Development:Debugging Crash - Revision history

Neobrain: Remove screenshot of outdated FEXConfig interface

2025-09-22T14:13:23Z

Remove screenshot of outdated FEXConfig interface

Neobrain: FEXInterpreter -> FEX

2025-09-22T14:00:56Z

FEXInterpreter -> FEX

Sonicadvance1 at 09:37, 27 June 2024

2024-06-27T09:37:58Z

Sonicadvance1 at 16:36, 21 June 2024

2024-06-21T16:36:41Z

Sonicadvance1 at 02:41, 1 December 2023

2023-12-01T02:41:38Z

Sonicadvance1 at 02:30, 1 December 2023

2023-12-01T02:30:49Z

Sonicadvance1 at 17:10, 13 September 2023

2023-09-13T17:10:57Z

Sonicadvance1 at 02:10, 22 July 2023

2023-07-22T02:10:04Z

Sonicadvance1 at 02:07, 22 July 2023

2023-07-22T02:07:17Z

Sonicadvance1 at 18:41, 10 June 2023

2023-06-10T18:41:27Z

@@ Line 73: / Line 73: @@
 ** It's in this code somewhere, let's change some FEX settings to get a clearer picture
 * Set block size to one instruction and disable multiblock
 * Now rerun our test application and find the new RIP

@@ Line 1: / Line 1: @@
 == Getting Started ==
-* Debug an application with `gdb --args FEXInterpreter <application full path>`
+* Debug an application with `gdb --args FEX <application full path>`
 * Under GDB make sure to do `handle SIGBUS SIGILL SIG63 noprint`
 ** We use signals for various things, check out [[Development:Debugging_FEX_with_Signals|Here]] for more information
@@ Line 6: / Line 6: @@
 == Crash in emulated/JIT code ==
 Walking through debugging a simple test application that is crashing.
-   $ gdb --args FEXInterpreter ./sigsegv_test
+   $ gdb --args FEX ./sigsegv_test
-   Reading symbols from FEXInterpreter...
+   Reading symbols from FEX...
    (gdb) r
-   Starting program: /usr/bin/FEXInterpreter ./sigsegv_test
+   Starting program: /usr/bin/FEX ./sigsegv_test
    [Thread debugging using libthread_db enabled]
    Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
    [New Thread 0x7fccb75f30 (LWP 90107)]
-   Thread 2 "FEXInterpreter" received signal SIGSEGV, Segmentation fault.
+   Thread 2 "FEX received signal SIGSEGV, Segmentation fault.
    [Switching to Thread 0x7fccb75f30 (LWP 90107)]
 x0000007fccfb9ec8 in ?? ()

@@ Line 134: / Line 134: @@
 Currently this isn't exposed in a way that a debugger can see other than manually typing out gdb commands
-   p/x *(uint64_t*)($x28+184) = inline block header ptr
+   p/x *(uint64_t*)($x28) = inline block header ptr
-   p/x *(uint32_t*)(*(uint64_t*)($x28+184)) = OffsetToBlockTail
+   p/x *(uint32_t*)(*(uint64_t*)($x28)) = OffsetToBlockTail
-   p/x *(uint64_t*)($x28+184) + *(uint32_t*)(*(uint64_t*)($x28+184))
+   p/x *(uint64_t*)($x28) + *(uint32_t*)(*(uint64_t*)($x28))
    p/x *(unsigned long long*)((*(unsigned long long*)($x28) + *(unsigned int*)(*(unsigned long long*)($x28)))+8) = RIP of block

@@ Line 138: / Line 138: @@
    p/x *(uint64_t*)($x28+184) + *(uint32_t*)(*(uint64_t*)($x28+184))
-   p/x *(unsigned long long*)((*(unsigned long long*)($x28+184) + *(unsigned int*)(*(unsigned long long*)($x28+184)))+8) = RIP of block
+   p/x *(unsigned long long*)((*(unsigned long long*)($x28) + *(unsigned int*)(*(unsigned long long*)($x28)))+8) = RIP of block
-   disas *(unsigned long long*)($x28+184),+*(unsigned long long*)(*(unsigned long long*)($x28+184) + *(unsigned int*)(*(unsigned long long*)($x28+184))) = Disassemble this block of code.
+   disas *(unsigned long long*)($x28),+*(unsigned long long*)(*(unsigned long long*)($x28) + *(unsigned int*)(*(unsigned long long*)($x28))) = Disassemble this block of code.

← Older revision		Revision as of 02:41, 1 December 2023
Line 151:		Line 151:

	x/64wx ((FEXCore::Core::CPUState*)$x28)->gregs[FEXCore::X86State::REG_RSP]		x/64wx ((FEXCore::Core::CPUState*)$x28)->gregs[FEXCore::X86State::REG_RSP]
−
−	~~Doing raw pointer math here means that this works even when gdb fails to find symbols for the CPUState object, which happens very frequently for some reason.~~
−
−	~~== Getting RIP of current code block - x86 host ==~~
−	~~FEX sets up an address in our CPU context to get some debug data out.~~
−
−	~~Currently this isn't exposed in a way that a debugger can see other than manually typing out gdb commands~~
−
−	~~p/x (uint64_t)($r14+184) = inline block header ptr~~
−	~~p/x (uint32_t)((uint64_t)($r14+184)) = OffsetToBlockTail~~
−	~~p/x (uint64_t)($r14+184) + (uint32_t)((uint64_t)($x28+184))~~
−
−	~~p/x (unsigned long long)(((unsigned long long)($r14+184) + (unsigned int)((unsigned long long)($r14+184)))+8) = RIP of block~~
−
−	~~disas (unsigned long long)($r14+184),+(unsigned long long)((unsigned long long)($r14+184) + (unsigned int)((unsigned long long)($r14+184))) = Disassemble this block of code.~~
−
−	~~While hard to decipher here is basically what is happening.~~
−	~~- x28 is the CPU register that FEX keeps in the JIT for context accesses~~
−	~~- offset 184 is the offset of the `InlineJITBlockHeader` member inside of that context.~~
−	~~- As long as FEX is in a JIT block that offset will be valid to point to the current RIP that the block is operating on.~~
−
−	~~Getting the stack can also be very useful~~
−
−	~~x/64wx ((FEXCore::Core::CPUState*)$r14)->gregs[FEXCore::X86State::REG_RSP]~~

	Doing raw pointer math here means that this works even when gdb fails to find symbols for the CPUState object, which happens very frequently for some reason.		Doing raw pointer math here means that this works even when gdb fails to find symbols for the CPUState object, which happens very frequently for some reason.

← Older revision		Revision as of 02:30, 1 December 2023
Line 140:		Line 140:
	p/x (unsigned long long)(((unsigned long long)($x28+184) + (unsigned int)((unsigned long long)($x28+184)))+8) = RIP of block		p/x (unsigned long long)(((unsigned long long)($x28+184) + (unsigned int)((unsigned long long)($x28+184)))+8) = RIP of block

−	disas (~~uint64_t~~)($x28+184),+(~~uint64_t~~)((~~uint64_t~~)($x28+184) + (~~uint32_t~~)((~~uint64_t~~)($x28+184))) = Disassemble this block of code.	+	disas (unsigned long long)($x28+184),+(unsigned long long)((unsigned long long)($x28+184) + (unsigned int)((unsigned long long)($x28+184))) = Disassemble this block of code.

@@ Line 163: / Line 163: @@
    p/x *(uint64_t*)($r14+184) + *(uint32_t*)(*(uint64_t*)($x28+184))
-   p/x *(uint64_t*)((*(uint64_t*)($r14+184) + *(uint32_t*)(*(uint64_t*)($r14+184)))+8) = RIP of block
+   p/x *(unsigned long long*)((*(unsigned long long*)($r14+184) + *(unsigned int*)(*(unsigned long long*)($r14+184)))+8) = RIP of block
 While hard to decipher here is basically what is happening.

← Older revision		Revision as of 02:07, 22 July 2023
Line 151:		Line 151:

	x/64wx ((FEXCore::Core::CPUState*)$x28)->gregs[FEXCore::X86State::REG_RSP]		x/64wx ((FEXCore::Core::CPUState*)$x28)->gregs[FEXCore::X86State::REG_RSP]
		+
		+	Doing raw pointer math here means that this works even when gdb fails to find symbols for the CPUState object, which happens very frequently for some reason.
		+
		+	== Getting RIP of current code block - x86 host ==
		+	FEX sets up an address in our CPU context to get some debug data out.
		+
		+	Currently this isn't exposed in a way that a debugger can see other than manually typing out gdb commands
		+
		+	p/x (uint64_t)($r14+184) = inline block header ptr
		+	p/x (uint32_t)((uint64_t)($r14+184)) = OffsetToBlockTail
		+	p/x (uint64_t)($r14+184) + (uint32_t)((uint64_t)($x28+184))
		+
		+	p/x (uint64_t)(((uint64_t)($r14+184) + (uint32_t)((uint64_t)($r14+184)))+8) = RIP of block
		+
		+	disas (uint64_t)($r14+184),+(uint64_t)((uint64_t)($r14+184) + (uint32_t)((uint64_t)($r14+184))) = Disassemble this block of code.
		+
		+
		+	While hard to decipher here is basically what is happening.
		+	- x28 is the CPU register that FEX keeps in the JIT for context accesses
		+	- offset 184 is the offset of the `InlineJITBlockHeader` member inside of that context.
		+	- As long as FEX is in a JIT block that offset will be valid to point to the current RIP that the block is operating on.
		+
		+	Getting the stack can also be very useful
		+
		+	x/64wx ((FEXCore::Core::CPUState*)$r14)->gregs[FEXCore::X86State::REG_RSP]

	Doing raw pointer math here means that this works even when gdb fails to find symbols for the CPUState object, which happens very frequently for some reason.		Doing raw pointer math here means that this works even when gdb fails to find symbols for the CPUState object, which happens very frequently for some reason.

← Older revision		Revision as of 18:41, 10 June 2023
Line 151:		Line 151:

	x/64wx ((FEXCore::Core::CPUState*)$x28)->gregs[FEXCore::X86State::REG_RSP]		x/64wx ((FEXCore::Core::CPUState*)$x28)->gregs[FEXCore::X86State::REG_RSP]
		+
		+	Doing raw pointer math here means that this works even when gdb fails to find symbols for the CPUState object, which happens very frequently for some reason.