[Bug c/19558] New: openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[Bug c/19558] New: openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[gj at pointblue dot com dot pl]

simply compile openssl 0.9.7e with gcc 4.0 and run openssl speed (speed  
benchmark).  
  
Backtrace:  
#0  0x00002aaaaad71ed4 in bn_add_words () from /usr/lib64/libcrypto.so.0.9.7  
#1  0x00002aaaaad692d7 in BN_uadd () from /usr/lib64/libcrypto.so.0.9.7  
#2  0x00002aaaaad70a05 in BN_mod_inverse () from /usr/lib64/libcrypto.so.0.9.7  
#3  0x00002aaaaad7bec7 in RSA_blinding_on () from /usr/lib64/libcrypto.so.0.9.7  
#4  0x00002aaaaad7a1e0 in RSA_PKCS1_SSLeay ()  
   from /usr/lib64/libcrypto.so.0.9.7  
#5  0x00002aaaaad7a716 in RSA_PKCS1_SSLeay ()  
   from /usr/lib64/libcrypto.so.0.9.7  
#6  0x00002aaaaad7c222 in RSA_sign () from /usr/lib64/libcrypto.so.0.9.7  
#7  0x0000000000430d57 in ?? ()  
#8  0x00000000004111c5 in ?? ()  
#9  0x0000000000411816 in ?? ()  
#10 0x00002aaaab058829 in __libc_start_main () from /lib64/tls/libc.so.6  
#  
  
disassemby of corrupted (it seems) place:  
0x00002aaaaad71ec0 <bn_add_words+0>:    xor    %r8d,%r8d  
0x00002aaaaad71ec3 <bn_add_words+3>:    test   %ecx,%ecx  
0x00002aaaaad71ec5 <bn_add_words+5>:    jle    0x2aaaaad71eec <bn_add_words+44>  
0x00002aaaaad71ec7 <bn_add_words+7>:    mov    %rdx,%rax  
0x00002aaaaad71eca <bn_add_words+10>:   sub    %rdx,%rdx  
0x00002aaaaad71ecd <bn_add_words+13>:   data16  
0x00002aaaaad71ece <bn_add_words+14>:   data16  
0x00002aaaaad71ecf <bn_add_words+15>:   nop  
0x00002aaaaad71ed0 <bn_add_words+16>:   mov    (%rsi,%rdx,8),%rax  
0x00002aaaaad71ed4 <bn_add_words+20>:   adc    (%rdx,%rdx,8),%rax  
0x00002aaaaad71ed8 <bn_add_words+24>:   mov    %rax,(%rdi,%rdx,8)  
0x00002aaaaad71edc <bn_add_words+28>:   lea    0x1(%rdx),%rdx  
0x00002aaaaad71ee0 <bn_add_words+32>:   loop   0x2aaaaad71ed0 <bn_add_words+16>  
0x00002aaaaad71ee2 <bn_add_words+34>:   sbb    %rax,%rax  
0x00002aaaaad71ee5 <bn_add_words+37>:   mov    %rax,%r8  
0x00002aaaaad71ee8 <bn_add_words+40>:   and    $0x1,%r8d  
0x00002aaaaad71eec <bn_add_words+44>:   mov    %r8,%rax  
0x00002aaaaad71eef <bn_add_words+47>:   retq  
  
I'll attach --save-temps output or this source, if necessary.

-- 
           Summary: openssl speed compiled with 20051020 gcc-4.0 (HEAD)
                    segfaults
           Product: gcc
           Version: 4.0.0
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: gj at pointblue dot com dot pl
                CC: gcc-bugs at gcc dot gnu dot org
  GCC host triplet: x86_64
GCC target triplet: amd64


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|critical                    |normal
          Component|c                           |target
           Keywords|                            |wrong-code


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[gj at pointblue dot com dot pl]

------- Additional Comments From gj at pointblue dot com dot pl  2005-01-21 02:49 -------
it looks like that in x86_64.i file: 
 
 
unsigned long bn_add_words (unsigned long *rp, unsigned long *ap, unsigned long 
*bp,int n) 
{ unsigned long ret,i; 
 
        if (n <= 0) return 0; 
 
        asm ( 
        "       subq    %2,%2           \n" 
        ".align 16                      \n" 
        "1:     movq    (%4,%2,8),%0    \n" 
        "       adcq    (%5,%2,8),%0    \n" 
        "       movq    %0,(%3,%2,8)    \n" 
        "       leaq    1(%2),%2        \n" 
        "       loop    1b              \n" 
        "       sbbq    %0,%0           \n" 
"); asm  "addq %: "+a"(ret),"+c"(n),"+r"(i) 
                : "r"(rp),"r"(ap),"r"(bp) 
                : "cc" 
        ); 
 
  return ret&1; 
} 
 
 
and in .s file: 
bn_add_words: 
.LFB11: 
        .loc 1 154 0 
        .loc 1 156 0 
.LBB25: 
        xorl    %r9d, %r9d 
        testl   %ecx, %ecx 
        jle     .L49 
        .loc 1 158 0 
#APP 
                subq    %r8,%r8 
.align 16 
1:      movq    (%rsi,%r8,8),%rax 
        adcq    (%rdx,%r8,8),%rax 
        movq    %rax,(%rdi,%r8,8) 
        leaq    1(%r8),%r8 
        loop    1b 
        sbbq    %rax,%rax 
 
#NO_APP 
        movq    %rax, %r9 
        .loc 1 172 0 
        andl    $1, %r9d 
        .loc 1 173 0 
.L49: 
.LBE25: 
        movq    %r9, %rax 
        ret 
 
 
so it looks like function written in assembler by programmer. At least to me. 
 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2005-01-21 09:10 -------
Your test case in comment #2 has syntax errors.  Please provide something 
that does compile. 
 

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[steven at gcc dot gnu dot org]

------- Additional Comments From steven at gcc dot gnu dot org  2005-01-21 09:13 -------
The test case in comment #1 I mean, of course. 
 
You also did not specify how you compiled the test.  This bug report 
misses basically *all* the information we need to do anything useful 
for you.  Please read http://gcc.gnu.org/bugs.html and give us the 
things we need ;-) 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[gj at pointblue dot com dot pl]

------- Additional Comments From gj at pointblue dot com dot pl  2005-01-21 09:43 -------
procedure was simple. The distro I am using on my amd64 is PLD 
(www.pld-linux.org). 
I got their openssl.spec, changed .rpmmacros to use gcc-4.0 for compilaition. 
gcc was prepared from sources, I do recompile it quite often. 
 
what params spec is giving to ./config in openssl ? 
 
./Configure --openssldir=%{_var}/lib/%{name} linux-x86_64 shared debug 
I've added debug, and --save-temps to OPTFLAGS, so I can get dumps. 
 
where --openssldir doesn't matter in that case. 
>From that compiler uses: 
gcc-4.0 -fPIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H 
-DOPENSSL_NO_KRB5 -m64 -DL_ENDIAN -DTERMIO -O2 -g --save-temps -Wall 
-DMD32_REG_T=int   -c  plus some -I options. 
 
I'll attach both full *.i and *.s file for (probably) the one that crashes. 
 
I can provide you with access to that box if needed, or put somewhere tar.bz2 
of build tree of made sources. Whatever. 
 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[gj at pointblue dot com dot pl]

------- Additional Comments From gj at pointblue dot com dot pl  2005-01-21 10:07 -------
unsigned long bn_add_words (unsigned long *rp, unsigned long *ap, unsigned long 
*bp,int n) 
{ unsigned long ret,i; 
 
        if (n <= 0) return 0; 
 
        asm ( 
        "       subq    %2,%2           \n" 
        ".align 16                      \n" 
        "1:     movq    (%4,%2,8),%0    \n" 
        "       adcq    (%5,%2,8),%0    \n" 
        "       movq    %0,(%3,%2,8)    \n" 
        "       leaq    1(%2),%2        \n" 
        "       loop    1b              \n" 
        "       sbbq    %0,%0           \n" 
                : "+a"(ret),"+c"(n),"+r"(i) 
                : "r"(rp),"r"(ap),"r"(bp) 
                : "cc" 
        ); 
 
  return ret&1; 
} 
 
again. 
 
Probably bugzilla is mangling something. 
Just go to .i file and search for bn_add_words ;) 
 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[gj at pointblue dot com dot pl]

------- Additional Comments From gj at pointblue dot com dot pl  2005-01-21 12:11 -------
0.9.7d crashes too.   
Please try it on your machines.If you have some amd64 computer. 
>From the backtrace: 
... 
0x00002aaaaad71ecd <bn_add_words+13>:   data16   
0x00002aaaaad71ece <bn_add_words+14>:   data16   
0x00002aaaaad71ecf <bn_add_words+15>:   nop   
... 
this 'data' is from .align 16. Shouldn't it all be nop's ? 
 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[rth at gcc dot gnu dot org]

------- Additional Comments From rth at gcc dot gnu dot org  2005-01-23 22:04 -------
No, it should not.  See the AMD K8 documentation for recommended nop sequences.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[gj at pointblue dot com dot pl]

------- Additional Comments From gj at pointblue dot com dot pl  2005-01-24 01:50 -------
how is it invalid ? 
openssl is crashing only when compiled with gcc4. It might not be the problem 
I've higlighted, but this crash is a fact!. 
IOW, you didn't enter any resolution. 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[gj at pointblue dot com dot pl]

------- Additional Comments From gj at pointblue dot com dot pl  2005-01-24 18:47 -------
sorry, still happends on amd64. I don't have intel 32bit platorm to test it on. 
I can only say it works fine on 32bit compiled openss for sparc. 

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-01-24 19:00 -------
        ".align 16                      \n" 
This is the bug but it is not in gcc, either it is in binutils or in the source, not in gcc since gcc just 
outputs the assembly instruction aka it just copies and pastes.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[gj at pointblue dot com dot pl]

------- Additional Comments From gj at pointblue dot com dot pl  2005-01-24 20:37 -------
so if it is binutils, how do you explain that gcc 3.3.5 got that right, and it 
isnt' ok with 4.0 ? 
I have the very same version of binutils in both cases. 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[rth at gcc dot gnu dot org]

------- Additional Comments From rth at gcc dot gnu dot org  2005-01-27 06:24 -------
I say you've completely mis-diagnosed the problem, since "0x66 0x66 0x90"
is a PERFECTLY LEGITIMATE x86-64 nop sequence.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[gj at pointblue dot com dot pl]

------- Additional Comments From gj at pointblue dot com dot pl  2005-01-27 13:46 -------
Subject: Re:  openssl speed compiled with 20051020 gcc-4.0
 (HEAD) segfaults

rth at gcc dot gnu dot org wrote:
> ------- Additional Comments From rth at gcc dot gnu dot org  2005-01-27 06:24 -------
> I say you've completely mis-diagnosed the problem, since "0x66 0x66 0x90"
> is a PERFECTLY LEGITIMATE x86-64 nop sequence.
> 
sure, but that still doesn't make this bug not valid. It does it on any 
amd64 machine I have here. It doesn't do it on sparc32 (with 64bit 
kernel). I don't have any other arch to test it on. Hence, if someone 
would be so kind and test it for me. Either deny or will get the same 
resoults. I am very much in doubt this is caused by binutils.



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[dank at kegel dot com]

------- Additional Comments From dank at kegel dot com  2005-05-31 03:41 -------
See also http://marc.theaimsgroup.com/?l=openssl-dev&m=111238996923252&w=2
which says

--- snip ---
gcc-4 miscompiles inline assembly bn/asm/x86_64-gcc.c so that the
functions bn_add_words and bn_sub_words are broken and segfault.

This applies only to the stable branch as in the devel branch there is
added initialization of the ret and i variables. However the
initialization is unnecessary instead the code should be modified this way:

@@ -164,7 +186,7 @@
        "       leaq    1(%2),%2        \n"
        "       loop    1b              \n"
        "       sbbq    %0,%0           \n"
-               : "+a"(ret),"+c"(n),"+r"(i)
+               : "=&a"(ret),"+c"(n),"=&r"(i)
                : "r"(rp),"r"(ap),"r"(bp)
                : "cc"
        );
@@ -187,7 +209,7 @@
        "       leaq    1(%2),%2        \n"
        "       loop    1b              \n"
        "       sbbq    %0,%0           \n"
-               : "+a"(ret),"+c"(n),"+r"(i)
+               : "=&a"(ret),"+c"(n),"=&r"(i)
                : "r"(rp),"r"(ap),"r"(bp)
                : "cc"
        );
--- snip ---

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558

[Bug target/19558] openssl speed compiled with 20051020 gcc-4.0 (HEAD) segfaults

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-05-31 03:44 -------
(In reply to comment #17)
> See also http://marc.theaimsgroup.com/?l=openssl-dev&m=111238996923252&w=2
> which says
> 
> --- snip ---
> gcc-4 miscompiles inline assembly bn/asm/x86_64-gcc.c so that the
> functions bn_add_words and bn_sub_words are broken and segfault.

Actually the inline-asm is questionable, see PR 20718 and it is not a regression by the way, people just 
got lucky with older versions of GCC with that inline-asm.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19558