mirror/binutils-gdb
2
0
Fork 0
mirror of https://sourceware.org/git/binutils-gdb.git synced 2024-12-09 04:21:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

[ARM] Software single step cross kernel helpers

Browse Source 
GDB step cross kernel helpers only works if the kernel helpers are tail
called, which is the case how it is used in glibc.  See __aeabi_read_tp
in sysdeps/unix/sysv/linux/arm/aeabi_read_tp.S.  In __aeabi_read_tp,
branch/jump to the kernel helper is the last instruction, and the next
instruction address is in LR, which is in caller function.  GDB can
handle this correctly.  For example, glibc function __GI___ctype_init
calls __aeabi_read_tp

   0xb6e19b30 <__GI___ctype_init+4>:	ldr	r3, [pc, #80]	;
   0xb6e19b34 <__GI___ctype_init+8>:	bl	0xb6e0a6e0 <__aeabi_read_tp>
   0xb6e19b38 <__GI___ctype_init+12>:	ldr	r3, [pc, r3]

and __aeabi_read_tp calls kernel helper,

(gdb) disassemble __aeabi_read_tp
   0xb6fef5d0 <+0>:	mvn	r0, #61440	; 0xf000
   0xb6fef5d4 <+4>:	sub	pc, r0, #31

once GDB or GDBserver single step instruction on 0xb6fef5d4, LR is
0xb6e19b38, which is right address of next instruction to set breakpoint
on.

However, if the kernel helpers are not tail-called, the LR is still the
address in the caller function of kernel helper's caller, which isn't
the right address of next instruction to set breakpoint on.  For example,
we use kernel helper in main,

(gdb) disassemble main
....
   0x00008624 <+32>:    mov     r3, #4064       ; 0xfe0^M
   0x00008628 <+36>:    movt    r3, #65535      ; 0xffff^M
   0x0000862c <+40>:    blx     r3
   0x00008630 <+44>:    ldr     r3, [r11, #-8]

kernel helper is called on 0x0000862c and the expected next instruction
address is 0x00008630, but the LR now is the return address of main.
The problem here is LR may not have the right address because when we
single step the instruction, it isn't executed yet, so the LR isn't
updated.  This patch fix this problem by decoding instruction, if the
instruction updates LR (BL and BLX), the next instruction address is
PC + INSN_SIZE, otherwise, get the address of next instruction from LR.

gdb:

2016-02-12  Yao Qi  <yao.qi@linaro.org>

	* arch/arm-linux.c (arm_linux_get_next_pcs_fixup): Calculate
	nextpc according to instruction.

gdb/testsuite:

2016-02-12  Yao Qi  <yao.qi@linaro.org>

	* gdb.arch/arm-single-step-kernel-helper.c: New.
	* gdb.arch/arm-single-step-kernel-helper.exp: New.
This commit is contained in:
Yao Qi 2016-02-10 14:21:38 +00:00
parent ed443b61e1
commit 01113bc1c5
5 changed files with 203 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
gdb/ChangeLog
View File

@ -1,3 +1,8 @@
2016-02-12 Yao Qi <yao.qi@linaro.org>
* arch/arm-linux.c (arm_linux_get_next_pcs_fixup): Calculate
nextpc according to instruction.
2016-02-12 Yao Qi <yao.qi@linaro.org>
* arch/arm-get-next-pcs.c (arm_get_next_pcs): Call

70
gdb/arch/arm-linux.c
View File

@ -68,10 +68,72 @@ arm_linux_get_next_pcs_fixup (struct arm_get_next_pcs *self,
/* The Linux kernel offers some user-mode helpers in a high page. We can
not read this page (as of 2.6.23), and even if we could then we
couldn't set breakpoints in it, and even if we could then the atomic
operations would fail when interrupted. They are all called as
functions and return to the address in LR, so step to there
instead. */
operations would fail when interrupted. They are all (tail) called
as functions and return to the address in LR. However, when GDB single
step this instruction, this instruction isn't executed yet, and LR
may not be updated yet. In other words, GDB can get the target
address from LR if this instruction isn't BL or BLX. */
if (nextpc > 0xffff0000)
nextpc = regcache_raw_get_unsigned (self->regcache, ARM_LR_REGNUM);
{
int bl_blx_p = 0;
CORE_ADDR pc = regcache_read_pc (self->regcache);
int pc_incr = 0;
if (self->ops->is_thumb (self))
{
unsigned short inst1
= self->ops->read_mem_uint (pc, 2, self->byte_order_for_code);
if (bits (inst1, 8, 15) == 0x47 && bit (inst1, 7))
{
/* BLX Rm */
bl_blx_p = 1;
pc_incr = 2;
}
else if (thumb_insn_size (inst1) == 4)
{
unsigned short inst2;
inst2 = self->ops->read_mem_uint (pc + 2, 2,
self->byte_order_for_code);
if ((inst1 & 0xf800) == 0xf000 && bits (inst2, 14, 15) == 0x3)
{
/* BL <label> and BLX <label> */
bl_blx_p = 1;
pc_incr = 4;
}
}
pc_incr = MAKE_THUMB_ADDR (pc_incr);
}
else
{
unsigned int insn
= self->ops->read_mem_uint (pc, 4, self->byte_order_for_code);
if (bits (insn, 28, 31) == INST_NV)
{
if (bits (insn, 25, 27) == 0x5) /* BLX <label> */
bl_blx_p = 1;
}
else
{
if (bits (insn, 24, 27) == 0xb /* BL <label> */
|| bits (insn, 4, 27) == 0x12fff3 /* BLX Rm */)
bl_blx_p = 1;
}
pc_incr = 4;
}
/* If the instruction BL or BLX, the target address is the following
instruction of BL or BLX, otherwise, the target address is in LR
already. */
if (bl_blx_p)
nextpc = pc + pc_incr;
else
nextpc = regcache_raw_get_unsigned (self->regcache, ARM_LR_REGNUM);
}
return nextpc;
}

5
gdb/testsuite/ChangeLog
View File

@ -1,3 +1,8 @@
2016-02-12 Yao Qi <yao.qi@linaro.org>
* gdb.arch/arm-single-step-kernel-helper.c: New.
* gdb.arch/arm-single-step-kernel-helper.exp: New.
2016-02-12 Markus Metzger <markus.t.metzger@intel.com>
* gdb.btrace/tailcall-only.exp: New.

30
gdb/testsuite/gdb.arch/arm-single-step-kernel-helper.c Normal file
View File

@ -0,0 +1,30 @@
/* This testcase is part of GDB, the GNU debugger.
Copyright 2016 Free Software Foundation, Inc.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>. */
static int *kernel_user_helper_version = (int *) 0xffff0ffc;
typedef void * (kernel_user_func_t)(void);
#define kernel_user_get_tls (*(kernel_user_func_t *) 0xffff0fe0)
int
main (void)
{
int i;
for (i = 0; i < 8; i++)
kernel_user_get_tls ();
}

97
gdb/testsuite/gdb.arch/arm-single-step-kernel-helper.exp Normal file
View File

@ -0,0 +1,97 @@
# Copyright (C) 2016 Free Software Foundation, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
if { ![is_aarch32_target] } {
verbose "Skipping ${gdb_test_file_name}."
return
}
standard_testfile
if { [prepare_for_testing ${testfile}.exp ${testfile} ${srcfile} \
[list debug]] } {
return -1
}
if { ![runto_main] } {
return -1
}
# Check kernel helpers are supported or not.
set kernel_helper_supported 0
gdb_test_multiple "p *kernel_user_helper_version" \
"check kernel helper version" {
-re " = ($decimal)\r\n$gdb_prompt $" {
if { $expect_out(1,string) >= 1 } {
set kernel_helper_supported 1
}
}
}
if { !$kernel_helper_supported } {
unsupported "kernel doesn't have helpers"
return 0
}
# Get the instruction branching to kernel helper, they can be
# blx rN or bx rN.
set branch_to_kernel_helper 0
set branch_insn "bl?x\[ \t\]*r${decimal}"
set test "disassemble main"
gdb_test_multiple $test $test {
-re ".*($hex) <\\+$decimal>:\[ \t\]+$branch_insn" {
set branch_to_kernel_helper $expect_out(1,string)
exp_continue
}
-re ".*$gdb_prompt $" {
}
}
if { ![gdb_assert $branch_to_kernel_helper \
"find instruction branch to kernel helper"] } {
return
}
with_test_prefix "single-step" {
gdb_breakpoint "*${branch_to_kernel_helper}"
gdb_continue_to_breakpoint "branch to kernel helper"
gdb_test "si"
set test "bt"
gdb_test_multiple $test $test {
-re "#0 \[^\\r\\n\]*main .*\r\n$gdb_prompt $" {
# Test that the program still stops in main rather than
# somewhere else.
pass $test
}
-re "#0 0xffff0fe0 .*\r\n$gdb_prompt $" {
# AArch64 linux kernel can do hardware single step, so
# the program can stop at kernel helper.
pass $test
}
}
delete_breakpoints
}
with_test_prefix "cond-breakpoint" {
gdb_breakpoint "*${branch_to_kernel_helper} if i > 5"
gdb_continue_to_breakpoint "branch to kernel helper"
gdb_test "p i" " = 6"
delete_breakpoints
}