[trace][intel pt] Simple detection of infinite decoding loops

[wallace]

Summary

The low-level decoder might fall into an infinite decoding loop for
various reasons, the simplest being an infinite direct loop reached due
to wrong handling of self-modified code in the kernel, e.g. it might
reach

0x0A: pause
0x0C: jump to 0x0A

In this case, all the code is sequential and requires no packets to be
decoded. The low-level decoder would produce an output like the
following

0x0A: pause
0x0C: jump to 0x0A
0x0A: pause
0x0C: jump to 0x0A
0x0A: pause
0x0C: jump to 0x0A
... infinite amount of times

These cases require stopping the decoder to avoid infinite work and signal this
at least as a trace error.

• Add a check that breaks decoding of a single PSB once 500k instructions have been decoded since the last packet was processed.
• Add a check that looks for infinite loops after certain amount of instructions have been decoded since the last packet was processed.
• Add some settings properties for tweaking the thresholds of the checks above. This is also nice because it does the basic work needed for future settings.
• Add an AnomalyDetector class that inspects the DecodedThread and the libipt decoder in search for anomalies. These anomalies are then signaled as fatal errors in the trace.
• Add an ErrorStats class that keeps track of all the errors in a DecodedThread, with a special counter for fatal errors.
• Add an entry for decoded thread errors in the dump info command.

Some notes are added in the code and in the documention of the settings,
so please read them.

Besides that, I haven't been unable to create a test case in LLVM style, but
I've found an anomaly in the thread #12 of the trace
72533820-3eb8-4465-b8e4-4e6bf0ccca99 at Meta. We have to figure out how to
artificially create traces with this kind of anomalies in LLVM style.

With this change, that anomalous thread now shows:

(lldb)thread trace dump instructions 12 -e -i 23101

thread #12: tid = 8
    ...missing instructions
    23101: (error) anomalous trace: possible infinite loop detected of size 2
  vmlinux-5.12.0-0_fbk8_clang_6656_gc85768aa64da`panic_smp_self_stop + 5 [inlined] rep_nop at processor.h:13:2
    23100: 0xffffffff81342785    pause
  vmlinux-5.12.0-0_fbk8_clang_6656_gc85768aa64da`panic_smp_self_stop + 7 at panic.c:87:2
    23099: 0xffffffff81342787    jmp    0xffffffff81342785        ; <+5> [inlined] rep_nop at processor.h:13:2
  vmlinux-5.12.0-0_fbk8_clang_6656_gc85768aa64da`panic_smp_self_stop + 5 [inlined] rep_nop at processor.h:13:2
    23098: 0xffffffff81342785    pause
  vmlinux-5.12.0-0_fbk8_clang_6656_gc85768aa64da`panic_smp_self_stop + 7 at panic.c:87:2
    23097: 0xffffffff81342787    jmp    0xffffffff81342785        ; <+5> [inlined] rep_nop at processor.h:13:2
  vmlinux-5.12.0-0_fbk8_clang_6656_gc85768aa64da`panic_smp_self_stop + 5 [inlined] rep_nop at processor.h:13:2
    23096: 0xffffffff81342785    pause
  vmlinux-5.12.0-0_fbk8_clang_6656_gc85768aa64da`panic_smp_self_stop + 7 at panic.c:87:2
    23095: 0xffffffff81342787    jmp    0xffffffff81342785        ; <+5> [inlined] rep_nop at processor.h:13:2

It used to be in an infinite loop where the decoder never stopped.

Besides that, the dump info command shows

(lldb) thread trace dump info 12

 Errors:
    Number of individual errors: 32
      Number of fatal errors: 1
      Number of other errors: 31

and in json format

(lldb) thread trace dump info 12 -j

 "errors": {
      "totalCount": 32,
      "libiptErrors": {},
      "fatalErrors": 1,
      "otherErrors": 31
    }

[wallace]

.

[jj10306]

looks good overall, mainly some questions and a few nits

lldb/source/Plugins/Trace/intel-pt/DecodedThread.h

123 ↗

(On Diff #470047)

130 ↗

(On Diff #470047)

nice, I was about to add this as part of my diff (:

lldb/source/Plugins/Trace/intel-pt/LibiptDecoder.cpp

206

can you explain why we are increasing the threshold?

235–241

if you move the --item_index in prev_insn_index lambda, would that allow you to remove this duplicated eTraceItemKindInstruction check and instead unconditionally call prev_insn_index?
or would this not work because the intention of the lamda is to skip the current event even if it's already an instruction

281

help me understand this please. I thought pt_insn_get_offset would always return a new, increasing offset every time this function is called.

[wallace]

lldb/source/Plugins/Trace/intel-pt/DecodedThread.h

123 ↗

(On Diff #470047)

ahh good one

130 ↗

(On Diff #470047)

oh nice!

lldb/source/Plugins/Trace/intel-pt/LibiptDecoder.cpp

206

the idea is to check for infinite loops sporadically without making the total checks in O(N^2) and instead do it in O(N)

If we first do a linear check in the trace, which is O(T) after T instructions are appended and there are no loops, we might want to check again in the future. We could wait for the next T instructions and then run another check, and if we fail, wait for the next T and so on. This result in a total time spent of O(T + 2T + 3T + 4T + ... + N) which is O(N^2). Instead, we can run the check after 2T, and then after 4T and then after 8T and so on. This gives us a geometric progression of (N + N/2 + N / 4 + ... + T) which is amortized total O(N). A similar algorithm is vector::push_back (https://cs.stackexchange.com/questions/9380/why-is-push-back-in-c-vectors-constant-amortized) which is total O(N) using a similar approach.

235–241

I like your idea. I think I can simplify the code

281

Not really. pt_insn_get_offset returns the offset of the last packet that was processed, and that single could lead to many individual sequential instructions until the next packet is needed.

Let's imagine that you have this trace

PSB with starting address of 0xAAA
TNT with 4 bits
TIP with address 0xFFF

What the decoder will do is to first read the PSB and start at IP 0xAAA. It'll then decode sequential instructions until it reaches the first branch or jump. It then needs to read the next packet, which is the TNT with 4 bits, so it will help decode the next 4 branches but not the fifth one. So the decoder will change the offset and resume decoding instructions sequentially until that fifth branch (or jump) is reached. Then the decoder will read the next packet, which is a TIP and tells the decoder to jump to address 0xFFF.
So this means that with the PSB, the decoder produced, let's say, 10 instructions, and with the TNT maybe 1000 were produced,, and then the decoder moved to the offset of the TIP for the next instruction.

[wallace]

address issues and comments

lldb/include/lldb/Core/PluginManager.h

public:
   static SymbolVendorCreateInstance
   GetSymbolVendorCreateCallbackAtIndex(uint32_t idx);
 
   // Trace
   static bool RegisterPlugin(
       llvm::StringRef name, llvm::StringRef description,
       TraceCreateInstanceFromBundle create_callback_from_bundle,
       TraceCreateInstanceForLiveProcess create_callback_for_live_process,
-      llvm::StringRef schema);
+      llvm::StringRef schema,
+      DebuggerInitializeCallback debugger_init_callback);
 
   static bool
   UnregisterPlugin(TraceCreateInstanceFromBundle create_callback);
 
   static TraceCreateInstanceFromBundle
   GetTraceCreateCallback(llvm::StringRef plugin_name);
 
   static TraceCreateInstanceForLiveProcess
public:
 
   static lldb::OptionValuePropertiesSP
   GetSettingForProcessPlugin(Debugger &debugger, ConstString setting_name);
 
   static bool CreateSettingForProcessPlugin(
       Debugger &debugger, const lldb::OptionValuePropertiesSP &properties_sp,
       ConstString description, bool is_global_property);
 
+  static bool CreateSettingForTracePlugin(
+      Debugger &debugger, const lldb::OptionValuePropertiesSP &properties_sp,
+      ConstString description, bool is_global_property);
+
   static lldb::OptionValuePropertiesSP
   GetSettingForObjectFilePlugin(Debugger &debugger, ConstString setting_name);
 
   static bool CreateSettingForObjectFilePlugin(
       Debugger &debugger, const lldb::OptionValuePropertiesSP &properties_sp,
       ConstString description, bool is_global_property);
 
   static lldb::OptionValuePropertiesSP

lldb/source/Core/PluginManager.cpp

 #pragma mark Trace
 
 struct TraceInstance
     : public PluginInstance<TraceCreateInstanceFromBundle> {
   TraceInstance(
       llvm::StringRef name, llvm::StringRef description,
       CallbackType create_callback_from_bundle,
       TraceCreateInstanceForLiveProcess create_callback_for_live_process,
-      llvm::StringRef schema)
+      llvm::StringRef schema, DebuggerInitializeCallback debugger_init_callback)
       : PluginInstance<TraceCreateInstanceFromBundle>(
-            name, description, create_callback_from_bundle),
+            name, description, create_callback_from_bundle,
+            debugger_init_callback),
         schema(schema),
         create_callback_for_live_process(create_callback_for_live_process) {}
 
   llvm::StringRef schema;
   TraceCreateInstanceForLiveProcess create_callback_for_live_process;
 };
 
 typedef PluginInstances<TraceInstance> TraceInstances;
 
 static TraceInstances &GetTracePluginInstances() {
   static TraceInstances g_instances;
   return g_instances;
 }
 
 bool PluginManager::RegisterPlugin(
     llvm::StringRef name, llvm::StringRef description,
     TraceCreateInstanceFromBundle create_callback_from_bundle,
     TraceCreateInstanceForLiveProcess create_callback_for_live_process,
-    llvm::StringRef schema) {
+    llvm::StringRef schema, DebuggerInitializeCallback debugger_init_callback) {
   return GetTracePluginInstances().RegisterPlugin(
       name, description, create_callback_from_bundle,
-      create_callback_for_live_process, schema);
+      create_callback_for_live_process, schema, debugger_init_callback);
 }
 
 bool PluginManager::UnregisterPlugin(
     TraceCreateInstanceFromBundle create_callback_from_bundle) {
   return GetTracePluginInstances().UnregisterPlugin(
       create_callback_from_bundle);
 }
 
if (properties_sp) {
     }
   }
   return false;
 }
 
 static const char *kDynamicLoaderPluginName("dynamic-loader");
 static const char *kPlatformPluginName("platform");
 static const char *kProcessPluginName("process");
+static const char *kTracePluginName("trace");
 static const char *kObjectFilePluginName("object-file");
 static const char *kSymbolFilePluginName("symbol-file");
 static const char *kJITLoaderPluginName("jit-loader");
 static const char *kStructuredDataPluginName("structured-data");
 
 lldb::OptionValuePropertiesSP
 PluginManager::GetSettingForDynamicLoaderPlugin(Debugger &debugger,
                                                 ConstString setting_name) {

 bool PluginManager::CreateSettingForProcessPlugin(
     Debugger &debugger, const lldb::OptionValuePropertiesSP &properties_sp,
     ConstString description, bool is_global_property) {
   return CreateSettingForPlugin(debugger, ConstString(kProcessPluginName),
                                 ConstString("Settings for process plug-ins"),
                                 properties_sp, description, is_global_property);
 }
 
+bool PluginManager::CreateSettingForTracePlugin(
+    Debugger &debugger, const lldb::OptionValuePropertiesSP &properties_sp,
+    ConstString description, bool is_global_property) {
+  return CreateSettingForPlugin(debugger, ConstString(kTracePluginName),
+                                ConstString("Settings for trace plug-ins"),
+                                properties_sp, description, is_global_property);
+}
+
 lldb::OptionValuePropertiesSP
 PluginManager::GetSettingForObjectFilePlugin(Debugger &debugger,
                                              ConstString setting_name) {
   return GetSettingForPlugin(debugger, setting_name,
                              ConstString(kObjectFilePluginName));
 }
 
 bool PluginManager::CreateSettingForObjectFilePlugin(

lldb/source/Plugins/Trace/intel-pt/CMakeLists.txt

 if (NOT LIBIPT_INCLUDE_PATH)
   message (FATAL_ERROR "libipt include path not provided")
 endif()
 
 if (NOT EXISTS "${LIBIPT_INCLUDE_PATH}")
   message (FATAL_ERROR "invalid libipt include path provided")
 endif()
 include_directories(${LIBIPT_INCLUDE_PATH})
 
 find_library(LIBIPT_LIBRARY ipt PATHS ${LIBIPT_LIBRARY_PATH} REQUIRED)
 
 lldb_tablegen(TraceIntelPTCommandOptions.inc -gen-lldb-option-defs
   SOURCE TraceIntelPTOptions.td
   TARGET TraceIntelPTOptionsGen)
 
+lldb_tablegen(TraceIntelPTProperties.inc -gen-lldb-property-defs
+  SOURCE TraceIntelPTProperties.td
+  TARGET TraceIntelPTPropertiesGen)
+
+lldb_tablegen(TraceIntelPTPropertiesEnum.inc -gen-lldb-property-enum-defs
+  SOURCE TraceIntelPTProperties.td
+  TARGET TraceIntelPTPropertiesEnumGen)
+
 add_lldb_library(lldbPluginTraceIntelPT PLUGIN
   CommandObjectTraceStartIntelPT.cpp
   DecodedThread.cpp
   TaskTimer.cpp
   LibiptDecoder.cpp
   PerfContextSwitchDecoder.cpp
   ThreadDecoder.cpp
   TraceCursorIntelPT.cpp
LINK_LIBS
     lldbTarget
     lldbPluginTraceCommon
     ${LIBIPT_LIBRARY}
   LINK_COMPONENTS
     Support
   )
 
 
-add_dependencies(lldbPluginTraceIntelPT TraceIntelPTOptionsGen)
+add_dependencies(lldbPluginTraceIntelPT
+  TraceIntelPTOptionsGen
+  TraceIntelPTPropertiesGen
+  TraceIntelPTPropertiesEnumGen)

lldb/source/Plugins/Trace/intel-pt/LibiptDecoder.cpp

public:
   /// \param[in] next_block_ip
   ///     The starting ip at the next PSB block of the same thread if available.
   ///
   /// \param[in] decoded_thread
   ///     A \a DecodedThread object where the decoded instructions will be
   ///     appended to. It might have already some instructions.
   PSBBlockDecoder(PtInsnDecoderUP &&decoder_up, const PSBBlock &psb_block,
                   Optional<lldb::addr_t> next_block_ip,
-                  DecodedThread &decoded_thread)
+                  DecodedThread &decoded_thread, TraceIntelPT &trace_intel_pt)
       : m_decoder_up(std::move(decoder_up)), m_psb_block(psb_block),
-        m_next_block_ip(next_block_ip), m_decoded_thread(decoded_thread) {}
+        m_next_block_ip(next_block_ip), m_decoded_thread(decoded_thread),
+        m_trace_intel_pt(trace_intel_pt) {}
 
   /// \param[in] trace_intel_pt
   ///     The main Trace object that own the PSB block.
   ///
   /// \param[in] decoder
   ///     A decoder configured to start and end within the boundaries of the
   ///     given \p psb_block.
   ///
Create(TraceIntelPT &trace_intel_pt, const PSBBlock &psb_block,
          ArrayRef<uint8_t> buffer, Process &process,
          Optional<lldb::addr_t> next_block_ip, DecodedThread &decoded_thread) {
     Expected<PtInsnDecoderUP> decoder_up =
         CreateInstructionDecoder(trace_intel_pt, buffer, process);
     if (!decoder_up)
       return decoder_up.takeError();
 
     return PSBBlockDecoder(std::move(*decoder_up), psb_block, next_block_ip,
-                           decoded_thread);
+                           decoded_thread, trace_intel_pt);
   }
 
   void DecodePSBBlock() {
     int status = pt_insn_sync_forward(m_decoder_up.get());
     assert(status >= 0 &&
            "Synchronization shouldn't fail because this PSB was previously "
            "decoded correctly.");
 
     // We emit a TSC before a sync event to more easily associate a timestamp to
     // the sync event. If present, the current block's TSC would be the first
     // TSC we'll see when processing events.
     if (m_psb_block.tsc)
       m_decoded_thread.NotifyTsc(*m_psb_block.tsc);
 
     m_decoded_thread.NotifySyncPoint(m_psb_block.psb_offset);
 
     DecodeInstructionsAndEvents(status);
   }
 
 private:
-  /// Decode all the instructions and events of the given PSB block.
-  ///
-  /// \param[in] status
-  ///   The status that was result of synchronizing to the most recent PSB.
+  /// Decode all the instructions and events of the given PSB block. The
+  /// decoding loop might stop abruptly if an infinite decoding loop is
+  /// detected.
   void DecodeInstructionsAndEvents(int status) {
     pt_insn insn;
+    size_t insn_added_since_last_packet = 0;
+    lldb::addr_t last_packet_offset = LLDB_INVALID_ADDRESS;
+    const size_t infinite_loop_threshold =
+        m_trace_intel_pt.GetGlobalProperties()
+            .GetInfiniteDecodingLoopVerificationThreshold();
+
+    // Append an instruction and return false if and only if an infinite
+    // decoding loop has been detected.
+    auto append_instruction = [&]() -> bool {
+      m_decoded_thread.AppendInstruction(insn);
+
+      // We want to check if we might have fallen in an infinite loop. We do so
+      // by checking how many instructions we have added since we processed the
+      // last Intel PT packet. This number should be low, because at some point
+      // we should see branches or interrupts that will require a new packet to
+      // be processed.
+      lldb::addr_t new_packet_offset;
+      if (!IsLibiptError(
+              pt_insn_get_offset(m_decoder_up.get(), &new_packet_offset)) &&
+          new_packet_offset != last_packet_offset) {
+        last_packet_offset = new_packet_offset;
+        insn_added_since_last_packet = 0;
+      }
+
+      // We don't expect a single packet to give, say, 100k instructions. That
+      // would mean that there are 100k sequential instructions without any
+      // single branch, which is highly unlikely, or that we found an infinite
+      // loop using direct jumps, e.g.
+      //
+      //   0x0A: nop or pause
+      //   0x0C: jump to 0x0A
+      //
+      // which is indeed code that is found in the kernel. I presume we reach
+      // this kind of code in the decoder because we don't handle self-modified
+      // code.
+      //
+      // As a note for the future, right now we only check for the
+      // number of instructions, but if this fails, we need to really identify
+      // if there's an infinite loop, which is doable in linear time using the
+      // Knuth-Morris-Pratt algorithm looking for any suffix of the trace that
+      // repeats itself.
+      //
+      // Finally, we are right now only signaling an error, but it would be
+      // more conservative to also discard all the trace items found in this
+      // PSB. I prefer not to do that now to give more exposure to this kind
+      // of anomalies.
+      if (++insn_added_since_last_packet >= infinite_loop_threshold) {
+        m_decoded_thread.AppendCustomError(
+            "decoding truncated: possible infinite decoding loop detected");
+        return false;
+      }
+      return true;
+    };
+
     while (true) {
       status = ProcessPTEvents(status);
 
       if (IsLibiptError(status))
         return;
       else if (IsEndOfStream(status))
         break;
 
       // The status returned by pt_insn_next will need to be processed
       // by ProcessPTEvents in the next loop if it is not an error.
       std::memset(&insn, 0, sizeof insn);
       status = pt_insn_next(m_decoder_up.get(), &insn, sizeof(insn));
 
       if (IsLibiptError(status)) {
         m_decoded_thread.AppendError(IntelPTError(status, insn.ip));
         return;
       } else if (IsEndOfStream(status)) {
         break;
       }
-      m_decoded_thread.AppendInstruction(insn);
+
+      if (!append_instruction())
+        return;
     }
 
     // We need to keep querying non-branching instructions until we hit the
     // starting point of the next PSB. We won't see events at this point. This
     // is based on
     // https://github.com/intel/libipt/blob/master/doc/howto_libipt.md#parallel-decode
     if (m_next_block_ip && insn.ip != 0) {
       while (insn.ip != *m_next_block_ip) {
-        m_decoded_thread.AppendInstruction(insn);
+        if (!append_instruction())
+          return;
 
         status = pt_insn_next(m_decoder_up.get(), &insn, sizeof(insn));
 
         if (IsLibiptError(status)) {
           m_decoded_thread.AppendError(IntelPTError(status, insn.ip));
           return;
         }
       }
int ProcessPTEvents(int status) {
     return status;
   }
 
 private:
   PtInsnDecoderUP m_decoder_up;
   PSBBlock m_psb_block;
   Optional<lldb::addr_t> m_next_block_ip;
   DecodedThread &m_decoded_thread;
+  TraceIntelPT &m_trace_intel_pt;
 };
 
 Error lldb_private::trace_intel_pt::DecodeSingleTraceForThread(
     DecodedThread &decoded_thread, TraceIntelPT &trace_intel_pt,
     ArrayRef<uint8_t> buffer) {
   Expected<std::vector<PSBBlock>> blocks =
       SplitTraceIntoPSBBlock(trace_intel_pt, buffer, /*expect_tscs=*/false);
   if (!blocks)

lldb/source/Plugins/Trace/intel-pt/TraceIntelPT.h

 #include "lldb/lldb-types.h"
 #include "llvm/Support/raw_ostream.h"
 
 namespace lldb_private {
 namespace trace_intel_pt {
 
 class TraceIntelPT : public Trace {
 public:
+  /// Properties to be used with the `settings` command.
+  class PluginProperties : public Properties {
+  public:
+    static ConstString GetSettingName();
+
+    PluginProperties();
+
+    ~PluginProperties() override = default;
+
+    uint64_t GetInfiniteDecodingLoopVerificationThreshold();
+  };
+
+  /// Return the global properties for this trace plug-in.
+  static PluginProperties &GetGlobalProperties();
+
   void Dump(Stream *s) const override;
 
   llvm::Expected<FileSpec> SaveToDisk(FileSpec directory,
                                       bool compact) override;
 
   ~TraceIntelPT() override = default;
 
   /// PluginInterface protocol
public:
   static llvm::Expected<lldb::TraceSP> CreateInstanceForTraceBundle(
       const llvm::json::Value &trace_bundle_description,
       llvm::StringRef bundle_dir, Debugger &debugger);
 
   static llvm::Expected<lldb::TraceSP>
   CreateInstanceForLiveProcess(Process &process);
 
   static llvm::StringRef GetPluginNameStatic() { return "intel-pt"; }
+
+  static void DebuggerInitialize(Debugger &debugger);
   /// \}
 
   lldb::CommandObjectSP
   GetProcessTraceStartCommand(CommandInterpreter &interpreter) override;
 
   lldb::CommandObjectSP
   GetThreadTraceStartCommand(CommandInterpreter &interpreter) override;
 

lldb/source/Plugins/Trace/intel-pt/TraceIntelPT.cpp

 #include "../common/ThreadPostMortemTrace.h"
 #include "CommandObjectTraceStartIntelPT.h"
 #include "DecodedThread.h"
 #include "TraceCursorIntelPT.h"
 #include "TraceIntelPTBundleLoader.h"
 #include "TraceIntelPTBundleSaver.h"
 #include "TraceIntelPTConstants.h"
 #include "lldb/Core/PluginManager.h"
+#include "lldb/Interpreter/OptionValueProperties.h"
 #include "lldb/Target/Process.h"
 #include "lldb/Target/Target.h"
 #include "llvm/ADT/None.h"
 
 using namespace lldb;
 using namespace lldb_private;
 using namespace lldb_private::trace_intel_pt;
 using namespace llvm;
 
 LLDB_PLUGIN_DEFINE(TraceIntelPT)
 
 lldb::CommandObjectSP
 TraceIntelPT::GetProcessTraceStartCommand(CommandInterpreter &interpreter) {
   return CommandObjectSP(
       new CommandObjectProcessTraceStartIntelPT(*this, interpreter));
 }
 
 lldb::CommandObjectSP
 TraceIntelPT::GetThreadTraceStartCommand(CommandInterpreter &interpreter) {
   return CommandObjectSP(
       new CommandObjectThreadTraceStartIntelPT(*this, interpreter));
 }
 
+#define LLDB_PROPERTIES_traceintelpt
+#include "TraceIntelPTProperties.inc"
+
+enum {
+#define LLDB_PROPERTIES_traceintelpt
+#include "TraceIntelPTPropertiesEnum.inc"
+};
+
+ConstString TraceIntelPT::PluginProperties::GetSettingName() {
+  return ConstString(TraceIntelPT::GetPluginNameStatic());
+}
+
+TraceIntelPT::PluginProperties::PluginProperties() : Properties() {
+  m_collection_sp = std::make_shared<OptionValueProperties>(GetSettingName());
+  m_collection_sp->Initialize(g_traceintelpt_properties);
+}
+
+uint64_t
+TraceIntelPT::PluginProperties::GetInfiniteDecodingLoopVerificationThreshold() {
+  const uint32_t idx = ePropertyInfiniteDecodingLoopVerificationThreshold;
+  return m_collection_sp->GetPropertyAtIndexAsUInt64(
+      nullptr, idx, g_traceintelpt_properties[idx].default_uint_value);
+}
+
+TraceIntelPT::PluginProperties &TraceIntelPT::GetGlobalProperties() {
+  static TraceIntelPT::PluginProperties g_settings;
+  return g_settings;
+}
+
 void TraceIntelPT::Initialize() {
-  PluginManager::RegisterPlugin(GetPluginNameStatic(), "Intel Processor Trace",
-                                CreateInstanceForTraceBundle,
-                                CreateInstanceForLiveProcess,
-                                TraceIntelPTBundleLoader::GetSchema());
+  PluginManager::RegisterPlugin(
+      GetPluginNameStatic(), "Intel Processor Trace",
+      CreateInstanceForTraceBundle, CreateInstanceForLiveProcess,
+      TraceIntelPTBundleLoader::GetSchema(), DebuggerInitialize);
+}
+
+void TraceIntelPT::DebuggerInitialize(Debugger &debugger) {
+  if (!PluginManager::GetSettingForProcessPlugin(
+          debugger, PluginProperties::GetSettingName())) {
+    const bool is_global_setting = true;
+    PluginManager::CreateSettingForTracePlugin(
+        debugger, GetGlobalProperties().GetValueProperties(),
+        ConstString("Properties for the intel-pt trace plug-in."),
+        is_global_setting);
+  }
 }
 
 void TraceIntelPT::Terminate() {
   PluginManager::UnregisterPlugin(CreateInstanceForTraceBundle);
 }
 
 StringRef TraceIntelPT::GetSchema() {
   return TraceIntelPTBundleLoader::GetSchema();

lldb/source/Plugins/Trace/intel-pt/TraceIntelPTProperties.td

+include "../../../../include/lldb/Core/PropertiesBase.td"
+
+let Definition = "traceintelpt" in {
+  def InfiniteDecodingLoopVerificationThreshold:
+      Property<"infinite-decoding-loop-veritication-threshold", "UInt64">,
+    Global,
+    DefaultUnsignedValue<200000>,
+    Desc<"Specify how many instructions following an individual Intel PT "
+      "packet must have been decoded before triggering the verification for "
+      "infinite decoding loops, which might happen if the image is corrupted, "
+      "such as with self-modifying code. If an infinite loop is detected, an "
+      "error will be included inside the trace.">;
+}