binutils-gdb/gdb/gdbserver
Pedro Alves e76126e8d1 GDBserver crashes when killing a multi-thread process
Here's an example, with the new test:

 gdbserver :9999 gdb.threads/kill
 gdb gdb.threads/kill
 (gdb) b 52
 Breakpoint 1 at 0x4007f4: file kill.c, line 52.
 Continuing.

 Breakpoint 1, main () at kill.c:52
 52        return 0; /* set break here */
 (gdb) k
 Kill the program being debugged? (y or n) y

 gdbserver :9999 gdb.threads/kill
 Process gdb.base/watch_thread_num created; pid = 9719
 Listening on port 1234
 Remote debugging from host 127.0.0.1
 Killing all inferiors
 Segmentation fault (core dumped)

Backtrace:

 (gdb) bt
 #0  0x00000000004068a0 in find_inferior (list=0x66b060 <all_threads>, func=0x427637 <kill_one_lwp_callback>, arg=0x7fffffffd3fc) at src/gdb/gdbserver/inferiors.c:199
 #1  0x00000000004277b6 in linux_kill (pid=15708) at src/gdb/gdbserver/linux-low.c:966
 #2  0x000000000041354d in kill_inferior (pid=15708) at src/gdb/gdbserver/target.c:163
 #3  0x00000000004107e9 in kill_inferior_callback (entry=0x6704f0) at src/gdb/gdbserver/server.c:2934
 #4  0x0000000000406522 in for_each_inferior (list=0x66b050 <all_processes>, action=0x4107a6 <kill_inferior_callback>) at src/gdb/gdbserver/inferiors.c:57
 #5  0x0000000000412377 in process_serial_event () at src/gdb/gdbserver/server.c:3767
 #6  0x000000000041267c in handle_serial_event (err=0, client_data=0x0) at src/gdb/gdbserver/server.c:3880
 #7  0x00000000004189ff in handle_file_event (event_file_desc=4) at src/gdb/gdbserver/event-loop.c:434
 #8  0x00000000004181c6 in process_event () at src/gdb/gdbserver/event-loop.c:189
 #9  0x0000000000418f45 in start_event_loop () at src/gdb/gdbserver/event-loop.c:552
 #10 0x0000000000411272 in main (argc=3, argv=0x7fffffffd8d8) at src/gdb/gdbserver/server.c:3283

The problem is that linux_wait_for_event deletes lwps that have exited
(even those not passed in as lwps of interest), while the lwp/thread
list is being walked on with find_inferior.  find_inferior can handle
the current iterated inferior being deleted, but not others.

When killing lwps, we don't really care about any of the pending
status handling of linux_wait_for_event.  We can just waitpid the lwps
directly, which is also what GDB does (see
linux-nat.c:kill_wait_callback).  This way the lwps are not deleted
while we're walking the list.  They'll be deleted by linux_mourn
afterwards.

This crash triggers several times when running the testsuite against
GDBserver with the native-gdbserver board (target remote), but as GDB
can't distinguish between GDBserver crashing and "kill" being
sucessful, as in both cases the connection is closed (the 'k' packet
doesn't require a reply), and the inferior is gone, that results in no
FAIL.

The patch adds a generic test that catches the issue with
extended-remote mode (and works fine with native testing too).  Here's
how it fails with the native-extended-gdbserver board without the fix:

 (gdb) info threads
   Id   Target Id         Frame
   6    Thread 15367.15374 0x000000373bcbc98d in nanosleep () at ../sysdeps/unix/syscall-template.S:81
   5    Thread 15367.15373 0x000000373bcbc98d in nanosleep () at ../sysdeps/unix/syscall-template.S:81
   4    Thread 15367.15372 0x000000373bcbc98d in nanosleep () at ../sysdeps/unix/syscall-template.S:81
   3    Thread 15367.15371 0x000000373bcbc98d in nanosleep () at ../sysdeps/unix/syscall-template.S:81
   2    Thread 15367.15370 0x000000373bcbc98d in nanosleep () at ../sysdeps/unix/syscall-template.S:81
 * 1    Thread 15367.15367 main () at .../gdb.threads/kill.c:52
 (gdb) kill
 Kill the program being debugged? (y or n) y
 Remote connection closed
 ^^^^^^^^^^^^^^^^^^^^^^^^
 (gdb) FAIL: gdb.threads/kill.exp: kill

Extended remote should remain connected after the kill.

gdb/gdbserver/
2014-07-11  Pedro Alves  <palves@redhat.com>

	* linux-low.c (kill_wait_lwp): New function, based on
	kill_one_lwp_callback, but use my_waitpid directly.
	(kill_one_lwp_callback, linux_kill): Use it.

gdb/testsuite/
2014-07-11  Pedro Alves  <palves@redhat.com>

	* gdb.threads/kill.c: New file.
	* gdb.threads/kill.exp: New file.
2014-07-11 11:07:13 +01:00
..
.gitignore
acinclude.m4
aclocal.m4
ax.c gdbserver: on GDB breakpoint reinsertion, also delete the breakpoint's commands. 2014-06-02 22:27:32 +01:00
ax.h gdbserver: on GDB breakpoint reinsertion, also delete the breakpoint's commands. 2014-06-02 22:27:32 +01:00
ChangeLog GDBserver crashes when killing a multi-thread process 2014-07-11 11:07:13 +01:00
config.in Fix mingw32 build on x86-64 RHEL 6.5 2014-06-20 15:41:28 +01:00
configure Fix mingw32 build on x86-64 RHEL 6.5 2014-06-20 15:41:28 +01:00
configure.ac Fix mingw32 build on x86-64 RHEL 6.5 2014-06-20 15:41:28 +01:00
configure.srv Create nat/i386-dregs.c 2014-06-19 10:56:00 +01:00
debug.c link gdbserver against libiberty 2014-06-12 14:35:47 -06:00
debug.h
dll.c
dll.h
event-loop.c
event-loop.h
gdb_proc_service.h
gdbreplay.c
gdbthread.h
hostio-errno.c
hostio.c
hostio.h
i386-low.c Create nat/i386-dregs.c 2014-06-19 10:56:00 +01:00
i386-low.h Vectorize gdbserver x86 debug register accessors 2014-06-20 13:05:50 +01:00
i387-fp.c
i387-fp.h
inferiors.c
inferiors.h
linux-aarch64-low.c Include asm/ptrace.h for linux-aarch64-low.c 2014-05-23 09:01:14 +01:00
linux-amd64-ipa.c
linux-arm-low.c [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
linux-bfin-low.c
linux-cris-low.c
linux-crisv32-low.c [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
linux-i386-ipa.c
linux-ia64-low.c
linux-low.c GDBserver crashes when killing a multi-thread process 2014-07-11 11:07:13 +01:00
linux-low.h Move shared native target specific code to gdb/nat 2014-06-20 14:06:48 +01:00
linux-m32r-low.c
linux-m68k-low.c
linux-mips-low.c Move shared native target specific code to gdb/nat 2014-06-20 14:06:48 +01:00
linux-nios2-low.c
linux-ppc-low.c [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
linux-s390-low.c [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
linux-sh-low.c
linux-sparc-low.c [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
linux-tic6x-low.c
linux-tile-low.c
linux-x86-low.c x86 Linux watchpoints: Couldn't write debug register: Invalid argument. 2014-06-23 16:44:04 +01:00
linux-xtensa-low.c
lynx-i386-low.c
lynx-low.c [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
lynx-low.h
lynx-ppc-low.c
Makefile.in Move shared native target specific code to gdb/nat 2014-06-20 14:06:48 +01:00
mem-break.c gdbserver crash if the_target->supports_z_point_type is NULL 2014-06-04 17:57:21 -04:00
mem-break.h gdbserver: on GDB breakpoint reinsertion, also delete the breakpoint's commands. 2014-06-02 22:27:32 +01:00
notif.c
notif.h
nto-low.c [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
nto-low.h
nto-x86-low.c
proc-service.c
proc-service.list
README
regcache.c
regcache.h
remote-utils.c
remote-utils.h
server.c link gdbserver against libiberty 2014-06-12 14:35:47 -06:00
server.h
spu-low.c [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
target.c
target.h [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
tdesc.c
tdesc.h
terminal.h
thread-db.c Move shared native target specific code to gdb/nat 2014-06-20 14:06:48 +01:00
tracepoint.c
tracepoint.h
utils.c delete gdbserver's freeargv 2014-06-12 14:35:49 -06:00
utils.h
win32-arm-low.c [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
win32-i386-low.c Vectorize gdbserver x86 debug register accessors 2014-06-20 13:05:50 +01:00
win32-low.c [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
win32-low.h [GDBserver] Make Zx/zx packet handling idempotent. 2014-05-20 18:42:30 +01:00
wincecompat.c
wincecompat.h
xtensa-xtregs.c

		   README for GDBserver & GDBreplay
		    by Stu Grossman and Fred Fish

Introduction:

This is GDBserver, a remote server for Un*x-like systems.  It can be used to
control the execution of a program on a target system from a GDB on a different
host.  GDB and GDBserver communicate using the standard remote serial protocol
implemented in remote.c, and various *-stub.c files.  They communicate via
either a serial line or a TCP connection.

For more information about GDBserver, see the GDB manual.

Usage (server (target) side):

First, you need to have a copy of the program you want to debug put onto
the target system.  The program can be stripped to save space if needed, as
GDBserver doesn't care about symbols.  All symbol handling is taken care of by
the GDB running on the host system.

To use the server, you log on to the target system, and run the `gdbserver'
program.  You must tell it (a) how to communicate with GDB, (b) the name of
your program, and (c) its arguments.  The general syntax is:

	target> gdbserver COMM PROGRAM [ARGS ...]

For example, using a serial port, you might say:

	target> gdbserver /dev/com1 emacs foo.txt

This tells GDBserver to debug emacs with an argument of foo.txt, and to
communicate with GDB via /dev/com1.  GDBserver now waits patiently for the
host GDB to communicate with it.

To use a TCP connection, you could say:

	target> gdbserver host:2345 emacs foo.txt

This says pretty much the same thing as the last example, except that we are
going to communicate with the host GDB via TCP.  The `host:2345' argument means
that we are expecting to see a TCP connection from `host' to local TCP port
2345.  (Currently, the `host' part is ignored.)  You can choose any number you
want for the port number as long as it does not conflict with any existing TCP
ports on the target system.  This same port number must be used in the host
GDBs `target remote' command, which will be described shortly.  Note that if
you chose a port number that conflicts with another service, GDBserver will
print an error message and exit.

On some targets, GDBserver can also attach to running programs.  This is
accomplished via the --attach argument.  The syntax is:

	target> gdbserver --attach COMM PID

PID is the process ID of a currently running process.  It isn't necessary
to point GDBserver at a binary for the running process.

Usage (host side):

You need an unstripped copy of the target program on your host system, since
GDB needs to examine it's symbol tables and such.  Start up GDB as you normally
would, with the target program as the first argument.  (You may need to use the
--baud option if the serial line is running at anything except 9600 baud.)
Ie: `gdb TARGET-PROG', or `gdb --baud BAUD TARGET-PROG'.  After that, the only
new command you need to know about is `target remote'.  It's argument is either
a device name (usually a serial device, like `/dev/ttyb'), or a HOST:PORT
descriptor.  For example:

	(gdb) target remote /dev/ttyb

communicates with the server via serial line /dev/ttyb, and:

	(gdb) target remote the-target:2345

communicates via a TCP connection to port 2345 on host `the-target', where
you previously started up GDBserver with the same port number.  Note that for
TCP connections, you must start up GDBserver prior to using the `target remote'
command, otherwise you may get an error that looks something like
`Connection refused'.

Building GDBserver:

The supported targets as of November 2006 are:
	arm-*-linux*
	bfin-*-uclinux
	bfin-*-linux-uclibc
	crisv32-*-linux*
	cris-*-linux*
	i[34567]86-*-cygwin*
	i[34567]86-*-linux*
	i[34567]86-*-mingw*
	ia64-*-linux*
	m32r*-*-linux*
	m68*-*-linux*
	m68*-*-uclinux*
	mips*64*-*-linux*
	mips*-*-linux*
	powerpc[64]-*-linux*
	s390[x]-*-linux*
	sh-*-linux*
	spu*-*-*
	x86_64-*-linux*

Configuring GDBserver you should specify the same machine for host and
target (which are the machine that GDBserver is going to run on.  This
is not the same as the machine that GDB is going to run on; building
GDBserver automatically as part of building a whole tree of tools does
not currently work if cross-compilation is involved (we don't get the
right CC in the Makefile, to start with)).

Building GDBserver for your target is very straightforward.  If you build
GDB natively on a target which GDBserver supports, it will be built
automatically when you build GDB.  You can also build just GDBserver:

	% mkdir obj
	% cd obj
	% path-to-gdbserver-sources/configure
	% make

If you prefer to cross-compile to your target, then you can also build
GDBserver that way.  In a Bourne shell, for example:

	% export CC=your-cross-compiler
	% path-to-gdbserver-sources/configure your-target-name
	% make

Using GDBreplay:

A special hacked down version of GDBserver can be used to replay remote
debug log files created by GDB.  Before using the GDB "target" command to
initiate a remote debug session, use "set remotelogfile <filename>" to tell
GDB that you want to make a recording of the serial or tcp session.  Note
that when replaying the session, GDB communicates with GDBreplay via tcp,
regardless of whether the original session was via a serial link or tcp.

Once you are done with the remote debug session, start GDBreplay and
tell it the name of the log file and the host and port number that GDB
should connect to (typically the same as the host running GDB):

	$ gdbreplay logfile host:port

Then start GDB (preferably in a different screen or window) and use the
"target" command to connect to GDBreplay:

	(gdb) target remote host:port

Repeat the same sequence of user commands to GDB that you gave in the
original debug session.  GDB should not be able to tell that it is talking
to GDBreplay rather than a real target, all other things being equal.  Note
that GDBreplay echos the command lines to stderr, as well as the contents of
the packets it sends and receives.  The last command echoed by GDBreplay is
the next command that needs to be typed to GDB to continue the session in
sync with the original session.