Strange stepping behaviour with PPC 64 and secure PLTs

[PAUL GILLIAM <pgilliam at us dot ibm dot com>]

On a system with secure PLTs for 32-bit apps, when 'next'ing through a
simple 32-bit hello world program, GDB does not execute 'printf' and
then stop.  Instead, it seems to get lost in the 'lazy' invocation of
the dynamic loader.  Here is a transcript:

        pgilliam:~/gdb/tree-head> build/gdb/gdb hello32
        GNU gdb 6.4.50.20060330-cvs
        ...
        This GDB was configured as "powerpc64-unknown-linux-gnu"...Using
        host libthread_db library "/lib64/power4/libthread_db.so.1".
        
        (gdb) start
        Breakpoint 1 at 0x100004a4: file hello-simp.c, line 6.
        Starting program: /home/pgilliam/gdb/tree-head/hello32
        main () at hello-simp.c:6
        6           printf("Hello, world\n");
        (gdb) bt
        #0  main () at hello-simp.c:6
        (gdb) n
        0x10000810 in call___do_global_ctors_aux ()
        (gdb) bt
        #0  0x10000810 in call___do_global_ctors_aux ()
        #1  0x0fea97f0 in generic_start_main ()
        from /lib/power4/libc.so.6
        #2  0x0fea9a4c in __libc_start_main ()
        from /lib/power4/libc.so.6
        #3  0x00000000 in ?? ()
        (gdb) n
        Single stepping until exit from function
        call___do_global_ctors_aux,
        which has no line number information.
        0xf7ff5110 in _dl_runtime_resolve () from /lib/ld.so.1
        (gdb) bt
        #0  0xf7ff5110 in _dl_runtime_resolve () from /lib/ld.so.1
        #1  0x100004b0 in main () at hello-simp.c:6
        (gdb) n
        Single stepping until exit from function _dl_runtime_resolve,
        which has no line number information.
        0x0fef4f70 in puts () from /lib/power4/libc.so.6
        (gdb) bt
        #0  0x0fef4f70 in puts () from /lib/power4/libc.so.6
        #1  0x100004b0 in main () at hello-simp.c:6
        (gdb) n
        Single stepping until exit from function puts,
        which has no line number information.
        
        ---- apparent hang here (really single stepping through 'puts')
        ---

If I "finish" out of 'call___do_global_ctors_aux', things don't get back
on track.  Instead, GDB "finish"s out of 'main':

        pgilliam:~/gdb/tree-head> build/gdb/gdb hello32
        GNU gdb 6.4.50.20060330-cvs
        ...
        This GDB was configured as "powerpc64-unknown-linux-gnu"...Using
        host libthread_db library "/lib64/power4/libthread_db.so.1".
        
        (gdb) start
        Breakpoint 1 at 0x100004a4: file hello-simp.c, line 6.
        Starting program: /home/pgilliam/gdb/tree-head/hello32
        main () at hello-simp.c:6
        6           printf("Hello, world\n");
        (gdb) bt
        #0  main () at hello-simp.c:6
        (gdb) n
        0x10000810 in call___do_global_ctors_aux ()
        (gdb) bt
        #0  0x10000810 in call___do_global_ctors_aux ()
        #1  0x0fea97f0 in generic_start_main ()
        from /lib/power4/libc.so.6
        #2  0x0fea9a4c in __libc_start_main ()
        from /lib/power4/libc.so.6
        #3  0x00000000 in ?? ()
        (gdb) finish
        Run till exit from #0  0x10000810 in call___do_global_ctors_aux
        ()
        Hello, world
        0x0fea97f0 in generic_start_main () from /lib/power4/libc.so.6
        (gdb) q
        
If I do a "next" instead of a finish when stopped at
call___do_global_ctors_aux, then the stack looks right again and a
"finish" will get things back on track.
        
        pgilliam@elm3b18:~/gdb/tree-head> build/gdb/gdb hello32
        GNU gdb 6.4.50.20060330-cvs
        ...
        This GDB was configured as "powerpc64-unknown-linux-gnu"...Using
        host libthread_db library "/lib64/power4/libthread_db.so.1".
        
        (gdb) start
        Breakpoint 1 at 0x100004a4: file hello-simp.c, line 6.
        Starting program: /home/pgilliam/gdb/tree-head/hello32
        main () at hello-simp.c:6
        6           printf("Hello, world\n");
        (gdb) bt
        #0  main () at hello-simp.c:6
        (gdb) n
        0x10000810 in call___do_global_ctors_aux ()
        (gdb) bt
        #0  0x10000810 in call___do_global_ctors_aux ()
        #1  0x0fea97f0 in generic_start_main ()
        from /lib/power4/libc.so.6
        #2  0x0fea9a4c in __libc_start_main ()
        from /lib/power4/libc.so.6
        #3  0x00000000 in ?? ()
        (gdb) n
        Single stepping until exit from function
        call___do_global_ctors_aux,
        which has no line number information.
        0xf7ff5110 in _dl_runtime_resolve () from /lib/ld.so.1
        (gdb) bt
        #0  0xf7ff5110 in _dl_runtime_resolve () from /lib/ld.so.1
        #1  0x100004b0 in main () at hello-simp.c:6
        (gdb) finish
        Run till exit from #0  0xf7ff5110 in _dl_runtime_resolve ()
        from /lib/ld.so.1
        Hello, world
        main () at hello-simp.c:7
        7       }
        (gdb) bt
        #0  main () at hello-simp.c:7
        (gdb) c
        Continuing.
        
        Program exited with code 015.
        (gdb) q
        

Note: in the old 32-bit PowerPC ABI the value of a PLT entry was an
executable instruction.  This was deemed security risk so in the new
ABI, PLT entries are pointer to routines, much like they are for 64-bit
apps.  In GDB for PowerPC, finding the real address of the function is
done by 'bfd_get_synthetic_symtab' when the elf file is loaded.  If this
routine was not working correctly due to a change in the ABI, would that
explain what I am seeing?

-=# Paul #=-