The standard layout of the XSAVE extended state area consists of three
regions. The first 512 bytes (legacy region) match the layout of the
FXSAVE instruction including floating point registers, MMX registers,
and SSE registers. The next 64 bytes (XSAVE header) contains a header
with a fixed layout. The final region (extended region) contains zero
or more optional state components. Examples of these include the
upper 128 bits of YMM registers for AVX.
These optional state components generally have an
architecturally-fixed size, but they are not assigned architectural
offsets in the extended region. Instead, processors provide
additional CPUID leafs describing the size and offset of each
component in the "standard" layout for a given CPU. (There is also a
"compact" format which uses an alternate layout, but existing OS's
currently export the "standard" layout when exporting XSAVE data via
ptrace() and core dumps.)
To date, GDB has assumed the layout used on current Intel processors
for state components in the extended region and hardcoded those
offsets in the tables in i387-tdep.c and i387-fp.cc. However, this
fails on recent AMD processors which use a different layout.
Specifically, AMD Zen3 and later processors do not leave space for the
MPX register set in between the AVX and AVX512 register sets.
To rectify this, add an x86_xsave_layout structure which contains the
total size of the XSAVE extended state area as well as the offset of
each known optional state component.
Subsequent commits will modify XSAVE parsing in both gdb and gdbserver
to use x86_xsave_layout.
Co-authored-by: Aleksandar Paunovic <aleksandar.paunovic@intel.com>
Approved-By: Simon Marchi <simon.marchi@efficios.com>
Mark Wielaard pointed out that cooked_index::dump uses PRIx64, and
Andreas Schwab pointed out that gdb already has sect_offset_str. This
patch applies both these observations.
The getsymname function uses PRIxPTR to print and uintptr_t value in
an error message. Use hex_string instead.
Approved-By: Tom Tromey <tom@tromey.com>
Building gdb with gcc 7.5.0 and -flto -O2 -flto-partition=one generates a
self-referencing DIE:
...
<2><91dace>: Abbrev Number: 405 (DW_TAG_label)
<91dad0> DW_AT_abstract_origin: <0x91dace>
...
When encountering the self-reference DIE in inherit_abstract_dies we loop
following the abstract origin, effectively hanging gdb.
Fix this by handling self-referencing DIEs in the loop in
inherit_abstract_dies.
Tested on x86_64-linux.
Approved-By: Tom Tromey <tom@tromey.com>
PR symtab/30799
https://sourceware.org/bugzilla/show_bug.cgi?id=30799
A low level function like coff_swap_aux_in really has no business
concatenating multiple auxents for the old PE multi-aux scheme of
handling long file names. In doing so, it assumes multiple internal
auxent buffers are available, which they are not in most calls to
bfd_coff_swap_aux_in, both inside BFD and outside, eg. GDB. Buffer
overflow fun. Concatenating multiple auxents belongs at a higher
level.
This required some changes to coff_get_normalized_symtab, which now
uses the external auxents to access the concatenated file name.
(Internal auxents are larger than the x_fname array, so the pieces of
the file name are not adjacent as they are in the external auxents.)
* coffswap.h (coff_swap_aux_in): Do not write more than one
internal auxent.
* coffcode.h (coff_bigobj_swap_aux_in): Likewise.
* coffgen.c (coff_get_normalized_symtab): Normalize strings
after swapping in each symbol so that external auxents are
available. Use external auxents for multi-aux long file
names. Formatting. Wrap long lines. Remove excess parens
and unnecessary casts. Don't zalloc when only the string
terminator needs zeroing, and memcpy rather than strncpy.
Delete unnecessary sanity check with unsigned _n_offset.
Return with failure if debug section can't be read, to avoid
trying to read it multiple times. Correct sanity check
against debug section size.
I missed another field that needs freeing. Also, oss-fuzz found a
case with a C_FILE sym using multiple auxents for a long file name
which overflowed the single auxent buffer. I'm going to fix that
problem in swap_aux_in too, but we may as well avoid it here too,
saving unnecessary work.
* coffcode.h (comdat_delf): Free comdat_name.
(fill_comdat_hash): Only look at symbols with one auxent.
When running test-cases gdb.cp/*.exp with gcc 4.8.4, I run into compilation
failures due to the test-cases requiring c++11 and the compiler defaulting
to less than that.
Fix this by compiling with -std=c++11.
This exposes two FAILs in gdb/testsuite/gdb.cp/empty-enum.exp due to
gcc PR debug/16063, so xfail those.
Also require have_compile_flag -std=c++17 in gdb.cp/constexpr-field.exp to
prevent compilation failure.
Tested on x86_64-linux.
Following the arrangement in GCC select a 64-bit ABI by default, either
n32 or n64, rather than o32 for `mipsisa64*-*-linux*' targets, just as
with the corresponding `mips64*-*-linux*' targets.
Only mips*el triples are supported by binutils. The mips*le
or mips*el* may cause some problem with other components of
binutils, since they will consider them as big endian.
EM_MIPS_RS3_LE has been deprecated quite long ago, and in fact
most of current LE ELF files are using EM_MIPS.
This problem didn't make some trouble for us, is due to that
gold is a linker, and all of the inputs to it has right EM values.
I was looking at dos_message and wondering why we have H_PUT_32
in _bfd_XXi_only_swap_filehdr_out but no H_GET_32 in pe_bfd_object_p.
On a big-endian machine this would result in scrambling the code and
strings constained in dos_message. Rather than fix the lack of
H_GET_32 in pe_bfd_object_p, I decided it doesn't make sense to store
dos_message internally as an array of ints.
include/
* coff/internal.h (struct internal_extra_pe_filehdr): Make
dos_message a char array.
* coff/msdos.h (struct external_DOS_hdr): Flatten dos_message.
* coff/pe.h (struct external_PEI_filehdr): Likewise.
bfd/
* libcoff-in.h (struct pe_tdata): Make dos_message a char array.
* libcoff.h: Regenerate.
* peXXigen.c (_bfd_XXi_only_swap_filehdr_out): memcpy dos_message
to output.
* peicode.h (pe_mkobject): Don't memset already zeroed pe_opthdr.
Tidy allocation of tdata.pe_obj_data. Set up dos_message from..
(default_dos_message): ..this. New static array.
Entries added to the hash table with bfd_malloc ought to be freed when
the hash table is deleted. This patch adds the necessary del_f to the
htab_create call, and delays creating the table until an
IMAGE_SCN_LNK_COMDAT symbol is read.
* peicode.h (pe_mkobject): Move comdat_hash creation..
(htab_hash_flags, htab_eq_flags): ..and these support functions..
* coffcode.h (handle_COMDAT): ..to here, renaming support to
(comdat_hashf, comdat_eqf): ..this and adding..
(comdat_delf): ..this new function.
A bfd_cleanup function needs to run when only tdata is correct for the
bfd. The xvec may have changed during bfd_check_format and thus the
flavour may be incorrect. The format won't have changed but checking
is superfluous. (In contrast to _bfd_free_cached_info or
_close_and_cleanup where we do need to check things.)
Not getting this correct leaked comdat_hash.
Also, pe_ILF_cleanup ought to call coff_object_cleanup as do all PE
files.
* coffgen.c (coff_object_cleanup): Don't check bfd flavour or
format.
* peicode.h (pe_ILF_cleanup): Call coff_object_cleanup.
Sanity check aux entries used by PE to extend a C_FILE name. See
coffswap.h:coff_swap_aux_in. The existing check only catered for
n_numaux == 1.
* coffcode.h (fill_comdat_hash): Properly sanity check n_numaux.
Formatting.
(handle_COMDAT): Formatting.
This patch sets GUILE to just plain 'guile'.
In the distant ("devo") past, the top-level build did support building
Guile in-tree. However, I don't think this really works any more.
For one thing, there are no build dependencies on it, so there's no
guarantee it would actually be built before the uses.
This patch also removes the use of "-s" as an option to cgen scheme
scripts. With my latest patch upstream, this is no longer needed.
After the upstream changes, either Guile 2 or Guile 3 will work, with
or without the compiler enabled.
2023-08-24 Tom Tromey <tom@tromey.com>
* cgen.sh: Don't pass "-s" to cgen.
* Makefile.in: Rebuild.
* Makefile.am (GUILE): Simplify.
The author of 'mold' pointed out that with a certain shared library,
gdb would fail to find the shared library's name in 'bt'.
The function in question appeared at the end of the .so's .text
segment and ended with a call to 'abort'.
This turned out to be a classic case of calling get_frame_pc when
get_frame_address_in_block is needed -- the former will be off-by-one
for purposes of finding the enclosing function or shared library.
The included test fails without the patch on my system. However, I
imagine it can't be assumed to reliably fail. Nevertheless it seemed
worth doing.
Regression tested on x86-64 Fedora 38.
Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29074
Reviewed-by: Kevin Buettner <kevinb@redhat.com>
i386: warning: format ‘%u’ expects argument of type ‘unsigned int’,
but argument 4 has type ‘size_t’ {aka ‘long unsigned int’} [-Wformat=]
ia64: warning: ignoring return value of ‘fgets’
* i386-gen.c (process_i386_opcodes): Correct format string.
* ia64-gen.c (load_insn_classes, load_depfile): Don't ignore
fgets return value.
This patch gets rid of the individual rules including the .Pc
dependency files made while generating e*.c files, replacing them with
a fancy GNU make pattern include. I've also moved creation of
ldscripts to the makefile since it is possible to run more than one
genscripts at once, resulting in "ldscripts: File exists" messages.
* Makefile.am: Replace individual include of *.Pc dependency
files with one pattern rule.
(.Pc): New dummy rule.
(ldscripts/stamp): New rule.
(GEN_DEPENDS): Add ldscripts/stamp.
(install-data-local): Exclude ldscripts/stamp from install.
* genscripts.sh: Don't make ldscripts dir.
* Makefile.in: Regenerate.
The getsymname function tries to emit an error using %ld for an
uintptr_t argument. Use PRIxPTR instead. Which works on any architecture
for uintptr_t.
This patch addresses an issue with malformed/fuzzed debug information that
was recently reported in gdb/30639. That bug specifically deals with
an ASAN issue, but the reproducer provided by the reporter causes a
another failure outside of ASAN:
$ ./gdb --data-directory data-directory -nx -q UAF_2
Reading symbols from /home/keiths/UAF_2...
Fatal signal: Segmentation fault
----- Backtrace -----
0x59a53a gdb_internal_backtrace_1
../../src/gdb/bt-utils.c:122
0x59a5dd _Z22gdb_internal_backtracev
../../src/gdb/bt-utils.c:168
0x786380 handle_fatal_signal
../../src/gdb/event-top.c:889
0x7864ec handle_sigsegv
../../src/gdb/event-top.c:962
0x7ff354c5fb6f ???
0x611f9a process_coff_symbol
../../src/gdb/coffread.c:1556
0x611025 coff_symtab_read
../../src/gdb/coffread.c:1172
0x60f8ff coff_read_minsyms
../../src/gdb/coffread.c:549
0x60fe4b coff_symfile_read
../../src/gdb/coffread.c:698
0xbde0f6 read_symbols
../../src/gdb/symfile.c:772
0xbde7a3 syms_from_objfile_1
../../src/gdb/symfile.c:966
0xbde867 syms_from_objfile
../../src/gdb/symfile.c:983
0xbded42 symbol_file_add_with_addrs
../../src/gdb/symfile.c:1086
0xbdf083 _Z24symbol_file_add_from_bfdRKN3gdb7ref_ptrI3bfd18gdb_bfd_ref_policyEEPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaISC_EES8_I12objfile_flagEP7objfile
../../src/gdb/symfile.c:1166
0xbdf0d2 _Z15symbol_file_addPKc10enum_flagsI16symfile_add_flagEPSt6vectorI14other_sectionsSaIS5_EES1_I12objfile_flagE
../../src/gdb/symfile.c:1179
0xbdf197 symbol_file_add_main_1
../../src/gdb/symfile.c:1203
0xbdf13e _Z20symbol_file_add_mainPKc10enum_flagsI16symfile_add_flagE
../../src/gdb/symfile.c:1194
0x90f97f symbol_file_add_main_adapter
../../src/gdb/main.c:549
0x90f895 catch_command_errors
../../src/gdb/main.c:518
0x9109b6 captured_main_1
../../src/gdb/main.c:1203
0x910fc8 captured_main
../../src/gdb/main.c:1310
0x911067 _Z8gdb_mainP18captured_main_args
../../src/gdb/main.c:1339
0x418c71 main
../../src/gdb/gdb.c:39
---------------------
A fatal error internal to GDB has been detected, further
debugging is not possible. GDB will now terminate.
This is a bug, please report it. For instructions, see:
<https://www.gnu.org/software/gdb/bugs/>.
Segmentation fault (core dumped)
The issue here is that the COFF offset for the fuzzed symbol's
name is outside the string table. That is, the offset is greater
than the actual string table size.
coffread.c:getsymname actually contains a FIXME about this, and that's
what I've chosen to address to fix this issue, following what is done
in the DWARF reader:
$ ./gdb --data-directory data-directory -nx -q UAF_2
Reading symbols from /home/keiths/UAF_2...
COFF Error: string table offset (256) outside string table (length 0)
(gdb)
Unfortunately, I haven't any idea how else to test this patch since
COFF is not very common anymore. GCC removed support for it five
years ago with GCC 8.
In AIX the first eight function parameters are stored from R3 to R10.
If there are more than eight parameters in a function then we store the 9th parameter onwards in the stack.
While doing so, in 64 bit mode the words were not zero extended and was coming like 32 bit mode.
This patch is a fix to the same.
While documented to not be reliable, it is still odd for objcopy to
silently produce bad output when converting COFF/PE object files to ELF
ones. The issue there is that relocation addends all are screwed up by
subtracting the symbol's section offset. In the COFF/PE world, to my
knowledge, section contents stores the addends alone, not the result of
symbol value plus addend. Hence the compensation talked about in a
comment ahead of the sole use site of CALC_ADDEND() may need to account
for the VMA (which is always zero for object files anyway), but not for
the symbol value.
The coff-sh.c adjustment is based upon guessing that behavior there is
the same. Note also how coff-aarch64.c short-circuits CALC_ADDEND()
altogether, which may suggest that a much simpler macro might do for the
COFF_WITH_PE case in the three arch-specific files touched here.
For (at least) Arm/WinCE this actually results in more appropriate
objdump output as well, as can be seen in the one testcase which has its
expectations adjusted (the generated binary doesn't change).
Rather than special-casing rx-*-* for section30, force use of
conventional section names uniformly. By further passing $dump_opts to
a few more tests, a number of xfail-s (and one notarget) can be
eliminated (some of which had wrong justifications in associated
comments anyway). Note that section7 and section15 need to be left
alone: The harness fiddling with section names there didn't help before
and is getting in the way now. For section12b, section16b, and most of
the Dwarf tests nothing changes. Interestingly by passing $dump_opts
the need to xfail section11 for LoongArch and RISC-V also goes away.
While --sectname-subst is nice, it isn't enough to e.g. mimic
-f{function,data}-sections in assembly code, when such use is to be
optional (e.g. dependent upon some configuration setting).
Assign meaning to '+' and '-' as section attribute letters, allowing
to inherit the prior section's attributes (and possibly type) along
with adding or removing some. Note that documenting the interaction
with '?' as undefined is a precautionary measure.
While touching the function invocation, stop using |= on the result of
obj_elf_parse_section_letters(): "attr" is firmly zero ahead of the
call.
Use the pattern rule in a comment from commit 77ac17b845.
* Makefile.am (run-genscripts): Delete. Use pattern rule
e%.c instead.
* Makefile.in: Regenerate.
Code in som_write_symbol_strings neglected to allow for padding, which
can result in a buffer overflow. It also used xrealloc, which we're
not supposed to use in libbfd because libbfd isn't supposed to call
exit. Also a realloc is perhaps not a good idea when none of the
buffer contents are needed, so replace with free, bfd_malloc. There
were three copies of the string handling code, so rather than fix them
all I've extracted them to a function. This necessitated making one
of the fields in struct som_symbol unsigned.
* som.c (add_string): New function.
(som_write_space_strings, som_write_symbol_strings): Use it.
* som.h (som_symbol_type <stringtab_offset>): Make unsigned.
Caused by commit 5a97377e55, specifically this code added to
Target_powerpc::do_relax
+ if (parameters->options().output_is_position_independent())
+ this->rela_dyn_size_
+ = this->rela_dyn_section(layout)->current_data_size();
The problem here is that if .rela.dyn isn't already created then the
call to rela_dyn_section creates it, and as this comment in
Target_powerpc::do_finalize_sections says:
// Annoyingly, we need to make these sections now whether or
// not we need them. If we delay until do_relax then we
// need to mess with the relaxation machinery checkpointing.
We can't be creating sections in do_relax.
PR 30794
* powerpc.cc (Target_powerpc::do_relax): Only set rela_dyn_size_
for size == 64, and assert that rela_dyn_ already exists.
Tidy code setting plt_thread_safe, which also only needs to be
set when size == 64 for ELFv1.
It is possible to debug a process which uses unsupported AMDGPU devices.
In such scenario, we can still use librocm-dbgapi.so to attach to the
process and complete the runtime activation sequence.
However, when listing shared objects loaded on the AMDGPU devices, we
might list SOs loaded on the unsupported devices. If such SO is
seen, one of two things can happen.
First, if the arch of this device is unknown to BFD,
'gdbarch_find_by_info (gdbarch_info info)' will return the gdbarch
matching default_bfd_arch. As a result,
rocm_solib_relocate_section_addresses will delegate the relocation
operation to svr4_so_ops.relocate_section_addresses, but this makes no
sense: this code object was not loaded by the system loader.
The second case is if BFD knows the micro-architecture of the device,
but dbgapi does not support it. In such case, gdbarch_info_fill will
successfully identify an amdgcn architecture (bfd_arch_amdgcn). From
there, gdbarch_find_by_info calls amdgpu_gdbarch_init which will fail to
query arch specific details from dbgapi and subsequently fail to
initialize the gdbarch object. As a result, gdbarch_find_by_info
returns nullptr, which will down the line cause some "gdb_assert
(gdbarch != nullptr)" assertion failures.
This patch proposes to add a check in rocm_solib_bfd_open to ensure that
the architecture associated with the code object to open is fully
supported by both BFD and amd-dbgapi, and error-out otherwise.
Change-Id: Ica97ab7cba45e4944b77d3080c54c1038aaeda54
Approved-By: Pedro Alves <pedro@palves.net>
In remote_target::thread_info_to_thread_handle we return a copy:
...
gdb::byte_vector
remote_target::thread_info_to_thread_handle (struct thread_info *tp)
{
remote_thread_info *priv = get_remote_thread_info (tp);
return priv->thread_handle;
}
...
Fix this by returning a gdb::array_view instead:
...
gdb::array_view<const gdb_byte>
remote_target::thread_info_to_thread_handle (struct thread_info *tp)
...
Tested on x86_64-linux.
This fixes the build when building with -std=c++20.
Approved-By: Pedro Alves <pedro@palves.net>
opcodes/
* kvx-dis.c (print_insn_kvx): Change the loop condition so that
wordcount is always less than KVXMAXBUNDLEWORDS.
(decode_prologue_epilogue_bundle): Likewise.
This commits tackles 2 problems in the test
gdb.reverse/insn-reverse.exp. They are, broadly: flawed logic when an
unexpected error occurs, and badly formed asm expressions.
For the first, what happens is that if the inferior stops progressing
for some reason, the test will emit an UNSUPPORTED and continue testing
by reversing from the current location and checking all registers for
every instruction. However, due to how the outputs are indexed in the
test, this early exit will cause most of the subsequent tests to be
de-synced and will emit many unrelated failures.
This commit changes the UNSUPPORTED for a FAIL, since the test has in
fact failed to record the execution of the whole function, and
decrements the recorded instruction count by one so that the indexes are
in sync once more.
At the time of committing, this reduces the amount of failures when
testing with clang-15 from around 150 to 2, and correctly identifies
where the issue lies.
The second problem is in how the asm statements in the *-x86.c file
are written. As an example, let's examine the following line:
__asm__ volatile ("rdrand %%ebp;" : "=r" (number));
This statement says that number is being used as the output variable,
but is not indicating which registers were clobbered so that the
compiler is able to properly output. GCC decides to just not save
anything, whereas clang assumes that the output is in %rax, and writes
it to the variable. This hid the problem that any compiler is not good
at dealing with asm statements that change the rbp register. It can be
seen more explicitly by informing gcc that rbp has been clobbered like
so:
__asm__ volatile ("rdrand %%ebp;" : "=r" (number) : : "%ebp");
This statement gets compiled into the following assembly:
rdrandl %ebp
movl %eax, -4(%rbp)
Which is clearly using the incorrect rbp to find the memory location of
the variable. Since the test only exercises GDB's ability to record the
register changes, this commit removes the output to memory.
Finally, correctly informing the compiler of clobbered registers
makes gcc throw an error that the rsp is no longer usable at the end of
the function. To avoid that, this commit compresses the 3 asm statements
that would save, change and reset registers into a single asm statement.
Approved-By: Tom Tromey <tom@tromey.com>
When testing using reverse-stepi to fully step through a function, the
code checks for an infinite loop by seeing if we land on the line that
contains the return statement multiple times. This assumption only works
if there is only one instruction associated with that line, which is how
GCC handles line information, but other compilers may handle it differently.
Clang-15, for instance, associates 6. Because of this, the inferior used
to get seriously out of sync with the test expectations, and result in 13
spurious failures. The same issue occurs with gdb.reverse/step-precsave.exp.
This commit changes the test so that we check for PC instead of line
number. The test still only happens when the same line is detected, to
simplify the resulting log. With this change, no new failures are
emitted when using clang.
Approved-By: Tom Tromey <tom@tromey.com>
The tests gdb.reverse/solib-precsave.exp and solib-reverse.exp have the
assumption that line tables will have an entry for the closing } in a
function. Not all compiles do this, one example being clang. To fix
this, this commit changes the function in shr2.c to have multiple lines,
and the test to accept either line as a correct step location.
To properly re-sync the inferiors, the function repeat_cmd_until had to
be slightly changed to work with empty "current locations", so that we
are able to step through multiple lines.
This also changes the annotations used to determine the breakpoint
locations in solib-reverse.c, adding a simple variable assignment right
before the return statement. This way GDB will not set a breakpoint in
the closing } line.
Approved-By: Tom Tromey <tom@tromey.com>
Clang does not add line information for lines that only contain a
closing } in functions. Many tests in the gdb.reverse folder set a
breakpoint in that line, but don't seem to use information available
after the return statement is executed, so this commit moves the
breakpoint to the previous line, where the return statement is.
Approved-By: Tom Tromey <tom@tromey.com>
As commit fa4f2d46f9 did for x86, there a few other targets that
wrongly use the output section rather than the dynamic section for
DT_JMPREL and others.
* elfnn-kvx.c (elfNN_kvx_finish_dynamic_sections): Use input
section for DT_JMPREL.
* elf32-sh.c (sh_elf_finish_dynamic_sections): Use input
section for DT_JMPREL and DT_PLTRELSZ.
* elf32-nds32.c (nds32_elf_finish_dynamic_sections): Likewise,
and for DT_PLTGOT and when adjusting DT_RELA.
John Baldwin
Tom Tromey
Mark Wielaard
Tom de Vries
Alan Modra
YunQiang Su
GDB Administrator
Tom Tromey
Keith Seitz
Aditya Vidyadhar Kamath
Jan Beulich
Lancelot SIX
Paul Iannetta
Guinevere Larsen
Oleg Tolmatcev