Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>The <a href="http://pastebin.com/g6L7VqUX" rel="nofollow">posted disassembly</a> is quite interesting.</p> <pre><code> 0x41302678 &lt;__sigsetjmp+40&gt;: fmrx r2, fpscr 0x4130267c &lt;__sigsetjmp+44&gt;: str r2, [r12], #4 0x41302680 &lt;__sigsetjmp+48&gt;: tst r2, #512 ; 0x200 0x41302684 &lt;__sigsetjmp+52&gt;: beq 0x413026a0 &lt;__sigsetjmp+80&gt; 0x41302688 &lt;__sigsetjmp+56&gt;: stfp f2, [r12], #8 *0x4130268c &lt;__sigsetjmp+60&gt;: stfp f3, [r12], #8* 0x41302690 &lt;__sigsetjmp+64&gt;: stfp f4, [r12], #8 0x41302694 &lt;__sigsetjmp+68&gt;: stfp f5, [r12], #8 0x41302698 &lt;__sigsetjmp+72&gt;: stfp f6, [r12], #8 0x4130269c &lt;__sigsetjmp+76&gt;: stfp f7, [r12], #8 </code></pre> <p>The code checks for bit 9 in fpscr, and, if set, tries to save registers f2-f7. What are those? I've never seen them in recent processors, but I <em>think</em> those are FPA ("Floating Point Accelerator") registers, implemented in a few old cores, and used for soft FP before VFP appeared.</p> <p>So, here's what I think happens:</p> <ol> <li>The libc on your device was compiled with FPA support, probably by mistake.</li> <li>In FPA processors bit 9 meant "FPA enabled" or something similar</li> <li>In the debug version of Qt the bit 9 of FPSCR (DZE = Division by Zero exception enable bit) is not set, so they don't try to save FPA registers. However, it gets set in the release version.</li> </ol> <p>I see here two options:</p> <ol> <li>Rebuild libc without FPA support</li> <li>Find where DZE gets set in the release ver (not sure how to do that)</li> </ol> <hr> <p><strong>Update</strong>: I was wrong. The gdb disassembly confused me. I found <a href="http://www.google.com/codesearch/p?hl=en#xy1xtVWIKOQ/pub/glibc/snapshots/glibc-ports-latest.tar.bz2%7CDNu48aiJSpY/glibc-ports-20090518/sysdeps/arm/eabi/setjmp.S&amp;q=tst%20a2,%20#HWCAP_ARM_IWMMXT&amp;d=8" rel="nofollow">the source</a> of setjmp.S, here's the relevant part:</p> <pre><code> tst a3, #HWCAP_ARM_VFP beq Lno_vfp /* Store the VFP registers. */ /* Following instruction is fstmiax ip!, {d8-d15}. */ stc p11, cr8, [r12], #68 /* Store the floating-point status register. */ /* Following instruction is fmrx r2, fpscr. */ mrc p10, 7, r2, cr1, cr0, 0 str r2, [ip], #4 Lno_vfp: tst a3, #HWCAP_ARM_IWMMXT beq Lno_iwmmxt /* Save the call-preserved iWMMXt registers. */ /* Following instructions are wstrd wr10, [ip], #8 (etc.) */ stcl p1, cr10, [r12], #8 stcl p1, cr11, [r12], #8 stcl p1, cr12, [r12], #8 stcl p1, cr13, [r12], #8 stcl p1, cr14, [r12], #8 stcl p1, cr15, [r12], #8 Lno_iwmmxt: </code></pre> <p>So, it's trying to store WMMXt registers, not FPA. <em>However</em>, there is a bug here. It's using r2 to temporarily store fpscr, <strong>but</strong> that ovewrites the previously loaded hwcap value in a3 (a3 is the <a href="http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0041c/ch09s02s02.html" rel="nofollow">APCS name</a> for r2). Maybe the author meant to use a2, not r2, or maybe the two parts were done by different people. In either case, somehow the release version of Qt changes FPSCR (which is most likely emulated by the kernel) and the code storing iwmmxt regs is triggered.</p> <p>Still, that's not the whole story. The hwcaps <a href="http://pastebin.com/NS5CyEpQ" rel="nofollow">you pasted</a> claim that the CPU does support iWMMXt, so I'm not sure why those instructions would be giving trouble. Maybe the reported PC value is wrong somehow. I think you should try putting breakpoint on __sigsetjmp and stepping through it by instruction (stepi), to see where exactly it crashes.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload