From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <sourceware-bugzilla@sourceware.org>
Received: by sourceware.org (Postfix, from userid 48)
	id F358E3857C52; Thu, 14 Mar 2024 01:55:18 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org F358E3857C52
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org;
	s=default; t=1710381319;
	bh=awwhG5gzaoyLG/L4NbXGvrksPKFn2Lv7A+FU7pbrBN0=;
	h=From:To:Subject:Date:From;
	b=sh7+2gncSGA7lB0/vloQ9dTkGnhkJbgO8DVkaZQWVe9EWn3N9kQZhQcKZdoVvyQN5
	 aWhCz2Ik6DnqrcfUAox+tBhJJzIuSelfr5Hu/3xZsejMO+zR9Lp63rmziPsRIh7san
	 vKqiYlsggvpWU9bXQiIAtPshLpraAxe7L0rhxX8k=
From: "boudewijn83 at gmail dot com" <sourceware-bugzilla@sourceware.org>
To: gdb-prs@sourceware.org
Subject: [Bug breakpoints/31481] New: Certain instructions load the wrong
 RIP-relative memory after setting a breakpoint
Date: Thu, 14 Mar 2024 01:55:14 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gdb
X-Bugzilla-Component: breakpoints
X-Bugzilla-Version: HEAD
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: boudewijn83 at gmail dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-31481-4717@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gdb-prs.sourceware.org>

https://sourceware.org/bugzilla/show_bug.cgi?id=3D31481

            Bug ID: 31481
           Summary: Certain instructions load the wrong RIP-relative
                    memory after setting a breakpoint
           Product: gdb
           Version: HEAD
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: breakpoints
          Assignee: unassigned at sourceware dot org
          Reporter: boudewijn83 at gmail dot com
  Target Milestone: ---

On Linux, x86-64, using any gdb version from:
  7.10.50.20150930 (commit 398e081380a204e3b9fb4eb4da069ccf471f930e)

Up to and including:
  HEAD

When you set a breakpoint at certain instructions that load RIP-relative
memory, run the program up to this breakpoint, then continue execution (or
single-step through), they will load the wrong memory.

Here's a minimal reproducible example:

  .globl _start

  .data
  .align 32
    unused1: .quad 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF
    number:  .quad 0x1122334455667788, 0xAABBCCDDEEDDCCBB
    unused2: .quad 0xEEEEEEEEEEEEEEEE, 0xEEEEEEEEEEEEEEEE

  .text
    _start:
      vmovq number(%rip), %xmm1
      vpextrq $0, %xmm1, %rdi
      mov $60, %eax
      syscall

Assemble, link, and run in strace:

  $ as -o test.o test.s && ld ./test.o && strace -e x=3Dexit ./a.out

Output is, as expected:

  exit(0x1122334455667788)

Now in gdb:

  $ gdb -ex "b _start" -ex "r" -ex "stepi 2" -ex "print/x \$rdi" ./a.out

  $1 =3D 0xccbb112233445566

Note how it somehow loaded 2 bytes from the second quad at "number".

Some instructions I found affected are:

  vmovq        number(%rip), %xmm1
  vmovdqu      number(%rip), %ymm1
  vpaddq       number(%rip), %ymm1, %ymm1
  vpxor        number(%rip), %ymm1, %ymm1
  vpbroadcastd number(%rip), %ymm1
  vpbroadcastq number(%rip), %ymm1

Some instructions NOT affected are:

  movq         number(%rip), %xmm1
  movdqu       number(%rip), %xmm1
  vpaddd       number(%rip), %ymm1, %ymm1
  vpblendd     $0xFF, number(%rip), %ymm1, %ymm1
  vpermq       $0x00, number(%rip), %ymm1

The regression seems to have occurred at the commit above, before that comm=
it
everything works as expected.

--=20
You are receiving this mail because:
You are on the CC list for the bug.=