lldb WIP/RFC: Adding support for address fixing on AArch64 with high and low memory addresses

[jasonmolenda]

Summary

The number of bits used for addressing on AArch64 is a bit more complicated than we're representing today in lldb. The same values apply to both EL0 and EL1 execution, but the number of bits used in addressing may be different for low memory (0x000...) versus high memory (0xfff...) addresses. The Darwin kernel always has the same page table setup for low and high memory, but I'm supporting some teams that need to have different settings for each, and they're managing to capture a single corefile / JTAG connection capturing the virtual addresses for both high and low memory in a single process. Having a single number of addressing bits cannot handle this situation today. Internally we use the Linux model of code address and data address mask, but that also doesn't encompass this concept.

This patch adds a high memory code and data mask, mirroring our existing code/data masks. By default the high memory masks will either be default value 0, or will have the same mask values. I'll need three ways of receiving the correct address bit numbers: a setting, an LC_NOTE way to get it from a corefile, and a qProcessInfo way of getting it from a gdb-remote connection to a JTAG etc device.

To start, I changed target.process.virtual-addressable-bits from taking a uint to an array of strings (it should be an array of uint's but I wasn't getting that to work correctly, I'll play around with it more later). The array can be zero elements (no user override), a single element (used for all addresses, like today), or two elements (first number is low memory, second number is high memory). The alternative is to have an additional setting for those environments that need to specify a different address mask for high memory vrs. low memory.

I also changed Process::GetDataAddressMask and Process::GetCodeAddressMask to have a clear set of precedence for values. If the user specifies a number of addressing bits in that setting, this overrides what the system might tell lldb. The user's specified values do not overwrite/set the Process address mask.

Current behavior is that the mask is overwritten by the setting value if the mask is unset. But once the mask is set, the user setting is ignored. In practice this means you can set the setting ONCE in a Process lifetime, and then further changes to the setting are ignored. Made it a little annoying to experiment with this environment when I first started working on it. :)

None of this should change behavior on linux, but if folks from the linux world have a comment or reaction to this change, I would be interested to hear opinions. I haven't done much testing beyond the one test corefile, and I still need to work out how the two values are communicated in corefiles & live debug, but those are trivial details on the core idea.

FTR this is the AArch64 TCR_EL1.T0SZ and TCR_EL1.T1SZ. The values of this control register apply to both EL0 and EL1 execution, but the T0SZ value applies to the TTBR0_EL1 for low memory addresses and the TCR_EL1.T1SZ applies to TTBR1_EL1 for high memory addresses.

[jingham]

LGTM

The help string for the setting seems clear. There's also some logic to handle the setting vrs. the values we find from the stub which you describe in the comment to the review, but it would be nice to see that in a comment in the code somewhere to help out future generations.

[JDevlieghere]

The array approach is cool but makes it hard to be backwards compatible: an old lldb is going to error out when presented with more than one value. If you made this two separate options, a client can use settings set -e to set the setting if it exists and still have valid low memory addresses if it doesn't.

[bulbazord]

lldb/source/Plugins/DynamicLoader/Darwin-Kernel/DynamicLoaderDarwinKernel.cpp

1099–1103

I think this comment needs to be updated? It doesn't look like you're calling SetVirtualAddressableBits here anymore.

[jasonmolenda]

Updated patch with Alex and Jonas' feedback incorporated. Most significantly, instead of making target.process.virtual-addressable-bits an array of uint values (between zero to two of them), I am leaving virtual-addressable-bits as-is, and adding a new target.process.highmem-virtual-addressable-bits setting. When this is set, its value will be used for setting high-memory signed addresses on AArch64 using the Apple ABI plugin. And the value in virtual-addressable-bits will be used for clearing low-memory signed addresses on AArch64 Apple. If this new highmem-virtual-addressable-bits is not set (the 99.9% most common case), virtual-addressable-bits applies to both address ranges.

[DavidSpickett]

None of this should change behavior on linux, but if folks from the linux world have a comment or reaction to this change, I would be interested to hear opinions. I haven't done much testing beyond the one test corefile, and I still need to work out how the two values are communicated in corefiles & live debug, but those are trivial details on the core idea.

I primarily work with lldb in Linux userspace, so this isn't an issue. Also seems unlikely that the Linux kernel would decide to change it, but if it did the scheme implemented here looks fine.

lldb/include/lldb/Target/Process.h

public:
 
   bool GetDisableMemoryCache() const;
   uint64_t GetMemoryCacheLineSize() const;
   Args GetExtraStartupCommands() const;
   void SetExtraStartupCommands(const Args &args);
   FileSpec GetPythonOSPluginPath() const;
   uint32_t GetVirtualAddressableBits() const;
   void SetVirtualAddressableBits(uint32_t bits);
+  uint32_t GetHighmemVirtualAddressableBits() const;
+  void SetHighmemVirtualAddressableBits(uint32_t bits);
   void SetPythonOSPluginPath(const FileSpec &file);
   bool GetIgnoreBreakpointsInExpressions() const;
   void SetIgnoreBreakpointsInExpressions(bool ignore);
   bool GetUnwindOnErrorInExpressions() const;
   void SetUnwindOnErrorInExpressions(bool ignore);
   bool GetStopOnSharedLibraryEvents() const;
   void SetStopOnSharedLibraryEvents(bool stop);
   bool GetDisableLangRuntimeUnwindPlans() const;
/// \see Process::Notifications
   ///     if there is no description available.
   const char *GetExitDescription();
 
   virtual void DidExit() {}
 
   lldb::addr_t GetCodeAddressMask();
   lldb::addr_t GetDataAddressMask();
 
+  lldb::addr_t GetHighmemCodeAddressMask();
+  lldb::addr_t GetHighmemDataAddressMask();
+
   void SetCodeAddressMask(lldb::addr_t code_address_mask) {
     m_code_address_mask = code_address_mask;
   }
 
   void SetDataAddressMask(lldb::addr_t data_address_mask) {
     m_data_address_mask = data_address_mask;
   }
 
+  void SetHighmemCodeAddressMask(lldb::addr_t code_address_mask) {
+    m_highmem_code_address_mask = code_address_mask;
+  }
+
+  void SetHighmemDataAddressMask(lldb::addr_t data_address_mask) {
+    m_highmem_data_address_mask = data_address_mask;
+  }
+
   /// Get the Modification ID of the process.
   ///
   /// \return
   ///     The modification ID of the process.
   ProcessModID GetModID() const { return m_mod_id; }
 
   const ProcessModID &GetModIDRef() const { return m_mod_id; }
 
protected:
 
   /// This is set at the beginning of Process::Finalize() to stop functions
   /// from looking up or creating things during or after a finalize call.
   std::atomic<bool> m_finalizing;
 
   /// Mask for code an data addresses. The default value (0) means no mask is
   /// set.  The bits set to 1 indicate bits that are NOT significant for
   /// addressing.
+  /// The highmem versions are for targets where we may have different masks
+  /// for low memory versus high memory addresses.
   /// @{
   lldb::addr_t m_code_address_mask = 0;
   lldb::addr_t m_data_address_mask = 0;
+  lldb::addr_t m_highmem_code_address_mask = 0;
+  lldb::addr_t m_highmem_data_address_mask = 0;
   /// @}
 
   bool m_clear_thread_plans_on_stop;
   bool m_force_next_event_delivery;
   lldb::StateType m_last_broadcast_state; /// This helps with the Public event
                                           /// coalescing in
                                           /// ShouldBroadcastEvent.
   std::map<lldb::addr_t, lldb::addr_t> m_resolved_indirect_addresses;

lldb/source/Plugins/ABI/AArch64/ABIMacOSX_arm64.h

public:
   bool CodeAddressIsValid(lldb::addr_t pc) override {
     if (pc & (4ull - 1ull))
       return false; // Not 4 byte aligned
 
     // Anything else if fair game..
     return true;
   }
 
-  lldb::addr_t FixAddress(lldb::addr_t pc, lldb::addr_t mask) override;
+  lldb::addr_t FixCodeAddress(lldb::addr_t pc) override;
+  lldb::addr_t FixDataAddress(lldb::addr_t pc) override;
 
   // Static Functions
 
   static void Initialize();
 
   static void Terminate();
 
   static lldb::ABISP CreateInstance(lldb::ProcessSP process_sp, const lldb_private::ArchSpec &arch);

lldb/source/Plugins/ABI/AArch64/ABIMacOSX_arm64.cpp

if (LoadValueFromConsecutiveGPRRegisters(
             data)) {
       return_valobj_sp = ValueObjectConstResult::Create(
           &thread, return_compiler_type, ConstString(""), data);
     }
   }
   return return_valobj_sp;
 }
 
-lldb::addr_t ABIMacOSX_arm64::FixAddress(addr_t pc, addr_t mask) {
-  lldb::addr_t pac_sign_extension = 0x0080000000000000ULL;
-  // When no mask is specified, clear/set the top byte; preserve
-  // the low 55 bits (00..54) for addressing and bit 55 to indicate
-  // sign.
-  if (mask == 0) {
-    // ~((1ULL<<55)-1)
-    mask = 0xff80000000000000;
+addr_t ABIMacOSX_arm64::FixCodeAddress(addr_t pc) {
+  addr_t pac_sign_extension = 0x0080000000000000ULL;
+  addr_t tbi_mask = 0xff80000000000000ULL;
+  addr_t mask = 0;
+
+  if (ProcessSP process_sp = GetProcessSP()) {
+    mask = process_sp->GetCodeAddressMask();
+    if (pc & pac_sign_extension) {
+      addr_t highmem_mask = process_sp->GetHighmemCodeAddressMask();
+      if (highmem_mask)
+        mask = highmem_mask;
     }
+  }
+  if (mask == 0)
+    mask = tbi_mask;
+
+  return (pc & pac_sign_extension) ? pc | mask : pc & (~mask);
+}
+
+addr_t ABIMacOSX_arm64::FixDataAddress(addr_t pc) {
+  addr_t pac_sign_extension = 0x0080000000000000ULL;
+  addr_t tbi_mask = 0xff80000000000000ULL;
+  addr_t mask = 0;
+
+  if (ProcessSP process_sp = GetProcessSP()) {
+    mask = process_sp->GetDataAddressMask();
+    if (pc & pac_sign_extension) {
+      addr_t highmem_mask = process_sp->GetHighmemDataAddressMask();
+      if (highmem_mask)
+        mask = highmem_mask;
+    }
+  }
+  if (mask == 0)
+    mask = tbi_mask;
+
   return (pc & pac_sign_extension) ? pc | mask : pc & (~mask);
 }
 
 void ABIMacOSX_arm64::Initialize() {
   PluginManager::RegisterPlugin(GetPluginNameStatic(), pluginDesc,
                                 CreateInstance);
 }
 
 void ABIMacOSX_arm64::Terminate() {
   PluginManager::UnregisterPlugin(CreateInstance);
 }

lldb/source/Plugins/DynamicLoader/Darwin-Kernel/DynamicLoaderDarwinKernel.cpp

if (m_kernel.IsLoaded() && m_kernel.GetModule()) {
               kext_summary_symbol, eSymbolTypeData);
       if (symbol) {
         m_kext_summary_header_ptr_addr = symbol->GetAddress();
         // Update all image infos
         ReadAllKextSummaries();
       }
       // If the kernel global with the T1Sz setting is available,
       // update the target.process.virtual-addressable-bits to be correct.
+      // NB the xnu kernel always has T0Sz and T1Sz the same value.  If
+      // it wasn't the same, we would need to set
+      // target.process.virtual-addressable-bits = T0Sz
+      // target.process.highmem-virtual-addressable-bits = T1Sz
       symbol = m_kernel.GetModule()->FindFirstSymbolWithNameAndType(
           arm64_T1Sz_value, eSymbolTypeData);
       if (symbol) {
-        const uint32_t orig_bits_value = m_process->GetVirtualAddressableBits();
-        // Mark all bits as addressable so we don't strip any from our
-        // memory read below, with an incorrect default value.
-        // b55 is the sign extension bit with PAC, b56:63 are TBI,
-        // don't mark those as addressable.
-        m_process->SetVirtualAddressableBits(55);
+        const addr_t orig_code_mask = m_process->GetCodeAddressMask();
+        const addr_t orig_data_mask = m_process->GetDataAddressMask();
+
+        m_process->SetCodeAddressMask(0);
+        m_process->SetDataAddressMask(0);
         Status error;
         // gT1Sz is 8 bytes.  We may run on a stripped kernel binary
         // where we can't get the size accurately.  Hardcode it.
         const size_t sym_bytesize = 8; // size of gT1Sz value
         uint64_t sym_value =
             m_process->GetTarget().ReadUnsignedIntegerFromMemory(
                 symbol->GetAddress(), sym_bytesize, 0, error);
         if (error.Success()) {
           // 64 - T1Sz is the highest bit used for auth.
           // The value we pass in to SetVirtualAddressableBits is
           // the number of bits used for addressing, so if
           // T1Sz is 25, then 64-25 == 39, bits 0..38 are used for
           // addressing, bits 39..63 are used for PAC/TBI or whatever.
           uint32_t virt_addr_bits = 64 - sym_value;
-          m_process->SetVirtualAddressableBits(virt_addr_bits);
+          addr_t mask = ~((1ULL << virt_addr_bits) - 1);
+          m_process->SetCodeAddressMask(mask);
+          m_process->SetDataAddressMask(mask);
         } else {
-          m_process->SetVirtualAddressableBits(orig_bits_value);
+          m_process->SetCodeAddressMask(orig_code_mask);
+          m_process->SetDataAddressMask(orig_data_mask);
         }
       }
     } else {
       m_kernel.Clear();
     }
   }
 }
 

lldb/source/Target/Process.cpp

uint32_t ProcessProperties::GetVirtualAddressableBits() const {
   return GetPropertyAtIndexAs<uint64_t>(
       idx, g_process_properties[idx].default_uint_value);
 }
 
 void ProcessProperties::SetVirtualAddressableBits(uint32_t bits) {
   const uint32_t idx = ePropertyVirtualAddressableBits;
   SetPropertyAtIndex(idx, static_cast<uint64_t>(bits));
 }
+
+uint32_t ProcessProperties::GetHighmemVirtualAddressableBits() const {
+  const uint32_t idx = ePropertyHighmemVirtualAddressableBits;
+  return GetPropertyAtIndexAs<uint64_t>(
+      idx, g_process_properties[idx].default_uint_value);
+}
+
+void ProcessProperties::SetHighmemVirtualAddressableBits(uint32_t bits) {
+  const uint32_t idx = ePropertyHighmemVirtualAddressableBits;
+  SetPropertyAtIndex(idx, static_cast<uint64_t>(bits));
+}
+
 void ProcessProperties::SetPythonOSPluginPath(const FileSpec &file) {
   const uint32_t idx = ePropertyPythonOSPluginPath;
   SetPropertyAtIndex(idx, file);
 }
 
 bool ProcessProperties::GetIgnoreBreakpointsInExpressions() const {
   const uint32_t idx = ePropertyIgnoreBreakpointsInExpressions;
   return GetPropertyAtIndexAs<bool>(
void Process::Flush() {
   m_thread_list.Flush();
   m_extended_thread_list.Flush();
   m_extended_thread_stop_id = 0;
   m_queue_list.Clear();
   m_queue_list_stop_id = 0;
 }
 
 lldb::addr_t Process::GetCodeAddressMask() {
-  if (m_code_address_mask == 0) {
-    if (uint32_t number_of_addressable_bits = GetVirtualAddressableBits()) {
-      lldb::addr_t address_mask = ~((1ULL << number_of_addressable_bits) - 1);
-      SetCodeAddressMask(address_mask);
-    }
-  }
+  if (uint32_t num_bits_setting = GetVirtualAddressableBits())
+    return ~((1ULL << num_bits_setting) - 1);
+
   return m_code_address_mask;
 }
 
 lldb::addr_t Process::GetDataAddressMask() {
-  if (m_data_address_mask == 0) {
-    if (uint32_t number_of_addressable_bits = GetVirtualAddressableBits()) {
-      lldb::addr_t address_mask = ~((1ULL << number_of_addressable_bits) - 1);
-      SetDataAddressMask(address_mask);
-    }
-  }
-  return m_data_address_mask;
+  if (uint32_t num_bits_setting = GetVirtualAddressableBits())
+    return ~((1ULL << num_bits_setting) - 1);
+
+  return m_data_address_mask;
+
+lldb::addr_t Process::GetHighmemCodeAddressMask() {
+  if (uint32_t num_bits_setting = GetHighmemVirtualAddressableBits())
+    return ~((1ULL << num_bits_setting) - 1);
+  return GetCodeAddressMask();
+
+lldb::addr_t Process::GetHighmemDataAddressMask() {
+  if (uint32_t num_bits_setting = GetHighmemVirtualAddressableBits())
+    return ~((1ULL << num_bits_setting) - 1);
+  return GetDataAddressMask();
 }
 
 void Process::DidExec() {
   Log *log = GetLog(LLDBLog::Process);
   LLDB_LOGF(log, "Process::%s()", __FUNCTION__);
 
   Target &target = GetTarget();
   target.CleanupProcess();

lldb/source/Target/TargetProperties.td

def InterruptTimeout: Property<"interrupt-timeout", "UInt64">,
     DefaultUnsignedValue<20>,
     Desc<"The time in seconds to wait for an interrupt succeed in stopping the target.">;
   def SteppingRunsAllThreads: Property<"run-all-threads", "Boolean">,
     DefaultFalse,
     Desc<"If true, stepping operations will run all threads.  This is equivalent to setting the run-mode option to 'all-threads'.">;
   def VirtualAddressableBits: Property<"virtual-addressable-bits", "UInt64">,
     DefaultUnsignedValue<0>,
     Desc<"The number of bits used for addressing. If the value is 39, then bits 0..38 are used for addressing. The default value of 0 means unspecified.">;
+  def HighmemVirtualAddressableBits: Property<"highmem-virtual-addressable-bits", "UInt64">,
+    DefaultUnsignedValue<0>,
+    Desc<"The number of bits used for addressing high memory, when it differs from low memory in the same Process. When this is non-zero, target.process.virtual-addressable-bits will be the value for low memory (0x000... addresses) and this setting will be the value for high memory (0xfff... addresses). When this is zero, target.process.virtual-addressable-bits applies to all addresses. It is very uncommon to use this setting.">;
   def FollowForkMode: Property<"follow-fork-mode", "Enum">,
     DefaultEnumValue<"eFollowParent">,
     EnumValues<"OptionEnumValues(g_follow_fork_mode_values)">,
     Desc<"Debugger's behavior upon fork or vfork.">;
 }
 
 let Definition = "platform" in {
   def UseModuleCache: Property<"use-module-cache", "Boolean">,