Discussion:
Bug#1078916: rr crashes on aarch64 ARM Cortex-A53
(too old to reply)
Bernhard Übelacker
2024-08-17 16:00:01 UTC
Permalink
Package: rr
Version: 5.8.0-1
Severity: normal
X-Debbugs-Cc: debian-***@lists.debian.org, ***@mailbox.org
User: debian-***@lists.debian.org
Usertags: arm64



Dear Maintainer,
I tried to run rr within a Debian arm64 trixie/unstable,
running at a Raspberry Pi 3 with a ARM Cortex-A53.

I know this CPU does not support rr,
but crashing may still not be desired.

Following is an example gdb session where the crash happens
in the static initialization by using a "retaa" instruction,
which seems to belong to pointer authentication, but I am
not sure if this CPU is supposed to support it.

If pointer authentication is not part of the arm64 baseline,
maybe the package isa-support should provide a package
which rr can depend on, like it does to sse2-support at i386?

Kind regards,
Bernhard



***@rpi3-20240331:~# gdb -q --args rr true
Reading symbols from rr...
Reading symbols from /usr/lib/debug/.build-id/d5/cbd34499cde785655fcd7cb84960a78162b147.debug...
(gdb) set width 0
(gdb) set pagination off
(gdb) run
Starting program: /usr/bin/rr true
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".

Program received signal SIGILL, Illegal instruction.
0x0000aaaaaab1be44 in std::vector<rr::Command*, std::allocator<rr::Command*> >::_M_realloc_insert<rr::Command*> (this=<optimized out>, __position=..., ***@entry=non-dereferenceable iterator for std::vector) at /usr/include/c++/13/bits/vector.tcc:524
warning: Source file is more recent than executable.
524 }
(gdb) bt
#0 0x0000aaaaaab1be44 in std::vector<rr::Command*, std::allocator<rr::Command*> >::_M_realloc_insert<rr::Command*> (this=<optimized out>, __position=..., ***@entry=non-dereferenceable iterator for std::vector) at /usr/include/c++/13/bits/vector.tcc:524
#1 0x0000aaaaaab1b950 in std::vector<rr::Command*, std::allocator<rr::Command*> >::emplace_back<rr::Command*> (this=<optimized out>) at /usr/include/c++/13/bits/stl_iterator.h:1076
#2 std::vector<rr::Command*, std::allocator<rr::Command*> >::push_back (__x=@0xfffffffffc10: 0xaaaaaad50560 <rr::BuildidCommand::singleton>, this=<optimized out>) at /usr/include/c++/13/bits/stl_vector.h:1299
#3 rr::Command::Command (this=***@entry=0xaaaaaad50560 <rr::BuildidCommand::singleton>, name=***@entry=0xaaaaaacc8310 "buildid", help=***@entry=0xaaaaaacc8280 " rr buildid\n Accepts paths on stdin, prints buildids on stdout. Will terminate when\n either an empty line or an invalid path is provided.\n") at ./src/Command.cc:37
#4 0x0000aaaaaaaf9900 in rr::BuildidCommand::BuildidCommand (help=0xaaaaaacc8280 " rr buildid\n Accepts paths on stdin, prints buildids on stdout. Will terminate when\n either an empty line or an invalid path is provided.\n", name=0xaaaaaacc8310 "buildid", this=0xaaaaaad50560 <rr::BuildidCommand::singleton>) at ./src/BuildidCommand.cc:19
#5 __static_initialization_and_destruction_0 () at ./src/BuildidCommand.cc:28
#6 _GLOBAL__sub_I__ZN2rr14BuildidCommand9singletonE () at ./src/BuildidCommand.cc:56
#7 0x0000fffff77b229c in call_init (env=<optimized out>, argv=0xfffffffffcd8, argc=2) at ../csu/libc-start.c:145
#8 __libc_start_main_impl (main=0xaaaaaaafa530 <main(int, char**)>, argc=2, argv=0xfffffffffcd8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=<optimized out>) at ../csu/libc-start.c:347
#9 0x0000aaaaaaafc970 in _start ()
(gdb) display/i $pc
1: x/i $pc
=> 0xaaaaaab1be44 <_ZNSt6vectorIPN2rr7CommandESaIS2_EE17_M_realloc_insertIJS2_EEEvN9__gnu_cxx17__normal_iteratorIPS2_S4_EEDpOT_+180>: retaa
(gdb) shell lscpu
Architecture: aarch64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian
CPU(s): 4
On-line CPU(s) list: 0-3
Vendor ID: ARM
Model name: Cortex-A53
Model: 4
Thread(s) per core: 1
Core(s) per cluster: 4
Socket(s): -
Cluster(s): 1
Stepping: r0p4
CPU(s) scaling MHz: 100%
CPU max MHz: 1200,0000
CPU min MHz: 600,0000
BogoMIPS: 38,40
Flags: fp asimd evtstrm crc32 cpuid
...
(gdb) shell uname -a
Linux rpi3-20240331 6.10.3-arm64 #1 SMP Debian 6.10.3-1 (2024-08-04) aarch64 GNU/Linux
(gdb)




-- System Information:
Debian Release: trixie/sid
APT prefers testing-debug
APT policy: (500, 'testing-debug'), (500, 'testing')
Architecture: arm64 (aarch64)

Kernel: Linux 6.10.3-arm64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_CRAP
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages rr depends on:
ii libbrotli1 1.1.0-2+b4
ii libc6 2.39-6
ii libcapnp-1.0.1 1.0.1-4
ii libgcc-s1 14.2.0-1
ii libstdc++6 14.2.0-1
ii python3 3.12.4-1
ii zlib1g 1:1.3.dfsg+really1.3.1-1

rr recommends no packages.

rr suggests no packages.

-- no debconf information
Stephen Kitt
2024-08-18 13:00:01 UTC
Permalink
Hi Bernhard,

On Sat, 17 Aug 2024 17:49:20 +0200, Bernhard Übelacker
Post by Bernhard Übelacker
I tried to run rr within a Debian arm64 trixie/unstable,
running at a Raspberry Pi 3 with a ARM Cortex-A53.
I know this CPU does not support rr,
but crashing may still not be desired.
Following is an example gdb session where the crash happens
in the static initialization by using a "retaa" instruction,
which seems to belong to pointer authentication, but I am
not sure if this CPU is supposed to support it.
If pointer authentication is not part of the arm64 baseline,
maybe the package isa-support should provide a package
which rr can depend on, like it does to sse2-support at i386?
rr isn’t supposed to crash on unsupported CPUs; on my Allwinner A64
Cortex-A53 system it exits with

[FATAL ./src/PerfCounters_aarch64.h:83:compute_cpu_microarch()] Unknown
aarch64 CPU type implementer: 0x41, variant: 0x0 part: 0xd03


Presumably on your system, retaa is encountered before this check. My A53
system supports more features than yours (lscpu reports aes, pmull, sha1, and
sha2 in addition to the flags in your lscpu output), perhaps it supports
retaa — I don’t know enough about ARMv8 (v8.3-A in fact) to determine that.
The build specifies -march=armv8.3-a so it is definitely possible for
unsupported instructions to be encountered before CPU identification has
finished...

I take it "rr true" fails similarly, outside of gdb?

Regards,

Stephen
Bernhard Übelacker
2024-08-18 18:00:01 UTC
Permalink
Post by Stephen Kitt
Hi Bernhard,
On Sat, 17 Aug 2024 17:49:20 +0200, Bernhard Übelacker
Post by Bernhard Übelacker
I tried to run rr within a Debian arm64 trixie/unstable,
running at a Raspberry Pi 3 with a ARM Cortex-A53.
I know this CPU does not support rr,
but crashing may still not be desired.
Following is an example gdb session where the crash happens
in the static initialization by using a "retaa" instruction,
which seems to belong to pointer authentication, but I am
not sure if this CPU is supposed to support it.
If pointer authentication is not part of the arm64 baseline,
maybe the package isa-support should provide a package
which rr can depend on, like it does to sse2-support at i386?
rr isn’t supposed to crash on unsupported CPUs; on my Allwinner A64
Cortex-A53 system it exits with
[FATAL ./src/PerfCounters_aarch64.h:83:compute_cpu_microarch()] Unknown
aarch64 CPU type implementer: 0x41, variant: 0x0 part: 0xd03
Presumably on your system, retaa is encountered before this check. My A53
system supports more features than yours (lscpu reports aes, pmull, sha1, and
sha2 in addition to the flags in your lscpu output), perhaps it supports
retaa — I don’t know enough about ARMv8 (v8.3-A in fact) to determine that.
The build specifies -march=armv8.3-a so it is definitely possible for
unsupported instructions to be encountered before CPU identification has
finished...
I take it "rr true" fails similarly, outside of gdb?
Regards,
Stephen
Hello Stephen,
yes, outside of gdb it crashes too [1].

I also forgot to note the rr build in bookworm (5.6.0-3+b1)
does not show this issue and shows the expected message about
the unknown/unsupported CPU.

Kind regards,
Bernhard

[1]
***@rpi3-20240331:~# rr true
Ungültiger Maschinenbefehl (Speicherabzug geschrieben)
***@rpi3-20240331:~#

[2]
***@chroot-12-bookworm-stable-arm64:~# rr --version
rr version 5.6.0
***@chroot-12-bookworm-stable-arm64:~# rr true
[FATAL ./src/PerfCounters_aarch64.h:83:compute_cpu_microarch()] Unknown aarch64 CPU type implementer: 0x41, variant: 0x0 part: 0xd03
***@chroot-12-bookworm-stable-arm64:~#

Loading...