Bug 492923

Created attachment 173510 [details]
Patch

SUMMARY

On current Valgrind (VALGRIND_3_23_0-107-g1a1343b13), the translation for `xchg ax, r16` will mistakenly clear rax[63:16]. Attached patch corrects the issue.

STEPS TO REPRODUCE

The following test program demonstrates this issue:

```c
// gcc -o test_xchg_ax_dx test_xchg_ax_dx.c
#include <stdint.h>
#include <stdio.h>
#include <assert.h>

int main(int argc, char const *argv[])
{
	uint64_t rax = 0xfbcadd99fbca7654;
	uint64_t rdx = 0x1234fdb512345678;
	asm volatile (
		"xchg %%ax, %%dx;"
		: "=a"(rax), "=d"(rdx)
		: "a"(rax), "d"(rdx)
		);
	printf("rax = %016lx, rdx = %016lx\n", rax, rdx);
	assert(rax == 0xfbcadd99fbca5678);
	assert(rdx == 0x1234fdb512347654);
	return 0;
}
```

OBSERVED RESULT

```
matt@iron:~/valgrind-src$ ./bin/valgrind ./test_xchg_ax_dx 
==61465== Memcheck, a memory error detector
==61465== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
==61465== Using Valgrind-3.24.0.GIT and LibVEX; rerun with -h for copyright info
==61465== Command: ./test_xchg_ax_dx
==61465== 
rax = 0000000000005678, rdx = 1234fdb512347654
test_xchg_ax_dx: test_xchg_ax_dx.c:15: main: Assertion `rax == 0xfbcadd99fbca5678' failed.
==61465== 
==61465== Process terminating with default action of signal 6 (SIGABRT)
==61465==    at 0x4912B1C: __pthread_kill_implementation (pthread_kill.c:44)
==61465==    by 0x4912B1C: __pthread_kill_internal (pthread_kill.c:78)
==61465==    by 0x4912B1C: pthread_kill@@GLIBC_2.34 (pthread_kill.c:89)
==61465==    by 0x48B926D: raise (raise.c:26)
==61465==    by 0x489C8FE: abort (abort.c:79)
==61465==    by 0x489C81A: __assert_fail_base.cold (assert.c:94)
==61465==    by 0x48AF506: __assert_fail (assert.c:103)
==61465==    by 0x109200: main (in /home/matt/valgrind-src/test_xchg_ax_dx)
==61465== 
==61465== HEAP SUMMARY:
==61465==     in use at exit: 1,024 bytes in 1 blocks
==61465==   total heap usage: 6 allocs, 5 frees, 2,972 bytes allocated
==61465== 
==61465== LEAK SUMMARY:
==61465==    definitely lost: 0 bytes in 0 blocks
==61465==    indirectly lost: 0 bytes in 0 blocks
==61465==      possibly lost: 0 bytes in 0 blocks
==61465==    still reachable: 1,024 bytes in 1 blocks
==61465==         suppressed: 0 bytes in 0 blocks
==61465== Rerun with --leak-check=full to see details of leaked memory
==61465== 
==61465== For lists of detected and suppressed errors, rerun with: -s
==61465== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Aborted
```

EXPECTED RESULT

```
matt@iron:~/valgrind-src$ ./test_xchg_ax_dx 
rax = fbcadd99fbca5678, rdx = 1234fdb512347654
```

SOFTWARE/OS VERSIONS
Windows: 
macOS: 
(available in the Info Center app, or by running `kinfo` in a terminal window)
Linux/KDE Plasma: 
KDE Plasma Version: 
KDE Frameworks Version: 
Qt Version: 

ADDITIONAL INFORMATION

Issue originally reported to angr at https://github.com/angr/angr/issues/3878 by mnd-c.