1. The World Leader in High Performance Signal Processing Solutions How to Fix Bugs with Toolchain Jie Zhang

2. No theory for fixing bugs  Fixing bugs is trial and error.  We needs tools, experience, imagination and a little lucky.  I will introduce some tools and facilities built in the components of the toolchain.  In these slides is my experience.

3. The components in the toolchain  GCC  Binutils as ld readelf, objcopy, objdump, ar, etc.  GDB, gdbserver  simulator  uClibc  elf2flt

4. How are the tools used?  Compile bfin-uclinux-gcc -Wl,-elf2flt -g -o helloworld helloworld.c  What does user see? helloworld.c -> helloworld helloworld.gdb  Actually bfin-uclinux-gcc calls cc1 helloworld.c -> helloworld.s bfin-uclinux-gcc calls as helloworld.s -> helloworld.o bfin-uclinux-gcc calls collect2, which in turn calls ld which is wrapper script provided by elf2flt package. bfin-uclinux-ld calls ld.real crt1.o crti.o crtbegin.o helloworld.o –lgcc –lc –lgcc crtend.o crtn.o -> helloworld.elf bfin-uclinux-ld calls elf2flt helloworld.elf -> helloworld helloworld.elf is renamed to helloworld.gdb

5. How are the tools used? (cont.)  Debug GDB + simulator GDB + gdbserver  Binary file operation Objcopy Objdump Readelf

6. helloworld does not works properly – a bug  User reports a bug for gcc  But, It’s really a bug of gcc? bfin-uclinux-gcc calls cc1 helloworld.c -> helloworld.s bfin-uclinux-gcc calls as helloworld.s -> helloworld.o bfin-uclinux-gcc calls collect2, which in turn calls ld which is wrapper script provided by elf2flt package. bfin-uclinux-ld calls ld.real crt1.o crti.o crtbegin.o helloworld.o -lgcc -lc -lgcc crtend.o crtn.o -> helloworld.elf bfin-uclinux-ld calls elf2flt helloworld.elf -> helloworld helloworld.elf is renamed to helloworld.gdb User’s error kernel, or other program’s bug, like bash.

7. helloworld does not works properly (cont.)  User uses objdump to disassemble helloworld.gdb and find that there is a wrong instruction. A bug of cc1, as, or ld? No, maybe a bug of objdump.

8. helloworld cannot be debugged properly  User report a bug for GDB, for example, breakpoint doesn’t work, print command show wrong value of variable.  But it may be a bug of simulator, gdbserver, cc1, as, ld, or elf2flt.

9. Tools used to debug Tools  Native GDB  Cross GDB + gdbserver  readelf, objdump, nm  printf () and printk ()

10. Built-in facilities in the toolchain  GCC -dletters/-fdump-rtl-pass -fdump-tree-switch-options (C and C++ only)  GDB with gdbserver set debug remote 1  elf2flt -v

11. Case 1 bug #719... rec_head_status = get_reg (RTL8019_DMA_DATA); next_packet_pointer = get_reg (RTL8019_DMA_DATA); packet_length0 = get_reg (RTL8019_DMA_DATA); packet_length1 = get_reg (RTL8019_DMA_DATA);... Instead of generating asm instruction four times for get_reg function. The toolchain optimizes & generates code for a single get_reg with optimization (-Os). get_reg () is defined as: static unsigned char get_reg (unsigned int regno) { return (*(unsigned char *) regno); }

12. Case 1 (cont.) This is not a bug of toolchain. It’s a user code bug.

13. Case 2 bug #713 Compiler reported the following error when compiling > bfin-uclinux-gcc -Os -c regex.i /tmp/ccXlEqCd.s: Assembler messages: /tmp/ccXlEqCd.s:415: Error: pcrel too far BFD_RELOC_12 It may be an assembler bug or a compiler bug.

14. Case 2 (cont.)  To find out if it’s a bug of assembler or a bug of compiler is not easy. Assembler translate one 4-byte instruction between the jump instruction and its target into a 6-byte one. Compiler has a different idea with assembler on the length of one or more instruction. One optimization pass of the compiler has a different idea with the code generation pass. There are about 1000 thousand instructions between the jump instruction and its target.  just trial and error.  There is a option -dp which can annotate the instruction with a comment including the length of the instruction, like this: if !cc jump 4 (bp); jump.s L$L$373; // 7303 cbranchbi4 [length = 4]

15. Case 2 (cont.)  Finally I found that there is an instruction whose actual length does not match the length in the comment. if !cc jump 6 (bp); jump.l L$L$893; // 3389 cbranchbi4 [length = 4]  Now things were easier. Just to find out how length attribute is computed and how it was used to generate instruction for conditional branches.

16. Thanks

17. Q & A