Fix up hijacking on arm32 (preserve async continuation register) #123526

eduardo-vp · 2026-01-23T04:47:46Z

The original PR #123057 led to some crashes in the outerloop runs so was reverted in #123474.

Given the code in

runtime/src/coreclr/nativeaot/Runtime/StackFrameIterator.cpp

Lines 171 to 187 in 0b9b34d

    
           #ifdef TARGET_ARM 
        
               m_RegDisplay.pLR = (PTR_uintptr_t)PTR_HOST_MEMBER_TADDR(PInvokeTransitionFrame, pFrame, m_RIP); 
        
               if (pFrame->m_Flags & PTFF_SAVE_R4)  { m_RegDisplay.pR4 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_R5)  { m_RegDisplay.pR5 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_R6)  { m_RegDisplay.pR6 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_R7)  { m_RegDisplay.pR7 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_R8)  { m_RegDisplay.pR8 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_R9)  { m_RegDisplay.pR9 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_R10)  { m_RegDisplay.pR10 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_SP)  { m_RegDisplay.SP  = *pPreservedRegsCursor++; } 
        
               m_RegDisplay.pR11 = (PTR_uintptr_t) PTR_HOST_MEMBER_TADDR(PInvokeTransitionFrame, pFrame, m_FramePointer); 
        
               if (pFrame->m_Flags & PTFF_SAVE_R0)  { m_RegDisplay.pR0 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_R1)  { m_RegDisplay.pR1 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_R2)  { m_RegDisplay.pR2 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_R3)  { m_RegDisplay.pR3 = pPreservedRegsCursor++; } 
        
               if (pFrame->m_Flags & PTFF_SAVE_LR)  { m_RegDisplay.pLR = pPreservedRegsCursor++; }

I think the stack has r0, r1, r2 but without the PTFF_SAVE_R1 flag, r1 gets skipped and PTFF_SAVE_R2 is actually used to preserve r1 instead.

…net#123057) Flag r2 (see [async calling convention](https://github.com/dotnet/runtime/blob/main/docs/design/coreclr/botr/clr-abi.md#returning-continuation)) during GC as it might contain an async continuation. Contributes to dotnet#122492. --------- Co-authored-by: Eduardo Velarde <[email protected]> Co-authored-by: Jan Kotas <[email protected]>

dotnet-policy-service · 2026-01-23T04:51:31Z

Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR fixes ARM32 hijacking during GC to properly preserve the async continuation register (r2). The original code only saved r0 and r1 during hijacking, but ARM32's async calling convention uses r2 to return continuations (as documented in the CLR ABI). Without this fix, async continuations could be lost during GC, leading to incorrect behavior.

Changes:

Added flag definitions for PTFF_SAVE_R1 and PTFF_SAVE_R2 to enable saving these registers during hijacking
Modified GC probe frame to save and restore r0-r2 (was r0-r1) to preserve the async continuation register
Updated stack frame layout calculations and alignment to accommodate the additional saved register

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/coreclr/nativeaot/Runtime/unix/unixasmmacrosarm.inc	Added PTFF_SAVE_R1 and PTFF_SAVE_R2 flag definitions matching PInvokeTransitionFrameFlags enum
src/coreclr/nativeaot/Runtime/arm/GcProbe.S	Updated PUSH_PROBE_FRAME, POP_PROBE_FRAME, and FixupHijackedCallstack macros to save/restore r0-r2, adjusted stack frame size from 88 to 96 bytes with proper 8-byte alignment, and updated RhpGcProbeHijack to set the new flags

MichalStrehovsky · 2026-01-23T06:14:45Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2026-01-23T06:15:03Z

Azure Pipelines successfully started running 1 pipeline(s).

jkotas · 2026-01-23T20:33:42Z

Outer loop has a lot of crashes on linux arm32 that are likely caused by the PR

eduardo-vp · 2026-01-23T21:15:37Z

Outer loop has a lot of crashes on linux arm32 that are likely caused by the PR

I think that's likely. Is there a better way to check the changes than running the outerloop pipeline by any chance?

jkotas · 2026-01-23T23:10:45Z

You can run NAOT-compiled linux arm32 binarier under qemu using docker (using same image as what's used in CI). For example, I have just done the following to reproduce the crash:

runfo get-helix-payload -j 201029a5-27fd-4db8-a0b2-4ae69bf23f10 -w System.Runtime.Tests -o c:\helix_payload
docker run -it --privileged --cap-add=SYS_PTRACE -v c:\helix_payload:/helix_payload mcr.microsoft.com/dotnet-buildtools/prereqs:debian-13-helix-arm32v7
cd helix_payload/workitems/System.Runtime.Tests
./System.Runtime.Tests

To test your local changes, you can build your changes and the failing test in arm32 cross-build image (same image as what's used by the CI): https://github.com/dotnet/runtime/blob/main/docs/workflow/using-docker.md , and then run them under docker/qemu using the flow from my previous point.
Getting working debugger on arm32 with qemu is close to impossible. If you really want to have a working debugger on arm32, I had the best success with a 32-bit Raspberry Pi.

jkotas · 2026-01-23T23:16:00Z

I think the stack has r0, r1, r2 but without the PTFF_SAVE_R1 flag, r1 gets skipped and PTFF_SAVE_R2 is actually used to preserve r1 instead.

Looking at this code, is there a problem with where the alignment that gets inserted between SP and R0? I think the alignment needs to be inserted above r2, so that sp and r0 are next to each other to match this code.

eduardo-vp · 2026-01-24T00:42:42Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2026-01-24T00:42:53Z

Azure Pipelines successfully started running 1 pipeline(s).

jkotas · 2026-01-24T02:09:01Z

/azp run runtime-nativeaot-outerloop

azure-pipelines · 2026-01-24T02:09:11Z

Azure Pipelines successfully started running 1 pipeline(s).

eduardo-vp and others added 2 commits January 22, 2026 19:56

Save R1 too

0d7c939

eduardo-vp requested a review from MichalStrehovsky as a code owner January 23, 2026 04:47

Copilot AI review requested due to automatic review settings January 23, 2026 04:47

github-actions bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Jan 23, 2026

dotnet-policy-service bot assigned eduardo-vp Jan 23, 2026

Copilot started reviewing on behalf of eduardo-vp January 23, 2026 04:48 View session

eduardo-vp added area-NativeAOT-coreclr runtime-async and removed needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Jan 23, 2026

Copilot AI reviewed Jan 23, 2026

View reviewed changes

build-analysis bot mentioned this pull request Jan 23, 2026

Unable to pull image from mcr.microsoft.com #117164

Open

eduardo-vp changed the title ~~Merged Fix up hijacking on arm32 (preserve async continuation register)~~ Fix up hijacking on arm32 (preserve async continuation register) Jan 23, 2026

build-analysis bot mentioned this pull request Jan 23, 2026

Illegal memory access in System.Runtime.Extensions.Tests #122867

Open

Place alignment above r2

5a419a7

Merge branch 'main' into hijack-arm32

09394f7

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix up hijacking on arm32 (preserve async continuation register) #123526

Fix up hijacking on arm32 (preserve async continuation register) #123526

eduardo-vp commented Jan 23, 2026 •

edited

Loading

Uh oh!

dotnet-policy-service bot commented Jan 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

MichalStrehovsky commented Jan 23, 2026

Uh oh!

azure-pipelines bot commented Jan 23, 2026

Uh oh!

jkotas commented Jan 23, 2026

Uh oh!

eduardo-vp commented Jan 23, 2026

Uh oh!

jkotas commented Jan 23, 2026 •

edited

Loading

Uh oh!

jkotas commented Jan 23, 2026

Uh oh!

eduardo-vp commented Jan 24, 2026

Uh oh!

azure-pipelines bot commented Jan 24, 2026

Uh oh!

jkotas commented Jan 24, 2026

Uh oh!

azure-pipelines bot commented Jan 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	#ifdef TARGET_ARM
	m_RegDisplay.pLR = (PTR_uintptr_t)PTR_HOST_MEMBER_TADDR(PInvokeTransitionFrame, pFrame, m_RIP);

	if (pFrame->m_Flags & PTFF_SAVE_R4) { m_RegDisplay.pR4 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_R5) { m_RegDisplay.pR5 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_R6) { m_RegDisplay.pR6 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_R7) { m_RegDisplay.pR7 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_R8) { m_RegDisplay.pR8 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_R9) { m_RegDisplay.pR9 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_R10) { m_RegDisplay.pR10 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_SP) { m_RegDisplay.SP = *pPreservedRegsCursor++; }
	m_RegDisplay.pR11 = (PTR_uintptr_t) PTR_HOST_MEMBER_TADDR(PInvokeTransitionFrame, pFrame, m_FramePointer);
	if (pFrame->m_Flags & PTFF_SAVE_R0) { m_RegDisplay.pR0 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_R1) { m_RegDisplay.pR1 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_R2) { m_RegDisplay.pR2 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_R3) { m_RegDisplay.pR3 = pPreservedRegsCursor++; }
	if (pFrame->m_Flags & PTFF_SAVE_LR) { m_RegDisplay.pLR = pPreservedRegsCursor++; }

Fix up hijacking on arm32 (preserve async continuation register) #123526

Are you sure you want to change the base?

Fix up hijacking on arm32 (preserve async continuation register) #123526

Conversation

eduardo-vp commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dotnet-policy-service bot commented Jan 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

MichalStrehovsky commented Jan 23, 2026

Uh oh!

azure-pipelines bot commented Jan 23, 2026

Uh oh!

jkotas commented Jan 23, 2026

Uh oh!

eduardo-vp commented Jan 23, 2026

Uh oh!

jkotas commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkotas commented Jan 23, 2026

Uh oh!

eduardo-vp commented Jan 24, 2026

Uh oh!

azure-pipelines bot commented Jan 24, 2026

Uh oh!

jkotas commented Jan 24, 2026

Uh oh!

azure-pipelines bot commented Jan 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

eduardo-vp commented Jan 23, 2026 •

edited

Loading

jkotas commented Jan 23, 2026 •

edited

Loading