1 files changed, 23 insertions, 0 deletions

diff --git a/gitlab/issues/target_missing/host_missing/accel_TCG/947.toml b/gitlab/issues/target_missing/host_missing/accel_TCG/947.toml
new file mode 100644
index 00000000..63352d7b
--- /dev/null
+++ b/gitlab/issues/target_missing/host_missing/accel_TCG/947.toml
@@ -0,0 +1,23 @@
+id = 947
+title = "TCG AARCH64 Segmentation fault when helper function is called"
+state = "closed"
+created_at = "2022-03-29T08:05:56.647Z"
+closed_at = "2022-03-31T20:02:06.238Z"
+labels = ["Closed::Fixed", "accel: TCG", "kind::Bug"]
+url = "https://gitlab.com/qemu-project/qemu/-/issues/947"
+host-os = "Windows 11"
+host-arch = "ARM64"
+qemu-version = "6.2.90"
+guest-os = "n/a"
+guest-arch = "n/a"
+description = """Segmentation fault in the TCG thread.
+The issue occurs in the generated code when branching to (helper)lookup_tb_ptr (see op longs).
+It seems that the generated instruction don't load the upper32 of the address of lookup_tb_ptr in the register before branching to it. According to LLDB, the program tries to access 0x1cffe060 while the right address 0x7ff71cffe060 (see debugger logs)."""
+reproduce = "n/a"
+additional = """The issue seems to be located at https://gitlab.com/qemu-project/qemu/-/blob/master/tcg/aarch64/tcg-target.c.inc#L1091
+`t2 = t1 & ~(0xffffUL << s1);`. 
+The fix would be `t2 = t1 & ~(0xffffULL << s1);`
+
+
+[lldb.log](/uploads/6a1d57eaecae4a375c6ada7384489876/lldb.log)
+[qemu_segmentation.log](/uploads/e3c2d6d42291ff7d1ff8d37341e3da1d/qemu_segmentation.log)"""