R_MIPS_TLS_GD reloc overflow when linking >=xulrunner-1.9.1.5

[ZHANG Le]

http://lists.debian.org/debian-mips/2009/11/msg00015.html

There is a preliminary analysis in the above link.
I met exactly the same problem.

I have done a little further investigation. This symbol is defined in
 ./xpcom/threads/nsThreadManager.o, and its visibility is HIDDEN.

IIRC, currently binutils support multigot. If so, I have no idea why this
happened.

So what can I do next? Any suggestions?

Thanks in advance!

And please CC me since I haven't subscribed to the list.

# find -name *.o | xargs -I {} sh -c "if readelf -s {} | grep gTLSIsMainThread; then echo {}; fi"
    39: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./xpcom/ds/nsObserverService.o
    58: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./xpcom/ds/nsArray.o
   105: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./xpcom/base/nsCycleCollector.o
    66: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./xpcom/base/nsMemoryImpl.o
    63: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./xpcom/components/nsNativeComponentLoader.o
   131: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./xpcom/build/nsXPComInit.o
    73: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./xpcom/threads/TimerThread.o
    69: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./xpcom/threads/nsProcessCommon.o
   101: 00000000     1 TLS     GLOBAL HIDDEN   39 gTLSIsMainThread
./xpcom/threads/nsThreadManager.o
   109: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./xpcom/threads/nsThread.o
    51: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./intl/uconv/src/nsCharsetConverterManager.o
    54: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./security/manager/ssl/src/nsSSLThread.o
   248: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./security/manager/ssl/src/nsNSSCallbacks.o
    59: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./dom/base/nsDOMScriptObjectFactory.o
   268: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./dom/base/nsJSEnvironment.o
   203: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./dom/src/threads/nsDOMThreadService.o
   500: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./dom/src/threads/nsDOMWorkerXHR.o
   416: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./dom/src/threads/nsDOMWorker.o
   363: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./dom/src/threads/nsDOMWorkerXHRProxy.o
   114: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./js/src/xpconnect/src/xpcjsruntime.o
   115: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./js/src/xpconnect/src/xpcthreadcontext.o
   170: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./modules/plugin/base/src/nsNPAPIPlugin.o
    85: 00000000     0 TLS     GLOBAL DEFAULT  UND gTLSIsMainThread
./netwerk/base/src/nsSocketTransportService2.o


--
Zhang, Le
Gentoo/Loongson Developer
http://zhangle.is-a-geek.org
0260 C902 B8F8 6506 6586 2B90 BC51 C808 1E4E 2973

[ZHANG Le]

I made some progress, found where the problem happens:

(gdb) info b
Num     Type           Disp Enb Address    What
2       breakpoint     keep y   0x2ab390cc in mips_elf_calculate_relocation at elfxx-mips.c:5094
        stop only if r_type==R_MIPS_TLS_GD
        breakpoint already hit 2 times

return value:
5164              g = mips_elf_local_got_index (abfd, input_bfd, info,
    Value returned is $17 = 73452

5171          g = mips_elf_got_offset_from_index (info, abfd, input_bfd, g);
    Value returned is $18 = 40700

Then 40700 is passed to mips_elf_overflow_p(value, 16)

However, I haven't got time to take a look at what those two function does.
Will do it later.

BTW, the userland here is N32 ABI.

--
Zhang, Le
Gentoo/Loongson Developer
http://zhangle.is-a-geek.org
0260 C902 B8F8 6506 6586 2B90 BC51 C808 1E4E 2973

[ZHANG Le]

On 01:24 Mon 21 Dec     , Zhang Le wrote:

> I made some progress, found where the problem happens:
>
> (gdb) info b
> Num     Type           Disp Enb Address    What
> 2       breakpoint     keep y   0x2ab390cc in mips_elf_calculate_relocation at elfxx-mips.c:5094
>         stop only if r_type==R_MIPS_TLS_GD
>         breakpoint already hit 2 times
>
> return value:
> 5164              g = mips_elf_local_got_index (abfd, input_bfd, info,
>     Value returned is $17 = 73452

This problem still exists for xulrunner-1.9.3_alpha5 and binutils from cvs
(checked out today).

I found that the index's value is assigned here:

  next_index = MIPS_ELF_GOT_SIZE (entry->abfd) * (long) g->tls_assigned_gotno;

in mips_elf_initialize_tls_index().

And the g->tls_assigned_gotno is assigned here:

      g->tls_assigned_gotno = g->local_gotno + g->global_gotno;

in mips_elf_multi_got().

In one of those overflows:
  global_gotno = 0x1239
  local_gotno = 0x3c3b
So
  tls_assigned_gotno = 0x4e74

And the next_index is 0x4e74 * 4 = 80336, which is higher than 2**16.
And thus overflow.

However I still haven't found out why the local_gotno and global_gotno is so
high and how to make them not so high.

--
Zhang, Le
Gentoo/Loongson Developer
http://zhangle.is-a-geek.org
0260 C902 B8F8 6506 6586 2B90 BC51 C808 1E4E 2973

[ZHANG Le]

On 13:25 Tue 01 Jun     , Zhang Le wrote:

> On 01:24 Mon 21 Dec     , Zhang Le wrote:
> > I made some progress, found where the problem happens:
> >
> > (gdb) info b
> > Num     Type           Disp Enb Address    What
> > 2       breakpoint     keep y   0x2ab390cc in mips_elf_calculate_relocation at elfxx-mips.c:5094
> >         stop only if r_type==R_MIPS_TLS_GD
> >         breakpoint already hit 2 times
> >
> > return value:
> > 5164              g = mips_elf_local_got_index (abfd, input_bfd, info,
> >     Value returned is $17 = 73452
>
> This problem still exists for xulrunner-1.9.3_alpha5 and binutils from cvs
> (checked out today).
>
> I found that the index's value is assigned here:
>
>   next_index = MIPS_ELF_GOT_SIZE (entry->abfd) * (long) g->tls_assigned_gotno;
>
> in mips_elf_initialize_tls_index().
>
> And the g->tls_assigned_gotno is assigned here:
>
>       g->tls_assigned_gotno = g->local_gotno + g->global_gotno;
>
> in mips_elf_multi_got().
>
> In one of those overflows:
>   global_gotno = 0x1239
>   local_gotno = 0x3c3b
> So
>   tls_assigned_gotno = 0x4e74
>
> And the next_index is 0x4e74 * 4 = 80336, which is higher than 2**16.
> And thus overflow.
>
> However I still haven't found out why the local_gotno and global_gotno is so
> high and how to make them not so high.

I found this may caused by some error in estimating gotno when mering got's.
Haven't located the exact problem though.

But after changing the max_count in got_per_bfd_arg from 16377 to 12000,
all relocation overflows disappear.

Then I found 12639 is the largest allowable value.

Of course, this by no means would be the final solution.

I will go on investigating it.

--
Zhang, Le
Gentoo/Loongson Developer
http://zhangle.is-a-geek.org
0260 C902 B8F8 6506 6586 2B90 BC51 C808 1E4E 2973

[ZHANG Le]

BTW, there is a bug about this problem
http://sourceware.org/bugzilla/show_bug.cgi?id=11956

Could someone pick it up?

--
Zhang, Le
Gentoo/Loongson Developer
http://zhangle.is-a-geek.org
0260 C902 B8F8 6506 6586 2B90 BC51 C808 1E4E 2973