aab48c99c2
On arm64 machines, when there is a hardware breakpoint or watchpoint set, and lldb has instruction-stepped a thread, and then done a Process::Resume, we will sometimes receive an extra "instruction step completed" mach exception and the pc has not advanced. From a user's perspective, they hit Continue and lldb stops again at the same spot. From the testsuite's perspective, this has been a constant source of testsuite failures for any test using hardware watchpoints and breakpoints, the arm64 CI bots seem especially good at hitting this issue. Jim and I have been slowly looking at this for a few months now, and finally I decided to try to detect this situation in lldb and silently resume the process again when it happens. We were already detecting this "got an insn-step finished mach exception but this thread was not instruction stepping" combination in StopInfoMachException where we take the mach exception and create a StopInfo object for it. We had a lot of logging we used to understand the failure as it was hit on the bots in assert builds. This patch adds a new case to `Thread::GetPrivateStopInfo()` to call the StopInfo's (new) `IsContinueInterrupted()` method. In StopInfoMachException, where we previously had logging for assert builds, I now note it in an ivar, and when `Thread::GetPrivateStopInfo()` asks if this has happened, we check all of the combination of events that this comes up: We have a hardware breakpoint or watchpoint, we were not instruction stepping this thread but got an insn-step mach exception, the pc is the same as the previous stop's pc. And in that case, `Thread::GetPrivateStopInfo()` returns no StopInfo -- indicating that this thread would like to resume execution. The `Thread` object has two StackFrameLists, `m_curr_frames_sp` and `m_prev_frames_sp`. When a thread resumes execution, we move `m_curr_frames_sp` in to `m_prev_frames_sp` and when it stops executing, w euse `m_prev_frames_sp` to seed the new `m_curr_frames_sp` if most of the stack is the same as before. In this same location, I now save the Thread's RegisterContext::GetPC into an ivar, `m_prev_framezero_pc`. StopInfoMachException needs this information to check all of the conditions I outlined above for `IsContinueInterrupted`. This has passed exhaustive testing and we do not have any testsuite failures for hardware watchpoints and breakpoints due to this kernel bug with the patch in place. In focusing on these tests for thousands of runs, I have found two other uncommon race conditions for the TestConcurrent* tests on arm64. TestConcurrentManyBreakpoints.py (which uses no hardware watchpoint/breakpoints) will sometimes only have 99 breakpoints when it expects 100, and any of the concurrent tests using the shared harness (I've seen it in TestConcurrentWatchBreakDelay.py, TestConcurrentTwoBreakpointsOneSignal.py, TestConcurrentSignalDelayWatch.py) can fail when the test harness checks that there is only one thread still running at the end, and it finds two -- one of them under pthread_exit / pthread_terminate. Both of these failures happen on github main without my changes, and with my changes - they are unrelated race conditions in these tests, and I'm sure I'll be looking into them at some point if they hit the CI bots with frequency. On my computer, these are in the 0.3-0.5% of the time class. But the CI bots do have different timing.
862 lines
28 KiB
C++
862 lines
28 KiB
C++
//===-- StopInfoMachException.cpp -----------------------------------------===//
|
|
//
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "StopInfoMachException.h"
|
|
|
|
#include "lldb/lldb-forward.h"
|
|
|
|
#if defined(__APPLE__)
|
|
// Needed for the EXC_RESOURCE interpretation macros
|
|
#include <kern/exc_resource.h>
|
|
#endif
|
|
|
|
#include "lldb/Breakpoint/Watchpoint.h"
|
|
#include "lldb/Symbol/Symbol.h"
|
|
#include "lldb/Target/ABI.h"
|
|
#include "lldb/Target/DynamicLoader.h"
|
|
#include "lldb/Target/ExecutionContext.h"
|
|
#include "lldb/Target/Process.h"
|
|
#include "lldb/Target/RegisterContext.h"
|
|
#include "lldb/Target/Target.h"
|
|
#include "lldb/Target/Thread.h"
|
|
#include "lldb/Target/ThreadPlan.h"
|
|
#include "lldb/Target/UnixSignals.h"
|
|
#include "lldb/Utility/LLDBLog.h"
|
|
#include "lldb/Utility/Log.h"
|
|
#include "lldb/Utility/StreamString.h"
|
|
#include <optional>
|
|
|
|
using namespace lldb;
|
|
using namespace lldb_private;
|
|
|
|
/// Information about a pointer-authentication related instruction.
|
|
struct PtrauthInstructionInfo {
|
|
bool IsAuthenticated;
|
|
bool IsLoad;
|
|
bool DoesBranch;
|
|
};
|
|
|
|
/// Get any pointer-authentication related information about the instruction
|
|
/// at address \p at_addr.
|
|
static std::optional<PtrauthInstructionInfo>
|
|
GetPtrauthInstructionInfo(Target &target, const ArchSpec &arch,
|
|
const Address &at_addr) {
|
|
const char *plugin_name = nullptr;
|
|
const char *flavor = nullptr;
|
|
AddressRange range_bounds(at_addr, 4);
|
|
const bool prefer_file_cache = true;
|
|
DisassemblerSP disassembler_sp = Disassembler::DisassembleRange(
|
|
arch, plugin_name, flavor, target, range_bounds, prefer_file_cache);
|
|
if (!disassembler_sp)
|
|
return std::nullopt;
|
|
|
|
InstructionList &insn_list = disassembler_sp->GetInstructionList();
|
|
InstructionSP insn = insn_list.GetInstructionAtIndex(0);
|
|
if (!insn)
|
|
return std::nullopt;
|
|
|
|
return PtrauthInstructionInfo{insn->IsAuthenticated(), insn->IsLoad(),
|
|
insn->DoesBranch()};
|
|
}
|
|
|
|
/// Describe the load address of \p addr using the format filename:line:col.
|
|
static void DescribeAddressBriefly(Stream &strm, const Address &addr,
|
|
Target &target) {
|
|
strm.Printf("at address=0x%" PRIx64, addr.GetLoadAddress(&target));
|
|
StreamString s;
|
|
if (addr.GetDescription(s, target, eDescriptionLevelBrief))
|
|
strm.Printf(" %s", s.GetString().data());
|
|
strm.Printf(".\n");
|
|
}
|
|
|
|
bool StopInfoMachException::DeterminePtrauthFailure(ExecutionContext &exe_ctx) {
|
|
bool IsBreakpoint = m_value == 6; // EXC_BREAKPOINT
|
|
bool IsBadAccess = m_value == 1; // EXC_BAD_ACCESS
|
|
if (!IsBreakpoint && !IsBadAccess)
|
|
return false;
|
|
|
|
// Check that we have a live process.
|
|
if (!exe_ctx.HasProcessScope() || !exe_ctx.HasThreadScope() ||
|
|
!exe_ctx.HasTargetScope())
|
|
return false;
|
|
|
|
Thread &thread = *exe_ctx.GetThreadPtr();
|
|
StackFrameSP current_frame = thread.GetStackFrameAtIndex(0);
|
|
if (!current_frame)
|
|
return false;
|
|
|
|
Target &target = *exe_ctx.GetTargetPtr();
|
|
Process &process = *exe_ctx.GetProcessPtr();
|
|
ABISP abi_sp = process.GetABI();
|
|
const ArchSpec &arch = target.GetArchitecture();
|
|
assert(abi_sp && "Missing ABI info");
|
|
|
|
// Check for a ptrauth-enabled target.
|
|
const bool ptrauth_enabled_target =
|
|
arch.GetCore() == ArchSpec::eCore_arm_arm64e;
|
|
if (!ptrauth_enabled_target)
|
|
return false;
|
|
|
|
// Set up a stream we can write a diagnostic into.
|
|
StreamString strm;
|
|
auto emit_ptrauth_prologue = [&](uint64_t at_address) {
|
|
strm.Printf("EXC_BAD_ACCESS (code=%" PRIu64 ", address=0x%" PRIx64 ")\n",
|
|
m_exc_code, at_address);
|
|
strm.Printf("Note: Possible pointer authentication failure detected.\n");
|
|
};
|
|
|
|
// Check if we have a "brk 0xc47x" trap, where the value that failed to
|
|
// authenticate is in x16.
|
|
Address current_address = current_frame->GetFrameCodeAddress();
|
|
if (IsBreakpoint) {
|
|
RegisterContext *reg_ctx = exe_ctx.GetRegisterContext();
|
|
if (!reg_ctx)
|
|
return false;
|
|
|
|
const RegisterInfo *X16Info = reg_ctx->GetRegisterInfoByName("x16");
|
|
RegisterValue X16Val;
|
|
if (!reg_ctx->ReadRegister(X16Info, X16Val))
|
|
return false;
|
|
uint64_t bad_address = X16Val.GetAsUInt64();
|
|
|
|
uint64_t fixed_bad_address = abi_sp->FixCodeAddress(bad_address);
|
|
Address brk_address;
|
|
if (!target.ResolveLoadAddress(fixed_bad_address, brk_address))
|
|
return false;
|
|
|
|
auto brk_ptrauth_info =
|
|
GetPtrauthInstructionInfo(target, arch, current_address);
|
|
if (brk_ptrauth_info && brk_ptrauth_info->IsAuthenticated) {
|
|
emit_ptrauth_prologue(bad_address);
|
|
strm.Printf("Found value that failed to authenticate ");
|
|
DescribeAddressBriefly(strm, brk_address, target);
|
|
m_description = std::string(strm.GetString());
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
assert(IsBadAccess && "Handle EXC_BAD_ACCESS only after this point");
|
|
|
|
// Check that we have the "bad address" from an EXC_BAD_ACCESS.
|
|
if (m_exc_data_count < 2)
|
|
return false;
|
|
|
|
// Ok, we know the Target is valid and that it describes a ptrauth-enabled
|
|
// device. Now, we need to determine whether this exception was caused by a
|
|
// ptrauth failure.
|
|
|
|
uint64_t bad_address = m_exc_subcode;
|
|
uint64_t fixed_bad_address = abi_sp->FixCodeAddress(bad_address);
|
|
uint64_t current_pc = current_address.GetLoadAddress(&target);
|
|
|
|
// Detect: LDRAA, LDRAB (Load Register, with pointer authentication).
|
|
//
|
|
// If an authenticated load results in an exception, the instruction at the
|
|
// current PC should be one of LDRAx.
|
|
if (bad_address != current_pc && fixed_bad_address != current_pc) {
|
|
auto ptrauth_info =
|
|
GetPtrauthInstructionInfo(target, arch, current_address);
|
|
if (ptrauth_info && ptrauth_info->IsAuthenticated && ptrauth_info->IsLoad) {
|
|
emit_ptrauth_prologue(bad_address);
|
|
strm.Printf("Found authenticated load instruction ");
|
|
DescribeAddressBriefly(strm, current_address, target);
|
|
m_description = std::string(strm.GetString());
|
|
return true;
|
|
}
|
|
}
|
|
|
|
// Detect: BLRAA, BLRAAZ, BLRAB, BLRABZ (Branch with Link to Register, with
|
|
// pointer authentication).
|
|
//
|
|
// TODO: Detect: BRAA, BRAAZ, BRAB, BRABZ (Branch to Register, with pointer
|
|
// authentication). At a minimum, this requires call site info support for
|
|
// indirect calls.
|
|
//
|
|
// If an authenticated call or tail call results in an exception, stripping
|
|
// the bad address should give the current PC, which points to the address
|
|
// we tried to branch to.
|
|
if (bad_address != current_pc && fixed_bad_address == current_pc) {
|
|
if (StackFrameSP parent_frame = thread.GetStackFrameAtIndex(1)) {
|
|
addr_t return_pc =
|
|
parent_frame->GetFrameCodeAddress().GetLoadAddress(&target);
|
|
Address blr_address;
|
|
if (!target.ResolveLoadAddress(return_pc - 4, blr_address))
|
|
return false;
|
|
|
|
auto blr_ptrauth_info =
|
|
GetPtrauthInstructionInfo(target, arch, blr_address);
|
|
if (blr_ptrauth_info && blr_ptrauth_info->IsAuthenticated &&
|
|
blr_ptrauth_info->DoesBranch) {
|
|
emit_ptrauth_prologue(bad_address);
|
|
strm.Printf("Found authenticated indirect branch ");
|
|
DescribeAddressBriefly(strm, blr_address, target);
|
|
m_description = std::string(strm.GetString());
|
|
return true;
|
|
}
|
|
}
|
|
}
|
|
|
|
// TODO: Detect: RETAA, RETAB (Return from subroutine, with pointer
|
|
// authentication).
|
|
//
|
|
// Is there a motivating, non-malicious code snippet that corrupts LR?
|
|
|
|
return false;
|
|
}
|
|
|
|
const char *StopInfoMachException::GetDescription() {
|
|
if (!m_description.empty())
|
|
return m_description.c_str();
|
|
if (GetValue() == eStopReasonInvalid)
|
|
return "invalid stop reason!";
|
|
|
|
ExecutionContext exe_ctx(m_thread_wp.lock());
|
|
Target *target = exe_ctx.GetTargetPtr();
|
|
const llvm::Triple::ArchType cpu =
|
|
target ? target->GetArchitecture().GetMachine()
|
|
: llvm::Triple::UnknownArch;
|
|
|
|
const char *exc_desc = nullptr;
|
|
const char *code_label = "code";
|
|
const char *code_desc = nullptr;
|
|
const char *subcode_label = "subcode";
|
|
const char *subcode_desc = nullptr;
|
|
|
|
#if defined(__APPLE__)
|
|
char code_desc_buf[32];
|
|
char subcode_desc_buf[32];
|
|
#endif
|
|
|
|
switch (m_value) {
|
|
case 1: // EXC_BAD_ACCESS
|
|
exc_desc = "EXC_BAD_ACCESS";
|
|
subcode_label = "address";
|
|
switch (cpu) {
|
|
case llvm::Triple::x86:
|
|
case llvm::Triple::x86_64:
|
|
switch (m_exc_code) {
|
|
case 0xd:
|
|
code_desc = "EXC_I386_GPFLT";
|
|
m_exc_data_count = 1;
|
|
break;
|
|
}
|
|
break;
|
|
case llvm::Triple::arm:
|
|
case llvm::Triple::thumb:
|
|
switch (m_exc_code) {
|
|
case 0x101:
|
|
code_desc = "EXC_ARM_DA_ALIGN";
|
|
break;
|
|
case 0x102:
|
|
code_desc = "EXC_ARM_DA_DEBUG";
|
|
break;
|
|
}
|
|
break;
|
|
|
|
case llvm::Triple::aarch64:
|
|
if (DeterminePtrauthFailure(exe_ctx))
|
|
return m_description.c_str();
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
}
|
|
break;
|
|
|
|
case 2: // EXC_BAD_INSTRUCTION
|
|
exc_desc = "EXC_BAD_INSTRUCTION";
|
|
switch (cpu) {
|
|
case llvm::Triple::x86:
|
|
case llvm::Triple::x86_64:
|
|
if (m_exc_code == 1)
|
|
code_desc = "EXC_I386_INVOP";
|
|
break;
|
|
|
|
case llvm::Triple::arm:
|
|
case llvm::Triple::thumb:
|
|
if (m_exc_code == 1)
|
|
code_desc = "EXC_ARM_UNDEFINED";
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
}
|
|
break;
|
|
|
|
case 3: // EXC_ARITHMETIC
|
|
exc_desc = "EXC_ARITHMETIC";
|
|
switch (cpu) {
|
|
case llvm::Triple::x86:
|
|
case llvm::Triple::x86_64:
|
|
switch (m_exc_code) {
|
|
case 1:
|
|
code_desc = "EXC_I386_DIV";
|
|
break;
|
|
case 2:
|
|
code_desc = "EXC_I386_INTO";
|
|
break;
|
|
case 3:
|
|
code_desc = "EXC_I386_NOEXT";
|
|
break;
|
|
case 4:
|
|
code_desc = "EXC_I386_EXTOVR";
|
|
break;
|
|
case 5:
|
|
code_desc = "EXC_I386_EXTERR";
|
|
break;
|
|
case 6:
|
|
code_desc = "EXC_I386_EMERR";
|
|
break;
|
|
case 7:
|
|
code_desc = "EXC_I386_BOUND";
|
|
break;
|
|
case 8:
|
|
code_desc = "EXC_I386_SSEEXTERR";
|
|
break;
|
|
}
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
}
|
|
break;
|
|
|
|
case 4: // EXC_EMULATION
|
|
exc_desc = "EXC_EMULATION";
|
|
break;
|
|
|
|
case 5: // EXC_SOFTWARE
|
|
exc_desc = "EXC_SOFTWARE";
|
|
if (m_exc_code == 0x10003) {
|
|
subcode_desc = "EXC_SOFT_SIGNAL";
|
|
subcode_label = "signo";
|
|
}
|
|
break;
|
|
|
|
case 6: // EXC_BREAKPOINT
|
|
{
|
|
exc_desc = "EXC_BREAKPOINT";
|
|
switch (cpu) {
|
|
case llvm::Triple::x86:
|
|
case llvm::Triple::x86_64:
|
|
switch (m_exc_code) {
|
|
case 1:
|
|
code_desc = "EXC_I386_SGL";
|
|
break;
|
|
case 2:
|
|
code_desc = "EXC_I386_BPT";
|
|
break;
|
|
}
|
|
break;
|
|
|
|
case llvm::Triple::arm:
|
|
case llvm::Triple::thumb:
|
|
switch (m_exc_code) {
|
|
case 0x101:
|
|
code_desc = "EXC_ARM_DA_ALIGN";
|
|
break;
|
|
case 0x102:
|
|
code_desc = "EXC_ARM_DA_DEBUG";
|
|
break;
|
|
case 1:
|
|
code_desc = "EXC_ARM_BREAKPOINT";
|
|
break;
|
|
// FIXME temporary workaround, exc_code 0 does not really mean
|
|
// EXC_ARM_BREAKPOINT
|
|
case 0:
|
|
code_desc = "EXC_ARM_BREAKPOINT";
|
|
break;
|
|
}
|
|
break;
|
|
|
|
case llvm::Triple::aarch64:
|
|
if (DeterminePtrauthFailure(exe_ctx))
|
|
return m_description.c_str();
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
}
|
|
} break;
|
|
|
|
case 7:
|
|
exc_desc = "EXC_SYSCALL";
|
|
break;
|
|
|
|
case 8:
|
|
exc_desc = "EXC_MACH_SYSCALL";
|
|
break;
|
|
|
|
case 9:
|
|
exc_desc = "EXC_RPC_ALERT";
|
|
break;
|
|
|
|
case 10:
|
|
exc_desc = "EXC_CRASH";
|
|
break;
|
|
case 11:
|
|
exc_desc = "EXC_RESOURCE";
|
|
#if defined(__APPLE__)
|
|
{
|
|
int resource_type = EXC_RESOURCE_DECODE_RESOURCE_TYPE(m_exc_code);
|
|
|
|
code_label = "limit";
|
|
code_desc = code_desc_buf;
|
|
subcode_label = "observed";
|
|
subcode_desc = subcode_desc_buf;
|
|
|
|
switch (resource_type) {
|
|
case RESOURCE_TYPE_CPU:
|
|
exc_desc =
|
|
"EXC_RESOURCE (RESOURCE_TYPE_CPU: CPU usage monitor tripped)";
|
|
snprintf(code_desc_buf, sizeof(code_desc_buf), "%d%%",
|
|
(int)EXC_RESOURCE_CPUMONITOR_DECODE_PERCENTAGE(m_exc_code));
|
|
snprintf(subcode_desc_buf, sizeof(subcode_desc_buf), "%d%%",
|
|
(int)EXC_RESOURCE_CPUMONITOR_DECODE_PERCENTAGE_OBSERVED(
|
|
m_exc_subcode));
|
|
break;
|
|
case RESOURCE_TYPE_WAKEUPS:
|
|
exc_desc = "EXC_RESOURCE (RESOURCE_TYPE_WAKEUPS: idle wakeups monitor "
|
|
"tripped)";
|
|
snprintf(
|
|
code_desc_buf, sizeof(code_desc_buf), "%d w/s",
|
|
(int)EXC_RESOURCE_CPUMONITOR_DECODE_WAKEUPS_PERMITTED(m_exc_code));
|
|
snprintf(subcode_desc_buf, sizeof(subcode_desc_buf), "%d w/s",
|
|
(int)EXC_RESOURCE_CPUMONITOR_DECODE_WAKEUPS_OBSERVED(
|
|
m_exc_subcode));
|
|
break;
|
|
case RESOURCE_TYPE_MEMORY:
|
|
exc_desc = "EXC_RESOURCE (RESOURCE_TYPE_MEMORY: high watermark memory "
|
|
"limit exceeded)";
|
|
snprintf(code_desc_buf, sizeof(code_desc_buf), "%d MB",
|
|
(int)EXC_RESOURCE_HWM_DECODE_LIMIT(m_exc_code));
|
|
subcode_desc = nullptr;
|
|
subcode_label = nullptr;
|
|
break;
|
|
#if defined(RESOURCE_TYPE_IO)
|
|
// RESOURCE_TYPE_IO is introduced in macOS SDK 10.12.
|
|
case RESOURCE_TYPE_IO:
|
|
exc_desc = "EXC_RESOURCE RESOURCE_TYPE_IO";
|
|
snprintf(code_desc_buf, sizeof(code_desc_buf), "%d MB",
|
|
(int)EXC_RESOURCE_IO_DECODE_LIMIT(m_exc_code));
|
|
snprintf(subcode_desc_buf, sizeof(subcode_desc_buf), "%d MB",
|
|
(int)EXC_RESOURCE_IO_OBSERVED(m_exc_subcode));
|
|
;
|
|
break;
|
|
#endif
|
|
}
|
|
}
|
|
#endif
|
|
break;
|
|
case 12:
|
|
exc_desc = "EXC_GUARD";
|
|
break;
|
|
}
|
|
|
|
StreamString strm;
|
|
|
|
if (exc_desc)
|
|
strm.PutCString(exc_desc);
|
|
else
|
|
strm.Printf("EXC_??? (%" PRIu64 ")", m_value);
|
|
|
|
if (m_exc_data_count >= 1) {
|
|
if (code_desc)
|
|
strm.Printf(" (%s=%s", code_label, code_desc);
|
|
else
|
|
strm.Printf(" (%s=%" PRIu64, code_label, m_exc_code);
|
|
}
|
|
|
|
if (m_exc_data_count >= 2) {
|
|
if (subcode_label && subcode_desc)
|
|
strm.Printf(", %s=%s", subcode_label, subcode_desc);
|
|
else if (subcode_label)
|
|
strm.Printf(", %s=0x%" PRIx64, subcode_label, m_exc_subcode);
|
|
}
|
|
|
|
if (m_exc_data_count > 0)
|
|
strm.PutChar(')');
|
|
|
|
m_description = std::string(strm.GetString());
|
|
return m_description.c_str();
|
|
}
|
|
|
|
static StopInfoSP GetStopInfoForHardwareBP(Thread &thread, Target *target,
|
|
uint32_t exc_data_count,
|
|
uint64_t exc_sub_code,
|
|
uint64_t exc_sub_sub_code) {
|
|
// Try hardware watchpoint.
|
|
if (target) {
|
|
// The exc_sub_code indicates the data break address.
|
|
WatchpointResourceSP wp_rsrc_sp =
|
|
target->GetProcessSP()->GetWatchpointResourceList().FindByAddress(
|
|
(addr_t)exc_sub_code);
|
|
if (wp_rsrc_sp && wp_rsrc_sp->GetNumberOfConstituents() > 0) {
|
|
return StopInfo::CreateStopReasonWithWatchpointID(
|
|
thread, wp_rsrc_sp->GetConstituentAtIndex(0)->GetID());
|
|
}
|
|
}
|
|
|
|
// Try hardware breakpoint.
|
|
ProcessSP process_sp(thread.GetProcess());
|
|
if (process_sp) {
|
|
// The exc_sub_code indicates the data break address.
|
|
lldb::BreakpointSiteSP bp_sp =
|
|
process_sp->GetBreakpointSiteList().FindByAddress(
|
|
(lldb::addr_t)exc_sub_code);
|
|
if (bp_sp && bp_sp->IsEnabled()) {
|
|
return StopInfo::CreateStopReasonWithBreakpointSiteID(thread,
|
|
bp_sp->GetID());
|
|
}
|
|
}
|
|
|
|
return nullptr;
|
|
}
|
|
|
|
#if defined(__APPLE__)
|
|
const char *
|
|
StopInfoMachException::MachException::Name(exception_type_t exc_type) {
|
|
switch (exc_type) {
|
|
case EXC_BAD_ACCESS:
|
|
return "EXC_BAD_ACCESS";
|
|
case EXC_BAD_INSTRUCTION:
|
|
return "EXC_BAD_INSTRUCTION";
|
|
case EXC_ARITHMETIC:
|
|
return "EXC_ARITHMETIC";
|
|
case EXC_EMULATION:
|
|
return "EXC_EMULATION";
|
|
case EXC_SOFTWARE:
|
|
return "EXC_SOFTWARE";
|
|
case EXC_BREAKPOINT:
|
|
return "EXC_BREAKPOINT";
|
|
case EXC_SYSCALL:
|
|
return "EXC_SYSCALL";
|
|
case EXC_MACH_SYSCALL:
|
|
return "EXC_MACH_SYSCALL";
|
|
case EXC_RPC_ALERT:
|
|
return "EXC_RPC_ALERT";
|
|
#ifdef EXC_CRASH
|
|
case EXC_CRASH:
|
|
return "EXC_CRASH";
|
|
#endif
|
|
case EXC_RESOURCE:
|
|
return "EXC_RESOURCE";
|
|
#ifdef EXC_GUARD
|
|
case EXC_GUARD:
|
|
return "EXC_GUARD";
|
|
#endif
|
|
#ifdef EXC_CORPSE_NOTIFY
|
|
case EXC_CORPSE_NOTIFY:
|
|
return "EXC_CORPSE_NOTIFY";
|
|
#endif
|
|
#ifdef EXC_CORPSE_VARIANT_BIT
|
|
case EXC_CORPSE_VARIANT_BIT:
|
|
return "EXC_CORPSE_VARIANT_BIT";
|
|
#endif
|
|
default:
|
|
break;
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
std::optional<exception_type_t>
|
|
StopInfoMachException::MachException::ExceptionCode(const char *name) {
|
|
return llvm::StringSwitch<std::optional<exception_type_t>>(name)
|
|
.Case("EXC_BAD_ACCESS", EXC_BAD_ACCESS)
|
|
.Case("EXC_BAD_INSTRUCTION", EXC_BAD_INSTRUCTION)
|
|
.Case("EXC_ARITHMETIC", EXC_ARITHMETIC)
|
|
.Case("EXC_EMULATION", EXC_EMULATION)
|
|
.Case("EXC_SOFTWARE", EXC_SOFTWARE)
|
|
.Case("EXC_BREAKPOINT", EXC_BREAKPOINT)
|
|
.Case("EXC_SYSCALL", EXC_SYSCALL)
|
|
.Case("EXC_MACH_SYSCALL", EXC_MACH_SYSCALL)
|
|
.Case("EXC_RPC_ALERT", EXC_RPC_ALERT)
|
|
#ifdef EXC_CRASH
|
|
.Case("EXC_CRASH", EXC_CRASH)
|
|
#endif
|
|
.Case("EXC_RESOURCE", EXC_RESOURCE)
|
|
#ifdef EXC_GUARD
|
|
.Case("EXC_GUARD", EXC_GUARD)
|
|
#endif
|
|
#ifdef EXC_CORPSE_NOTIFY
|
|
.Case("EXC_CORPSE_NOTIFY", EXC_CORPSE_NOTIFY)
|
|
#endif
|
|
.Default(std::nullopt);
|
|
}
|
|
#endif
|
|
|
|
StopInfoSP StopInfoMachException::CreateStopReasonWithMachException(
|
|
Thread &thread, uint32_t exc_type, uint32_t exc_data_count,
|
|
uint64_t exc_code, uint64_t exc_sub_code, uint64_t exc_sub_sub_code,
|
|
bool pc_already_adjusted, bool adjust_pc_if_needed) {
|
|
if (exc_type == 0)
|
|
return StopInfoSP();
|
|
|
|
bool not_stepping_but_got_singlestep_exception = false;
|
|
uint32_t pc_decrement = 0;
|
|
ExecutionContext exe_ctx(thread.shared_from_this());
|
|
Target *target = exe_ctx.GetTargetPtr();
|
|
const llvm::Triple::ArchType cpu =
|
|
target ? target->GetArchitecture().GetMachine()
|
|
: llvm::Triple::UnknownArch;
|
|
|
|
switch (exc_type) {
|
|
case 1: // EXC_BAD_ACCESS
|
|
case 2: // EXC_BAD_INSTRUCTION
|
|
case 3: // EXC_ARITHMETIC
|
|
case 4: // EXC_EMULATION
|
|
break;
|
|
|
|
case 5: // EXC_SOFTWARE
|
|
if (exc_code == 0x10003) // EXC_SOFT_SIGNAL
|
|
{
|
|
if (exc_sub_code == 5) {
|
|
// On MacOSX, a SIGTRAP can signify that a process has called exec,
|
|
// so we should check with our dynamic loader to verify.
|
|
ProcessSP process_sp(thread.GetProcess());
|
|
if (process_sp) {
|
|
DynamicLoader *dynamic_loader = process_sp->GetDynamicLoader();
|
|
if (dynamic_loader && dynamic_loader->ProcessDidExec()) {
|
|
// The program was re-exec'ed
|
|
return StopInfo::CreateStopReasonWithExec(thread);
|
|
}
|
|
}
|
|
}
|
|
return StopInfo::CreateStopReasonWithSignal(thread, exc_sub_code);
|
|
}
|
|
break;
|
|
|
|
case 6: // EXC_BREAKPOINT
|
|
{
|
|
bool is_actual_breakpoint = false;
|
|
bool is_trace_if_actual_breakpoint_missing = false;
|
|
switch (cpu) {
|
|
case llvm::Triple::x86:
|
|
case llvm::Triple::x86_64:
|
|
if (exc_code == 1) // EXC_I386_SGL
|
|
{
|
|
if (!exc_sub_code) {
|
|
// This looks like a plain trap.
|
|
// Have to check if there is a breakpoint here as well. When you
|
|
// single-step onto a trap, the single step stops you not to trap.
|
|
// Since we also do that check below, let's just use that logic.
|
|
is_actual_breakpoint = true;
|
|
is_trace_if_actual_breakpoint_missing = true;
|
|
} else {
|
|
if (StopInfoSP stop_info =
|
|
GetStopInfoForHardwareBP(thread, target, exc_data_count,
|
|
exc_sub_code, exc_sub_sub_code))
|
|
return stop_info;
|
|
}
|
|
} else if (exc_code == 2 || // EXC_I386_BPT
|
|
exc_code == 3) // EXC_I386_BPTFLT
|
|
{
|
|
// KDP returns EXC_I386_BPTFLT for trace breakpoints
|
|
if (exc_code == 3)
|
|
is_trace_if_actual_breakpoint_missing = true;
|
|
|
|
is_actual_breakpoint = true;
|
|
if (!pc_already_adjusted)
|
|
pc_decrement = 1;
|
|
}
|
|
break;
|
|
|
|
case llvm::Triple::arm:
|
|
case llvm::Triple::thumb:
|
|
if (exc_code == 0x102) // EXC_ARM_DA_DEBUG
|
|
{
|
|
// LWP_TODO: We need to find the WatchpointResource that matches
|
|
// the address, and evaluate its Watchpoints.
|
|
|
|
// It's a watchpoint, then, if the exc_sub_code indicates a
|
|
// known/enabled data break address from our watchpoint list.
|
|
lldb::WatchpointSP wp_sp;
|
|
if (target)
|
|
wp_sp = target->GetWatchpointList().FindByAddress(
|
|
(lldb::addr_t)exc_sub_code);
|
|
if (wp_sp && wp_sp->IsEnabled()) {
|
|
return StopInfo::CreateStopReasonWithWatchpointID(thread,
|
|
wp_sp->GetID());
|
|
} else {
|
|
is_actual_breakpoint = true;
|
|
is_trace_if_actual_breakpoint_missing = true;
|
|
}
|
|
} else if (exc_code == 1) // EXC_ARM_BREAKPOINT
|
|
{
|
|
is_actual_breakpoint = true;
|
|
is_trace_if_actual_breakpoint_missing = true;
|
|
} else if (exc_code == 0) // FIXME not EXC_ARM_BREAKPOINT but a kernel
|
|
// is currently returning this so accept it
|
|
// as indicating a breakpoint until the
|
|
// kernel is fixed
|
|
{
|
|
is_actual_breakpoint = true;
|
|
is_trace_if_actual_breakpoint_missing = true;
|
|
}
|
|
break;
|
|
|
|
case llvm::Triple::aarch64_32:
|
|
case llvm::Triple::aarch64: {
|
|
// xnu describes three things with type EXC_BREAKPOINT:
|
|
//
|
|
// exc_code 0x102 [EXC_ARM_DA_DEBUG], exc_sub_code addr-of-insn
|
|
// Watchpoint access. exc_sub_code is the address of the
|
|
// instruction which trigged the watchpoint trap.
|
|
// debugserver may add the watchpoint number that was triggered
|
|
// in exc_sub_sub_code.
|
|
//
|
|
// exc_code 1 [EXC_ARM_BREAKPOINT], exc_sub_code 0
|
|
// Instruction step has completed.
|
|
//
|
|
// exc_code 1 [EXC_ARM_BREAKPOINT], exc_sub_code address-of-instruction
|
|
// Software breakpoint instruction executed.
|
|
|
|
if (exc_code == 1 && exc_sub_code == 0) // EXC_ARM_BREAKPOINT
|
|
{
|
|
// This is hit when we single instruction step aka MDSCR_EL1 SS bit 0
|
|
// is set
|
|
is_actual_breakpoint = true;
|
|
is_trace_if_actual_breakpoint_missing = true;
|
|
if (thread.GetTemporaryResumeState() != eStateStepping)
|
|
not_stepping_but_got_singlestep_exception = true;
|
|
}
|
|
if (exc_code == 0x102) // EXC_ARM_DA_DEBUG
|
|
{
|
|
// LWP_TODO: We need to find the WatchpointResource that matches
|
|
// the address, and evaluate its Watchpoints.
|
|
|
|
// It's a watchpoint, then, if the exc_sub_code indicates a
|
|
// known/enabled data break address from our watchpoint list.
|
|
lldb::WatchpointSP wp_sp;
|
|
if (target)
|
|
wp_sp = target->GetWatchpointList().FindByAddress(
|
|
(lldb::addr_t)exc_sub_code);
|
|
if (wp_sp && wp_sp->IsEnabled()) {
|
|
return StopInfo::CreateStopReasonWithWatchpointID(thread,
|
|
wp_sp->GetID());
|
|
}
|
|
// EXC_ARM_DA_DEBUG seems to be reused for EXC_BREAKPOINT as well as
|
|
// EXC_BAD_ACCESS
|
|
if (thread.GetTemporaryResumeState() == eStateStepping)
|
|
return StopInfo::CreateStopReasonToTrace(thread);
|
|
}
|
|
// It looks like exc_sub_code has the 4 bytes of the instruction that
|
|
// triggered the exception, i.e. our breakpoint opcode
|
|
is_actual_breakpoint = exc_code == 1;
|
|
break;
|
|
}
|
|
|
|
default:
|
|
break;
|
|
}
|
|
|
|
if (is_actual_breakpoint) {
|
|
RegisterContextSP reg_ctx_sp(thread.GetRegisterContext());
|
|
addr_t pc = reg_ctx_sp->GetPC() - pc_decrement;
|
|
|
|
ProcessSP process_sp(thread.CalculateProcess());
|
|
|
|
lldb::BreakpointSiteSP bp_site_sp;
|
|
if (process_sp)
|
|
bp_site_sp = process_sp->GetBreakpointSiteList().FindByAddress(pc);
|
|
if (bp_site_sp && bp_site_sp->IsEnabled()) {
|
|
// Update the PC if we were asked to do so, but only do so if we find
|
|
// a breakpoint that we know about cause this could be a trap
|
|
// instruction in the code
|
|
if (pc_decrement > 0 && adjust_pc_if_needed)
|
|
reg_ctx_sp->SetPC(pc);
|
|
|
|
// If the breakpoint is for this thread, then we'll report the hit,
|
|
// but if it is for another thread, we can just report no reason. We
|
|
// don't need to worry about stepping over the breakpoint here, that
|
|
// will be taken care of when the thread resumes and notices that
|
|
// there's a breakpoint under the pc. If we have an operating system
|
|
// plug-in, we might have set a thread specific breakpoint using the
|
|
// operating system thread ID, so we can't make any assumptions about
|
|
// the thread ID so we must always report the breakpoint regardless
|
|
// of the thread.
|
|
if (bp_site_sp->ValidForThisThread(thread) ||
|
|
thread.GetProcess()->GetOperatingSystem() != nullptr)
|
|
return StopInfo::CreateStopReasonWithBreakpointSiteID(
|
|
thread, bp_site_sp->GetID());
|
|
else if (is_trace_if_actual_breakpoint_missing)
|
|
return StopInfo::CreateStopReasonToTrace(thread);
|
|
else
|
|
return StopInfoSP();
|
|
}
|
|
|
|
// Don't call this a trace if we weren't single stepping this thread.
|
|
if (is_trace_if_actual_breakpoint_missing &&
|
|
thread.GetTemporaryResumeState() == eStateStepping) {
|
|
return StopInfo::CreateStopReasonToTrace(thread);
|
|
}
|
|
}
|
|
} break;
|
|
|
|
case 7: // EXC_SYSCALL
|
|
case 8: // EXC_MACH_SYSCALL
|
|
case 9: // EXC_RPC_ALERT
|
|
case 10: // EXC_CRASH
|
|
break;
|
|
}
|
|
|
|
return std::make_shared<StopInfoMachException>(
|
|
thread, exc_type, exc_data_count, exc_code, exc_sub_code,
|
|
not_stepping_but_got_singlestep_exception);
|
|
}
|
|
|
|
// Detect an unusual situation on Darwin where:
|
|
//
|
|
// 0. We did an instruction-step before this.
|
|
// 1. We have a hardware breakpoint or watchpoint set.
|
|
// 2. We resumed the process, but not with an instruction-step.
|
|
// 3. The thread gets an "instruction-step completed" mach exception.
|
|
// 4. The pc has not advanced - it is the same as before.
|
|
//
|
|
// This method returns true for that combination of events.
|
|
bool StopInfoMachException::WasContinueInterrupted(Thread &thread) {
|
|
Log *log = GetLog(LLDBLog::Step);
|
|
|
|
// We got an instruction-step completed mach exception but we were not
|
|
// doing an instruction step on this thread.
|
|
if (!m_not_stepping_but_got_singlestep_exception)
|
|
return false;
|
|
|
|
RegisterContextSP reg_ctx_sp(thread.GetRegisterContext());
|
|
std::optional<addr_t> prev_pc = thread.GetPreviousFrameZeroPC();
|
|
if (!reg_ctx_sp || !prev_pc)
|
|
return false;
|
|
|
|
// The previous pc value and current pc value are the same.
|
|
if (*prev_pc != reg_ctx_sp->GetPC())
|
|
return false;
|
|
|
|
// We have a watchpoint -- this is the kernel bug.
|
|
ProcessSP process_sp = thread.GetProcess();
|
|
if (process_sp->GetWatchpointResourceList().GetSize()) {
|
|
LLDB_LOGF(log,
|
|
"Thread stopped with insn-step completed mach exception but "
|
|
"thread was not stepping; there is a hardware watchpoint set.");
|
|
return true;
|
|
}
|
|
|
|
// We have a hardware breakpoint -- this is the kernel bug.
|
|
auto &bp_site_list = process_sp->GetBreakpointSiteList();
|
|
for (auto &site : bp_site_list.Sites()) {
|
|
if (site->IsHardware() && site->IsEnabled()) {
|
|
LLDB_LOGF(log,
|
|
"Thread stopped with insn-step completed mach exception but "
|
|
"thread was not stepping; there is a hardware breakpoint set.");
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|