Subject: Unable to single step under ppc?

From: "Wang, Baojun" <[email-masked]>
Date: Sun, 28 Oct 2007 17:05:28 +0800

On Saturday 27 October 2007 07:14:45, you wrote：
> >>>        stw     r0,INT_FRAME_SIZE+4(r1)
> >>>
> >>>        stw     r31,INT_FRAME_SIZE+128(r1)
> >>>
> >>>        lwz     r5,EVENTS_USER_ADDR_OFFSET(r4)
> >>>        mr      r31,r5	/* r31 to hold new_domain->events_user_addr */
> >>>
> >>>        cmpwi   r3,0
> >>>        beq     1f
> >>>
> >>>        mtctr   r3
>
>                    ^^^^^ whats in R3 then ? Having 0 in r3 seems plain
>                          wrong !
>
> > hi, If they were not setup properly in tlb, then we should get a
> > DataTLBError/InstructionTLBError, I single stepped(stepi) to the `mtctr'
> > insn, then set a breakpoint at DataTLBError/InstructionTLBError, but both
> > of them were not triggered. Also, when I was at `mtctr', I could not
> > single step (use stepi) thus unable to debug the program.
>
> If you cant single step over this instruction then the address
> you are loading must have some problem.
>
> hofrat

Hi, I'm using bdi2000/gdb to debug a program which is like a module (the 
excutable is loaded by myself), but I can not single step while executing 
`bctrl', where ctr contains the valid address for the _start() function, it 
is valid because I could use `x' or `disas' command to display the contents 
of register `ctr', however when `bctrl' execute, I got unable to access 
address xxx, what the problem could be? Could somebody give me some hints? 
Thanks very much.

here is a sample debug session:

(gdb) b jump_xm_dom
Breakpoint 1 at 0xc001e694
(gdb) c
Continuing.

Breakpoint 1, 0xc001e694 in jump_xm_dom ()
Current language:  auto; currently asm
(gdb) disas $pc $pc+32
Dump of assembler code from 0xc001e694 to 0xc001e6b4:
0xc001e694 <jump_xm_dom+16>:    lwz     r5,36(r4)
0xc001e698 <jump_xm_dom+20>:    mr      r31,r5
0xc001e69c <jump_xm_dom+24>:    cmpwi   r3,0
0xc001e6a0 <jump_xm_dom+28>:    beq-    0xc001e6c0 <jump_xm_dom+60>
0xc001e6a4 <jump_xm_dom+32>:    mfmsr   r11
0xc001e6a8 <jump_xm_dom+36>:    stw     r11,240(r1)	/* store old msr */
0xc001e6ac <jump_xm_dom+40>:    andi.   r11,r11,16384	/* drop privilege */
0xc001e6b0 <jump_xm_dom+44>:    mtmsr   r11
End of assembler dump.
(gdb) nexti
0xc001e698 in jump_xm_dom ()
(gdb)
0xc001e69c in jump_xm_dom ()
(gdb)
0xc001e6a0 in jump_xm_dom ()
(gdb)
0xc001e6a4 in jump_xm_dom ()
(gdb)
0xc001e6a8 in jump_xm_dom ()
(gdb)
0xc001e6ac in jump_xm_dom ()
(gdb)
0xc001e6b0 in jump_xm_dom ()
(gdb) disas $pc $pc+32
Dump of assembler code from 0xc001e6b0 to 0xc001e6d0:
0xc001e6b0 <jump_xm_dom+44>:    mtmsr   r11
0xc001e6b4 <jump_xm_dom+48>:    mtctr   r3	/* r3 contains _start() address */
0xc001e6b8 <jump_xm_dom+52>:    bctrl
0xc001e6bc <jump_xm_dom+56>:    li      r3,0
0xc001e6c0 <jump_xm_dom+60>:    lwz     r31,320(r1)	/* restore r31 */
0xc001e6c4 <jump_xm_dom+64>:    lwz     r11,240(r1)	/* restore msr */
0xc001e6c8 <jump_xm_dom+68>:    mtmsr   r11
0xc001e6cc <jump_xm_dom+72>:    lwz     r0,196(r1)
End of assembler dump.
(gdb) nexti
0xc001e6b4 in jump_xm_dom ()
(gdb)
0xc001e6b8 in jump_xm_dom ()
(gdb) info registers
r0             0xc001b908       3221338376
r1             0xd1072e60       3506908768
r2             0xc0549b70       3226770288
r3             0x10000094       268435604
r4             0xd106c000       3506880512
r5             0x2000000        33554432
r6             0xc014033c       3222537020
r7             0xc0240000       3223584768
r8             0x20000  131072
r9             0xc02c0000       3224109056
r10            0x0      0
r11            0x0      0
r12            0x0      0
r13            0x0      0
r14            0x0      0
r15            0x0      0
r16            0x0      0
r17            0x0      0
r18            0x0      0
r19            0x0      0
r20            0x0      0
r21            0x0      0
r22            0x0      0
r23            0x0      0
r24            0x0      0
r25            0x0      0
r26            0x0      0
r27            0x0      0
r28            0x0      0
r29            0xc02c0000       3224109056
r30            0x0      0
r31            0x2000000        33554432
pc             0xc001e6b8       3221350072
cr             0x28000022       671088674
lr             0xc001b908       3221338376
---Type <return> to continue, or q <return> to quit---
ctr            0x10000094       268435604
xer            0x0      0
(gdb) x/32b $r3
0x10000094:     0x94    0x21    0xff    0x40    0x7c    0x08    0x02    0xa6
0x1000009c:     0x90    0x01    0x00    0xc4    0x7f    0xe3    0xfb    0x78
0x100000a4:     0x3d    0x20    0x10    0x01    0x90    0x69    0x07    0xa0
0x100000ac:     0x48    0x00    0x02    0x55    0x80    0x01    0x00    0xc4
(gdb) disas $r3 $r3+32
Dump of assembler code from 0x10000094 to 0x100000b4:
0x10000094:     stwu    r1,-192(r1)
0x10000098:     mflr    r0
0x1000009c:     stw     r0,196(r1)
0x100000a0:     mr      r3,r31
0x100000a4:     lis     r9,4097
0x100000a8:     stw     r3,1952(r9)
0x100000ac:     bl      0x10000300
0x100000b0:     lwz     r0,196(r1)
End of assembler dump.
(gdb) nexti
Cannot access memory at address 0xd1072e60	/* this is the SP address */
(gdb)
0x10000094 in ?? ()
Cannot access memory at address 0x10000094	/* r3 or ctr address */
(gdb)

the address 0x10000094 is accessable before `bctrl' we could see.. Is it 
because $r3 is just contain a address just for data access not instruction 
access? the page prot is: _PAGE_PRESENT | _PAGE_RW | _PAGE_HWEXEC | 
_PAGE_WRENABLE | _PAGE_USER, I think it's ready for exec..

  Regards,
Wang
-- 
Wang, Baojun                                        Lanzhou University
Distributed & Embedded System Lab              http://dslab.lzu.edu.cn
School of Information Science and Engeneering        [email-masked]
Tianshui South Road 222. Lanzhou 730000                     .P.R.China
Tel:+86-931-8912025                                Fax:+86-931-8912022