summary refs log tree commit diff stats
path: root/results/classifier/105/instruction/947
diff options
context:
space:
mode:
authorChristian Krinitsin <mail@krinitsin.com>2025-06-03 12:04:13 +0000
committerChristian Krinitsin <mail@krinitsin.com>2025-06-03 12:04:13 +0000
commit256709d2eb3fd80d768a99964be5caa61effa2a0 (patch)
tree05b2352fba70923126836a64b6a0de43902e976a /results/classifier/105/instruction/947
parent2ab14fa96a6c5484b5e4ba8337551bb8dcc79cc5 (diff)
downloademulator-bug-study-256709d2eb3fd80d768a99964be5caa61effa2a0.tar.gz
emulator-bug-study-256709d2eb3fd80d768a99964be5caa61effa2a0.zip
add new classifier result
Diffstat (limited to 'results/classifier/105/instruction/947')
-rw-r--r--results/classifier/105/instruction/94726
1 files changed, 26 insertions, 0 deletions
diff --git a/results/classifier/105/instruction/947 b/results/classifier/105/instruction/947
new file mode 100644
index 00000000..1f05f0e3
--- /dev/null
+++ b/results/classifier/105/instruction/947
@@ -0,0 +1,26 @@
+instruction: 0.931
+graphic: 0.863
+semantic: 0.820
+device: 0.758
+other: 0.683
+vnc: 0.678
+network: 0.668
+socket: 0.595
+boot: 0.527
+mistranslation: 0.335
+KVM: 0.302
+assembly: 0.260
+
+TCG AARCH64 Segmentation fault when helper function is called
+Description of problem:
+Segmentation fault in the TCG thread.
+The issue occurs in the generated code when branching to (helper)lookup_tb_ptr (see op longs).
+It seems that the generated instruction don't load the upper32 of the address of lookup_tb_ptr in the register before branching to it. According to LLDB, the program tries to access 0x1cffe060 while the right address 0x7ff71cffe060 (see debugger logs).
+Additional information:
+The issue seems to be located at https://gitlab.com/qemu-project/qemu/-/blob/master/tcg/aarch64/tcg-target.c.inc#L1091
+`t2 = t1 & ~(0xffffUL << s1);`. 
+The fix would be `t2 = t1 & ~(0xffffULL << s1);`
+
+
+[lldb.log](/uploads/6a1d57eaecae4a375c6ada7384489876/lldb.log)
+[qemu_segmentation.log](/uploads/e3c2d6d42291ff7d1ff8d37341e3da1d/qemu_segmentation.log)