When resuming execution, DW_CFA_GNU_args_size from the current frame
must be added back to the stack pointer. Clang now generates these frequently
at -O3. A simple repro for x86_64, that will crash with clang ~3.9 or newer:
void f(int, int,int,int,int,int,int,int,int);
int main() {
try {
f(0,1,2,3,4,5,6,7,8);
} catch (int) {
return 0;
}
return 1;
}
Where f is something that throws an int, but in a different translation unit to
prevent optimization.
This results in cfi instructions before the call:
.cfi_escape 0x2e, 0x20
Grabbing the args_size means fully parsing the cfi in the current frame, which
is unfortunate because it means nearly twice the work at each step. The logic
to grab args_size can be in unw_step or get_proc_info (since this is always
called before resuming in stack unwinding). Putting it in get_proc_info allows
the more common unw_step code to remain fast.
It would potentially fit in nicely with a proc info cache (as mentioned in the
if0 comment block)
GCC versions 4.9~current will often generate stack alignment prologues like:
lea 0x8(%rsp),%r10
and $0xfffffffffffffff0,%rsp
...
push %rbp
mov %rsp, %rbp
push %r10
resulting in dwarf expressions:
DW_CFA_def_cfa_expression (DW_OP_breg6: -8; DW_OP_deref)
DW_CFA_expression: r6 (rbp) (DW_OP_breg6: 0)
These prologues seem to be generated for SSE/AVX code, but sometimes
other times as well.
tdep_trace fastpath currently falls back to the slow dwarf parsing path
if it encounters any cfa_expressions. Unfortunately this is happening
often enough in our codebase to cause perf issues. We could also fix the
fallback path (make the rs cache bigger, lock-free instead of locking, etc),
but that seems like a separate issue, and it will ever be as fast as the tracing
code. Our binaries each have at least ~100 functions in them like this.
This patch teaches the tdep_trace about the two specific cfa_expressions,
which really just result in a single extra memory dereference of the stack
at a fixed offset from rbp.
next = inote.descdata + align_power (inote.descsz, 2);
this align is missing, leading to parsing errors. In one case
libunwind only found 1 thread out of 4.
Improves support for binaries missing the GNU_EH_FRAME segment
(.eh_frame_hdr section) by adding a function
'dwarf_find_eh_frame_section' that can create a synthetic one.
If we don't link to libexecinfo, as detected by the
AC_SEARCH_LIBS(backtrace, execinfo) configure probe, we get
```
test-coredump-unwind.o: In function `handle_sigsegv':
/home/libunwind/tests/test-coredump-unwind.c:246: undefined reference to
`backtrace_symbols_fd'
collect2: error: ld returned 1 exit status
Makefile:1187: recipe for target 'test-coredump-unwind' failed
```
and
```
Gtest-init.o: In function `do_backtrace()':
Gtest-init.cxx:(.text+0x2f): undefined reference to `_Ux86_64_getcontext'
Gtest-init.cxx:(.text+0x48): undefined reference to `_Ux86_64_init_local'
Gtest-init.cxx:(.text+0x63): undefined reference to `_Ux86_64_get_reg'
Gtest-init.cxx:(.text+0x96): undefined reference to `_Ux86_64_get_proc_name'
Gtest-init.cxx:(.text+0x171): undefined reference to `_Ux86_64_step'
collect2: error: ld returned 1 exit status
Makefile:1063: recipe for target 'Gtest-init' failed
```
There are 2 XFAIL and 6 FAIL tests, but it's a start
unw_is_signal_frame() returns <= 0 if not a signal frame. Several places in
code were only checking for a "if (unw_is_signal_frame())", or
"if (!unw_is_signal_frame())".
Add dummy assign statements at the top so we don't have to trace all
the different if paths to see where the value is initially assigned.
Now all code paths just append it.
This fixes GCC 4.9.3 warnings (Linux/mipsel):
dwarf/Gfind_proc_info-lsb.c: In function 'locate_debug_info':
dwarf/Gfind_proc_info-lsb.c:244:23: warning: 'mi.buf_end' may be used
uninitialized in this function [-Wmaybe-uninitialized]
struct map_iterator mi;
^
dwarf/Gfind_proc_info-lsb.c:244:23: warning: 'mi.buf' may be used
uninitialized in this function [-Wmaybe-uninitialized]
In file included from dwarf/Gfind_proc_info-lsb.c:46:0:
./os-linux.h:292:27: warning: 'mi.buf_size' may be used uninitialized in
this function [-Wmaybe-uninitialized]
munmap (mi->buf_end - mi->buf_size, mi->buf_size);
^
dwarf/Gfind_proc_info-lsb.c:244:23: note: 'mi.buf_size' was declared here
struct map_iterator mi;
^
It looks like the dynamic frame support isn't fully baked on
non-ia64, leading to lots of mailing list comments about broken
tests (even though they're marked as supposed to fail, it's still
confusing).
The detection logic introduced in 28f33c8ce0 is
broken, because it tests mincore using an address that is almost certainly not
page-aligned. straces confirms that msync is used all the time.
This patch fixes the logic by page-aligning the test pointer. strace now shows
that mincore is actually used. Furthermore, the return value of mincore is not
sufficient to assess whether the address can be safely dereferenced: we should
also check that the pages are mapped, through the passed mvec array. This patch
also adds this verification.
Tested on a system where unwinding a stack across a JNI boundary would cause
sporadic segfaults; no more crashes were observed after the patch.
A recent commit added code to override the unwind location for the
TOC pointer register r2:
unsigned int *inst = (unw_word_t*)c->dwarf.ip;
if (*inst == (0xE8410000 + 24)) {
// @plt call, restoring R2 from CFA+24
c->dwarf.loc[UNW_PPC64_R2] = DWARF_LOC(c->dwarf.cfa + 24, 0);
}
It is correct that such code is needed, since DWARF CFI does not
describe the unwind location for r2 on PowerPC. However, this
particular bit of code has a number of issues, which are fixed
in this patch.
First of all, the location CFA+24 is correct only for the ELFv2
ABI. In the ELFv1 ABI, the TOC location is actually CFA+40.
More problematically, attempting to read the current instruction
by just dereferencing the address in c->dwarf.ip is wrong, and
may often lead to crashes. In particular:
- During remote unwinding, this is always wrong since we're in
the wrong address space. I've used the fetch32 helper from
remote.h to use the proper access_mem under the covers.
- c->dwarf.ip may be NULL if we've reached the end-of-stack.
I've fixed this by moving the c->dwarf.ip == 0 check down
to after unwinding (instead of before), just like all other
platforms do.
- Even so, c->dwarf.ip may point to some random location if
we've gotten confused during unwinding earlier. One likely
cause for such confusion is that we did not find DWARF CFI
for some earlier frame and attempted to use the stack
backchain. The problem is that this code currently claims
all registers remain unchanges in such a frame, which is
generally wrong. In particular if the function actually
saves and modifies r31, and this is used as frame pointer
by a later frame, things will likely go quite wrong. While
it is not really possibly to completely fix this, I've at
least marked all registers as unavailable after unwinding
a frame via stack backchain.
Tested on powerpc64-linux and powerpc64le-linux. The patch fixes
about a dozen test cases that were crashing before.
Signed-off-by: Ulrich Weigand <ulrich.weigand@de.ibm.com>
By default, the start_ip_offset in libunwind's table_entry struct is
relative to the unw_dyn_info_t's segbase. This presents a problem
for us in conjunction with using LLVM's MCJIT because it likes to
spread text sections and the corresponding eh_frame sections quite
far apart. This represents my attempt to support this use case in the
simplest manner that is backwards compatible, by adding a new format
kind (UNW_INFO_FORMAT_REMOTE_TABLE2) that indicates that the
`start_ip_offset` should be interpreted as relative to `start_ip`
rather than segbase.
Detect if current frame is a signal frame by checking for preceeding
syscall instruction. For signal frames, update the cursor correctly
from user context before calling dwarf_step.
This is similar to commit c90a2e02b3
"Mark run-ptrace-mapper and run-ptrace-misc as XFAIL on MIPS".
Starting with 2.6.39, ARM Linux returns -EIO for PTRACE_SINGLESTEP, so
we need to mark this as XFAIL for ARM too.
The Linux commit that changed this is
commit 425fc47adb5bb69f76285be77a09a3341a30799e
Author: Will Deacon <will.deacon@arm.com>
Date: Mon Feb 14 14:31:09 2011 +0100
ARM: 6668/1: ptrace: remove single-step emulation code
see: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=425fc47adb5bb69f76285be77a09a3341a30799e
Signed-off-by: Gregory Fong <gregory.0xf0@gmail.com>
Due to a bug in the gold linker[1], the .eh_frame and .eh_frame_hdr
sections contains garbage. When dwarf_extract_proc_info_from_fde tried
to look up the begin of the CIE subsection, it would underflow the
.eh_frame segment, resulting in a crash[2].
This patch avoids that crash by checking whether the CIE pointer is
located after the begin of the .eh_frame section. The variable "base"
was misused in various places as a boolean (decode as .debug_frame or
decode as .eh_frame). These instances have been renamed to
is_debug_frame where applicable.
Tested on Linux x86_64.
[1]: https://sourceware.org/bugzilla/show_bug.cgi?id=17639
[2]: http://lists.nongnu.org/archive/html/libunwind-devel/2014-11/msg00009.html
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
- Add autogen.sh to bootstrap autotools generation
- Make generation of man pages optional, and check for
availibity of latex2man if documentation is requested.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Signed-off-by: Arun Sharma <asharma@fb.com>
Set local_addr_space.big_endian flag according to current target
endianness. Before it was set by memset to 0, which corresponds
to little endian and it worked perfectly fine for aarch64.
But it breaks aarch64_be because dwarf_readu16, dwarf_readu32,
etc functions do not read values correctly since they operate
with wrong idea about current target endianness.
Signed-off-by: Victor Kamensky <victor.kamensky@linaro.org>
Introduce support for aarch64_be, aarch64 big endian, target.
We would like to reuse all code that was done for aarch64
(little endian) target. So we do similar thing that is done
for ARM v7 (arm) target for any aarch64* arch we set it
just to aarch64.
Signed-off-by: Victor Kamensky <victor.kamensky@linaro.org>
Though PTRACE_SINGLESTEP is defined on MIPS Linux, the kernel does
not support that kind of request. The ptrace call failed and sets
errno to EIO and paused process is not resumed. In case of
run-ptrace-mapper and run-ptrace-misc this leads to hanged execution
because next call to wait4 never returns.
This change adds run-ptrace-mapper and run-ptrace-misc to the list
of 'expected failed' tests on MIPS targets.
Signed-off-by: Simon Atanasyan <simon@atanasyan.com>
We've just traced a large memory increase to that patch (Google ref:
b/18069427).
It appears that labs() was there for a good reason.
Sorry about that :-(
For the curious:
unsigned long u1 = ~0UL;
unsigned long u2 = labs(u1);
assert(u1 != u2); // labs on unsigned *may* have an effect, despite
what Clang says.
Attached patch suppresses the Clang warning, while still keeping the
original behavior (which I believe to be correct).
Thanks,
--
Paul Pluzhnikov
After the following change the Lrs-race test case starts to intermittently
fails:
eac65dc Add basic support for the QNX operating system
When we include "config.h" into the "libunwind_i.h" we undefine
the HAVE___THREAD macro in a few lines below in #include "config.h"
pragma. The change eac65dc includes "config.h" into the "dwarf.h"
but forgets to undefine HAVE___THREAD. So now this macro has inconsistent
state among the code. Somewhere it is defined, somewhere not. In particular
it becomes defined in the mi/Gset_caching_policy.c and we do not replace
UNW_CACHE_PER_THREAD caching policy by the UNW_CACHE_GLOBAL.
The fix is rather dirty. It adds the code to undefine HAVE___THREAD in
the "dwarf.h" like we do that in the "libunwind_i.h". Probably the ideal
solution should fix per-thread caching implementation or turned it off
at all on platforms where it is not completely and correctly supported.
Signed-off-by: Simon Atanasyan <simon@atanasyan.com>
Hi,
there is a compilation issue with Clang and latest libunwind - It's
about "typedef struct unw_tdep_save_loc" and one more struct:
include/libunwind-x86_64.h:111:9: error: empty struct has size 0 in C,
size 1 in C++ [-Werror,-Wextern-c-compat]
The solution is very simple:
Greetings,
Roman reports that Clang warns on unnecessary calls to labs():
taking the absolute value of unsigned type 'unw_word_t' (aka
'unsigned long') has no effect [-Werror,-Wabsolute-value]
Since rs->reg[...].val is unw_word_t and unsigned on all platforms,
this patch removes the unnecessary calls to labs().
Tested on Linux x86_64, no regressions.
Thanks,
--
Paul Pluzhnikov
Fix returning the name of the function containing the frame PC,
for the non-interrupted frames. The symbol lookup code should
take use_prev_instr value into account, otherwise it could return
the name of the function adjacent to the caller.
Mark frames which are unwound with the frame-chain walker or
syscall frame code, as non-interrupted. The return PC in the frame
points to the instruction after the call.
For some architectures, -lgcc and -lgcc_s are not equivalent. On ARM for
example, libgcc_s.so.1 contains some symbols needed by libunwind which
are not present in libgcc.
This causes the following link error when building the X.Org X server
with libunwind support:
CCLD Xorg
/usr/lib/libunwind.so: undefined reference to `__aeabi_unwind_cpp_pr0'
/usr/lib/libunwind.so: undefined reference to `__aeabi_unwind_cpp_pr1'
Linking against libgcc_s explicitly solves this problem.
Signed-off-by: Thierry Reding <treding@nvidia.com>
We already have the value computed based on the executable. Furthermore,
debuginfo need not have valid program header table, thus the result
might be bogus.
Signed-off-by: Martin Milata <mmilata@redhat.com>
When JITs generate code without unwind information, it may be possible
to continue unwinding via RBP chaining. However, we currently disallow
RBP==RSP condition even though we can make forward progress.
Relax the check a bit in the code where we switch from one type of
unwinding to another to handle this situation. JIT authors
are encouraged to use the dynamic unwind info registration API when
the underlying platform supports it.
Signed-off-by: Kevin Modzelewski <kmod@dropbox.com>
