>From f0f5de68a9a36e9b76351c3f176ce2e952859f11 Mon Sep 17 00:00:00 2001 From: Ulrich Weigand Date: Fri, 13 Nov 2015 14:23:09 +0100 Subject: [PATCH] ppc64: Fix serious regression (many crashes in test suite) A recent commit added code to override the unwind location for the TOC pointer register r2: unsigned int *inst = (unw_word_t*)c->dwarf.ip; if (*inst == (0xE8410000 + 24)) { // @plt call, restoring R2 from CFA+24 c->dwarf.loc[UNW_PPC64_R2] = DWARF_LOC(c->dwarf.cfa + 24, 0); } It is correct that such code is needed, since DWARF CFI does not describe the unwind location for r2 on PowerPC. However, this particular bit of code has a number of issues, which are fixed in this patch. First of all, the location CFA+24 is correct only for the ELFv2 ABI. In the ELFv1 ABI, the TOC location is actually CFA+40. More problematically, attempting to read the current instruction by just dereferencing the address in c->dwarf.ip is wrong, and may often lead to crashes. In particular: - During remote unwinding, this is always wrong since we're in the wrong address space. I've used the fetch32 helper from remote.h to use the proper access_mem under the covers. - c->dwarf.ip may be NULL if we've reached the end-of-stack. I've fixed this by moving the c->dwarf.ip == 0 check down to after unwinding (instead of before), just like all other platforms do. - Even so, c->dwarf.ip may point to some random location if we've gotten confused during unwinding earlier. One likely cause for such confusion is that we did not find DWARF CFI for some earlier frame and attempted to use the stack backchain. The problem is that this code currently claims all registers remain unchanges in such a frame, which is generally wrong. In particular if the function actually saves and modifies r31, and this is used as frame pointer by a later frame, things will likely go quite wrong. While it is not really possibly to completely fix this, I've at least marked all registers as unavailable after unwinding a frame via stack backchain. Tested on powerpc64-linux and powerpc64le-linux. The patch fixes about a dozen test cases that were crashing before. Signed-off-by: Ulrich Weigand --- src/ppc64/Gstep.c | 44 ++++++++++++++++++++++++++++++-------------- 1 files changed, 30 insertions(+), 14 deletions(-) diff --git a/src/ppc64/Gstep.c b/src/ppc64/Gstep.c index 6170adc..318beee 100644 --- a/src/ppc64/Gstep.c +++ b/src/ppc64/Gstep.c @@ -27,6 +27,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ #include "unwind_i.h" #include "ucontext_i.h" +#include "remote.h" #include /* This definition originates in /usr/include/asm-ppc64/ptrace.h, but is @@ -57,17 +58,10 @@ unw_step (unw_cursor_t * cursor) stack_frame_t dummy; unw_word_t back_chain_offset, lr_save_offset, v_regs_ptr; struct dwarf_loc back_chain_loc, lr_save_loc, sp_loc, ip_loc, v_regs_loc; - int ret; + int ret, i; Debug (1, "(cursor=%p, ip=0x%016lx)\n", c, (unsigned long) c->dwarf.ip); - if (c->dwarf.ip == 0) - { - /* Unless the cursor or stack is corrupt or uninitialized, - we've most likely hit the top of the stack */ - return 0; - } - /* Try DWARF-based unwinding... */ ret = dwarf_step (&c->dwarf); @@ -119,6 +113,11 @@ unw_step (unw_cursor_t * cursor) ret); return ret; } + + /* Mark all registers unsaved */ + for (i = 0; i < DWARF_NUM_PRESERVED_REGS; ++i) + c->dwarf.loc[i] = DWARF_NULL_LOC; + ret = 1; } else @@ -433,16 +432,33 @@ unw_step (unw_cursor_t * cursor) } } + if (c->dwarf.ip == 0) + { + /* Unless the cursor or stack is corrupt or uninitialized, + we've most likely hit the top of the stack */ + Debug (2, "returning 0\n"); + return 0; + } + // on ppc64, R2 register is used as pointer to TOC // section which is used for symbol lookup in PIC code - // ppc64 linker generates "ld r2, 24(r1)" instruction after each + // ppc64 linker generates "ld r2, 40(r1)" (ELFv1) or + // "ld r2, 24(r1)" (ELFv2) instruction after each // @plt call. We need restore R2, but only for @plt calls { - unsigned int *inst = (unw_word_t*)c->dwarf.ip; - if (*inst == (0xE8410000 + 24)) { - // @plt call, restoring R2 from CFA+24 - c->dwarf.loc[UNW_PPC64_R2] = DWARF_LOC(c->dwarf.cfa + 24, 0); - } + unw_word_t ip = c->dwarf.ip; + unw_addr_space_t as = c->dwarf.as; + unw_accessors_t *a = unw_get_accessors (as); + void *arg = c->dwarf.as_arg; + uint32_t toc_save = (as->abi == UNW_PPC64_ABI_ELFv2)? 24 : 40; + int32_t inst; + + if (fetch32 (as, a, &ip, &inst, arg) >= 0 + && (uint32_t)inst == (0xE8410000U + toc_save)) + { + // @plt call, restoring R2 from CFA+toc_save + c->dwarf.loc[UNW_PPC64_R2] = DWARF_LOC(c->dwarf.cfa + toc_save, 0); + } } Debug (2, "returning %d with last return statement\n", ret); -- 1.7.1