From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 836 invoked by alias); 13 Jun 2005 22:04:14 -0000 Mailing-List: contact gdb-patches-help@sources.redhat.com; run by ezmlm Precedence: bulk List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sources.redhat.com Received: (qmail 821 invoked by uid 22791); 13 Jun 2005 22:04:02 -0000 Received: from mail-out4.apple.com (HELO mail-out4.apple.com) (17.254.13.23) by sourceware.org (qpsmtpd/0.30-dev) with ESMTP; Mon, 13 Jun 2005 22:04:01 +0000 Received: from mailgate1.apple.com (a17-128-100-225.apple.com [17.128.100.225]) by mail-out4.apple.com (8.12.11/8.12.11) with ESMTP id j5DM3xnq002434 for ; Mon, 13 Jun 2005 15:03:59 -0700 (PDT) Received: from relay3.apple.com (relay3.apple.com) by mailgate1.apple.com (Content Technologies SMTPRS 4.3.17) with ESMTP id ; Mon, 13 Jun 2005 15:03:59 -0700 Received: from [17.201.22.21] (moleja.apple.com [17.201.22.21]) by relay3.apple.com (8.12.11/8.12.11) with ESMTP id j5DM3xG2023032; Mon, 13 Jun 2005 15:03:59 -0700 (PDT) In-Reply-To: <200506120707.j5C77TL6005645@elgar.sibelius.xs4all.nl> References: <85C775AE-3B05-431E-96D2-49EA9D1413E6@apple.com> <200506120707.j5C77TL6005645@elgar.sibelius.xs4all.nl> Mime-Version: 1.0 (Apple Message framework v728) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Cc: gdb-patches@sources.redhat.com Content-Transfer-Encoding: 7bit From: Jason Molenda Subject: Re: The gdb x86 function prologue parser Date: Mon, 13 Jun 2005 22:04:00 -0000 To: Mark Kettenis X-SW-Source: 2005-06/txt/msg00170.txt.bz2 Hi Mark, On Jun 12, 2005, at 12:07 AM, Mark Kettenis wrote: > Sorry I didn't reply before; I still was on vacation when you sent out > this mail. Not at all. Thanks for taking the time to look at it. > Another question that I have is what calling convention MacOS X will > use. Is it something like the System V ABI where the caller is > supposed to clean up the stack after a function call? It's the System V IA-32 ABI except that small structs are returned in registers, stack frames are 16-byte aligned, and large types are kept at their natural alignment. We haven't officially finalized our x86 ABI yet, so it's possible we'll tweak it a bit before we're done. But it's a safe bet that any changes will be minor variations from the SysV IA32 ABI. > I don't know to what extent your version of gdb is synched with the > FSF tree, but if it is anything close to gdb 6.x, then yes, you're > pretty much hosed if the prologue scanner fails. Yeah, our currently-shipping sources are from a merge circa March 2004. We're starting to work on another merge to the current FSF tree. > It's no surprise to > me though that the prologue scanner appears a bit weak to you though. > It started out as a prologue scanner for the origional System V > compiler with some additions to older GCC versions when I took over. > At that point, GCC still had a fixed prologue. When GCC 3.x started > scheduling prologue instructions, it also started generating usable > DWARF CFI, so whe took the conscious decision to rely on that and only > improve the prologue scanner on an as-needed basis. Since GCC 3.x > targets for all major free OS'es all use DWARF by default, this means > that the prologue scanner really only handles some bits of > hand-optimized assembler. Ah! Now it starts to make sense. I couldn't understand how this had been so untested. :) The one part I'm curious about -- does gdb get the CFI information out of gcc's eh_frame section or something? How do developers debug KDE/GNOME applications, where many functions on their stack are from optimized libraries that don't have any debug info (except maybe eh_frame)? It seems like these users should be tripping on these problems all the time. > 4. new function, i386_find_esp_adjustments(). This is used in a > > > Being able to debug -fomit-frame-pointer code without CFI probably (I was only handling -fomit-leaf-frame-pointer) > means that instead of scanning the prologue, we'll have to scan the > complete function up to the current instruction pointer. I really > wonder if that's the way we should go. Yeah, my method is not failsafe. I was trying to handle the case where the prologue adjusts the stack pointer a constant amount for the lifetime of the function. If a function has something like an alloca() call in it with a non-constant size, I'm going to lose. If I had to scan through the entire function, I'm likely to hit instructions I don't understand and stop -- stack adjustments past that point would not work. The only real way to do this is with CFI and changes like those in this proposal: http://dwarf.freestandards.org/ShowIssue.php?issue=030812.2 (which, incidentally, is up for committee review tomorrow morning -- there's some more detailed proposed text kicking around.) I don't think gcc emits anything useful to help gdb in a case like alloca (argc) today, but should be possible to express. > Well, it handles most of the frameless functions encountered on a > GNU/Linux system with GCC 3.2 fine. I tested the patch on a FedoraCore 2 system -- I have no idea which compiler was used to build the system, but I'd guess it's gcc 3.2 or 3.3 A common idiom in this release of gcc is 0xa3b990 : call 0xa3ba6d 0xa3b995 : add $0x628df,%ecx 0xa3b99b : push %ebp 0xa3b99c : mov 0xffffff5c(% ecx),%eax 0xa3b9a2 : mov 0xffffff08(% ecx),%edx 0xa3b9a8 : mov %esp,%ebp 0xa3b9aa : movl $0x0,(%eax) 0xa3b9b0 : mov %edx,0x14(%eax) 0xa3b9b3 : mov 0xfffffee0(% ecx),%edx 0xa3b9b9 : movl $0x0,0x4(%eax) and 0xa3ba6d : mov (%esp),%ecx 0xa3ba70 : ret It's the standard sequence to find the current PC so static data can be located. The add imm32, r32 isn't recognized by the prologue parser, so if you have a C file like main () { foo (); } foo () { htmlDefaultSAXHandlerInit(); // invalid, but I'm not going to let it run } put a breakpoint on main, run the program and put a breakpoint after the mov %esp,%ebp: (gdb) b *0xa3b9aa Breakpoint 2 at 0xa3b9aa (gdb) c Continuing. Breakpoint 2, 0x00a3b9aa in htmlDefaultSAXHandlerInit () from /usr/lib/libxml.so.1 (gdb) bt #0 0x00a3b9aa in htmlDefaultSAXHandlerInit () from /usr/lib/libxml.so.1 #1 0xfef1ecf8 in ?? () #2 0x080485c3 in foo () at /tmp/a.c:10 Previous frame identical to this frame (corrupt stack?) (gdb) It might seem like I'm being mean and picking the one routine that fails, but no, this idiom is used in many places and gcc often schedules it right into the prologue. It's a system library, so there's no debug info to help you out. I honestly think that gdb users are hitting this a lot more often than you'd think, but aren't reporting it. > And no, assuming that a function > has set up a stack frame isn't right; it makes gdb silently skip > function calls in backtraces. That can be very confusing. On 0th frame, you're right, it's wrong to assume that the function sets up a stack frame. But when you're off the 0th frame (and the next_frame isn't a signal trampoline or gdb dummy frame, etc.), the function set up a stack frame (assuming -fomit-frame-pointer codegen wasn't used, in which case we're in real trouble ;). If we fail to parse the prologue instructions in that function, we should assume what must be the case - that it set up a stack frame. > Assuming that a function saves the previous value of %ebp is demanded > by the System V ABI, but GCC might violate the ABI for static > functions where it knows the caller has already saved %ebp. Yeah, rth was telling me the other week that gcc 4 can even ignore the ABI for such functions and pass arguments in registers. My changes aren't the only problem in such a scenario. > Great. I haven't looked at your patch in detail yet. But it sounds > like some of the improvements can be made right away, so let's get > working on this ;-). Yeah, I need to integrate the feedback I received last week from Daniel and Eli -- lose inttypes.h, use the opcodes instruction parser instead of doing it myself -- so I'll get that stuff wrapped up and post an updated patch soon. Thanks again for all the helpful notes, Jason