This is the mail archive of the
gdb@sourceware.org
mailing list for the GDB project.
Strange stepping behaviour with PPC 64 and secure PLTs
- From: PAUL GILLIAM <pgilliam at us dot ibm dot com>
- To: gdb at sources dot redhat dot com
- Date: Thu, 30 Mar 2006 14:46:21 -0800
- Subject: Strange stepping behaviour with PPC 64 and secure PLTs
- Reply-to: pgilliam at us dot ibm dot com
On a system with secure PLTs for 32-bit apps, when 'next'ing through a
simple 32-bit hello world program, GDB does not execute 'printf' and
then stop. Instead, it seems to get lost in the 'lazy' invocation of
the dynamic loader. Here is a transcript:
pgilliam:~/gdb/tree-head> build/gdb/gdb hello32
GNU gdb 6.4.50.20060330-cvs
...
This GDB was configured as "powerpc64-unknown-linux-gnu"...Using
host libthread_db library "/lib64/power4/libthread_db.so.1".
(gdb) start
Breakpoint 1 at 0x100004a4: file hello-simp.c, line 6.
Starting program: /home/pgilliam/gdb/tree-head/hello32
main () at hello-simp.c:6
6 printf("Hello, world\n");
(gdb) bt
#0 main () at hello-simp.c:6
(gdb) n
0x10000810 in call___do_global_ctors_aux ()
(gdb) bt
#0 0x10000810 in call___do_global_ctors_aux ()
#1 0x0fea97f0 in generic_start_main ()
from /lib/power4/libc.so.6
#2 0x0fea9a4c in __libc_start_main ()
from /lib/power4/libc.so.6
#3 0x00000000 in ?? ()
(gdb) n
Single stepping until exit from function
call___do_global_ctors_aux,
which has no line number information.
0xf7ff5110 in _dl_runtime_resolve () from /lib/ld.so.1
(gdb) bt
#0 0xf7ff5110 in _dl_runtime_resolve () from /lib/ld.so.1
#1 0x100004b0 in main () at hello-simp.c:6
(gdb) n
Single stepping until exit from function _dl_runtime_resolve,
which has no line number information.
0x0fef4f70 in puts () from /lib/power4/libc.so.6
(gdb) bt
#0 0x0fef4f70 in puts () from /lib/power4/libc.so.6
#1 0x100004b0 in main () at hello-simp.c:6
(gdb) n
Single stepping until exit from function puts,
which has no line number information.
---- apparent hang here (really single stepping through 'puts')
---
If I "finish" out of 'call___do_global_ctors_aux', things don't get back
on track. Instead, GDB "finish"s out of 'main':
pgilliam:~/gdb/tree-head> build/gdb/gdb hello32
GNU gdb 6.4.50.20060330-cvs
...
This GDB was configured as "powerpc64-unknown-linux-gnu"...Using
host libthread_db library "/lib64/power4/libthread_db.so.1".
(gdb) start
Breakpoint 1 at 0x100004a4: file hello-simp.c, line 6.
Starting program: /home/pgilliam/gdb/tree-head/hello32
main () at hello-simp.c:6
6 printf("Hello, world\n");
(gdb) bt
#0 main () at hello-simp.c:6
(gdb) n
0x10000810 in call___do_global_ctors_aux ()
(gdb) bt
#0 0x10000810 in call___do_global_ctors_aux ()
#1 0x0fea97f0 in generic_start_main ()
from /lib/power4/libc.so.6
#2 0x0fea9a4c in __libc_start_main ()
from /lib/power4/libc.so.6
#3 0x00000000 in ?? ()
(gdb) finish
Run till exit from #0 0x10000810 in call___do_global_ctors_aux
()
Hello, world
0x0fea97f0 in generic_start_main () from /lib/power4/libc.so.6
(gdb) q
If I do a "next" instead of a finish when stopped at
call___do_global_ctors_aux, then the stack looks right again and a
"finish" will get things back on track.
pgilliam@elm3b18:~/gdb/tree-head> build/gdb/gdb hello32
GNU gdb 6.4.50.20060330-cvs
...
This GDB was configured as "powerpc64-unknown-linux-gnu"...Using
host libthread_db library "/lib64/power4/libthread_db.so.1".
(gdb) start
Breakpoint 1 at 0x100004a4: file hello-simp.c, line 6.
Starting program: /home/pgilliam/gdb/tree-head/hello32
main () at hello-simp.c:6
6 printf("Hello, world\n");
(gdb) bt
#0 main () at hello-simp.c:6
(gdb) n
0x10000810 in call___do_global_ctors_aux ()
(gdb) bt
#0 0x10000810 in call___do_global_ctors_aux ()
#1 0x0fea97f0 in generic_start_main ()
from /lib/power4/libc.so.6
#2 0x0fea9a4c in __libc_start_main ()
from /lib/power4/libc.so.6
#3 0x00000000 in ?? ()
(gdb) n
Single stepping until exit from function
call___do_global_ctors_aux,
which has no line number information.
0xf7ff5110 in _dl_runtime_resolve () from /lib/ld.so.1
(gdb) bt
#0 0xf7ff5110 in _dl_runtime_resolve () from /lib/ld.so.1
#1 0x100004b0 in main () at hello-simp.c:6
(gdb) finish
Run till exit from #0 0xf7ff5110 in _dl_runtime_resolve ()
from /lib/ld.so.1
Hello, world
main () at hello-simp.c:7
7 }
(gdb) bt
#0 main () at hello-simp.c:7
(gdb) c
Continuing.
Program exited with code 015.
(gdb) q
Note: in the old 32-bit PowerPC ABI the value of a PLT entry was an
executable instruction. This was deemed security risk so in the new
ABI, PLT entries are pointer to routines, much like they are for 64-bit
apps. In GDB for PowerPC, finding the real address of the function is
done by 'bfd_get_synthetic_symtab' when the elf file is loaded. If this
routine was not working correctly due to a change in the ABI, would that
explain what I am seeing?
-=# Paul #=-