id = 947
title = "TCG AARCH64 Segmentation fault when helper function is called"
state = "closed"
created_at = "2022-03-29T08:05:56.647Z"
closed_at = "2022-03-31T20:02:06.238Z"
labels = ["Closed::Fixed", "accel: TCG", "kind::Bug"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/947"
host-os = "Windows 11"
host-arch = "ARM64"
qemu-version = "6.2.90"
guest-os = "n/a"
guest-arch = "n/a"
description = """Segmentation fault in the TCG thread.
The issue occurs in the generated code when branching to (helper)lookup_tb_ptr (see op longs).
It seems that the generated instruction don't load the upper32 of the address of lookup_tb_ptr in the register before branching to it. According to LLDB, the program tries to access 0x1cffe060 while the right address 0x7ff71cffe060 (see debugger logs)."""
reproduce = "n/a"
additional = """The issue seems to be located at https://gitlab.com/qemu-project/qemu/-/blob/master/tcg/aarch64/tcg-target.c.inc#L1091
`t2 = t1 & ~(0xffffUL << s1);`. 
The fix would be `t2 = t1 & ~(0xffffULL << s1);`


[lldb.log](/uploads/6a1d57eaecae4a375c6ada7384489876/lldb.log)
[qemu_segmentation.log](/uploads/e3c2d6d42291ff7d1ff8d37341e3da1d/qemu_segmentation.log)"""