Unwinding over ptrace and unwinding coredump fail to lookup the
.debug_frame dwarf data when the ELF file text segment virtual address
is non-zero. Looking at some binaries, the virtual address is non-zero
for non-pie binaries, and zero for PIC shared libraries and PIE
executables.
The core dump unwinder can be used for demonstrating the bug. Without
this patch, the unwinding fails badly (testing with a ARM qemu image):
$ UNW_ARM_UNWIND_METHOD=1 ./test-coredump-unwind core `cat backing_files`
test-coredump-unwind: unw_get_proc_info(ip=0x86d8) failed: ret=-10
After applying this patch, we can unwind all the way until running out
of dwarf data:
$ UNW_ARM_UNWIND_METHOD=1 ./test-coredump-unwind core `cat backing_files`
ip=0x000086d8 proc=000086d4-000086dc handler=0x00000000 lsda=0x00000000
test-coredump-unwind: step
test-coredump-unwind: step done:1
ip=0x000086ef proc=000086dc-000086f2 handler=0x00000000 lsda=0x00000000
test-coredump-unwind: step
test-coredump-unwind: step done:1
ip=0x000086e7 proc=000086dc-000086f2 handler=0x00000000 lsda=0x00000000
test-coredump-unwind: step
test-coredump-unwind: step done:1
ip=0x00008597 proc=00008584-0000859a handler=0x00000000 lsda=0x00000000
test-coredump-unwind: step
test-coredump-unwind: step done:1
ip=0x76eacc3b proc=76eacba0-76eaccec handler=0x00000000 lsda=0x00000000
test-coredump-unwind: step
test-coredump-unwind: step done:1
test-coredump-unwind: unw_get_proc_info(ip=0x85c3) failed: ret=-10
Note how the binary itself is mapped to address 0x8000, the virtual
address for the text segment is 0x8000, and the .debug_frame program
counter values are relative to 0:
$ tr ' ' '\n' < backing_files
0x8000:/home/user/tests/crasher
0x76e96000:/lib/arm-linux-gnueabi/libc-2.13.so
0x76f77000:/lib/arm-linux-gnueabi/libgcc_s.so.1
0x76f88000:/lib/arm-linux-gnueabi/ld-2.13.so
$ readelf -l crasher
Elf file type is EXEC (Executable file)
Entry point 0x859d
There are 9 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
EXIDX 0x0007b0 0x000087b0 0x000087b0 0x00030 0x00030 R 0x4
PHDR 0x000034 0x00008034 0x00008034 0x00120 0x00120 R E 0x4
INTERP 0x000154 0x00008154 0x00008154 0x00013 0x00013 R 0x1
[Requesting program interpreter: /lib/ld-linux.so.3]
LOAD 0x000000 0x00008000 0x00008000 0x007e4 0x007e4 R E 0x8000
LOAD 0x000efc 0x00010efc 0x00010efc 0x00148 0x00154 RW 0x8000
DYNAMIC 0x000f08 0x00010f08 0x00010f08 0x000f8 0x000f8 RW 0x4
NOTE 0x000168 0x00008168 0x00008168 0x00044 0x00044 R 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4
GNU_RELRO 0x000efc 0x00010efc 0x00010efc 0x00104 0x00104 R 0x1
$ readelf --debug-dump=frames crasher | grep FDE
00000010 00000024 00000000 FDE cie=00000000 pc=00008614..000086d4
00000038 0000000c 00000000 FDE cie=00000000 pc=000086d4..000086dc
00000048 00000014 00000000 FDE cie=00000000 pc=000086dc..000086f2
00000060 00000014 00000000 FDE cie=00000000 pc=00008584..0000859a
After successfully stepping the cursor on ARM, the proc info is
invalidated only in dwarf_step(). Invalidate the proc info also when
stepping with the non-dwarf based methods. This fixes
unw_get_proc_info() returning stale data.
The core dump unwinder can be used for demonstrating the bug. When
unwinding based only on DWARF data, the proc info is correct:
$ UNW_ARM_UNWIND_METHOD=1 ./test-coredump-unwind core `cat backing_files` 2>/dev/null
ip=0x000086d8 proc=000086d4-000086dc handler=0x00000000 lsda=0x00000000
ip=0x000086ef proc=000086dc-000086f2 handler=0x00000000 lsda=0x00000000
ip=0x000086e7 proc=000086dc-000086f2 handler=0x00000000 lsda=0x00000000
ip=0x00008597 proc=00008584-0000859a handler=0x00000000 lsda=0x00000000
ip=0x76e3ac3b proc=76e3aba0-76e3acec handler=0x00000000 lsda=0x00000000
When unwinding based only on the exidx method, we see the proc info
lagging behind:
$ UNW_ARM_UNWIND_METHOD=4 ./test-coredump-unwind core `cat backing_files` 2>/dev/null
ip=0x000086d8 proc=000086d4-000086db handler=0x00000000 lsda=0x00000000
ip=0x000086ef proc=000086d4-000086db handler=0x00000000 lsda=0x00000000
ip=0x000086e7 proc=000086dc-000086f3 handler=0x00000000 lsda=0x00000000
ip=0x00008597 proc=000086dc-000086f3 handler=0x00000000 lsda=0x00000000
ip=0x76e3ac3b proc=00008584-0000859b handler=0x00000000 lsda=0x00000000
ip=0x000085c3 proc=76e3aba0-76e3ae4b handler=0x00000000 lsda=0x00000000
Finally, with this patch applied, we get the desired proc info also with
the exidx unwinder:
$ UNW_ARM_UNWIND_METHOD=4 ./test-coredump-unwind core `cat backing_files` 2>/dev/null
ip=0x000086d8 proc=000086d4-000086db handler=0x00000000 lsda=0x00000000
ip=0x000086ef proc=000086dc-000086f3 handler=0x00000000 lsda=0x00000000
ip=0x000086e7 proc=000086dc-000086f3 handler=0x00000000 lsda=0x00000000
ip=0x00008597 proc=00008584-0000859b handler=0x00000000 lsda=0x00000000
ip=0x76e3ac3b proc=76e3aba0-76e3ae4b handler=0x00000000 lsda=0x00000000
ip=0x000085c3 proc=0000859c-00008613 handler=0x00000000 lsda=0x00000000
Implement the Linux version of _UCD_access_reg() for ARM. We can
sidestep the register number remapping, as the libunwind register
numbers match one-to-one to the ELF core file register numbers.
As far as I can tell, AC_FUNC_MEMCMP is useless for us. It checks for
some obscure `memcmp' bugs on some ancient systems, and gives us a
chance to provide a working `memcmp'. Since we're not shipping with a
local copy of a `memcmp', it makes no difference whether or not the test
fails. And when cross-compiling, the test automatically fails, as it
tries to compile and run a test program:
checking for working memcmp... no
Quoting autoconf docs: ``This macro is obsolescent, as current systems
have a working memcmp. New programs need not use this macro.''
test-varargs is checking how `backtrace()' provided by the system
behaves when varargs are used. Let's make the test more useful by
changing it to test the `backtrace()' provided by libunwind.
Change the testcase to return 0/1 for success/failure, and add it to the
set of checks, so that it gets run on `make check'. Also call
`unw_backtrace()' explicitly so that we do not need to bother with
`execinfo.h' and `backtrace()' prototype.
Just pass potentially NULL pointers to free() in the error path in
load_debug_frame(). Saved 40 bytes of code in libunwind.so on ARM -O2
thumb build at the expense of slightly slower execution.
Stop pretending that unw_get_proc_info() works on PPC, and instead give
an error back to the caller. As far as I can tell, none of the libunwind
tests clear out the `unw_proc_info_t' before passing it to
unw_get_proc_info(), so they would end up working on garbage data.
ppc32/Gstep.c:116: warning: comparison between pointer and integer
ppc32/Gstep.c:116: warning: comparison with string literal results in unspecified behavior
ppc32/Gstep.c:116: warning: initialization makes integer from pointer without a cast
ppc32/Gstep.c:116: warning: passing argument 2 of 'fprintf' makes pointer from integer without a cast
/usr/powerpc-linux-gnu/include/stdio.h:333: note: expected 'const char *__restrict__' but argument is of type 'int'
Fix bitrot in HPPA common_init(). This has only been compile tested.
hppa/init.h: In function 'common_init':
hppa/init.h:33: error: 'struct cursor' has no member named 'ip_loc'
hppa/init.h:33: warning: implicit declaration of function 'HPPA_REG_LOC'
hppa/init.h:34: error: 'struct cursor' has no member named 'sp_loc'
hppa/init.h:36: warning: implicit declaration of function 'hppa_get'
hppa/init.h:36: error: 'struct cursor' has no member named 'ip_loc'
hppa/init.h:36: error: 'struct cursor' has no member named 'ip'
hppa/init.h:40: error: 'struct cursor' has no member named 'sp'
Fixup commit 39b83981 ("Flush icache with __builtin___clear_cache() in
tests when compiling with GCC") to fix compilation with older GCC
versions that do not provide __builtin___clear_cache().
When compiling with GCC, use the builtin instruction cache flushing
mechanism in all tests where it is needed.
Quoting GCC docs: ''If the target does not require instruction cache
flushes, __builtin___clear_cache has no effect. Otherwise either
instructions are emitted in-line to clear the instruction cache or a
call to the __clear_cache function in libgcc is made.''.
Introduce a new test case that is derived from test-resume-sig, but
using the SA_SIGINFO sigaction() flag. This case is referred in the
linux kernel sources as "realtime" signal handler, and is handled
differently in the kernel on many architectures and in libunwind as
well.
When cross-compiling libunwind with optimizations (-O1 or higher),
gcc-4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5) optimizes away the memory
writes prior to the inline asm() statement in arm_local_resume() in the
non-signal-frame path, causing the `regs' array to be only allocated on
the stack, but not populated. This means that we are restoring garbage
to the registers.
As suggested in the GCC docs, add a fixed size input memory constraint
for the array content. This is enough to get the desired code to be
generated.
Adding __builtin_unreachable() to the point that we should never reach
was also in itself enough to inhibit the optimization. It also reduces
the function size by a few instructions.
Check the endianness earlier in unw_create_addr_space() on all
architectures to avoid leaking the dynamically allocated address space
struct.
This was already fixed for ARM in commit cf6a998796 ("Fix memory leak
in ARM unw_create_addr_space()"). Move the endianness check also on ARM
to avoid malloc() & free() in the error case.
GCC is complaining about the `%*jx' match in sscanf() format string.
Replace it with `%*x'; sscanf() will identically match an unsigned
hexadecimal integer without the length modifier.
crasher.c: In function 'write_maps':
crasher.c:30:9: warning: use of assignment suppression and length modifier together in gnu_scanf format [-Wformat]
For a few of the supported architectures we can use one-to-one mapping
from the dwarf to the libunwind register numbers. Allow the
architectures to define their own dwarf_to_unw_regnum() macro to do this
easily.
Properly export the symbol names also on MIPS. `make check' was
complaining:
src/.libs/libunwind.a(Linit.o): In function `mips_local_addr_space_init':
src/mips/Ginit.c:183: multiple definition of `mips_local_addr_space_init'
../src/.libs/libunwind-mips.a(Ginit.o):src/mips/Ginit.c:183: first defined here
src/.libs/libunwind.a(Lglobal.o): In function `_ULmips_init':
src/mips/Gglobal.c:42: multiple definition of `mips_lock'
../src/.libs/libunwind-mips.a(Gglobal.o):src/mips/Gglobal.c:42: first defined here
collect2: ld returned 1 exit status
Compiling the tests with -Wextra results to lots of warnings for unused
parameters. Annotate these cases with the `unused' attribute to avoid
the warnings.
In file included from mi/Lput_dynamic_unwind_info.c:4:
mi/Gput_dynamic_unwind_info.c:48:40: error: macro "tdep_put_unwind_info" passed 3 arguments, but takes just 2
Avoid manually coding the rule to build crasher, instead fuddle
the compiler so that even -O2 optimization does not eliminate call
to b().
First, put calls to both a() and b() in the b() into non-tail-recursive
position. Second, as recommended in gcc manual, use asm volatile("");
to prevent further prevent inlining, besides attribute((noinline).
And third, call b() by alias, which current gcc optimizer cannot see
through.
Also, do not dereference NULL in a, and mark the memory access as volatile.
[ Minor portability improvements: asharma@fb.com ]
After searching the normal symbol table, look if the binary contains
.gnu_debugdata section. If it does, run LZMA decompression on it, load
the resulting ELF image into memory and call lookup_symbol() on it
again.
lookup_symbol() is modified so that it takes min_dist as a parameter and
only returns a symbol when it finds one that is closer than indicated by
the parameter.
Signed-off-by: Martin Milata <mmilata@redhat.com>
