[tcf-dev] Faulty address resolving of global variable in tcf_elf.c

["Lillieskold, Claes" <claes.lillieskold@xxxxxxxxx>]

Hi,
I have a problem resolving the address of a global variable that resides in a Data (nm type 'D') section.
When debugging TCF (starting with get_location_info()), I get down to the function
elf_run_time_address_in_region(), which is iterates through the ELF program headers and 
attempts to find the right location for the variable using the each MemoryRegion that is passed 
from elf_map_to_run_time_address().

The correct address for my variable should be 0xff170200 (from ELF information, nm, and DWARF
information, objdump -W), but I get 0xff06c200.

If I understand the code in elf_run_time_address_in_region() correctly,
the conditions on line 1637 - 1640 in tcf_elf.c should be enough to find the
right combination of MemoryRegion and ELF program header which matches
the address, but it seems that I get a false hit.

Setting a breakpoint on tcf_elf.c:1641 and printing some variables after 'rt' has been set,
I get this 'rt' in elf_run_time_address_in_region() which uses the region starting at 0xff06c000.

Address addr:
    addr = 0x00000000ff170200
ELF_PHeader p:
    address  = 0x00000000ff170000
    mem_size = 0x00000000000008c0
    offset   = 0x000000000000ef8c
MemoryRegion r:
    addr      = 0x000000000000ef8c
   size      = 0x00000000ff06c000
    file_offs = 0x0000000000000850
Address rt:
    rt = 0x00000000ff06c200

I'm not sure *if* and *which* check is missing, but just for experimentation,
I added a check of the MemoryRegion in elf_map_to_run_time_address() before
calling elf_run_time_address_in_region:

+        if (addr < r->addr || addr > r->addr + r->size) {
+            continue;
+        }
         rt = elf_run_time_address_in_region(ctx, r, file, sec, addr);

Unlikely that this is correct, but with this fix, I get the correct address  for my symbol using 
the MemoryRegion starting at address 0xff170000:

Address addr:
    addr = 0x00000000ff170200
ELF_PHeader p:
    address  = 0x00000000ff170000
    mem_size = 0x00000000000008c0 <- equal to r->file_offs
    offset   = 0x000000000000ef8c
MemoryRegion r:
    addr      = 0x000000000000ef8c
    size      = 0x00000000ff170000
    file_offs = 0x00000000000008c0
Address rt:
  rt = 0x00000000ff170200

Perhaps the ELF program header should be range-checked against MemoryMap
somehow before (line 1639) calculating the address on line ?

Best regards,
Claes

PS: Code is from SHA a39644fbcd864ca93ba2033f7ac36e1f742db22d

tcf_elf.c:
1637 if (!is_p_header_region(file, p, r)) continue;
1638 if (addr < p->address || addr >= p->address + p->mem_size) continue;
1639 rt = (ContextAddress)(addr - p->address + p->offset - r->file_offs + r->addr);
1640 if (rt < r->addr || rt >= r->addr + r->size) continue;
1641 return rt;
----------------------------------------------------------------------
Intel Sweden AB
Registered Office: Isafjordsgatan 30B, 164 40 Kista, Stockholm, Sweden
Registration Number: 556189-6027

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.