15.2 on macOS 14 will mislink
17+
# the eh_frame addresses; ld-classic in those tools is one workaround.
18+
# This issue was fixed in Xcode 15.3, but it's not straightforward
19+
# to test for the linker version or Xcode version so tie this to
20+
# macOS 15 which uses Xcode 16 and does not have the issues.
21+
@skipIf(macos_version=["<", "15.0"])
22+
23+
def test_frameless_faulted_unwind(self):
24+
self.build()
25+
26+
(target, process, thread, bp) = lldbutil.run_to_name_breakpoint(
27+
self, "main", only_one_thread=False
28+
)
29+
30+
# The test program will have a backtrace like this at its deepest:
31+
#
32+
# * frame #0: 0x0000000102adc468 a.out`break_to_debugger + 4
33+
# frame #1: 0x0000000102adc458 a.out`trap + 16
34+
# frame #2: 0x0000000102adc440 a.out`to_be_interrupted + 20
35+
# frame #3: 0x0000000102adc418 a.out`main at main.c:4:7
36+
# frame #4: 0x0000000193b7eb4c dyld`start + 6000
37+
38+
correct_frames = ["break_to_debugger", "trap", "to_be_interrupted", "main"]
39+
40+
# Keep track of when main has branch & linked, instruction step until we're
41+
# back in main()
42+
main_has_bl_ed = False
43+
44+
# Instruction step through the binary until we are in a function not
45+
# listed in correct_frames.
46+
frame = thread.GetFrameAtIndex(0)
47+
step_count = 0
48+
max_step_count = 200
49+
while (
50+
process.GetState() == lldb.eStateStopped
51+
and frame.name in correct_frames
52+
and step_count < max_step_count
53+
):
54+
starting_index = 0
55+
if self.TraceOn():
56+
self.runCmd("bt")
57+
58+
# Find which index into correct_frames the current stack frame is
59+
for idx, name in enumerate(correct_frames):
60+
if frame.name == name:
61+
starting_index = idx
62+
63+
# Test that all frames after the current frame listed in
64+
# correct_frames appears in the backtrace.
65+
frame_idx = 0
66+
for expected_frame in correct_frames[starting_index:]:
67+
self.assertEqual(thread.GetFrameAtIndex(frame_idx).name, expected_frame)
68+
frame_idx = frame_idx + 1
69+
70+
# When we're at our deepest level, test that register passing of
71+
# x0 and x20 follow the by-hand UnwindPlan rules.
72+
# In this test program, we can get x0 in the middle of the stack
73+
# and we CAN'T get x20. The opposites of the normal AArch64 SysV
74+
# ABI.
75+
if frame.name == "break_to_debugger":
76+
tbi_frame = thread.GetFrameAtIndex(2)
77+
self.assertEqual(tbi_frame.name, "to_be_interrupted")
78+
# The original argument to to_be_interrupted(), 10
79+
# Normally can't get x0 mid-stack, but UnwindPlans have
80+
# special rules to make this possible.
81+
x0_reg = tbi_frame.register["x0"]
82+
self.assertTrue(x0_reg.IsValid())
83+
self.assertEqual(x0_reg.GetValueAsUnsigned(), 10)
84+
# The incremented return value from to_be_interrupted(), 11
85+
x24_reg = tbi_frame.register["x24"]
86+
self.assertTrue(x24_reg.IsValid())
87+
self.assertEqual(x24_reg.GetValueAsUnsigned(), 11)
88+
# x20 can normally be fetched mid-stack, but the UnwindPlan
89+
# has a rule saying it can't be fetched.
90+
x20_reg = tbi_frame.register["x20"]
91+
self.assertTrue(x20_reg.error.fail)
92+
93+
trap_frame = thread.GetFrameAtIndex(1)
94+
self.assertEqual(trap_frame.name, "trap")
95+
# Confirm that we can fetch x0 from trap() which
96+
# is normally not possible w/ SysV AbI, but special
97+
# UnwindPlans in use.
98+
x0_reg = trap_frame.register["x0"]
99+
self.assertTrue(x0_reg.IsValid())
100+
self.assertEqual(x0_reg.GetValueAsUnsigned(), 10)
101+
x1_reg = trap_frame.register["x1"]
102+
self.assertTrue(x1_reg.error.fail)
103+
104+
main_frame = thread.GetFrameAtIndex(3)
105+
self.assertEqual(main_frame.name, "main")
106+
# x20 can normally be fetched mid-stack, but the UnwindPlan
107+
# has a rule saying it can't be fetched.
108+
x20_reg = main_frame.register["x20"]
109+
self.assertTrue(x20_reg.error.fail)
110+
# x21 can be fetched mid-stack.
111+
x21_reg = main_frame.register["x21"]
112+
self.assertTrue(x21_reg.error.success)
113+
114+
# manually move past the BRK instruction in
115+
# break_to_debugger(). lldb-server doesn't
116+
# advance past the builtin_debugtrap() BRK
117+
# instruction.
118+
if (
119+
thread.GetStopReason() == lldb.eStopReasonException
120+
and frame.name == "break_to_debugger"
121+
):
122+
frame.SetPC(frame.GetPC() + 4)
123+
124+
if self.TraceOn():
125+
print("StepInstruction")
126+
thread.StepInstruction(False)
127+
frame = thread.GetFrameAtIndex(0)
128+
step_count = step_count + 1

‎lldb/test/API/functionalities/unwind/frameless-faulted/interrupt-and-trap-funcs.s‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
// This is assembly code that needs to be run
2+
// through the preprocessor, for simplicity of
3+
// preprocessing it's named .c to start with.
4+
//
5+
// clang-format off
6+
7+
8+
#define DW_CFA_register 0x9
9+
#define ehframe_x0 0
10+
#define ehframe_x20 20
11+
#define ehframe_x22 22
12+
#define ehframe_x23 23
13+
#define ehframe_pc 32
14+
15+
#if defined(__APPLE__)
16+
#define TO_BE_INTERRUPTED _to_be_interrupted
17+
#define TRAP _trap
18+
#define BREAK_TO_DEBUGGER _break_to_debugger
19+
#else
20+
#define TO_BE_INTERRUPTED to_be_interrupted
21+
#define TRAP trap
22+
#define BREAK_TO_DEBUGGER break_to_debugger
23+
#endif
24+
25+
.text
26+
//--------------------------------------
27+
// to_be_interrupted() a frameless function that does a non-ABI
28+
// function call to trap(), simulating an async signal/interrup/exception/fault.
29+
// Before it branches to trap(), put the return address in x23.
30+
// trap() knows to branch back to $x23 when it has finished.
31+
//--------------------------------------
32+
.globl TO_BE_INTERRUPTED
33+
#if defined(__APPLE__)
34+
.p2align 2
35+
#endif
36+
TO_BE_INTERRUPTED:
37+
.cfi_startproc
38+
39+
// This is a garbage entry to ensure that eh_frame is emitted.
40+
// If there's no eh_frame, lldb can use the assembly emulation scan,
41+
// which always includes a rule for $lr, and we won't replicate the
42+
// bug we're testing for.
43+
.cfi_escape DW_CFA_register, ehframe_x22, ehframe_x23
44+
mov x24, x0
45+
add x24, x24, #1
46+
47+
#if defined(__APPLE__)
48+
adrp x23, L_.return@PAGE // put return address in x23
49+
add x23, x23, L_.return@PAGEOFF
50+
#else
51+
adrp x23, .L.return
52+
add x23, x23, :lo12:.L.return
53+
#endif
54+
55+
b TRAP // branch to trap handler, fake async interrupt
56+
57+
#if defined(__APPLE__)
58+
L_.return:
59+
#else
60+
.L.return:
61+
#endif
62+
mov x0, x24
63+
ret
64+
.cfi_endproc
65+
66+
67+
68+
//--------------------------------------
69+
// trap() trap handler function, sets up stack frame
70+
// with special unwind rule for the pc value of the
71+
// "interrupted" stack frame (it's in x23), then calls
72+
// break_to_debugger().
73+
//--------------------------------------
74+
.globl TRAP
75+
#if defined(__APPLE__)
76+
.p2align 2
77+
#endif
78+
TRAP:
79+
.cfi_startproc
80+
.cfi_signal_frame
81+
82+
// The pc value when we were interrupted is in x23
83+
.cfi_escape DW_CFA_register, ehframe_pc, ehframe_x23
84+
85+
// For fun, mark x0 as unmodified so the caller can
86+
// retrieve the value if it wants.
87+
.cfi_same_value ehframe_x0
88+
89+
// Mark x20 as undefined. This is a callee-preserved
90+
// (non-volatile) register by the SysV AArch64 ABI, but
91+
// it'll be fun to see lldb not passing a value past this
92+
// point on the stack.
93+
.cfi_undefined ehframe_x20
94+
95+
// standard prologue save of fp & lr so we can call
96+
// break_to_debugger()
97+
sub sp, sp, #32
98+
stp x29, x30, [sp, #16]
99+
add x29, sp, #16
100+
.cfi_def_cfa w29, 16
101+
.cfi_offset w30, -8
102+
.cfi_offset w29, -16
103+
104+
bl BREAK_TO_DEBUGGER
105+
106+
ldp x29, x30, [sp, #16]
107+
.cfi_same_value x29
108+
.cfi_same_value x30
109+
.cfi_def_cfa sp, 32
110+
add sp, sp, #32
111+
.cfi_same_value sp
112+
.cfi_def_cfa sp, 0
113+
114+
// jump back to $x23 to resume execution of to_be_interrupted
115+
br x23
116+
.cfi_endproc
117+
118+
//--------------------------------------
119+
// break_to_debugger() executes a BRK instruction
120+
//--------------------------------------
121+
.globl BREAK_TO_DEBUGGER
122+
#if defined(__APPLE__)
123+
.p2align 2
124+
#endif
125+
BREAK_TO_DEBUGGER:
126+
.cfi_startproc
127+
128+
// For fun, mark x0 as unmodified so the caller can
129+
// retrieve the value if it wants.
130+
.cfi_same_value ehframe_x0
131+
132+
brk #0xf000 // __builtin_debugtrap aarch64 instruction
133+
134+
ret
135+
.cfi_endproc

‎lldb/test/API/functionalities/unwind/frameless-faulted/main.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
int to_be_interrupted(int);
2+
3+
int main() {
4+
int c = 10;
5+
c = to_be_interrupted(c);
6+
return c;
7+
}

0 commit comments

Comments
 (0)