Add/fix support for i386 elf core files

[dvlahovski]

Summary

There were places in the code, assuming(hardcoding) offsets
and types that were only valid for the x86_64 elf core file format.

The NT_PRSTATUS and NT_PRPSINFO structures are with the 64 bit layout.
I have reused them and parse i386 files manually, and fill them in the
same struct.

Also added some error handling during parsing that checks if the
available bytes in the buffer are enough to fill the structures.

The i386 core file test case now passes.

For reference on the structures layout, I generally used the
source of binutils (bfd, readelf)

Bug: https://llvm.org/bugs/show_bug.cgi?id=26947

[labath]

Looks great, thanks.

Please just fix the null pointer issue and we are good to go.

source/Plugins/ObjectFile/ELF/ObjectFileELF.cpp

1506 ↗

(On Diff #65937)

Originally, this was crashing the debugger because GetCStr returned a null pointer. That can still happen in case of a corrupt core file. While we're touching this code, we should fix that as well.

[dvlahovski]

Checking for null pointer, in case of a corrupt core file

[labath]

thanks

lldb/trunk/packages/Python/lldbsuite/test/functionalities/postmortem/linux-core/TestLinuxCore.py

class LinuxCoreTestCase(TestBase):
     _i386_pid   = 32306
     _x86_64_pid = 32259
     _s390x_pid  = 1045
 
     _i386_regions   = 4
     _x86_64_regions = 5
     _s390x_regions  = 2
 
-    @skipIf(bugnumber="llvm.org/pr26947")
     def test_i386(self):
         """Test that lldb can read the process information from an i386 linux core file."""
         self.do_test("i386", self._i386_pid, self._i386_regions)
 
     def test_x86_64(self):
         """Test that lldb can read the process information from an x86_64 linux core file."""
         self.do_test("x86_64", self._x86_64_pid, self._x86_64_regions)
 

lldb/trunk/source/Plugins/ObjectFile/ELF/ObjectFileELF.cpp

while (true)
         else if (note.n_name == LLDB_NT_OWNER_LINUX)
         {
             // This is sometimes found in core files and usually contains extended register info
             arch_spec.GetTriple().setOS(llvm::Triple::OSType::Linux);
         }
         else if (note.n_name == LLDB_NT_OWNER_CORE)
         {
             // Parse the NT_FILE to look for stuff in paths to shared libraries
-            // As the contents look like:
+            // As the contents look like this in a 64 bit ELF core file:
             // count     = 0x000000000000000a (10)
             // page_size = 0x0000000000001000 (4096)
             // Index start              end                file_ofs           path
             // ===== ------------------ ------------------ ------------------ -------------------------------------
             // [  0] 0x0000000000400000 0x0000000000401000 0x0000000000000000 /tmp/a.out
             // [  1] 0x0000000000600000 0x0000000000601000 0x0000000000000000 /tmp/a.out
             // [  2] 0x0000000000601000 0x0000000000602000 0x0000000000000001 /tmp/a.out
             // [  3] 0x00007fa79c9ed000 0x00007fa79cba8000 0x0000000000000000 /lib/x86_64-linux-gnu/libc-2.19.so
             // [  4] 0x00007fa79cba8000 0x00007fa79cda7000 0x00000000000001bb /lib/x86_64-linux-gnu/libc-2.19.so
             // [  5] 0x00007fa79cda7000 0x00007fa79cdab000 0x00000000000001ba /lib/x86_64-linux-gnu/libc-2.19.so
             // [  6] 0x00007fa79cdab000 0x00007fa79cdad000 0x00000000000001be /lib/x86_64-linux-gnu/libc-2.19.so
             // [  7] 0x00007fa79cdb2000 0x00007fa79cdd5000 0x0000000000000000 /lib/x86_64-linux-gnu/ld-2.19.so
             // [  8] 0x00007fa79cfd4000 0x00007fa79cfd5000 0x0000000000000022 /lib/x86_64-linux-gnu/ld-2.19.so
             // [  9] 0x00007fa79cfd5000 0x00007fa79cfd6000 0x0000000000000023 /lib/x86_64-linux-gnu/ld-2.19.so
+            // In the 32 bit ELFs the count, page_size, start, end, file_ofs are uint32_t
+            // For reference: see readelf source code (in binutils).
             if (note.n_type == NT_FILE)
             {
-                uint64_t count = data.GetU64(&offset);
-                offset += 8 + 3*8*count; // Skip page size and all start/end/file_ofs
+                uint64_t count = data.GetAddress(&offset);
+                const char *cstr;
+                data.GetAddress(&offset);                        // Skip page size
+                offset += count * 3 * data.GetAddressByteSize(); // Skip all start/end/file_ofs
                 for (size_t i=0; i<count; ++i)
                 {
-                    llvm::StringRef path(data.GetCStr(&offset));
-                    if (path.startswith("/lib/x86_64-linux-gnu"))
+                    cstr = data.GetCStr(&offset);
+                    if(cstr == nullptr)
+                    {
+                        error.SetErrorStringWithFormat("ObjectFileELF::%s trying to read at an offset after the end (GetCStr returned nullptr)", __FUNCTION__);
+                        return error;
+                    }
+                    llvm::StringRef path(cstr);
+                    if (path.startswith("/lib/x86_64-linux-gnu") || path.startswith("/lib/i386-linux-gnu"))
                     {
                         arch_spec.GetTriple().setOS(llvm::Triple::OSType::Linux);
                         break;
                     }
                 }
             }
         }
 

lldb/trunk/source/Plugins/Process/elf-core/ProcessElfCore.h

private:
 
     // Permissions for all ranges
     VMRangeToPermissions m_core_range_infos;
 
     // NT_FILE entries found from the NOTE segment
     std::vector<NT_FILE_Entry> m_nt_file_entries;
 
     // Parse thread(s) data structures(prstatus, prpsinfo) from given NOTE segment
-    void
-    ParseThreadContextsFromNoteSegment (const elf::ELFProgramHeader *segment_header,
-                                        lldb_private::DataExtractor segment_data);
+    lldb_private::Error
+    ParseThreadContextsFromNoteSegment(const elf::ELFProgramHeader *segment_header,
 
     // Returns number of thread contexts stored in the core file
     uint32_t
     GetNumThreadContexts();
 
     // Parse a contiguous address range of the process from LOAD segment
     lldb::addr_t
     AddAddressRangeFromLoadSegment(const elf::ELFProgramHeader *header);
 };
 
 #endif // liblldb_ProcessElfCore_h_

lldb/trunk/source/Plugins/Process/elf-core/ProcessElfCore.cpp

ProcessElfCore::DoLoadCore ()
     {
         const elf::ELFProgramHeader *header = core->GetProgramHeaderByIndex(i);
         assert(header != NULL);
 
         DataExtractor data = core->GetSegmentDataByIndex(i);
 
         // Parse thread contexts and auxv structure
         if (header->p_type == llvm::ELF::PT_NOTE)
-            ParseThreadContextsFromNoteSegment(header, data);
-
+        {
+            error = ParseThreadContextsFromNoteSegment(header, data);
+            if (error.Fail())
+                return error;
+        }
         // PT_LOAD segments contains address map
         if (header->p_type == llvm::ELF::PT_LOAD)
         {
             lldb::addr_t last_addr = AddAddressRangeFromLoadSegment(header);
             if (vm_addr > last_addr)
                 ranges_are_sorted = false;
             vm_addr = last_addr;
         }

 /// 5) If a core file contains multiple thread contexts then there is two data forms
 ///    a) Each thread context(2 or more NOTE entries) contained in its own segment (PT_NOTE)
 ///    b) All thread context is stored in a single segment(PT_NOTE).
 ///        This case is little tricker since while parsing we have to find where the
 ///        new thread starts. The current implementation marks beginning of
 ///        new thread when it finds NT_PRSTATUS or NT_PRPSINFO NOTE entry.
 ///    For case (b) there may be either one NT_PRPSINFO per thread, or a single
 ///    one that applies to all threads (depending on the platform type).
-void
+Error
 ProcessElfCore::ParseThreadContextsFromNoteSegment(const elf::ELFProgramHeader *segment_header,
                                                    DataExtractor segment_data)
 {
     assert(segment_header && segment_header->p_type == llvm::ELF::PT_NOTE);
 
     lldb::offset_t offset = 0;
     std::unique_ptr<ThreadData> thread_data(new ThreadData);
     bool have_prstatus = false;
     bool have_prpsinfo = false;
 
     ArchSpec arch = GetArchitecture();
     ELFLinuxPrPsInfo prpsinfo;
     ELFLinuxPrStatus prstatus;
     size_t header_size;
     size_t len;
+    Error error;
 
     // Loop through the NOTE entires in the segment
     while (offset < segment_header->p_filesz)
     {
         ELFNote note = ELFNote();
         note.Parse(segment_data, &offset);
 
         // Beginning of new thread
while (offset < segment_header->p_filesz)
             }
         }
         else if (note.n_name == "CORE")
         {
             switch (note.n_type)
             {
                 case NT_PRSTATUS:
                     have_prstatus = true;
-                    prstatus.Parse(note_data, arch);
+                    error = prstatus.Parse(note_data, arch);
+                    if (error.Fail())
+                        return error;
                     thread_data->signo = prstatus.pr_cursig;
                     thread_data->tid = prstatus.pr_pid;
                     header_size = ELFLinuxPrStatus::GetSize(arch);
                     len = note_data.GetByteSize() - header_size;
                     thread_data->gpregset = DataExtractor(note_data, header_size, len);
                     break;
                 case NT_FPREGSET:
                     thread_data->fpregset = note_data;
                     break;
                 case NT_PRPSINFO:
                     have_prpsinfo = true;
-                    prpsinfo.Parse(note_data, arch);
+                    error = prpsinfo.Parse(note_data, arch);
+                    if (error.Fail())
+                        return error;
                     thread_data->name = prpsinfo.pr_fname;
                     SetID(prpsinfo.pr_pid);
                     break;
                 case NT_AUXV:
                     m_auxv = DataExtractor(note_data);
                     break;
                 case NT_FILE:
                     {
while (offset < segment_header->p_filesz)
 
         offset += note_size;
     }
     // Add last entry in the note section
     if (thread_data && thread_data->gpregset.GetByteSize() > 0)
     {
         m_thread_data.push_back(*thread_data);
     }
+
+    return error;
 }
 
 uint32_t
 ProcessElfCore::GetNumThreadContexts ()
 {
     if (!m_thread_data_valid)
         DoLoadCore();
     return m_thread_data.size();

lldb/trunk/source/Plugins/Process/elf-core/ThreadElfCore.h

 
 struct compat_timeval
 {
     alignas(8) uint64_t tv_sec;
     alignas(8) uint64_t tv_usec;
 };
 
 // PRSTATUS structure's size differs based on architecture.
-// Currently parsing done only for x86-64 architecture by
-// simply reading data from the buffer.
+// This is the layout in the x86-64 arch.
+// In the i386 case we parse it manually and fill it again
+// in the same structure
+// The gp registers are also a part of this struct, but they are handled separately
 
 #undef si_signo
 #undef si_code
 #undef si_errno
 
 struct ELFLinuxPrStatus
 {
     int32_t si_signo;
struct ELFLinuxPrStatus
 
     compat_timeval pr_utime;
     compat_timeval pr_stime;
     compat_timeval pr_cutime;
     compat_timeval pr_cstime;
 
     ELFLinuxPrStatus();
 
-    bool
+    lldb_private::Error
     Parse(lldb_private::DataExtractor &data, lldb_private::ArchSpec &arch);
 
+    // Return the bytesize of the structure
+    // 64 bit - just sizeof
+    // 32 bit - hardcoded because we are reusing the struct, but some of the members are smaller -
+    // so the layout is not the same
     static size_t
     GetSize(lldb_private::ArchSpec &arch)
     {
         switch(arch.GetCore())
         {
             case lldb_private::ArchSpec::eCore_s390x_generic:
             case lldb_private::ArchSpec::eCore_x86_64_x86_64:
                 return sizeof(ELFLinuxPrStatus);
+            case lldb_private::ArchSpec::eCore_x86_32_i386:
+            case lldb_private::ArchSpec::eCore_x86_32_i486:
+                return 72;
             default:
                 return 0;
         }
     }
 };
 
 static_assert(sizeof(ELFLinuxPrStatus) == 112, "sizeof ELFLinuxPrStatus is not correct!");
 
+// PRPSINFO structure's size differs based on architecture.
+// This is the layout in the x86-64 arch case.
+// In the i386 case we parse it manually and fill it again
+// in the same structure
 struct ELFLinuxPrPsInfo
 {
     char pr_state;
     char pr_sname;
     char pr_zomb;
     char pr_nice;
     alignas(8) uint64_t pr_flag;
     uint32_t pr_uid;
     uint32_t pr_gid;
     int32_t pr_pid;
     int32_t pr_ppid;
     int32_t pr_pgrp;
     int32_t pr_sid;
     char pr_fname[16];
     char pr_psargs[80];
 
     ELFLinuxPrPsInfo();
 
-    bool
+    lldb_private::Error
     Parse(lldb_private::DataExtractor &data, lldb_private::ArchSpec &arch);
 
+    // Return the bytesize of the structure
+    // 64 bit - just sizeof
+    // 32 bit - hardcoded because we are reusing the struct, but some of the members are smaller -
+    // so the layout is not the same
     static size_t
     GetSize(lldb_private::ArchSpec &arch)
     {
         switch(arch.GetCore())
         {
             case lldb_private::ArchSpec::eCore_s390x_generic:
             case lldb_private::ArchSpec::eCore_x86_64_x86_64:
                 return sizeof(ELFLinuxPrPsInfo);
+            case lldb_private::ArchSpec::eCore_x86_32_i386:
+            case lldb_private::ArchSpec::eCore_x86_32_i486:
+                return 124;
             default:
                 return 0;
         }
     }
 };
 
 static_assert(sizeof(ELFLinuxPrPsInfo) == 136, "sizeof ELFLinuxPrPsInfo is not correct!");
 

lldb/trunk/source/Plugins/Process/elf-core/ThreadElfCore.cpp

 #include "lldb/Target/Target.h"
 #include "lldb/Target/Unwind.h"
 
 #include "ThreadElfCore.h"
 #include "ProcessElfCore.h"
 #include "Plugins/Process/Utility/RegisterContextLinux_arm.h"
 #include "Plugins/Process/Utility/RegisterContextLinux_arm64.h"
 #include "Plugins/Process/Utility/RegisterContextLinux_s390x.h"
+#include "Plugins/Process/Utility/RegisterContextLinux_i386.h"
 #include "Plugins/Process/Utility/RegisterContextLinux_x86_64.h"
 #include "Plugins/Process/Utility/RegisterContextFreeBSD_arm.h"
 #include "Plugins/Process/Utility/RegisterContextFreeBSD_arm64.h"
 #include "Plugins/Process/Utility/RegisterContextFreeBSD_i386.h"
 #include "Plugins/Process/Utility/RegisterContextFreeBSD_mips64.h"
 #include "Plugins/Process/Utility/RegisterContextFreeBSD_powerpc.h"
 #include "Plugins/Process/Utility/RegisterContextFreeBSD_x86_64.h"
 #include "RegisterContextPOSIXCore_arm.h"
if (concrete_frame_idx == 0)
                         reg_interface = new RegisterContextLinux_arm(arch);
                         break;
                     case llvm::Triple::aarch64:
                         reg_interface = new RegisterContextLinux_arm64(arch);
                         break;
                     case llvm::Triple::systemz:
                         reg_interface = new RegisterContextLinux_s390x(arch);
                         break;
+                    case llvm::Triple::x86:
+                        reg_interface = new RegisterContextLinux_i386(arch);
+                        break;
                     case llvm::Triple::x86_64:
                         reg_interface = new RegisterContextLinux_x86_64(arch);
                         break;
                     default:
                         break;
                 }
                 break;
             }

 //----------------------------------------------------------------
 // Parse PRSTATUS from NOTE entry
 //----------------------------------------------------------------
 ELFLinuxPrStatus::ELFLinuxPrStatus()
 {
     memset(this, 0, sizeof(ELFLinuxPrStatus));
 }
 
-bool
+Error
 ELFLinuxPrStatus::Parse(DataExtractor &data, ArchSpec &arch)
 {
+    Error error;
     ByteOrder byteorder = data.GetByteOrder();
-    size_t len;
+    if (GetSize(arch) > data.GetByteSize())
+    {
+        error.SetErrorStringWithFormat("NT_PRSTATUS size should be %lu, but the remaining bytes are: %lu",
+                                       GetSize(arch), data.GetByteSize());
+        return error;
+    }
+
     switch(arch.GetCore())
     {
         case ArchSpec::eCore_s390x_generic:
         case ArchSpec::eCore_x86_64_x86_64:
-            len = data.ExtractBytes(0, sizeof(ELFLinuxPrStatus), byteorder, this);
-            return len == sizeof(ELFLinuxPrStatus);
+            data.ExtractBytes(0, sizeof(ELFLinuxPrStatus), byteorder, this);
+            break;
+        case ArchSpec::eCore_x86_32_i386:
+        case ArchSpec::eCore_x86_32_i486:
+        {
+            // Parsing from a 32 bit ELF core file, and populating/reusing the structure
+            // properly, because the struct is for the 64 bit version
+            offset_t offset = 0;
+            si_signo = data.GetU32(&offset);
+            si_code = data.GetU32(&offset);
+            si_errno = data.GetU32(&offset);
+
+            pr_cursig = data.GetU16(&offset);
+            offset += 2; // pad
+
+            pr_sigpend = data.GetU32(&offset);
+            pr_sighold = data.GetU32(&offset);
+
+            pr_pid = data.GetU32(&offset);
+            pr_ppid = data.GetU32(&offset);
+            pr_pgrp = data.GetU32(&offset);
+            pr_sid = data.GetU32(&offset);
+
+            pr_utime.tv_sec = data.GetU32(&offset);
+            pr_utime.tv_usec = data.GetU32(&offset);
+
+            pr_stime.tv_sec = data.GetU32(&offset);
+            pr_stime.tv_usec = data.GetU32(&offset);
+
+            pr_cutime.tv_sec = data.GetU32(&offset);
+            pr_cutime.tv_usec = data.GetU32(&offset);
+
+            pr_cstime.tv_sec = data.GetU32(&offset);
+            pr_cstime.tv_usec = data.GetU32(&offset);
+
+            break;
+        }
         default:
-            return false;
+            error.SetErrorStringWithFormat("ELFLinuxPrStatus::%s Unknown architecture", __FUNCTION__);
+            break;
     }
+
+    return error;
 }
 
 //----------------------------------------------------------------
 // Parse PRPSINFO from NOTE entry
 //----------------------------------------------------------------
 ELFLinuxPrPsInfo::ELFLinuxPrPsInfo()
 {
     memset(this, 0, sizeof(ELFLinuxPrPsInfo));
 }
 
-bool
+Error
 ELFLinuxPrPsInfo::Parse(DataExtractor &data, ArchSpec &arch)
 {
+    Error error;
     ByteOrder byteorder = data.GetByteOrder();
-    size_t len;
+    if (GetSize(arch) > data.GetByteSize())
+    {
+        error.SetErrorStringWithFormat("NT_PRPSINFO size should be %lu, but the remaining bytes are: %lu",
+                                       GetSize(arch), data.GetByteSize());
+        return error;
+    }
+
     switch(arch.GetCore())
     {
         case ArchSpec::eCore_s390x_generic:
         case ArchSpec::eCore_x86_64_x86_64:
-            len = data.ExtractBytes(0, sizeof(ELFLinuxPrPsInfo), byteorder, this);
-            return len == sizeof(ELFLinuxPrPsInfo);
+            data.ExtractBytes(0, sizeof(ELFLinuxPrPsInfo), byteorder, this);
+            break;
+        case ArchSpec::eCore_x86_32_i386:
+        case ArchSpec::eCore_x86_32_i486:
+        {
+            // Parsing from a 32 bit ELF core file, and populating/reusing the structure
+            // properly, because the struct is for the 64 bit version
+            size_t size = 0;
+            offset_t offset = 0;
+
+            pr_state = data.GetU8(&offset);
+            pr_sname = data.GetU8(&offset);
+            pr_zomb = data.GetU8(&offset);
+            pr_nice = data.GetU8(&offset);
+
+            pr_flag = data.GetU32(&offset);
+            pr_uid = data.GetU16(&offset);
+            pr_gid = data.GetU16(&offset);
+
+            pr_pid = data.GetU32(&offset);
+            pr_ppid = data.GetU32(&offset);
+            pr_pgrp = data.GetU32(&offset);
+            pr_sid = data.GetU32(&offset);
+
+            size = 16;
+            data.ExtractBytes(offset, size, byteorder, pr_fname);
+            offset += size;
+
+            size = 80;
+            data.ExtractBytes(offset, size, byteorder, pr_psargs);
+            offset += size;
+
+            break;
+        }
         default:
-            return false;
+            error.SetErrorStringWithFormat("ELFLinuxPrPsInfo::%s Unknown architecture", __FUNCTION__);
+            break;
     }
+
+    return error;
 }