Bug 2227356 - breakpoint in vandps instruction causes register clobber
Summary: breakpoint in vandps instruction causes register clobber
Keywords:
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: gdb
Version: 8.6
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Keith Seitz
QA Contact: qe-baseos-tools-bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-07-28 20:37 UTC by Paulo Andrade
Modified: 2023-08-15 18:34 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
gdb_avx_issue.tar (10.00 KB, application/x-tar)
2023-07-28 20:37 UTC, Paulo Andrade
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-163812 0 None None None 2023-07-28 20:38:14 UTC
Red Hat Knowledge Base (Solution) 7028078 0 None None None 2023-08-09 17:40:45 UTC
Sourceware 28999 0 P2 UNCONFIRMED amd64_get_insn_details wrong for some AVX instructions 2023-08-09 16:28:59 UTC

Description Paulo Andrade 2023-07-28 20:37:25 UTC
Created attachment 1980527 [details]
gdb_avx_issue.tar

Example reproducer:

$ tar xf gdb_avx_issue.tar
$ cd gdb_avx_issue/
$ ./build
$ ./run 
Out 0: 0xdeadbeef
Out 1: 0xdeadbeef
Out 2: 0xdeadbeef
Out 3: 0xdeadbeef
Out 4: 0xdeadbeef
Out 5: 0xdeadbeef
Out 6: 0xdeadbeef
Out 7: 0xdeadbeef

  Now in gdb:

$ gdb run
...
(gdb) b test_func
Breakpoint 1 at 0x401240: file /usr/lib/gcc/x86_64-redhat-linux/11/include/avxintrin.h, line 174.
(gdb) r
...
Breakpoint 1, test_func (x=...) at test.c:12
12	  return _mm256_and_ps(x, constants[512]);
(gdb) c
Continuing.
Out 0: 0x00000000
Out 1: 0x00000000
Out 2: 0x00000000
Out 3: 0x00000000
Out 4: 0x00000000
Out 5: 0x00000000
Out 6: 0x00000000
Out 7: 0x00000000

This issue appears to happen not just in rhel8 but any other recent environment
tested with different gdb major versions.

For the reproducer, the issue appear to only happen if the breakpoint is in the
vandps instruction, but probably might trigger in other instructions or
conditions.

(gdb) p $ymm0
$1 = {..., v8_int32 = {-1, -1, -1, -1, -1, -1, -1, -1}, ... }
(gdb) watch $ymm0
Watchpoint 2: $ymm0
(gdb) disassemble 
Dump of assembler code for function test_func:
=> 0x0000000000401240 <+0>:	vandps 0x6e18(%rip),%ymm0,%ymm0        # 0x408060 <constants+16384>
   0x0000000000401248 <+8>:	ret
End of assembler dump.
(gdb) si

Watchpoint 2: $ymm0

Old value = {..., v8_int32 = {-1, -1, -1, -1, -1, -1, -1, -1}, ...}
New value = {..., v8_int32 = {0, 0, 0, 0, 0, 0, 0, 0}, ...}
0x0000000000401248 in test_func (x=...) at test.c:18
18	}

Comment 1 Paulo Andrade 2023-08-07 20:45:33 UTC
Any news? On a quick sampling with:

$ lldb -v
lldb version 13.0.1

it works, but failed will all gdb versions I tested.

$ lldb run
(lldb) target create "run"
Current executable set to '/home/pcpa/gdb_avx_issue/run' (x86_64).
(lldb) b test_func
Breakpoint 1: where = run`test_func [inlined] _mm256_and_ps at avxintrin.h:174:19, address = 0x0000000000401240
(lldb) r
Process 1489184 launched: '/home/pcpa/gdb_avx_issue/run' (x86_64)
Process 1489184 stopped
* thread #1, name = 'run', stop reason = breakpoint 1.1
    frame #0: 0x0000000000401240 run`test_func [inlined] _mm256_and_ps(__B=([0] = -6.2598534E+18, [1] = -6.2598534E+18, [2] = -6.2598534E+18, [3] = -6.2598534E+18, [4] = -6.2598534E+18, [5] = -6.2598534E+18, [6] = -6.2598534E+18, [7] = -6.2598534E+18), __A=<unavailable>) at avxintrin.h:174:19
   171 	extern __inline __m256 __attribute__((__gnu_inline__, __always_inline__, __artificial__))
   172 	_mm256_and_ps (__m256 __A, __m256 __B)
   173 	{
-> 174 	  return (__m256) __builtin_ia32_andps256 ((__v8sf)__A, (__v8sf)__B);
   175 	}
   176 	
   177 	extern __inline __m256d __attribute__((__gnu_inline__, __always_inline__, __artificial__))
(lldb) p $ymm0
(unsigned char __attribute__((ext_vector_type(32)))) $0 = (0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff)
(lldb) disassemble 
run`test_func:
->  0x401240 <+0>: vandps 0x6e18(%rip), %ymm0, %ymm0 ; constants + 16384
    0x401248 <+8>: retq   
(lldb) si
Process 1489184 stopped
* thread #1, name = 'run', stop reason = instruction step into
    frame #0: 0x0000000000401248 run`test_func(x=<unavailable>) at test.c:13:1
   10  	
   11  	__m256 test_func(__m256 x) {
   12  	  return _mm256_and_ps(x, constants[512]);
-> 13  	}
(lldb) p $ymm0
(unsigned char __attribute__((ext_vector_type(32)))) $1 = (0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde)
(lldb) c
Process 1489184 resuming
Out 0: 0xdeadbeef
Out 1: 0xdeadbeef
Out 2: 0xdeadbeef
Out 3: 0xdeadbeef
Out 4: 0xdeadbeef
Out 5: 0xdeadbeef
Out 6: 0xdeadbeef
Out 7: 0xdeadbeef
Process 1489184 exited with status = 0 (0x00000000) 
(lldb) q

Comment 2 Keith Seitz 2023-08-07 20:48:11 UTC
I will be looking into this tomorrow.

Comment 3 Keith Seitz 2023-08-09 14:45:51 UTC
While I do not specifically have a solution for the problem, I can
offer two workarounds which should help until a proper solution is
developed.

1) Use gdbserver.
2) Disable displaced stepping (set displaced-stepping off).
   [This can be added to a .gdbinit, e.g., or passed on command-line
    with -ex or -iex.]


Note You need to log in before you can comment on or make changes to this bug.