TCG AARCH64 Segmentation fault when helper function is called
Host environment
- Operating system: Windows 11
- Architecture: ARM64
- QEMU flavor: qemu-system-aarch64
- QEMU version: 6.2.90
- QEMU command line:
./qemu-system-aarch64 -M virt
Description of problem
Segmentation fault in the TCG thread. The issue occurs in the generated code when branching to (helper)lookup_tb_ptr (see op longs). It seems that the generated instruction don't load the upper32 of the address of lookup_tb_ptr in the register before branching to it. According to LLDB, the program tries to access 0x1cffe060 while the right address 0x7ff71cffe060 (see debugger logs).
Additional information
The issue seems to be located at https://gitlab.com/qemu-project/qemu/-/blob/master/tcg/aarch64/tcg-target.c.inc#L1091
t2 = t1 & ~(0xffffUL << s1);
.
The fix would be t2 = t1 & ~(0xffffULL << s1);
Edited by Jerome Haxhiaj