Clear non-addressable bits from fp/sp/lr/pc values in RegisterContextUnwind

[jasonmolenda]

Summary

The darwin kernel may have authentication bits on fields like $pc or $sp when the register state is thread_get_state'd with macOS Sonoma. debugserver clears these bits before handing the values to lldb arm64 corefiles created by gcore on MacOS Sonoma (macOS 14) will include these signed value as-is.

This patch changes RegisterContextUnwind to clear the unaddressable bits from sp/pc/fp/lr -- these must point to stack or code in memory.

We already clear the bits from spilled lr's because that's frequently signed with an ABI using ARMv8.3 ptrauth. This patch extends that same behavior to sp and fp.

[bulbazord]

I noticed you're pulling a lot of raw pointers out of shared pointers. Is there a particular reason you're doing that? operator bool on std::shared_ptr returns true if the held pointer is non-null.

[jasonmolenda]

In D152861#4419197, @bulbazord wrote:

I noticed you're pulling a lot of raw pointers out of shared pointers. Is there a particular reason you're doing that? operator bool on std::shared_ptr returns true if the held pointer is non-null.

Nah, I didn't care much in these contexts whether I was holding a shared pointer from the lifetime point of view. You're right it's not going to be more efficient to do it this way, I might as well use the shared pointers I got back instead of extracting the pointer out of the SP.

[jasonmolenda]

Address Alex's feedback of not extracting the ABI pointer out of the shared pointer; simply use the shared pointer.

[DavidSpickett]

I'm curious how you would end up with a signed PC value, but given this is unwind it could be a value from a previous frame that was signed when stored to the stack.

LGTM.

[jasonmolenda]

In D152861#4420223, @DavidSpickett wrote:

I'm curious how you would end up with a signed PC value, but given this is unwind it could be a value from a previous frame that was signed when stored to the stack.

The darwin kernel signs sp/pc (and maybe fp too) when they're at rest inside the kernel, I think. When we fetch the values for these with thread_get_state, they need to be run through and auth-and-clear before the values are sent to lldb (in debugserver aka lldb-server). gcore isn't stripping the auth bits when it fetches the register contexts from the kernel, and is putting those values as-is in corefiles.

You're right that this shouldn't happen in a real process. We already strip auth bits from $lr and spilled $lr's on the stack, where the code actually does sign it. This is purely addressing an artifact of how the darwin kernel represents these internally. gcore should really be clearing the auth bits from these register before putting them in a core file, but we need to work on core files that have already been created like this, so I'm starting with an lldb patch.

[DavidSpickett]

TIL what gcore is. One can save a corefile from within lldb too, I assume you've checked what that does (and with this change, it wouldn't matter either way).

lldb/source/Target/RegisterContextUnwind.cpp

void RegisterContextUnwind::InitializeZerothFrame() {
 
   Process *process = exe_ctx.GetProcessPtr();
 
   // Let ABIs fixup code addresses to make sure they are valid. In ARM ABIs
   // this will strip bit zero in case we read a PC from memory or from the LR.
   // (which would be a no-op in frame 0 where we get it from the register set,
   // but still a good idea to make the call here for other ABIs that may
   // exist.)
-  ABI *abi = process->GetABI().get();
-  if (abi)
-    current_pc = abi->FixCodeAddress(current_pc);
+  if (ABISP abi_sp = process->GetABI())
+    current_pc = abi_sp->FixCodeAddress(current_pc);
 
   UnwindPlanSP lang_runtime_plan_sp = LanguageRuntime::GetRuntimeUnwindPlan(
       m_thread, this, m_behaves_like_zeroth_frame);
   if (lang_runtime_plan_sp.get()) {
     UnwindLogMsg("This is an async frame");
   }
 
   // Initialize m_current_pc, an Address object, based on current_pc, an
void RegisterContextUnwind::InitializeNonZerothFrame() {
   if (!ReadGPRValue(eRegisterKindGeneric, LLDB_REGNUM_GENERIC_PC, pc)) {
     UnwindLogMsg("could not get pc value");
     m_frame_type = eNotAValidFrame;
     return;
   }
 
   // Let ABIs fixup code addresses to make sure they are valid. In ARM ABIs
   // this will strip bit zero in case we read a PC from memory or from the LR.
-  ABI *abi = process->GetABI().get();
-  if (abi)
-    pc = abi->FixCodeAddress(pc);
+  ABISP abi_sp = process->GetABI();
+  if (abi_sp)
+    pc = abi_sp->FixCodeAddress(pc);
 
   if (log) {
     UnwindLogMsg("pc = 0x%" PRIx64, pc);
     addr_t reg_val;
-    if (ReadGPRValue(eRegisterKindGeneric, LLDB_REGNUM_GENERIC_FP, reg_val))
+    if (ReadGPRValue(eRegisterKindGeneric, LLDB_REGNUM_GENERIC_FP, reg_val)) {
+      if (abi_sp)
+        reg_val = abi_sp->FixDataAddress(reg_val);
       UnwindLogMsg("fp = 0x%" PRIx64, reg_val);
-    if (ReadGPRValue(eRegisterKindGeneric, LLDB_REGNUM_GENERIC_SP, reg_val))
+    }
+    if (ReadGPRValue(eRegisterKindGeneric, LLDB_REGNUM_GENERIC_SP, reg_val)) {
+      if (abi_sp)
+        reg_val = abi_sp->FixDataAddress(reg_val);
       UnwindLogMsg("sp = 0x%" PRIx64, reg_val);
     }
+  }
 
   // A pc of 0x0 means it's the end of the stack crawl unless we're above a trap
   // handler function
   bool above_trap_handler = false;
   if (GetNextFrame().get() && GetNextFrame()->IsValid() &&
       GetNextFrame()->IsTrapHandlerFrame())
     above_trap_handler = true;
 
if (process->GetLoadAddressPermissions(pc, permissions) &&
         // we're off in the weeds -- stop now.
         m_frame_type = eNotAValidFrame;
         UnwindLogMsg("pc is in a non-executable section of memory and this "
                      "isn't the 2nd frame in the stack walk.");
         return;
       }
     }
 
-    if (abi) {
+    if (abi_sp) {
       m_fast_unwind_plan_sp.reset();
       m_full_unwind_plan_sp =
           std::make_shared<UnwindPlan>(lldb::eRegisterKindGeneric);
-      abi->CreateDefaultUnwindPlan(*m_full_unwind_plan_sp);
+      abi_sp->CreateDefaultUnwindPlan(*m_full_unwind_plan_sp);
       if (m_frame_type != eSkipFrame) // don't override eSkipFrame
       {
         m_frame_type = eNormalFrame;
       }
       m_all_registers_available = false;
       m_current_offset = -1;
       m_current_offset_backed_up_one = -1;
       RegisterKind row_register_kind = m_full_unwind_plan_sp->GetRegisterKind();
if (SavedLocationForRegister(pc_regnum.GetAsKind(eRegisterKindLLDB),
       UnwindLLDB::RegisterSearchResult::eRegisterFound) {
     const RegisterInfo *reg_info =
         GetRegisterInfoAtIndex(pc_regnum.GetAsKind(eRegisterKindLLDB));
     if (reg_info) {
       RegisterValue reg_value;
       if (ReadRegisterValueFromRegisterLocation(regloc, reg_info, reg_value)) {
         old_caller_pc_value = reg_value.GetAsUInt64();
         if (ProcessSP process_sp = m_thread.GetProcess()) {
-          if (ABISP abi = process_sp->GetABI())
-            old_caller_pc_value = abi->FixCodeAddress(old_caller_pc_value);
+          if (ABISP abi_sp = process_sp->GetABI())
+            old_caller_pc_value = abi_sp->FixCodeAddress(old_caller_pc_value);
         }
       }
     }
   }
 
   // This is a tricky wrinkle!  If SavedLocationForRegister() detects a really
   // impossible register location for the full unwind plan, it may call
   // ForceSwitchToFallbackUnwindPlan() which in turn replaces the full
if (SavedLocationForRegister(pc_regnum.GetAsKind(eRegisterKindLLDB),
       const RegisterInfo *reg_info =
           GetRegisterInfoAtIndex(pc_regnum.GetAsKind(eRegisterKindLLDB));
       if (reg_info) {
         RegisterValue reg_value;
         if (ReadRegisterValueFromRegisterLocation(regloc, reg_info,
                                                   reg_value)) {
           new_caller_pc_value = reg_value.GetAsUInt64();
           if (ProcessSP process_sp = m_thread.GetProcess()) {
-            if (ABISP abi = process_sp->GetABI())
-              new_caller_pc_value = abi->FixCodeAddress(new_caller_pc_value);
+            if (ABISP abi_sp = process_sp->GetABI())
+              new_caller_pc_value = abi_sp->FixCodeAddress(new_caller_pc_value);
           }
         }
       }
     }
 
     if (new_caller_pc_value == LLDB_INVALID_ADDRESS) {
       UnwindLogMsg("failed to get a pc value for the caller frame with the "
                    "fallback unwind plan");

 
 bool RegisterContextUnwind::ReadFrameAddress(
     lldb::RegisterKind row_register_kind, UnwindPlan::Row::FAValue &fa,
     addr_t &address) {
   RegisterValue reg_value;
 
   address = LLDB_INVALID_ADDRESS;
   addr_t cfa_reg_contents;
+  ABISP abi_sp = m_thread.GetProcess()->GetABI();
 
   switch (fa.GetValueType()) {
   case UnwindPlan::Row::FAValue::isRegisterDereferenced: {
     RegisterNumber cfa_reg(m_thread, row_register_kind,
                            fa.GetRegisterNumber());
     if (ReadGPRValue(cfa_reg, cfa_reg_contents)) {
       const RegisterInfo *reg_info =
           GetRegisterInfoAtIndex(cfa_reg.GetAsKind(eRegisterKindLLDB));
       RegisterValue reg_value;
       if (reg_info) {
+        if (abi_sp)
+          cfa_reg_contents = abi_sp->FixDataAddress(cfa_reg_contents);
         Status error = ReadRegisterValueFromMemory(
             reg_info, cfa_reg_contents, reg_info->byte_size, reg_value);
         if (error.Success()) {
           address = reg_value.GetAsUInt64();
-          if (ABISP abi_sp = m_thread.GetProcess()->GetABI())
+          if (abi_sp)
             address = abi_sp->FixCodeAddress(address);
           UnwindLogMsg(
               "CFA value via dereferencing reg %s (%d): reg has val 0x%" PRIx64
               ", CFA value is 0x%" PRIx64,
               cfa_reg.GetName(), cfa_reg.GetAsKind(eRegisterKindLLDB),
               cfa_reg_contents, address);
           return true;
         } else {
           UnwindLogMsg("Tried to deref reg %s (%d) [0x%" PRIx64
                        "] but memory read failed.",
                        cfa_reg.GetName(), cfa_reg.GetAsKind(eRegisterKindLLDB),
                        cfa_reg_contents);
         }
       }
     }
     break;
   }
   case UnwindPlan::Row::FAValue::isRegisterPlusOffset: {
     RegisterNumber cfa_reg(m_thread, row_register_kind,
                            fa.GetRegisterNumber());
     if (ReadGPRValue(cfa_reg, cfa_reg_contents)) {
+      if (abi_sp)
+        cfa_reg_contents = abi_sp->FixDataAddress(cfa_reg_contents);
       if (cfa_reg_contents == LLDB_INVALID_ADDRESS || cfa_reg_contents == 0 ||
           cfa_reg_contents == 1) {
         UnwindLogMsg(
             "Got an invalid CFA register value - reg %s (%d), value 0x%" PRIx64,
             cfa_reg.GetName(), cfa_reg.GetAsKind(eRegisterKindLLDB),
             cfa_reg_contents);
         cfa_reg_contents = LLDB_INVALID_ADDRESS;
         return false;

 }
 
 lldb::addr_t RegisterContextUnwind::GetReturnAddressHint(int32_t plan_offset) {
   addr_t hint;
   if (!ReadGPRValue(eRegisterKindGeneric, LLDB_REGNUM_GENERIC_SP, hint))
     return LLDB_INVALID_ADDRESS;
   if (!m_sym_ctx.module_sp || !m_sym_ctx.symbol)
     return LLDB_INVALID_ADDRESS;
+  if (ABISP abi_sp = m_thread.GetProcess()->GetABI())
+    hint = abi_sp->FixCodeAddress(hint);
 
   hint += plan_offset;
 
   if (auto next = GetNextFrame()) {
     if (!next->m_sym_ctx.module_sp || !next->m_sym_ctx.symbol)
       return LLDB_INVALID_ADDRESS;
     if (auto expected_size =
             next->m_sym_ctx.module_sp->GetSymbolFile()->GetParameterStackSize(
bool RegisterContextUnwind::ReadGPRValue(lldb::RegisterKind register_kind,
   assert(reg_info);
   if (!reg_info) {
     UnwindLogMsg(
         "Could not find RegisterInfo definition for lldb register number %d",
         lldb_regnum);
     return false;
   }
 
+  uint32_t generic_regnum = LLDB_INVALID_REGNUM;
+  if (register_kind == eRegisterKindGeneric)
+    generic_regnum = regnum;
+  else
+    m_thread.GetRegisterContext()->ConvertBetweenRegisterKinds(
+        register_kind, regnum, eRegisterKindGeneric, generic_regnum);
+  ABISP abi_sp = m_thread.GetProcess()->GetABI();
+
   RegisterValue reg_value;
   // if this is frame 0 (currently executing frame), get the requested reg
   // contents from the actual thread registers
   if (IsFrameZero()) {
     if (m_thread.GetRegisterContext()->ReadRegister(reg_info, reg_value)) {
       value = reg_value.GetAsUInt64();
+      if (abi_sp && generic_regnum != LLDB_INVALID_REGNUM) {
+        if (generic_regnum == LLDB_REGNUM_GENERIC_PC ||
+            generic_regnum == LLDB_REGNUM_GENERIC_RA)
+          value = abi_sp->FixCodeAddress(value);
+        if (generic_regnum == LLDB_REGNUM_GENERIC_SP ||
+            generic_regnum == LLDB_REGNUM_GENERIC_FP)
+          value = abi_sp->FixDataAddress(value);
+      }
       return true;
     }
     return false;
   }
 
   bool pc_register = false;
-  uint32_t generic_regnum;
-  if (register_kind == eRegisterKindGeneric &&
-      (regnum == LLDB_REGNUM_GENERIC_PC || regnum == LLDB_REGNUM_GENERIC_RA)) {
-    pc_register = true;
-  } else if (m_thread.GetRegisterContext()->ConvertBetweenRegisterKinds(
-                 register_kind, regnum, eRegisterKindGeneric, generic_regnum) &&
-             (generic_regnum == LLDB_REGNUM_GENERIC_PC ||
-              generic_regnum == LLDB_REGNUM_GENERIC_RA)) {
+  if (generic_regnum != LLDB_INVALID_REGNUM &&
+       generic_regnum == LLDB_REGNUM_GENERIC_RA))
     pc_register = true;
-  }
 
   lldb_private::UnwindLLDB::RegisterLocation regloc;
   if (!m_parent_unwind.SearchForSavedLocationForRegister(
           lldb_regnum, regloc, m_frame_number - 1, pc_register)) {
     return false;
   }
   if (ReadRegisterValueFromRegisterLocation(regloc, reg_info, reg_value)) {
     value = reg_value.GetAsUInt64();
     if (pc_register) {
-      if (ProcessSP process_sp = m_thread.GetProcess()) {
-        if (ABISP abi = process_sp->GetABI())
-          value = abi->FixCodeAddress(value);
+      if (ABISP abi_sp = m_thread.GetProcess()->GetABI()) {
+        value = abi_sp->FixCodeAddress(value);
       }
     }
     return true;
   }
   return false;
 }
 
 bool RegisterContextUnwind::ReadGPRValue(const RegisterNumber &regnum,
if (!m_parent_unwind.SearchForSavedLocationForRegister(
           lldb_regnum, regloc, m_frame_number - 1, is_pc_regnum))
     return false;
 
   bool result = ReadRegisterValueFromRegisterLocation(regloc, reg_info, value);
   if (result) {
     if (is_pc_regnum && value.GetType() == RegisterValue::eTypeUInt64) {
       addr_t reg_value = value.GetAsUInt64(LLDB_INVALID_ADDRESS);
       if (reg_value != LLDB_INVALID_ADDRESS) {
-        if(ProcessSP process_sp = m_thread.GetProcess()) {
-          if (ABISP abi = process_sp->GetABI())
-            value = abi->FixCodeAddress(reg_value);
-        }
+        if (ABISP abi_sp = m_thread.GetProcess()->GetABI())
+          value = abi_sp->FixCodeAddress(reg_value);
       }
     }
   }
   return result;
 }
 
 bool RegisterContextUnwind::WriteRegister(const RegisterInfo *reg_info,
                                           const RegisterValue &value) {
bool RegisterContextUnwind::GetStartPC(addr_t &start_pc) {
 
   if (!m_start_pc.IsValid()) {
         bool read_successfully = ReadPC (start_pc);
         if (read_successfully)
         {
             ProcessSP process_sp (m_thread.GetProcess());
             if (process_sp)
             {
-                ABI *abi = process_sp->GetABI().get();
-                if (abi)
-                    start_pc = abi->FixCodeAddress(start_pc);
+              if (ABISP abi_sp = process_sp->GetABI())
+                start_pc = abi_sp->FixCodeAddress(start_pc);
             }
         }
         return read_successfully;
   }
   start_pc = m_start_pc.GetLoadAddress(CalculateTarget().get());
   return true;
 }
 
bool RegisterContextUnwind::ReadPC(addr_t &pc) {
   if (ReadGPRValue(eRegisterKindGeneric, LLDB_REGNUM_GENERIC_PC, pc)) {
     // A pc value of 0 or 1 is impossible in the middle of the stack -- it
     // indicates the end of a stack walk.
     // On the currently executing frame (or such a frame interrupted
     // asynchronously by sigtramp et al) this may occur if code has jumped
     // through a NULL pointer -- we want to be able to unwind past that frame
     // to help find the bug.
 
-    ProcessSP process_sp (m_thread.GetProcess());
-    if (process_sp)
-    {
-        ABI *abi = process_sp->GetABI().get();
-        if (abi)
-            pc = abi->FixCodeAddress(pc);
-    }
+    if (ABISP abi_sp = m_thread.GetProcess()->GetABI())
+      pc = abi_sp->FixCodeAddress(pc);
 
     return !(m_all_registers_available == false &&
              above_trap_handler == false && (pc == 0 || pc == 1));
   } else {
     return false;
   }
 }