commit 037505 "Fix resolving ELF symbols for live PIDs with deleted files"
changed find_dynsym to assume the PT_DYNAMIC entries had been adjusted by
the dynamic linker. That is often a correct assumption when the ELF image
comes from remote memory. But we cannot rely on that. In the case of the
vdso image the DYNAMIC segment has not been adjusted for example.
There is no good way to determine whether the DYNAMIC segment has or
hasn't been adjusted already to the load address by the dynamic linker.
So we just try twice. Once without and if the fails again with assuming
adjustments being applied.
Includes a new vdsosyms testcase that fails on i686 before and succeeds
after the fix.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Add new function dwarf_peel_type. Some type annotations in DWARF are
specified by modifier tag type wrappers instead of attributes.
For type aliases (typedef) and qualifiers (const, volatile, restrict)
tags dwarf_peel_type follows the DW_AT_type attributes till it finds
a base, user-defined, reference or pointer type DIE.
Use this new function in the backends for return type DIEs (replacing
the existing dwarf_peel_type there) and in dwarf_aggregate_size so
it can provide the sizes for qualified types too. Add a new version
and testcase for the new dwarf_aggregate_size functionality.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
We don't want to run the deleted test process under valgrind then
eu-stack will see the valgrind process backtrace.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Martin Milata:
------------------------------------------------------------------------------
RFE: dwfl_core_file_report: use NT_FILE core note if the link_map chain is broken
https://bugzilla.redhat.com/show_bug.cgi?id=1129777
The dwfl_core_file_report function follows dynamic linker's link_map chain in
order to determine the shared libraries used by the executable. As this data
structure is located in writable memory it can be overwritten by garbage, which
is sometimes the case.
https://github.com/abrt/satyr/issues/127#issuecomment-46957546
Since version 3.7 (commit 2aa362c49), Linux kernel adds NT_FILE note to core
files which contains the files mapped by the process, including shared
libraries.
------------------------------------------------------------------------------
dwfl_core_file_report now tries to fall back on NT_FILE if the link_map chain
is broken.
elfutils would already find the appropriate binary file from
/usr/lib/debug/.build-id/ symbolic links. But those symbolic links do not have
to be present on the system while NT_FILE still points to the correct binaries.
Filenames from the note NT_FILE are used only if link_map filenames failed to
locate matching binaries.
tests/test-core.core.bz2 had to have its NT_FILE disabled as run-unstrip-n.sh
otherwise FAILs:
FAIL: 0x7f67f2aaf000+0x202000 - . - /home/jkratoch/redhat/elfutils-libregr/test-core-lib.so
PASS: 0x7f67f2aaf000+0x202000 - . - test-core-lib.so
As test-core-lib.so is found in link_map but it is not present on the disk
elfutils now chooses the more reliable filename from NT_FILE (although that
filename is also not found on the disk). Updating the expected text would be
also sufficient.
libdwfl/
2014-09-26 Jan Kratochvil <jan.kratochvil@redhat.com>
Support NT_FILE for locating files.
* core-file.c (dwfl_core_file_report): New variables note_file and
note_file_size, set them and pass them to dwfl_segment_report_module.
* dwfl_segment_report_module.c: Include common.h and fcntl.h.
(buf_has_data, buf_read_ulong, handle_file_note): New functions.
(invalid_elf): New function from code of dwfl_segment_report_module.
(dwfl_segment_report_module): Add parameters note_file and
note_file_size. New variables elf and fd, clean them up in finish.
Move some code to invalid_elf. Call handle_file_note, if it found
a name verify the file by invalid_elf. Protect elf and fd against
cleanup by finish if we found the file for new Dwfl_Module.
* libdwflP.h (dwfl_segment_report_module): Add parameters note_file and
note_file_size.
tests/
2014-09-26 Jan Kratochvil <jan.kratochvil@redhat.com>
Support NT_FILE for locating files.
* Makefile.am (TESTS): Add run-linkmap-cut.sh.
(EXTRA_DIST): Add run-linkmap-cut.sh, linkmap-cut-lib.so.bz2,
linkmap-cut.bz2 and linkmap-cut.core.bz2 .
* linkmap-cut-lib.so.bz2: New file.
* linkmap-cut.bz2: New file.
* linkmap-cut.core.bz2: New file.
* run-linkmap-cut.sh: New file.
* run-unstrip-n.sh: Update its expected output.
Signed-off-by: Jan Kratochvil <jan.kratochvil@redhat.com>
For deleted shared library files the offsets to the symbol table were
calculated wrongly from the phdrs because the main_bias wasn't taken into
account.
Formerly shared libraries did not get resolved properly:
#2 0x00007fc4d86c56d6
#3 0x0000000000400938 main
Fixed elfutils produce:
#2 0x00007f61094876d6 libfunc
#3 0x0000000000400938 main
Signed-off-by: Jan Kratochvil <jan.kratochvil@redhat.com>
On some architectures (Debian armhl) system calls go through
__libc_do_syscall instead of __kernel_vsyscall. Accept either of
these symbol names for the first backtrace frame.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The special arm check in check_unsupported should only trigger for native
tests, otherwise on arm various backtrace tests would be skipped that
should work just fine.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
When dwfl_attach_state fails functions that need the process state should
return the error that caused the attach to fail. Use this in the backtrace
test to signal any attach failure. This makes sure that architectures that
don't provide unwinder support get properly detected (and the tests SKIPs)
Also don't assert when trying to attach a non-core ELF file, but return an
error to indicate failure.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Compilers and demanglers might treat local/static functions different
between versions. In particular g++ 4.1.2 and libstdc++ mangle and
demangle the static void cxxfunc (int i) function as _Z7cxxfunci.
While g++ 4.8.2 and libstdc++ mangle and demangle it as _ZL7cxxfunci.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Don't hard code the Dwarf dwz alt multi file search but allow the user
to override it through the standard Dwfl_Callbacks. Also move ownership
completely to the user of dwarf_setalt by removing free_alt from Dwarf
and adding alt, fd and elf fields to Dwfl_Module. Add a relative .dwz
file test case.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Move internal function __libdwfl_find_build_id to libdwelf and use it to
add a public dwelf_elf_gnu_build_id function to extract the NT_GNU_BUILD_ID
from an ELF file using either the shdrs or phdrs. Adjust internal callers
and add a testcase.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
New public header elfutils/libdwelf.h for low-level DWARF/ELF helper
functions. The new function dwelf_elf_gnu_debuglink returns the name and
crc as found in the .gnu_debuglink section of an ELF file.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The --enable-mudflap configure build has been broken for 2 years without
anybody apparently noticing. GCC 4.9 removed mudflap support. Before
release we now run make distcheck with valgrind support. Removal of the
mudflap configure option simplifies the build a little.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
readelf uses libdw to open the Dwarf and read some of the DWARF data.
But it also uses its own parsers to display some of the low-level
unprocessed data. If the DWARF debug section was zlib compressed it
should actually use the decompressed section data from libdw instead
of the raw section data.
Includes a testcase for those sections that couldn't be properly
displayed when compressed before.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Add aarch64 backend functions frame_nregs and set_initial_registers_tid.
Mark pc_register in aarch64 prstatus_regs as pc_register.
Add backtrace-core-aarch64 testcase.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
This adds testfilebaxmin, an ET_EXEC binary with .gnu_debugdata that
doesn't match the load address of the main file. A previous bug made
this trigger a kernel heuristic that forces the module to act like
ET_DYN, which makes things like dwfl_module_relocate_address report
relative addresses rather than proper absolute addresses.
For example, before the fix dwflsyms would print:
deregister_tm_clones (0) 0x400430, rel: 0x430 (.text)
Now it properly prints:
deregister_tm_clones (0) 0x400430, rel: 0x400430 (.text)
These new test additions confirm that it's fixed.
Signed-off-by: Josh Stone <jistone@redhat.com>
This allows CFI unwinding for ARM. It relies on having .debug_frame around
which is always the case in our testsuite. All native backtrace tests PASS
on arm if debuginfo (for glibc) is installed on the system. Otherwise the
tests SKIP.
For non-debug unwinding ARM uses EXIDX tables, not .eh_frames, which
would have to be translated to CFI to do unwinding without .debug_frame
available.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
This just makes sure that all format strings are given as literals to
printf like functions so the compiler can see and check them. Remove
all no_Wformat, add -Wformat=2 unconditionally to AM_CFLAGS.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Using dwarf_getscopes_die we can get all scopes that make up the current
subprogram representing an address. Using the call_file/line/column
attributes we can also show the source locations of these "inlined" calls.
Includes a test that shows that when DWARF debuginfo is available all
inlined function call frames and their source location can be shown.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Includes test that shows -d matches the function name that corresponds to
the actual source line we report with -s for a frame address.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Some self tests would run for a really long time (especially under valgrind)
because we included all libebl backends in the list (there are 12 backends).
Now only test two explicitly. Also there were no ET_REL files in the
self test file list. So add two ET_REL files. The total number of self test
files is now 12.
run-nm-self.sh would run 4 * 3 * 3 * 22 = 792 tests (on all self test files).
Reduce the number of different files to test to 3 (one ET_EXEC, one ET_DYN
and one ET_REL file). Reducing the number of test runs to 99.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
There can be more than 3 frames, but depending on the system/installed
glibc we might not be able to unwind fully till the end.
cxxfunc -> f -> main
Expect to see the top two and a warning that there are more frames
(exit code 1)
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Needed when /proc/sys/kernel/core_uses_pid is set to 0. Try to rename
the core file, and if it does still fail, skip the test.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
On older kernels the ptrace detach stop trick doesn't work reliably.
Just keep the child processes attached and stopped during the tests,
dwfl_linux_proc_attach will handle that fine now. Also on older kernels
raise would sometimes return anyway and cause a spurious assert. Just
ignore it.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The testcase originally came from GCC which was testing the runtime
unwinder using _Unwind_ForcedUnwind. Since we are using our own external
unwinder we can just abort at the right place and unwind from there.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Setup initial CIE values for aarch64 for use with dwarf_frame functions.
Register info prefix should be the empty string (not NULL) when not used.
Add an EM_AARCH64 testcase to tests/run-addrcfi.sh to check both issues.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Rewrite __libdwfl_attach_state_for_pid and __libdwfl_attach_state_for_core
as public functions and don't call them from dwfl_linux_proc_report and
dwfl_core_file_report anymore. This lets the user attach state explicitly
independ from how the dwfl modules have been reported. Since attaching
state is an explicit action now the error can be returned directly and we
don't need to keep track of process_attach_error. dwfl_linux_proc_attach
lets the user can tell libdwfl whether caller takes care of ptrace
attaching and stopping the threads under inspection, or whether the
callback needs to take care of that and detaching again.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
dwfl_getthread_frames is a convenience function for when the user is only
interested in one specific thread id of a process. It can be implemented by
a simple wrapper function that removes an extra callback layer just to
filter on thread id. But it also provides an optimized path to getting
access to just one particular Dwfl_Thread of the Dwfl process by providing
and (optional) new callback for the state provider. The pid_thread_callbacks
now provide an (optional) pid_getthread that doesn't need to travers all
threads anymore. Which is implemented for the linux-pid-attach provider.
stack now uses this to implement a new '-1' option that shows just one
specific thread of a process.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
On some architectures gcc might introduce some "padding instructions"
at the end of the function (like on ppc64). So only assert we are at the
last instruction of backtracegen if on x86_64 native. In theory the assert
could even fail on that architectures, but in practice it doesn't and it
is a nice test to have.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Some arches like ppc64 use function descriptor values instead of function
addresses causing matching of names and addresses to fail when using
dwfl_module_getsym or dwfl_module_addrsym.
Add ebl hook to resolve any function descriptor values found in non-ET_REL
modules.
The new function dwfl_module_getsym_info doesn't adjust the symbol value
in any way, but returns the adjusted and/or resolved address associated
with the symbol separately. The new function dwfl_module_addrinfo resolves
against both the address associated with the symbol (which could be the
function entry address) value and the adjusted st_value. So that it is
easy to resolve and match either function descriptors and/or function
entry addresses.
Since these new functions also return more information they replace the
dwfl_module_getsym_elf and dwfl_module_addrsym_elf functions that never
made it into a released elfutils version.
addr2line and readelf now use the new functions when looking up functions
names. addr2line will now also display the section the address was found
in when given -x.
Extra testcases were added for both addr2line and the dwflsyms testscase.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The only tests that fork and exec are those that will then try to ptrace
attach the child for unwind testing. That won't work when the child is
also running under valgrind. So remove --trace-children=yes. Also disable
valgrind while dumping a core or for tests that try to inspect their own
state. They will get confused otherwise finding pieces of valgrind in
their maps.
Note we still seem to hit the following valgrind bug because the way we
map and unmap some shared libraries gets valgrind confused:
https://bugs.kde.org/show_bug.cgi?id=327427
Signed-off-by: Mark Wielaard <mjw@redhat.com>
When dwarf_getlocation_implicit_pointer and dwarf_getlocation_attr
refer to a DIE that doesn't contain a DW_AT_location then don't generate
an error, but return an empty location expression to signal the actual
value pointed to is not available. This isn't invalid DWARF. Also make
sure that __libdw_intern_expression handles empty location expressions.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Mark Wielaard