FEX-Emu / FEX-Emu/FEX

AArch64 JIT block linking bug. Causes crash inside of `linuxgsm` setup.

Open
#1,876 11 comments 0 reactions 1 assignee Assigned to @skmp View on GitHub
Dominant language
C++
Stars
8k
Forks
351
Avg merge
12h 31m
Merged PRs (30d)
102

Description

When running linuxgsm through its setup stages, it manages to crash to SIGSEGV with a branch to zero.
This is from some bug in our block linking code.

Following the commands here: https://linuxgsm.com/servers/tfcserver/
This can be reproduced by executing the following commands while inside of FEXBash
```
wget -O linuxgsm.sh https://linuxgsm.sh && chmod +x linuxgsm.sh && bash linuxgsm.sh tfcserver
./tfcserver install
```

The second command is the one that will crash. While it works on the x86-64 JIT.

A workaround is to change the ExitFunctionLink function to always do a dispatcher loop to the top, Arm64JITCore_ExitFunctionLink in there. But that uncovers an issue that this slows down code execution to the point that their curl instances can't download their config files in time due to timeout.

The crash occurs in the Arm64Dispatcher.cpp in the ExitFunctionLinkerAddress asm routine.
`ldr(x3, STATE_PTR(CpuStateFrame, Pointers.Common.ExitFunctionLink));`
This LDR manages to load a nullptr
Almost feels like the CpuStateFrame is getting corrupted somehow.

Adding Stef to this bug since they have the experience of dealing with the block linking and might see the bug quicker.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.