Bug 29867 - [gdb/tdep, s390x -m31] FAIL: gdb.guile/scm-lazy-string.exp: ptr: print ptr
Summary: [gdb/tdep, s390x -m31] FAIL: gdb.guile/scm-lazy-string.exp: ptr: print ptr
Status: RESOLVED FIXED
Alias: None
Product: gdb
Classification: Unclassified
Component: tdep (show other bugs)
Version: HEAD
: P2 normal
Target Milestone: 13.1
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-12-09 12:57 UTC by Tom de Vries
Modified: 2022-12-10 14:42 UTC (History)
4 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tom de Vries 2022-12-09 12:57:50 UTC 
With gdb build from trunk on s390x-linux with target board unix/-m31, I run into:
...
(gdb) PASS: gdb.guile/scm-lazy-string.exp: bad length
print ptr^M
$1 = 0x804006b0 <error: Cannot access memory at address 0x804006b0>^M
(gdb) FAIL: gdb.guile/scm-lazy-string.exp: ptr: print ptr
...

A minimal example is:
...
$ gdb -q -batch -ex "set trace-commands on" -x gdb.in
+file scm-lazy-string/scm-lazy-string
+break main
Breakpoint 1 at 0x4005d2: file scm-lazy-string.c, line 23.
+run 

Breakpoint 1, main () at scm-lazy-string.c:23
23        const char *ptr = "pointer";
+step
24        const char array[] = "array";
+print ptr
$1 = 0x804006b0 <error: Cannot access memory at address 0x804006b0>
...

If we delete the breakpoint after running to it, we have instead the expected:
...
$ gdb -q -batch -ex "set trace-commands on" -x gdb.in
+file scm-lazy-string
+break main
Breakpoint 1 at 0x4005d2: file scm-lazy-string.c, line 23.
+run 

Breakpoint 1, main () at scm-lazy-string.c:23
23        const char *ptr = "pointer";
+delete
+step
24        const char array[] = "array";
+print ptr
$1 = 0x4006b0 "pointer"
...
Comment 1 Tom de Vries 2022-12-09 13:25:47 UTC 
The problem is in displaced stepping over insn:
...
│B+> 0x4005d2 <main+10>      larl    %r1,0x4006b0                                            │...

In the failing case we have:
...
(gdb) si
(gdb) p /x $r1
$1 = 0x3ff804006b0
(gdb) 
...

In the passing case we have:
...
(gdb) si
(gdb) p /x $r1
$2 = 0x3ff004006b0
...

The difference comes from this code in s390_displaced_step_fixup:
...
  /* Handle LOAD ADDRESS RELATIVE LONG.  */
  else if (is_ril (insn, op1_larl, op2_larl, &r1, &i2))
    {
      /* Update PC.  */
      regcache_write_pc (regs, from + insnlen);
      /* Recompute output address in R1.  */
      regcache_cooked_write_unsigned (regs, S390_R0_REGNUM + r1,
                                      amode | (from + i2 * 2));
    }
...
where the "amode |" adds the 0x80000000.

Using this patch:
...
diff --git a/gdb/s390-tdep.c b/gdb/s390-tdep.c
index d0dba7654bb..11b309dc817 100644
--- a/gdb/s390-tdep.c
+++ b/gdb/s390-tdep.c
@@ -557,7 +557,7 @@ s390_displaced_step_fixup (struct gdbarch *gdbarch,
       regcache_write_pc (regs, from + insnlen);
       /* Recompute output address in R1.  */
       regcache_cooked_write_unsigned (regs, S390_R0_REGNUM + r1,
-                                     amode | (from + i2 * 2));
+                                     (from + i2 * 2));
     }
 
   /* If we executed a breakpoint instruction, point PC right back at it.  */
...
the test-case passes.

I don't understand the architecture well enough to decide what the root cause is and whether this patch addresses it.
Comment 2 Ulrich Weigand 2022-12-09 14:36:51 UTC 
Ah right.  LARL does *not* set the amode bit in 31-bit mode (in contrast to BASR / BRASL).  The patch looks good to me.