Re: [PATCH V7] amd64-mpx: initialize bnd register before performing inferior calls.

[Pedro Alves <palves at redhat dot com>]

On 02/16/2017 01:49 PM, Tedeschi, Walfred wrote:

>> Correct?
> Yes.
> But actual behavior at 7 has an issue!

7. is:

>>> 7. expected - control should be back to 1, i.e. on stop mode.
>>> 7. actual behavior - application finishes with the signal

But the rest of your email doesn't talk about this at all.
I'm confused....

> 
> When we set the BND registers from gdb itself (applying the patch) it
> looks like changing the values of BND again while in the prolog have no
> effect.
> Lets go to the reproducer:
> 
> The inferior call i want to do is "upper (x, a, b, c, d, 100)".
> it has the following relevant prolog:
> 
>   0x0000000000400a0b <+1>:    mov    %rsp,%rbp
>    0x0000000000400a0e <+4>:    sub    $0x18,%rsp
>    0x0000000000400a12 <+8>:    mov    %rdi,-0x18(%rbp)
>    0x0000000000400a16 <+12>:    mov    %rsi,-0x20(%rbp)
>    0x0000000000400a1a <+16>:    mov    %rdx,-0x28(%rbp)
>    0x0000000000400a1e <+20>:    mov    %rcx,-0x30(%rbp)
>    0x0000000000400a22 <+24>:    mov    %r8,-0x38(%rbp)
>    0x0000000000400a26 <+28>:    mov    %r9d,-0x3c(%rbp)
>    0x0000000000400a2a <+32>:    bndmov %bnd0,-0x50(%rbp)
>    0x0000000000400a2f <+37>:    bndmov %bnd1,-0x60(%rbp)
>    0x0000000000400a34 <+42>:    bndmov %bnd2,-0x70(%rbp)
>    0x0000000000400a39 <+47>:    bndmov %bnd3,-0x80(%rbp)
> 
> I can stop at the first instruction of "upper" by issuing b (void*)&upper.

FYI, the usual way to do that is with "b *upper".

> In order to verify the effective change in the BND i have printed
> bnd0..bnd3. Register values were same as entered with the GDB command.

printed how?  and printed when exactly?

> Other way is to do instruction stepping till " bndmov %bnd3,-0x80(%rbp)"
> and examine the memory at the indicated places.

Memory?  I thought you'd examine the registers?  What indicated
places, BTW?

> 
> Surprise! In the gdb i have applied the patch though changing the
> BND0..BND3 values at 0x0400a0b value present on memory was still set to
> the init state.

_memory_ set to the init state?

Can you please explain what you're seeing in a bit more detail?
You're leaving out details I'm finding myself needing to guess,
and I'd probably guess wrong.

But still, if I have to guess, I'd think that the problem with
stopping at function entry and poking the bnd registers
_before_ the prologue runs, would be that whatever bnd register value
you patch in, would be overridden by the bndmov instructions in the
prologue.  I.e., you need to single-step past those bndmov
instructions, and patch the bnd registers _then_, otherwise
the bndmovs undo your patching.

But this comment:

> In the version without applying the patch it i could see the value i
> entered while stopped at the first instruction.

... seems to contradict that.  So I'm double confused.

Still, I don't see what does this have to do with point 7.

Thanks,
Pedro Alves