Bug 1445829

Valgrind cannot decode some ADCX and ADOX instructions. The issue was encountered on a 6th gen Skylake when using the Clang compiler on a C++ program with -std=c++03 and -std=c++11.

The upstream bug report is located at https://bugs.kde.org/show_bug.cgi?id=360415.

$ cat test.c
#include <stdint.h>

int main(int argc, char* argv[])
{
    uint32_t a = argc*4, b = argc*8;
    asm ("adcxl %1, %0" : "+r"(a) : "rm"(b));
    return a;
}

$ gcc test.c -o test.exe

$ /usr/bin/valgrind ./test.exe
==15504== Memcheck, a memory error detector
==15504== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==15504== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info
==15504== Command: ./test.exe
==15504==
vex amd64->IR: unhandled instruction bytes: 0x66 0xF 0x38 0xF6 0x45 0xF8 0x89 0x45 0xFC 0x8B
vex amd64->IR:   REX=0 REX.W=0 REX.R=0 REX.X=0 REX.B=0
vex amd64->IR:   VEX=0 VEX.L=0 VEX.nVVVV=0x0 ESC=0F38
vex amd64->IR:   PFX.66=1 PFX.F2=0 PFX.F3=0
==15504== valgrind: Unrecognised instruction at address 0x4004c6.
==15504==    at 0x4004C6: main (in /home/test/test.exe)
==15504== Your program just tried to execute an instruction that Valgrind
==15504== did not recognise.  There are two possible reasons for this.
==15504== 1. Your program has a bug and erroneously jumped to a non-code
==15504==    location.  If you are running Memcheck and you just saw a
==15504==    warning about a bad jump, it's probably your program's fault.
==15504== 2. The instruction is legitimate but Valgrind doesn't handle it,
==15504==    i.e. it's Valgrind's fault.  If you think this is the case or
==15504==    you are not sure, please let us know and we'll try to fix it.
==15504== Either way, Valgrind will now raise a SIGILL signal which will
==15504== probably kill your program.
==15504==
==15504== Process terminating with default action of signal 4 (SIGILL)
==15504==  Illegal opcode at address 0x4004C6
==15504==    at 0x4004C6: main (in /home/test/test.exe)
==15504==
==15504== HEAP SUMMARY:
==15504==     in use at exit: 0 bytes in 0 blocks
==15504==   total heap usage: 0 allocs, 0 frees, 0 bytes allocated
==15504==
==15504== All heap blocks were freed -- no leaks are possible
==15504==
==15504== For counts of detected and suppressed errors, rerun with: -v
==15504== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Illegal instruction (core dumped)

And:

$ gcc -O1 test.c -c
skylake:cryptopp$ objdump --disassemble test.o

test.o:     file format elf64-x86-64

Disassembly of section .text:

0000000000000000 <main>:
   0:   8d 04 bd 00 00 00 00    lea    0x0(,%rdi,4),%eax
   7:   c1 e7 03                shl    $0x3,%edi
   a:   66 0f 38 f6 c7          adcx   %edi,%eax
   f:   c3                      retq


**********

Valgrind has a patch to decode ADCX and ADOX for version 3.12, but it has not been applied to 3.12 or 3.13. Also see https://bugs.kde.org/show_bug.cgi?id=360415.

Building Valgrind from sources after applying the patch manually results in success.

  svn co svn://svn.valgrind.org/valgrind/trunk valgrind
  cd valgrind

  wget https://bugsfiles.kde.org/attachment.cgi?id=105193 -O adcx.patch
  cd VEX

  svn patch ../adcx.patch
  cd ..

  ./autogen.sh
  ./configure --prefix=...
  make
  make install


**********

$ lsb_release -a
LSB Version:    :core-4.1-amd64:core-4.1-noarch
Distributor ID: Fedora
Description:    Fedora release 25 (Twenty Five)
Release:        25
Codename:       TwentyFive

$ dnf info valgrind.x86_64
Last metadata expiration check: 2 days, 4:24:31 ago on Mon Apr 24 06:32:49 2017.
Installed Packages
Name        : valgrind
Arch        : x86_64
Epoch       : 1
Version     : 3.12.0
Release     : 1.fc25
Size        : 26 M
Repo        : @System
From repo   : fedora
...

$ cat /proc/cpuinfo
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 94
model name      : Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz
stepping        : 3
microcode       : 0x9e
cpu MHz         : 899.945
cache size      : 6144 KB
physical id     : 0
siblings        : 4
core id         : 0
cpu cores       : 4
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 22
wp              : yes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf tsc_known_freq pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch intel_pt tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid mpx rdseed adx smap clflushopt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp
bugs            :
bogomips        : 5424.00
clflush size    : 64
cache_alignment : 64
address sizes   : 39 bits physical, 48 bits virtual
power management:
...