The ARM EABI says that the zero bit of function symbol st_value indicates
whether the symbol points to a THUMB or ARM function. Also the return
value address in an unwind will contain the same extra bit to indicate
whether to return to a regular ARM or THUMB function. Add a new ebl
function to mask off such bits and turn a function value into a function
address so that we get the actual value that a function symbol or return
address points to. It isn't easily possible to reuse the existing
ebl_resolve_sym_value for this purpose, so we end up with another hook
that can be used from dwfl_module_getsym, handle_cfi and elflint.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Use libdw/memory-access.h macros read_4ubyte_unaligned_noncvt and
read_8ubyte_unaligned_noncvt to access possibly unaligned data in
core files.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
When dwfl_attach_state fails functions that need the process state should
return the error that caused the attach to fail. Use this in the backtrace
test to signal any attach failure. This makes sure that architectures that
don't provide unwinder support get properly detected (and the tests SKIPs)
Also don't assert when trying to attach a non-core ELF file, but return an
error to indicate failure.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
As pointed out in https://bugzilla.redhat.com/show_bug.cgi?id=1107654
commit 191080 introduced a thinko that caused dwfl_standard_argp
to fail if the Dwfl couldn't be attached. Instead of generating a warning
as the comment intended, the failure would be fatal. But even warning
about dwfl_core_file_attach () or dwfl_linux_proc_attach () failing
would be a mistake. The caller/user might not be interested in such
a non-fatal issue. So just ignore if the call failed for whatever reason.
If the caller is interested in warning up front about this issue, then
dwfl_pid () should be called to check the Dwfl is attached. Things should
work just fine for anything that doesn't call any of the dwfl_state related
functions.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Don't hard code the Dwarf dwz alt multi file search but allow the user
to override it through the standard Dwfl_Callbacks. Also move ownership
completely to the user of dwarf_setalt by removing free_alt from Dwarf
and adding alt, fd and elf fields to Dwfl_Module. Add a relative .dwz
file test case.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Move internal function __libdwfl_find_build_id to libdwelf and use it to
add a public dwelf_elf_gnu_build_id function to extract the NT_GNU_BUILD_ID
from an ELF file using either the shdrs or phdrs. Adjust internal callers
and add a testcase.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
New public header elfutils/libdwelf.h for low-level DWARF/ELF helper
functions. The new function dwelf_elf_gnu_debuglink returns the name and
crc as found in the .gnu_debuglink section of an ELF file.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Found by gcc -fsanitize=undefined while running the backtrace-core-ppc test.
runtime error: shift exponent 45 is too large for 32-bit type 'unsigned int'
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The --enable-mudflap configure build has been broken for 2 years without
anybody apparently noticing. GCC 4.9 removed mudflap support. Before
release we now run make distcheck with valgrind support. Removal of the
mudflap configure option simplifies the build a little.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
If the last PT_LOAD segment that contains the whole shdrs also extends
the segment in memory beyond the end of file the program might be reusing
the memory space that we expect the shdrs to be in. Don't trust the shdrs
are valid in that case.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
As noted in https://sourceware.org/bugzilla/show_bug.cgi?id=16676#c2 for
systemtap, the heuristic used by open_elf to set the kernel Dwfl_Module
type to ET_DYN, even if the underlying ELF file e_type was set to
ET_EXEC, could trigger erroneously for non-kernel/non-main (debug or
aux) files. Make sure we only set the e_type of the module once when
processing the main file (when the phdrs can be trusted).
If a module has a "(deleted)" main ELF file, then try to read it from
remote memory if the Dwfl has process state attached by reusing the ptrace
mechanism from linux-pid-attach.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
elf_from_remote_memory would use the actual p_align of the PT_LOAD segments
to calculate the loadbase, end and start of a segment. But the dynamic
loader aligns the segments using the pagesize and only sanity checks the
p_align values. So we should do the same to get accurate segment addresses.
Also fixes a small memory leak in case the ELF image appears to be bad.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
If ino == last_ino && dmajor == last_dmajor && dminor == last_dminor then
we expect the file names to be the same as well. Which is reasonable if
the input came from the /proc file system. But there could be bad user
input if the file was supplied through dwfl_linux_proc_maps_report.
Instead of asserting on the bad input, just signal a bad_report.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
There was a type in the case of parsing ELFCLASS64 phdrs. Check against
p64 p_type, not the p32 p_type which at a different location in the union.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
For PPC64 we skip resetting the return register if it is already set.
This is because on PPC64 there are two DWARF registers numbers that can
represent the same register. Setting the return address again confuses
the unwinder. But we do want to reset it if the register number
(non-translated by the ppc64 ebl) is equal to the actual register number
as set in the CIE as return address. This happens on older toolchains in
.debug_frame where the return address is set to 108, but the ebl abi_cfi
also sets register number 65.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Rewrite __libdwfl_attach_state_for_pid and __libdwfl_attach_state_for_core
as public functions and don't call them from dwfl_linux_proc_report and
dwfl_core_file_report anymore. This lets the user attach state explicitly
independ from how the dwfl modules have been reported. Since attaching
state is an explicit action now the error can be returned directly and we
don't need to keep track of process_attach_error. dwfl_linux_proc_attach
lets the user can tell libdwfl whether caller takes care of ptrace
attaching and stopping the threads under inspection, or whether the
callback needs to take care of that and detaching again.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
When the dwfl_linux_proc_find_elf callback is used together with the
dwfl_linux_proc_report callback that reads /proc/PID/maps files we might
see and try to open special character device files that cannot be normally
read and processed by libelf (and might hang the library on the initial
open or read from the file). Make sure we only try to open and return
regular files.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
core_next_thread would allocate a new thread_arg each time but never free
it. We only need one active thread_arg to keep the state. Free it when
there are no more threads. It was also not possible to start walking all
threads in the core again. Just reset the note offset at the start.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
We might already have allocated memory to hold the build_id early in
consider_notes when we called consider_phdr for the program headers
we've read from the image. We would leak that memory when we don't use
it then because we return early/fail. This can be because either we
didn't find the correct bias or we skip the module because it would
conflict in address space with any already existing module of DWFL.
In both cases explicitly free the build_id memory.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
On PPC64 there are two DWARF registers numbers that can represent the
same register. If that register is the CIE return register then we only
want to set it once. The second setting will confuse the unwinder.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
dwfl_getthread_frames is a convenience function for when the user is only
interested in one specific thread id of a process. It can be implemented by
a simple wrapper function that removes an extra callback layer just to
filter on thread id. But it also provides an optimized path to getting
access to just one particular Dwfl_Thread of the Dwfl process by providing
and (optional) new callback for the state provider. The pid_thread_callbacks
now provide an (optional) pid_getthread that doesn't need to travers all
threads anymore. Which is implemented for the linux-pid-attach provider.
stack now uses this to implement a new '-1' option that shows just one
specific thread of a process.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Because of wrongly placed parens the result of only one asprintf call
was checked correctly. Causing dwfl_linux_kernel_report_offline to return
ENOMEM. Rewrite nested if unlikely check into separate if statements to
make clear what is actually being checked and what the actual unlikely
condition is.
Reported against systemtap "build-id difficulties with hand-built kernels"
https://sourceware.org/bugzilla/show_bug.cgi?id=16358
Reported-by: Crestez Dan Leonard <lcrestez@ixiacom.com>
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Some arches like ppc64 use function descriptor values instead of function
addresses causing matching of names and addresses to fail when using
dwfl_module_getsym or dwfl_module_addrsym.
Add ebl hook to resolve any function descriptor values found in non-ET_REL
modules.
The new function dwfl_module_getsym_info doesn't adjust the symbol value
in any way, but returns the adjusted and/or resolved address associated
with the symbol separately. The new function dwfl_module_addrinfo resolves
against both the address associated with the symbol (which could be the
function entry address) value and the adjusted st_value. So that it is
easy to resolve and match either function descriptors and/or function
entry addresses.
Since these new functions also return more information they replace the
dwfl_module_getsym_elf and dwfl_module_addrsym_elf functions that never
made it into a released elfutils version.
addr2line and readelf now use the new functions when looking up functions
names. addr2line will now also display the section the address was found
in when given -x.
Extra testcases were added for both addr2line and the dwflsyms testscase.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
dwfl_getthreads would otherwise fail to report any threads after it was
called once.
Reported-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Mark Wielaard <mjw@redhat.com>
New function that provides the index after the last non-local symbol as
returned by dwfl_module_getsym and dwfl_module_getsym_info. Allows users to
first search through all global symbols before searching the local symbols
in the table like dwfl_module_addrsym and dwfl_module_addrsym_info do as
optimization.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The result of dwarf_cfi_addrframe should have been freed when done.
Dwfl_Module cached the reloc_info and the eh_cfi it which also should
have been released when disposing of the module.
Reported-by: Masatake YAMATO <yamato@redhat.com>
Tested-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Introduce two new functions that also return the elf associated with a
symbol to make symbol section indexing work for non-special sections.
Simplify code by removing dwfl_file where appropriate and just track Elf
directly. Document limitations of shndx with existing dwfl_module_addrsym
and dwfl_module_getsym. Extend dwflsyms testcase to check some more symbol
and section (index) properties.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The aux_sym address_sync already worked with a full prelink, which has
.gnu.prelink_undo, but it failed on plain relocations with prelink -r.
Now it uses the difference in ehdr.e_entry as a first offset guess, and
the tests confirm this seems to work fine.
Signed-off-by: Josh Stone <jistone@redhat.com>
Mark Wielaard