Writing regs to corefile

Jon Ringle
2005-04-25T20:37:39Z

Hello,

I have a core file that was generated due to a buggy signal handler. What
happened as far as I can tell, is that my signal handler got called due to a
SIGPIPE signal, however, my signal handler itself also caused a SIGPIPE
signal. I therefore have a recursive signal handler :( Eventually, the process
got a SIGSEGV causing a core dump to be generated. I get the following bt on
the core file:

(gdb) bt
#0 0x401672d8 in _IO_vfprintf (s=0x1d, format=0x20c3afc "\n*** PID %d returning from signal %d @ pc %08x lr %08x\n", ap=Cannot access memory at address 0xbee01f44
) at vfprintf.c:209
#1 0x40175d5c in _IO_vsprintf (string=0x20f7aa8 "\n*** PID 79 returning from signal 13 @ pc 401b9304 lr 401039d8\n",
format=0x20c3afc "\n*** PID %d returning from signal %d @ pc %08x lr %08x\n", args=0xbee0252c) at iovsprintf.c:47
#2 0x020ba51c in dbgPrintf (fmt=0x20c3afc "\n*** PID %d returning from signal %d @ pc %08x lr %08x\n") at dbgprint.c:184
#3 0x0200b278 in client_sigaction (sig=13, psi=0xbee02624, arg=0xbee026a4) at signals.c:103
#4 0x40101fc8 in pthread_sighandler_rt (signo=13, si=0xbee02624, uc=0xbee026a4) at signals.c:119
#5 <signal handler called>
Previous frame inner to this frame (corrupt stack?)
(gdb) frame 3
#3 0x0200b278 in client_sigaction (sig=13, psi=0xbee02624, arg=0xbee026a4) at signals.c:103
103 dbgPrintf("\n*** PID %d returning from signal %d @ pc %08x lr %08x\n", getpid(), sig, (unsigned int)sc->arm_pc, (unsigned int)sc->arm_lr);
(gdb) p/x *sc
$1 = {trap_no = 0x0, error_code = 0x0, oldmask = 0x80000000, arm_r0 = 0xffffffe0, arm_r1 = 0x20f7aa8, arm_r2 = 0x3f, arm_r3 = 0x0, arm_r4 = 0x3f, arm_r5 = 0x20f7aa8, arm_r6 = 0x1f,
arm_r7 = 0xbee02848, arm_r8 = 0xbee028c8, arm_r9 = 0x1d, arm_r10 = 0x40113ac4, arm_fp = 0xbee02730, arm_ip = 0x40113adc, arm_sp = 0xbee02714, arm_lr = 0x401039d8, arm_pc = 0x401b9304,
arm_cpsr = 0x60000010}

I'd like to be able to get to a backtrace of the original SIGPIPE signal. I
then hand edited the core file with the register information from the *sc
above, and got to the previous signal backtrace:

(gdb) bt
#0 0x401b9304 in write () from /home/ringlej/mp1000/trunk-fixes/Soundpipe/install/lib/libc.so.6
#1 0x401039d8 in write (fd=31, buf=0x20f7aa8, n=63) at wrapsyscall.c:139
#2 0x020ba54c in dbgPrintf (fmt=0x20c3afc "\n*** PID %d returning from signal %d @ pc %08x lr %08x\n") at dbgprint.c:188
#3 0x0200b278 in client_sigaction (sig=13, psi=0xbee02848, arg=0xbee028c8) at signals.c:103
#4 0x40101fc8 in pthread_sighandler_rt (signo=13, si=0xbee02848, uc=0xbee028c8) at signals.c:119
#5 <signal handler called>
Previous frame inner to this frame (corrupt stack?)
(gdb) info registers
r0 0xffffffe0 -32
r1 0x20f7aa8 34568872
r2 0x3f 63
r3 0x0 0
r4 0x3f 63
r5 0x20f7aa8 34568872
r6 0x1f 31
r7 0xbee02848 -1092605880
r8 0xbee028c8 -1092605752
r9 0x1d 29
r10 0x40113ac4 1074870980
r11 0xbee02730 -1092606160
r12 0x40113adc 1074871004
sp 0xbee02714 -1092606188
lr 0x401039d8 1074805208
pc 0x401b9304 1075548932
fps 0x0 0
cpsr 0x60000010 1610612752
(gdb) frame 3
#3 0x0200b278 in client_sigaction (sig=13, psi=0xbee02848, arg=0xbee028c8) at signals.c:103
103 dbgPrintf("\n*** PID %d returning from signal %d @ pc %08x lr %08x\n", getpid(), sig, (unsigned int)sc->arm_pc, (unsigned int)sc->arm_lr);
(gdb) p/x *sc
$5 = {trap_no = 0x0, error_code = 0x0, oldmask = 0x80000000, arm_r0 = 0xffffffe0, arm_r1 = 0x20f7aa8, arm_r2 = 0x3f, arm_r3 = 0x0, arm_r4 = 0x3f, arm_r5 = 0x20f7aa8, arm_r6 = 0x1f,
arm_r7 = 0xbee02a6c, arm_r8 = 0xbee02aec, arm_r9 = 0x1d, arm_r10 = 0x40113ac4, arm_fp = 0xbee02954, arm_ip = 0x40113adc, arm_sp = 0xbee02938, arm_lr = 0x401039d8, arm_pc = 0x401b9304,
arm_cpsr = 0x60000010}

I could then hand edit the core file with the *sc register information yet
again to get to the previous signal backtrace. However, this process is
tedious.

Is there another way I could traverse the recursive chain of signal handlers
that is a bit more automatic?

I can't seem to write directly to the core file register set from within gdb
(which is why I was hand editing the core file):
(gdb) set $r0 = 0xffffffe4
You can't do that without a process to debug.

Regards,

Jon