Bug 2227356

Summary: breakpoint in vandps instruction causes register clobber
Product: Red Hat Enterprise Linux 8 Reporter: Paulo Andrade <pandrade>
Component: gdbAssignee: Keith Seitz <keiths>
gdb sub component: system-version QA Contact: qe-baseos-tools-bugs
Status: NEW --- Docs Contact:
Severity: medium    
Priority: medium CC: gdb-bugs, hartsjc, ohudlick
Version: 8.6Keywords: Triaged
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
gdb_avx_issue.tar none

Description Paulo Andrade 2023-07-28 20:37:25 UTC
Created attachment 1980527 [details]
gdb_avx_issue.tar

Example reproducer:

$ tar xf gdb_avx_issue.tar
$ cd gdb_avx_issue/
$ ./build
$ ./run 
Out 0: 0xdeadbeef
Out 1: 0xdeadbeef
Out 2: 0xdeadbeef
Out 3: 0xdeadbeef
Out 4: 0xdeadbeef
Out 5: 0xdeadbeef
Out 6: 0xdeadbeef
Out 7: 0xdeadbeef

  Now in gdb:

$ gdb run
...
(gdb) b test_func
Breakpoint 1 at 0x401240: file /usr/lib/gcc/x86_64-redhat-linux/11/include/avxintrin.h, line 174.
(gdb) r
...
Breakpoint 1, test_func (x=...) at test.c:12
12	  return _mm256_and_ps(x, constants[512]);
(gdb) c
Continuing.
Out 0: 0x00000000
Out 1: 0x00000000
Out 2: 0x00000000
Out 3: 0x00000000
Out 4: 0x00000000
Out 5: 0x00000000
Out 6: 0x00000000
Out 7: 0x00000000

This issue appears to happen not just in rhel8 but any other recent environment
tested with different gdb major versions.

For the reproducer, the issue appear to only happen if the breakpoint is in the
vandps instruction, but probably might trigger in other instructions or
conditions.

(gdb) p $ymm0
$1 = {..., v8_int32 = {-1, -1, -1, -1, -1, -1, -1, -1}, ... }
(gdb) watch $ymm0
Watchpoint 2: $ymm0
(gdb) disassemble 
Dump of assembler code for function test_func:
=> 0x0000000000401240 <+0>:	vandps 0x6e18(%rip),%ymm0,%ymm0        # 0x408060 <constants+16384>
   0x0000000000401248 <+8>:	ret
End of assembler dump.
(gdb) si

Watchpoint 2: $ymm0

Old value = {..., v8_int32 = {-1, -1, -1, -1, -1, -1, -1, -1}, ...}
New value = {..., v8_int32 = {0, 0, 0, 0, 0, 0, 0, 0}, ...}
0x0000000000401248 in test_func (x=...) at test.c:18
18	}

Comment 1 Paulo Andrade 2023-08-07 20:45:33 UTC
Any news? On a quick sampling with:

$ lldb -v
lldb version 13.0.1

it works, but failed will all gdb versions I tested.

$ lldb run
(lldb) target create "run"
Current executable set to '/home/pcpa/gdb_avx_issue/run' (x86_64).
(lldb) b test_func
Breakpoint 1: where = run`test_func [inlined] _mm256_and_ps at avxintrin.h:174:19, address = 0x0000000000401240
(lldb) r
Process 1489184 launched: '/home/pcpa/gdb_avx_issue/run' (x86_64)
Process 1489184 stopped
* thread #1, name = 'run', stop reason = breakpoint 1.1
    frame #0: 0x0000000000401240 run`test_func [inlined] _mm256_and_ps(__B=([0] = -6.2598534E+18, [1] = -6.2598534E+18, [2] = -6.2598534E+18, [3] = -6.2598534E+18, [4] = -6.2598534E+18, [5] = -6.2598534E+18, [6] = -6.2598534E+18, [7] = -6.2598534E+18), __A=<unavailable>) at avxintrin.h:174:19
   171 	extern __inline __m256 __attribute__((__gnu_inline__, __always_inline__, __artificial__))
   172 	_mm256_and_ps (__m256 __A, __m256 __B)
   173 	{
-> 174 	  return (__m256) __builtin_ia32_andps256 ((__v8sf)__A, (__v8sf)__B);
   175 	}
   176 	
   177 	extern __inline __m256d __attribute__((__gnu_inline__, __always_inline__, __artificial__))
(lldb) p $ymm0
(unsigned char __attribute__((ext_vector_type(32)))) $0 = (0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff)
(lldb) disassemble 
run`test_func:
->  0x401240 <+0>: vandps 0x6e18(%rip), %ymm0, %ymm0 ; constants + 16384
    0x401248 <+8>: retq   
(lldb) si
Process 1489184 stopped
* thread #1, name = 'run', stop reason = instruction step into
    frame #0: 0x0000000000401248 run`test_func(x=<unavailable>) at test.c:13:1
   10  	
   11  	__m256 test_func(__m256 x) {
   12  	  return _mm256_and_ps(x, constants[512]);
-> 13  	}
(lldb) p $ymm0
(unsigned char __attribute__((ext_vector_type(32)))) $1 = (0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde)
(lldb) c
Process 1489184 resuming
Out 0: 0xdeadbeef
Out 1: 0xdeadbeef
Out 2: 0xdeadbeef
Out 3: 0xdeadbeef
Out 4: 0xdeadbeef
Out 5: 0xdeadbeef
Out 6: 0xdeadbeef
Out 7: 0xdeadbeef
Process 1489184 exited with status = 0 (0x00000000) 
(lldb) q

Comment 2 Keith Seitz 2023-08-07 20:48:11 UTC
I will be looking into this tomorrow.

Comment 3 Keith Seitz 2023-08-09 14:45:51 UTC
While I do not specifically have a solution for the problem, I can
offer two workarounds which should help until a proper solution is
developed.

1) Use gdbserver.
2) Disable displaced stepping (set displaced-stepping off).
   [This can be added to a .gdbinit, e.g., or passed on command-line
    with -ex or -iex.]