Re: Debugging big-endian ARM target from little-endian host

[Simon Marchi <simon.marchi@polymtl.ca>]

On 2019-02-27 14:50, Jeff Wandling wrote:
> I have a question about the method to configure gdb(1) to debug
> big-endian target firmware.
> 
> Question and comments, ping me directly.  I'll summarize as warranted
> based on responses.  Thanks in advance.

Hi Jeff,

You seem to have identified multiple issues, so let's focus on the 
big-endian one first, which seems the most problematic.

> The symptom/problem:
> 
> When the target firmware is compiled for big-endian, and when
> JLinkGDBServer is running such that the target is big-endian, then
> when debugging with gdb the capability to break and step fails.
> 
> The question(s) are:
> 
> If the remote target is big-endian, and the host is little-endian, is
> there something _more_ needed to be done in gdb(1) configuration to
> conduct a debug session whereas the endianness of the data and
> registers is interpreted as expected?
> Is there a setting in gdb that enforces a behavior to step INTO
> assembly functions rather than OVER them even when "si" is used?
> 
> Setup:
> Target device TMS570LC4357  (Hercules, TMS 570)   ARM Cortex-R5
> Target firmware, C/ASM code compiled as "big endian" (-mbig-endian, 
> -EB, etc..)
> 
> All compilations made with:
> $ arm-none-eabi-gcc --version
> arm-none-eabi-gcc (15:4.9.3+svn231177-1) 4.9.3 20150529 (prerelease)
> 
> $ arm-none-eabi-as --version
> GNU assembler (2.26-4ubuntu1+8) 2.26
> 
> $ arm-none-eabi-ar --version
> GNU ar (2.26-4ubuntu1+8) 2.26
> 
> $ arm-none-eabi-ld --version
> GNU ld (2.26-4ubuntu1+8) 2.26
> 
> 
> Host:
> Little-endian Xeon with Ubuntu
> Host runs JLinkGDBServer.exe  ( version V642-f)
> 
> Host runs gdb(1) version 8.2
> 
> GDB was configured as follows:
>    configure --host=x86_64-linux-gnu --target=arm-none-eabi
>              --with-auto-load-dir=:/auto-load
>              --with-auto-load-safe-path=:/auto-load
>              --with-expat
>              --with-gdb-datadir=/usr/lib/arm-none-eabi/share/gdb
>              --with-jit-reader-dir=/usr/lib/lib/gdb
>              --without-libunwind-ia64
>              --without-lzma
>              --without-babeltrace
>              --without-intel-pt
>              --disable-libmcheck
>              --without-mpfr
>              --without-guile
>              --with-separate-debug-dir=/usr/lib/lib/debug
>              --with-system-gdbinit=/usr/lib/arm-none-eabi/lib/gdbinit
> 
> 
> Data and explanation:
> 
> Suppose the firmware has a function at physical address 0x0000003C
> (somewhere in the first block of flash)
> Suppose the breakpoint set in gdb is at this address.
> 
> If the breakpoint is set, and then the firmware is run, the gdb traps
> on the breakpoint:
> 
> GNU gdb (GDB) 8.2
> Copyright (C) 2018 Free Software Foundation, Inc.
> License GPLv3+: GNU GPL version 3 or later
> This is free software: you are free to change and redistribute it.
> There is NO WARRANTY, to the extent permitted by law.
> Type "show copying" and "show warranty" for details.
> This GDB was configured as "--host=x86_64-linux-gnu 
> --target=arm-none-eabi".
> Type "show configuration" for configuration details.
> For bug reporting instructions, please see:
> .
> Find the GDB manual and other documentation resources online at:
>     .
> 
> For help, type "help".
> Type "apropos word" to search for commands related to "word".
> Reading symbols from image.elf...done.
> Remote debugging using localhost:2331
> 0x00000000 in ?? ()
> The target endianness is set automatically (currently big endian)
> (gdb) load
> Loading section .text, size 0x4758 lma 0x20
> Loading section .rodata, size 0x200 lma 0x4778
> Start address 0x3c, load size 18776
> Transfer rate: 6111 KB/sec, 6258 bytes/write.
> (gdb) br _c_int00
> Breakpoint 1 at 0x3c: file source/HL_sys_startup.c, line 88.
> (gdb) c
> Continuing.
> 
> Program received signal SIGTRAP, Trace/breakpoint trap.
> 0x3c000000 in ?? ()
> (gdb) list
> 1
> 2
> 3       int main()
> 4       {
> 5          return 0;
> 6       }
> (gdb) step
> Cannot find bounds of current function
> 
> Attempts to step fail
> "Cannot find bounds of current function"
> I presume this is because the big-endian interpretation of the PC is
> an address where the function is not located.. The function is at
> physical address 0x3C.
> (gdb) monitor regs
> PC = 3C000000, CPSR = 000003D3 (SVC mode, ARM FIQ dis. IRQ dis.)
> R0 = 00173180, R1 = FFFFFF48, R2 = 00000000, R3 = D3D3E1AB
> R4 = 00000000, R5 = 08000B60, R6 = 00000000, R7 = 0800013F
> USR: R8 =52894D31, R9 =084C44C1, R10=8D206C51, R11 =58311700, R12 
> =AC0C7CD7
>      R13=08000BA0, R14=08000137
> FIQ: R8 =180A8884, R9 =00200200, R10=97D50C37, R11 =081E1C10, R12 
> =18A40002
>      R13=00008000, R14=9167F273, SPSR=2E0008E8
> SVC: R13=04A9A810, R14=00000040, SPSR=2E0018E8
> ABT: R13=2E6FA985, R14=3C000004, SPSR=00000393
> IRQ: R13=2067F940, R14=0D044C2C, SPSR=2E0018E9
> UND: R13=01004080, R14=00000008, SPSR=0000039B

Yeah,  it seems like all registers are interpreted with the wrong 
endianness.

First, a sanity check, the command "show endian" should show that GDB 
knows the target is big endian.

In the remote protocol (which GDB uses to communicate with your target), 
register values need to be transmitted in target order (big endian in 
your case).  Let's verify that it's what JLink sends.

Do "set debug remote 1" and then "continue" so that you hit your 
breakpoint.  Towards the end of the debug output, you should see a 
vCont;c packet, with a "stop reply" packet (assuming JLink supports the 
vCont packet, and you use the all-stop mode).  Here's an example with 
x86-64:

Sending packet: $vCont;c:p209a.-1#da...Packet received: 
T05swbreak:;06:10ddffffff7f0000;07:10ddffffff7f0000;10:0c46555555550000;thread:p209a.209a;core:0;

In the response, you can see a few pairs of register number/register 
values.  Since you know the PC you expect your program to stop at, it 
should be fairly easy to spot the PC register.  The value should be in 
big endian, in your case.  In my case, 10:0c46555555550000 corresponds 
to the PC value in little endian:

(gdb) p $pc
$1 = (void (*)()) 0x55555555460c <main+4>

If you have trouble interpreting the debug remote output, pastebin it 
and send the link.

Based on what you find here, we should know whether GDB or JLink's 
gdbserver is at fault.

Simon