[Qemu-devel] qemu-arm segfaulting

[Lennert Buytenhek]

Hi all,

One segfault I keep getting with qemu-arm (had it in various binaries)
is in this piece of code:

IN: ptmalloc_init
0x0000a6e4:  mov        r12, #61        ; 0x3d
0x0000a6e8:  mov        r3, #0  ; 0x0
0x0000a6ec:  mov        r0, r5
0x0000a6f0:  mov        r1, r12
0x0000a6f4:  mov        r2, r3
0x0000a6f8:  ldrb       r3, [r5, r3]
0x0000a6fc:  cmp        r3, r2
0x0000a700:  beq        0xa724

OP:
0x0000: movl_T1_im 0x3d
0x0001: movl_r12_T1
0x0002: movl_T1_im 0x0
0x0003: movl_r3_T1
0x0004: movl_T1_r5
0x0005: movl_r0_T1
0x0006: movl_T1_r12
0x0007: movl_r1_T1
0x0008: movl_T1_r3
0x0009: movl_r2_T1
0x000a: movl_T1_r5
0x000b: movl_T2_r3
0x000c: addl_T1_T2
0x000d: ldub_T0_T1
0x000e: movl_r3_T0
0x000f: movl_T1_r2
0x0010: movl_T0_r3
0x0011: subl_T0_T1_cc
0x0012: test_ne 0x6020697c 0xa704
0x0013: jmp 0x6020697c 0xa724
0x0014: end

OUT: [size=125]
0x60a88820:  mov    $0x3d,%esi
0x60a88825:  mov    %esi,0x30(%ebp)
0x60a88828:  mov    $0x0,%esi
0x60a8882d:  mov    %esi,0xc(%ebp)
0x60a88830:  mov    0x14(%ebp),%esi
0x60a88833:  mov    %esi,0x0(%ebp)
0x60a88836:  mov    0x30(%ebp),%esi
0x60a88839:  mov    %esi,0x4(%ebp)
0x60a8883c:  mov    0xc(%ebp),%esi
0x60a8883f:  mov    %esi,0x8(%ebp)
0x60a88842:  mov    0x14(%ebp),%esi
0x60a88845:  mov    0xc(%ebp),%edi
0x60a88848:  add    %edi,%esi
0x60a8884a:  movzbl (%esi),%ebx                 <- %esi is 0xffffffff here
0x60a8884d:  mov    %ebx,0xc(%ebp)
0x60a88850:  mov    0x8(%ebp),%esi
0x60a88853:  mov    0xc(%ebp),%ebx
0x60a88856:  mov    %ebx,%eax
0x60a88858:  xor    %edx,%edx
0x60a8885a:  sub    %esi,%ebx
0x60a8885c:  cmp    %esi,%eax
0x60a8885e:  setae  %dl
0x60a88861:  mov    %edx,0x44(%ebp)
0x60a88864:  mov    %eax,%edx
0x60a88866:  xor    %esi,%edx
0x60a88868:  xor    %ebx,%eax
0x60a8886a:  and    %edx,%eax
0x60a8886c:  mov    %ebx,0x4c(%ebp)
0x60a8886f:  mov    %eax,0x48(%ebp)
0x60a88872:  mov    0x4c(%ebp),%eax
0x60a88875:  test   %eax,%eax
0x60a88877:  je     0x60a8888b
0x60a88879:  jmp    0x61cee1a6
0x60a8887e:  mov    $0x6020697c,%ebx
0x60a88883:  movl   $0xa704,0x3c(%ebp)
0x60a8888a:  ret    
0x60a8888b:  jmp    0x61ceea4b
0x60a88890:  mov    $0x6020697d,%ebx
0x60a88895:  movl   $0xa724,0x3c(%ebp)
0x60a8889c:  ret    

Any ideas?


cheers,
Lennert