One of our partners has reported that they are seeing SEGVs running SpecJBB2013.

They have included the attached hs_err log.

I have disassembled the instructions contained in the hs_err log by creating a C program as follows

unsigned char mem[] = {
 0x1f, 0x08, 0x00, 0xf9, 0x70, 0x81, 0x80, 0xf9, 0x1f, 0x0c, 0x00, 0xf9, 0xbf, 0x3a, 0x03, 0xd5,
 0x0a, 0xfc, 0x49, 0xd3, 0xab, 0xf1, 0x7f, 0x90, 0x6b, 0xe8, 0xdf, 0xf2, 0x12, 0x08, 0x00, 0xf9,
 0x7f, 0x79, 0x2a, 0x38, 0xbf, 0x3b, 0x03, 0xd5, 0xfd, 0x7b, 0x43, 0xa9, 0xff, 0x03, 0x01, 0x91,
 0xa8, 0xb8, 0x06, 0x90, 0x1f, 0x01, 0x40, 0xb9, 0xc0, 0x03, 0x5f, 0xd6, 0xf1, 0x03, 0x03, 0x2a,
};

int main(void)
{
}

(gdb) x/16i 0x4107e8
   0x4107e8 <mem>: str xzr, [x0,#16]
   0x4107ec <mem+4>: prfm pstl1keep, [x11,#256]
   0x4107f0 <mem+8>: str xzr, [x0,#24]
   0x4107f4 <mem+12>: dmb ishst
   0x4107f8 <mem+16>: lsr x10, x0, #9
   0x4107fc <mem+20>: adrp x11, 0x100244000
   0x410800 <mem+24>: movk x11, #0xff43, lsl #32
   0x410804 <mem+28>: str x18, [x0,#16]
   0x410808 <mem+32>: strb wzr, [x11,x10,lsl #0] <<<<<
   0x41080c <mem+36>: dmb ish
   0x410810 <mem+40>: ldp x29, x30, [sp,#48]
   0x410814 <mem+44>: add sp, sp, #0x40
   0x410818 <mem+48>: adrp x8, 0xdb24000
   0x41081c <mem+52>: ldr wzr, [x8]
   0x410820 <mem+56>: ret
   0x410824 <mem+60>: mov w17, w3

The SEGV happens on the instruction marked "<<<<<".

This instruction is writing to the card table, X11 should contain the byte map base and X10 the shifted OOP.

The 4 instructions in question are

   0x4107f8 <mem+16>: lsr x10, x0, #9
   0x4107fc <mem+20>: adrp x11, 0x100244000
   0x410800 <mem+24>: movk x11, #0xff43, lsl #32
   0x410804 <mem+28>: str x18, [x0,#16]
   0x410808 <mem+32>: strb wzr, [x11,x10,lsl #0]

At the time of the SEGV the following were the values in X0, X10, X11.

R0=0x0000ffc8a06c79a8
R10=0x0000007fe450363c
R11=0x0001ff43a02f0000

The fault address register is 0x0001ffc3847f363c

Note that R11 and the fault address register contain invalid aarch64 addresses in that the top 16 bits are not all zeros.

R11 should contain the byte map base. The hs_err log reports the byte map base as

Card table byte_map: [0x0000ffc381ff0000,0x0000ffc3a0000000] byte_map_base: 0x0000ff43a02f0000

However, instead R11 contains the value 0x0001ff43a02f0000

R11 is calculated with the following instructions

   0x4107fc <mem+20>: adrp x11, 0x100244000
   0x410800 <mem+24>: movk x11, #0xff43, lsl #32

however the address shown in the disassembly above is incorrect because adrp instruction is actually located at 0x0000ffffa04bccf4. If the above instruction were disassembled at the correct address they would be.

0x0000ffffa04bccf4: adrp x11, 0x10000a02f0000
0x0000ffffa04bccf8: movk x11, #0xff43, lsl #32

Which calculates the incorrect address 0x0001ff43a02f0000 instead of 0x0000ff43a02f0000