[Bug breakpoints/27205] New: [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)

[Bug breakpoints/27205] New: [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27205

            Bug ID: 27205
           Summary: [-m32] FAIL: gdb.base/longjmp.exp: next over
                    longjmp(1)
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: breakpoints
          Assignee: unassigned at sourceware dot org
          Reporter: vries at gcc dot gnu.org
  Target Milestone: ---

On openSUSE Factory I see with target board unix/-m32:
...
(gdb) PASS: gdb.base/longjmp.exp: next to longjmp (1)
next^M
Warning:^M
Cannot insert breakpoint 0.^M
Cannot access memory at address 0xcfb589ee^M
^M
__libc_siglongjmp (env=0x804c040 <env>, val=1) at ../setjmp/longjmp.c:30^M
30      }^M
(gdb) FAIL: gdb.base/longjmp.exp: next over longjmp(1)
...

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug breakpoints/27205] [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27205

--- Comment #1 from Tom de Vries <vries at gcc dot gnu.org> ---
The failure to access memory is due to glibc having pointer encryption (aka
"pointer mangling" or "pointer guard") of the long jump buffer.

So, when we're trying to read pc from the long jump buffer in
i386_get_longjmp_target, we get an encrypted pointer, and don't decrypt it. 
This issue has been known for a bit, see
https://sourceware.org/legacy-ml/gdb-patches/2008-04/msg00127.html.

Possibly error mode could be improved: if we can detect that pc is not in a
text segment or displaced stepping buffer, we return 0 in
i386_get_longjmp_target, and revert to single stepping.

Anyway, the reason we're exercising i386_get_longjmp_target is that this fails:
...

          /* If we set the longjmp breakpoint via a SystemTap probe,            
             then use it to extract the arguments.  The destination PC          
             is the third argument to the probe.  */
          arg_value = probe_safe_evaluate_at_pc (frame, 2);
...
I double checked on openSUSE Leap 15.2 and there this works, so I'll try to
figure out what's the difference.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug breakpoints/27205] [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27205

--- Comment #2 from Tom de Vries <vries at gcc dot gnu.org> ---
This could be the longjmp version of PR26881.

We install both master longjmp breakpoints using probe, and longjmp_names, in
case libc debug info package is installed. 

For -m64, the probe one trigger first, and everything is handled properly. 
With -m32, the longjump_names one triggers first, and we run into the encrypted
pc problem.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug breakpoints/27205] [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27205

--- Comment #3 from Tom de Vries <vries at gcc dot gnu.org> ---
After installing glibc debug info for m32 on openSUSE Leap, I got the same, so
the problem is reproducible with both glibc 2.26 and 2.32.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug breakpoints/27205] [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27205

--- Comment #4 from Tom de Vries <vries at gcc dot gnu.org> ---
Created attachment 13148
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13148&action=edit
Tentative patch

Tentative patch, fixes failure.

Similar to fix for master exception breakpoint in 1940319c0ef "[gdb] Fix
internal-error in process_event_stop_test" .

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug breakpoints/27205] [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27205

--- Comment #5 from Tom de Vries <vries at gcc dot gnu.org> ---
Patch submitted:
https://sourceware.org/pipermail/gdb-patches/2021-January/175503.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug breakpoints/27205] [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27205

--- Comment #6 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Tom de Vries <vries@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=2a7f6487d0a2f9a5f16d0f67904ac35100313eb1

commit 2a7f6487d0a2f9a5f16d0f67904ac35100313eb1
Author: Tom de Vries <tdevries@suse.de>
Date:   Thu Jan 28 10:59:42 2021 +0100

    [gdb/breakpoints] Fix longjmp master breakpoint with separate debug info

    When running test-case gdb.base/longjmp.exp with target board unix/-m32, we
    run into:
    ...
    (gdb) next^M
    Warning:^M
    Cannot insert breakpoint 0.^M
    Cannot access memory at address 0x7dbf7353^M
    ^M
    __libc_siglongjmp (env=0x804a040 <env>, val=1) at longjmp.c:28^M
    28        longjmps++;^M
    (gdb) FAIL: gdb.base/longjmp.exp: next over longjmp(1)
    ...

    The failure to access memory happens in i386_get_longjmp_target and is due
to
    glibc having pointer encryption (aka "pointer mangling" or "pointer guard")
of
    the long jump buffer.  This is a known problem.

    In create_longjmp_master_breakpoint (which attempts to install a master
    longjmp breakpoint) a preference scheme is present, which installs a
    probe breakpoint if a libc:longjmp probe is present, and otherwise falls
back
    to setting breakpoints at the names in the longjmp_names array.

    But in fact, both the probe breakpoint and the longjmp_names breakpoints
are
    set.  The latter ones are set when processing libc.so.debug, and the former
    one when processing libc.so.  In other words, this is the longjmp variant
of
    PR26881, which describes the same problem for master exception breakpoints.

    This problem only triggers when the glibc debug info package is installed,
    which is not due to the debug info itself in libc.so.debug, but due to the
    minimal symbols (because create_longjmp_master_breakpoint uses minimal
symbols
    to translate the longjmp_names to addresses).

    The problem doesn't trigger for -m64, because there tdep->jb_pc_offset is
not
    set.

    Fix this similar to commit 1940319c0ef (the fix for PR26881): only install
    longjmp_names breakpoints in libc.so/libc.so.debug if installing the
    libc:longjmp probe in libc.so failed.

    Tested on x86_64-linux.

    gdb/ChangeLog:

    2021-01-28  Tom de Vries  <tdevries@suse.de>

            PR breakpoints/27205
            * breakpoint.c (create_longjmp_master_breakpoint_probe)
            (create_longjmp_master_breakpoint_names): New function, factored
out
            of ...
            (create_longjmp_master_breakpoint): ... here.  Only try to install
            longjmp_names breakpoints in libc.so/libc.so.debug if installing
probe
            breakpoint in libc.so failed.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug breakpoints/27205] [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27205

Tom de Vries <vries at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED
   Target Milestone|---                         |11.1

--- Comment #7 from Tom de Vries <vries at gcc dot gnu.org> ---
Patch committed, marking resolved-fixed.

-- 
You are receiving this mail because:
You are on the CC list for the bug.