diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-07-17 09:10:43 +0200 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-07-17 09:10:43 +0200 |
| commit | f2ec263023649e596c5076df32c2d328bc9393d2 (patch) | |
| tree | 5dd86caab46e552bd2e62bf9c4fb1a7504a44db4 /results/scraper/fex/1876 | |
| parent | 63d2e9d409831aa8582787234cae4741847504b7 (diff) | |
| download | qemu-analysis-main.tar.gz qemu-analysis-main.zip | |
Diffstat (limited to 'results/scraper/fex/1876')
| -rw-r--r-- | results/scraper/fex/1876 | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/results/scraper/fex/1876 b/results/scraper/fex/1876 new file mode 100644 index 000000000..a9cbec276 --- /dev/null +++ b/results/scraper/fex/1876 @@ -0,0 +1,21 @@ +AArch64 JIT block linking bug. Causes crash inside of `linuxgsm` setup. +When running linuxgsm through its setup stages, it manages to crash to SIGSEGV with a branch to zero. +This is from some bug in our block linking code. + +Following the commands here: https://linuxgsm.com/servers/tfcserver/ +This can be reproduced by executing the following commands while inside of FEXBash +``` +wget -O linuxgsm.sh https://linuxgsm.sh && chmod +x linuxgsm.sh && bash linuxgsm.sh tfcserver +./tfcserver install +``` + +The second command is the one that will crash. While it works on the x86-64 JIT. + +A workaround is to change the ExitFunctionLink function to always do a dispatcher loop to the top, Arm64JITCore_ExitFunctionLink in there. But that uncovers an issue that this slows down code execution to the point that their curl instances can't download their config files in time due to timeout. + +The crash occurs in the Arm64Dispatcher.cpp in the ExitFunctionLinkerAddress asm routine. +`ldr(x3, STATE_PTR(CpuStateFrame, Pointers.Common.ExitFunctionLink));` +This LDR manages to load a nullptr +Almost feels like the CpuStateFrame is getting corrupted somehow. + +Adding Stef to this bug since they have the experience of dealing with the block linking and might see the bug quicker. |