September 2015 - Wine-Bugs - list.winehq.org

[Bug 34495] New: Total War: Shogun 2 character models are fixed sideways
by wine-bugs＠winehq.org May 8, 2020

May 8, 2020

http://bugs.winehq.org/show_bug.cgi?id=34495 Bug #: 34495 Summary: Total War: Shogun 2 character models are fixed sideways Product: Wine Version: 1.7.1 Platform: x86-64 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: directx-d3dx9 AssignedTo: wine-bugs(a)winehq.org ReportedBy: thebenj88(a)gmail.com CC: wine-bugs(a)winehq.org Classification: Unclassified All the in-game character (Advisers, generals, agents, in-battle units) models are fixed sideways. I've uploaded several screenshots of the issue here: http://imgur.com/a/RQnRM I'm currently using a NVIDIA GTX 660ti with the 325.15 driver, and wine 1.7.1, though I have tried other wine versions with no success (1.4, 1.5.28, 1.6rc3, 1.6). Several other users have also reported this same issue, though all have reported using NVIDIA cards. I've not heard from any AMD users about this issue. Aside from that, suspect that this issue may be a regression, as previous test data from NVIDIA users did not mention this bug. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 32

[Bug 37388] New: GTA IV fails to launch under Wine 1.7.28
by wine-bugs＠winehq.org May 8, 2020

May 8, 2020

https://bugs.winehq.org/show_bug.cgi?id=37388 Bug ID: 37388 Summary: GTA IV fails to launch under Wine 1.7.28 Product: Wine Version: 1.7.28 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: lynx.light0(a)gmail.com Created attachment 49720 --> https://bugs.winehq.org/attachment.cgi?id=49720 terminal output Attempting to launch GTA IV fails under Wine 1.7.28 with the error message: wine: Unhandled page fault on write access to 0x00000000 at address 0x5a9346 (thread 002c), starting debugger... Unhandled exception: page fault on write access to 0x00000000 in 32-bit code (0x005a9346). 0046:Call user32.MessageBoxW(00000000,0033ec78 L"GTA IV FATAL ERROR: Invalid resource detected - Please re-install the game",0033ea78 L"GTA IV FATAL ERROR: VDS100",00040010) ret=005a9346 I attach plain text terminal output. Here is a google drive link to the debug output (it is bzip2 compressed): https://drive.google.com/file/d/0B8rj1_DmnmmrcnhiQ3R4NURkZDA/view -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 7

[Bug 12845] New: Mono 1.9. 1 installer EULA is not rendered due to richedit regression
by wine-bugs＠winehq.org May 7, 2020

May 7, 2020

http://bugs.winehq.org/show_bug.cgi?id=12845 Summary: Mono 1.9.1 installer EULA is not rendered due to richedit regression Product: Wine Version: CVS/GIT Platform: PC URL: http://ftp.novell.com/pub/mono/archive/1.9.1/windows- installer/2/mono-1.9.1-gtksharp-2.10.4-win32-2.exe OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: richedit AssignedTo: wine-bugs(a)winehq.org ReportedBy: nodisgod(a)yahoo.com CC: a_villacis(a)palosanto.com When running the Mono 1.9.1 installer with today's Git (wine-0.9.60-354-g4055751), the EULA text box is rendered blank. Regression testing showed the bad commit in question to be: 4f95cf707254653a3199caff3553fd0f732f23df is first bad commit commit 4f95cf707254653a3199caff3553fd0f732f23df Author: Alex Villacís Lasso <a_villacis(a)palosanto.com> Date: Thu Apr 24 10:07:12 2008 -0500 riched20: Reject RTF that is recognized as invalid. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 11

[Bug 31095] New: When I load Team Fortress 2 the opening credits go by fine...then the screen turns black my mouse appears and this error message pops up. It happens if i run it through steam or through the command line. Anyone help me please?
by wine-bugs＠winehq.org May 7, 2020

May 7, 2020

http://bugs.winehq.org/show_bug.cgi?id=31095 Bug #: 31095 Summary: When I load Team Fortress 2 the opening credits go by fine...then the screen turns black my mouse appears and this error message pops up. It happens if i run it through steam or through the command line. Anyone help me please? Product: Wine Version: 1.3.28 Platform: Other OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: headshot9557(a)yahoo.com Classification: Unclassified Happens everytime i load up the game -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 31695] New: the new walkman NWZ-E463/E464/E465/E463K/E464K/E463HK has stopped the software set up in ubuntu 12.04. Can you help me pleace?
by wine-bugs＠winehq.org May 7, 2020

May 7, 2020

http://bugs.winehq.org/show_bug.cgi?id=31695 Bug #: 31695 Summary: the new walkman NWZ-E463/E464/E465/E463K/E464K/E463HK has stopped the software set up in ubuntu 12.04. Can you help me pleace? Product: Wine Version: unspecified Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: chira.chi(a)live.it Classification: Unclassified Unhandled exception: page fault on read access to 0x00000068 in 32-bit code (0x0048a658). Register dump: CS:0073 SS:007b DS:007b ES:007b FS:0033 GS:003b EIP:0048a658 ESP:0033e4a0 EBP:00754b20 EFLAGS:00210212( R- -- I -A- - ) EAX:00000001 EBX:00000000 ECX:00000010 EDX:00000000 ESI:00000010 EDI:00754b20 Stack dump: 0x0033e4a0: 00000000 00000000 0043a407 00000000 0x0033e4b0: 76eecc7b 00000001 0075da38 00411f8b 0x0033e4c0: 00750000 00000000 00000001 0033e5d8 0x0033e4d0: 00000000 00000007 005a39d4 0053d178 0x0033e4e0: 0075d958 0075d990 0075d990 0033e4e4 0x0033e4f0: 0033e4e8 00000000 0075d9aa 0033e4f4 Backtrace: =>0 0x0048a658 in setuplauncher (+0x8a658) (0x00754b20) 1 0x00754b20 (0x0053f630) 2 0x00423450 in setuplauncher (+0x2344f) (0x0044d370) 0x0048a658: movb 0x58(%esi),%al Modules: Module Address Debug info Name (113 modules) PE 400000- 63b000 Export setuplauncher ELF 7b800000-7ba15000 Deferred kernel32<elf> \-PE 7b810000-7ba15000 \ kernel32 ELF 7bc00000-7bcc3000 Deferred ntdll<elf> \-PE 7bc10000-7bcc3000 \ ntdll ELF 7bf00000-7bf04000 Deferred <wine-loader> ELF 7d547000-7d583000 Deferred libxslt.so.1 ELF 7d583000-7d5a9000 Deferred mpr<elf> \-PE 7d590000-7d5a9000 \ mpr ELF 7d5a9000-7d618000 Deferred wininet<elf> \-PE 7d5b0000-7d618000 \ wininet ELF 7d618000-7d69c000 Deferred urlmon<elf> \-PE 7d620000-7d69c000 \ urlmon ELF 7d69c000-7d7e9000 Deferred libxml2.so.2 ELF 7d901000-7d997000 Deferred msxml3<elf> \-PE 7d910000-7d997000 \ msxml3 ELF 7d997000-7d9b4000 Deferred msxml<elf> \-PE 7d9a0000-7d9b4000 \ msxml ELF 7d9ca000-7d9fe000 Deferred uxtheme<elf> \-PE 7d9d0000-7d9fe000 \ uxtheme ELF 7d9fe000-7da19000 Deferred spoolss<elf> \-PE 7da00000-7da19000 \ spoolss ELF 7da19000-7da3a000 Deferred localspl<elf> \-PE 7da20000-7da3a000 \ localspl ELF 7da5e000-7da67000 Deferred librt.so.1 ELF 7da67000-7da6c000 Deferred libgpg-error.so.0 ELF 7da6c000-7da84000 Deferred libresolv.so.2 ELF 7da84000-7dacd000 Deferred libdbus-1.so.3 ELF 7dacd000-7dadf000 Deferred libp11-kit.so.0 ELF 7dadf000-7db64000 Deferred libgcrypt.so.11 ELF 7db64000-7db76000 Deferred libtasn1.so.3 ELF 7db76000-7db7f000 Deferred libkrb5support.so.0 ELF 7db7f000-7dba7000 Deferred libk5crypto.so.3 ELF 7dba7000-7dc76000 Deferred libkrb5.so.3 ELF 7dc76000-7dc88000 Deferred libavahi-client.so.3 ELF 7dc88000-7dd4c000 Deferred libgnutls.so.26 ELF 7dd4c000-7dd8a000 Deferred libgssapi_krb5.so.2 ELF 7dd8a000-7dddd000 Deferred libcups.so.2 ELF 7dde1000-7ddf4000 Deferred gnome-keyring-pkcs11.so ELF 7de0c000-7de12000 Deferred libxfixes.so.3 ELF 7de12000-7de1d000 Deferred libxcursor.so.1 ELF 7de1d000-7de21000 Deferred libkeyutils.so.1 ELF 7de21000-7de26000 Deferred libcom_err.so.2 ELF 7de26000-7de34000 Deferred libavahi-common.so.3 ELF 7de9a000-7dec4000 Deferred libexpat.so.1 ELF 7dec4000-7def8000 Deferred libfontconfig.so.1 ELF 7def8000-7df08000 Deferred libxi.so.6 ELF 7df08000-7df0c000 Deferred libxcomposite.so.1 ELF 7df0c000-7df15000 Deferred libxrandr.so.2 ELF 7df15000-7df1f000 Deferred libxrender.so.1 ELF 7df1f000-7df25000 Deferred libxxf86vm.so.1 ELF 7df25000-7df2c000 Deferred libxdmcp.so.6 ELF 7df2c000-7df4d000 Deferred libxcb.so.1 ELF 7df4d000-7df67000 Deferred libice.so.6 ELF 7df67000-7e09b000 Deferred libx11.so.6 ELF 7e09b000-7e0ad000 Deferred libxext.so.6 ELF 7e0ad000-7e0b6000 Deferred libsm.so.6 ELF 7e0cd000-7e160000 Deferred winex11<elf> \-PE 7e0e0000-7e160000 \ winex11 ELF 7e160000-7e176000 Deferred libz.so.1 ELF 7e176000-7e210000 Deferred libfreetype.so.6 ELF 7e212000-7e216000 Deferred libxinerama.so.1 ELF 7e216000-7e21a000 Deferred libxau.so.6 ELF 7e21a000-7e220000 Deferred libuuid.so.1 ELF 7e227000-7e24f000 Deferred msacm32<elf> \-PE 7e230000-7e24f000 \ msacm32 ELF 7e24f000-7e2fc000 Deferred winmm<elf> \-PE 7e260000-7e2fc000 \ winmm ELF 7e2fc000-7e371000 Deferred gdiplus<elf> \-PE 7e310000-7e371000 \ gdiplus ELF 7e371000-7e463000 Deferred oleaut32<elf> \-PE 7e390000-7e463000 \ oleaut32 ELF 7e463000-7e56b000 Deferred ole32<elf> \-PE 7e480000-7e56b000 \ ole32 ELF 7e56b000-7e5a3000 Deferred oledlg<elf> \-PE 7e570000-7e5a3000 \ oledlg ELF 7e5a3000-7e69b000 Deferred comctl32<elf> \-PE 7e5b0000-7e69b000 \ comctl32 ELF 7e69b000-7e705000 Deferred shlwapi<elf> \-PE 7e6b0000-7e705000 \ shlwapi ELF 7e705000-7e916000 Deferred shell32<elf> \-PE 7e710000-7e916000 \ shell32 ELF 7e916000-7e9f5000 Deferred comdlg32<elf> \-PE 7e920000-7e9f5000 \ comdlg32 ELF 7e9f5000-7ea6a000 Deferred rpcrt4<elf> \-PE 7ea00000-7ea6a000 \ rpcrt4 ELF 7ea6a000-7eaa4000 Deferred winspool<elf> \-PE 7ea70000-7eaa4000 \ winspool ELF 7eaa4000-7eb0b000 Deferred setupapi<elf> \-PE 7eab0000-7eb0b000 \ setupapi ELF 7eb0b000-7eb6b000 Deferred advapi32<elf> \-PE 7eb20000-7eb6b000 \ advapi32 ELF 7eb6b000-7ec28000 Deferred gdi32<elf> \-PE 7eb80000-7ec28000 \ gdi32 ELF 7ec28000-7ed68000 Deferred user32<elf> \-PE 7ec40000-7ed68000 \ user32 ELF 7ed68000-7ed8a000 Deferred imm32<elf> \-PE 7ed70000-7ed8a000 \ imm32 ELF 7ed8a000-7eda3000 Deferred version<elf> \-PE 7ed90000-7eda3000 \ version ELF 7eda3000-7edbd000 Deferred libnsl.so.1 ELF 7efbd000-7efe9000 Deferred libm.so.6 ELF 7efec000-7f000000 Deferred msimg32<elf> \-PE 7eff0000-7f000000 \ msimg32 ELF b7450000-b745d000 Deferred libnss_files.so.2 ELF b745e000-b7463000 Deferred libdl.so.2 ELF b7463000-b7608000 Deferred libc.so.6 ELF b7609000-b7624000 Deferred libpthread.so.0 ELF b7625000-b7631000 Deferred libnss_nis.so.2 ELF b7631000-b763a000 Deferred libnss_compat.so.2 ELF b763b000-b777d000 Dwarf libwine.so.1 ELF b777f000-b77a1000 Deferred ld-linux.so.2 ELF b77a1000-b77a2000 Deferred [vdso].so Threads: process tid prio (all id:s are in hex) 0000000c services.exe 00000043 0 00000028 0 0000000e 0 0000000d 0 00000012 explorer.exe 00000013 0 00000025 winedevice.exe 0000002c 0 0000002b 0 00000027 0 00000026 0 0000002d Setup.exe 00000032 0 00000031 0 00000030 0 0000002f 0 0000002e 0 00000033 Setup.exe 00000034 0 0000001a (D) C:\users\chira\Temp\SonyWMvn6kn4ku\Install\Installlauncher\SetupLauncher.exe 0000001d 0 0000001c 0 0000001b 0 <== System information: Wine build: wine-1.4 Platform: i386 Host system: Linux Host version: 3.2.0-30-generic-pae -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 5

[Bug 27332] New: richedit EM_STREAMIN handler needs to return the number of characters read (Dirt3 installer shows error instead of EULA text)
by wine-bugs＠winehq.org May 7, 2020

May 7, 2020

http://bugs.winehq.org/show_bug.cgi?id=27332 Summary: richedit EM_STREAMIN handler needs to return the number of characters read (Dirt3 installer shows error instead of EULA text) Product: Wine Version: 1.3.21 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: richedit AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Hello, another bug while looking at "Dirt 3" game installer ... When the installer is about to display the EULA, the whole EULA text can be seen a very short time only to be immediately replaced by the message "Could not read the EULA file <path>\\EULA\\English\\EULA.txt." The EULA is a plain text file. --- snip --- 0009:Call KERNEL32.CreateFileW(004bfa40 L"Z:\\mnt\\iso\\EULA\\English\\EULA.txt",80000000,00000001,00000000,00000003,00000000,00000000) ret=00403177 0009:Ret KERNEL32.CreateFileW() retval=00000078 ret=00403177 ... 0009:Call user32.SendMessageW(0003006a,00000449,00000001,0032f90c) ret=004031b9 0009:Call window proc 0x20027d11 (hwnd=0x3006a,msg=WM_USER+73,wp=00000001,lp=0032f90c) 0009:trace:richedit:RichEditWndProc_common enter hwnd 0x3006a msg 0449 (EM_STREAMIN) 1 32f90c, unicode 1 ... 0009:trace:richedit:ME_StreamIn stream==0x32f90c editor==0x5ca8e8 format==0x1 0009:trace:richedit:ME_StreamInText 00000001 0x32e0a0 0009:Call KERNEL32.ReadFile(00000078,0032e0ac,00001000,0032e0a4,00000000) ret=0040225c 0009:Ret KERNEL32.ReadFile() retval=00000001 ret=0040225c 0009:Call KERNEL32.MultiByteToWideChar(00000000,00000000,0032e0ac "THE CODEMASTERS SOFTWARE COMPANY LIMITED SOFTWARE LICENSE AGREEMENT\r\n\r\nIMPORTANT - READ CAREFULLY: THE ACCOMPANYING PROGRAM (WHICH INCLUDES COMPUTER SOFTWARE PROGRAM, THE MEDIA AND RELATED DOCUMENTATION IN PRINTED OR ELECTRONIC FORM) IS LICENSED TO YOU ON THE TERMS SET FORTH BELOW, WHICH CONSTIT"...,00001000,00329c8e,00001000) ret=2001ba68 0009:Ret KERNEL32.MultiByteToWideChar() retval=00001000 ret=2001ba68 ... 0009:trace:richedit:RichEditWndProc_common exit hwnd 0x3006a msg 0449 (EM_STREAMIN) 1 32f90c, unicode 1 -> 0 0009:Ret window proc 0x20027d11 (hwnd=0x3006a,msg=WM_USER+73,wp=00000001,lp=0032f90c) retval=00000000 0009:Ret user32.SendMessageW() retval=00000000 ret=004031b9 ... 0009:Call user32.SetWindowTextW(0003006a,004bfaf0 L"Could not read the EULA file Z:\\mnt\\iso\\EULA\\English\\EULA.txt.") ret=00403219 0009:Call window proc 0x20027d11 (hwnd=0x3006a,msg=WM_SETTEXT,wp=00000000,lp=004bfaf0) 0009:trace:richedit:RichEditWndProc_common enter hwnd 0x3006a msg 000c () 0 4bfaf0, unicode 1 ... --- snip --- Upon return of EM_STREAMIN message handler, the installer checks the return value and if zero it assumes the text file (EULA) wasn't properly read. http://msdn.microsoft.com/en-us/library/bb774302.aspx --- quote --- Return Value This message returns the number of characters read. --- quote --- If this is done, the EULA is correctly displayed in richedit control. Currently ME_StreamIn -> ME_StreamInText unconditionally return zero, relying on the caller to look at inStream.editstream->dwError value. Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 6

[Bug 29669] New: Dragon Age: Origins DVD authenticity checks fail (descriptor structures returned by DVD_READ_STRUCT need a descriptor header prepended)
by wine-bugs＠winehq.org May 7, 2020

May 7, 2020

http://bugs.winehq.org/show_bug.cgi?id=29669 Bug #: 29669 Summary: Dragon Age: Origins DVD authenticity checks fail (descriptor structures returned by DVD_READ_STRUCT need a descriptor header prepended) Product: Wine Version: 1.3.37 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: ntdll AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello, continuation of bug 29667 Now that DVD_LAYER_DESCRIPTOR data is properly verified, the game loader retrieves DvdManufacturerDescriptor using IOCTL_DVD_READ_STRUCTURE. The interesting part is that the game loader copies the returned buffer bytes starting from offset 4 (throwing the first _four_ bytes away). Remembering these four bytes, I went back here: http://source.winehq.org/git/wine.git/blob/f082eac97c3ec71de58eea85bb4de5a1… --- quote --- /* The documented format of DVD_LAYER_DESCRIPTOR is wrong. Even the format in the * DDK's header is wrong. There are four bytes at the start defined by * MMC-5. The first two are the size of the structure in big-endian order as * defined by MMC-5. The other two are reserved. */ --- quote --- Actually all descriptor structures handled by DVD_READ_STRUCTURE have a DVD_DESCRIPTOR_HEADER prepended - not just DVD_LAYER_DESCRIPTOR. This forum posts give some useful information: http://forums.techguy.org/software-development/812384-scsi-read-disc-struct… --- snip --- typedef struct { USHORT Length; /* bigEndian */ UCHAR Reserved[2]; } DVD_DESCRIPTOR_HEADER, *PDVD_DESCRIPTOR_HEADER; --- snip --- Because of the missing DVD_DESCRIPTOR_HEADER, the first four bytes get lost hence the extraction of specific fields from manufacturer buffer gives wrong values. With the DVD_DESCRIPTOR_HEADER in place, all DVD authenticity checks pass and the game successfully runs using original media. Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 39

[Bug 32854] New: Winedbg on ARM: gdb proxy mode lacks support for reading CPSR
by wine-bugs＠winehq.org May 7, 2020

May 7, 2020

http://bugs.winehq.org/show_bug.cgi?id=32854 Bug #: 32854 Summary: Winedbg on ARM: gdb proxy mode lacks support for reading CPSR Product: Wine Version: 1.5.22 Platform: arm OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: winedbg AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, as the summary says ... Any command will show the problem: --- snip --- $ winedbg --gdb ./foo-arm.exe ... Wine-gdb> bt #0 0x4025202c in kill () from /lib/arm-linux-gnueabi/libc.so.6 Register 25 is not available --- snip --- Making winedbg more verbose yields: --- snip --- ... Packet: g Reply : 000000000500000000c00840103e00003c969f40300002408988000025000000000000000000000000000840fcfdcf408cc13e40f4fdcf4054a83a402c202540 Packet: p19 Register out of bounds 19 Reply : ... --- snip --- GDB reads standard registers using the "g" command ('get all registers'). Special purpose registers like CPSR are read using "p" command ('get individual register'). This is currently not supported by winedbg but essential when running proxy mode. Source: http://source.winehq.org/git/wine.git/blob/d62d7474d43949d71ac34e2157c2fdb8… --- snip --- 372 #elif defined(__arm__) 373 static struct cpu_register cpu_register_map[] = { 374 REG(R0, 4), 375 REG(R1, 4), 376 REG(R2, 4), 377 REG(R3, 4), 378 REG(R4, 4), 379 REG(R5, 4), 380 REG(R6, 4), 381 REG(R7, 4), 382 REG(R8, 4), 383 REG(R9, 4), 384 REG(R10, 4), 385 REG(Fp, 4), 386 REG(Ip, 4), 387 REG(Sp, 4), 388 REG(Lr, 4), 389 REG(Pc, 4), 390 }; --- snip --- Side note: For future it might be useful to add support for XML register set definitions (newer GDB versions are XML-aware = more flexible). Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 10

[Bug 32990] New: Wine on ARM: relay tracing is broken with entry points having an odd number of arguments, calling into glibc code that makes use of alloca()
by wine-bugs＠winehq.org May 7, 2020

May 7, 2020

http://bugs.winehq.org/show_bug.cgi?id=32990 Bug #: 32990 Summary: Wine on ARM: relay tracing is broken with entry points having an odd number of arguments, calling into glibc code that makes use of alloca() Product: Wine Version: 1.5.24 Platform: arm OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: ntdll AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, relay tracing doesn't work properly on ARM :( Example app (others have similar problem): WINEDEBUG=+tid,+seh,+relay,+time,+file --- snip --- ... 002e:Call KERNEL32.LZOpenFileW(408baf68 L"Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe",40d1fb8c,00000000) ret=40f17cec 002e:trace:file:LZOpenFileA (Z:\home\linaro\wine-apps\windefender\unpacked\MPSigStub.exe,0x40d1fb8c,0) 002e:trace:file:OpenFile Z:\home\linaro\wine-apps\windefender\unpacked\MPSigStub.exe OF_READ OF_SHARE_COMPAT 002e:trace:file:OpenFile Z:\home\linaro\wine-apps\windefender\unpacked\MPSigStub.exe 0000 002e:trace:file:RtlGetFullPathName_U (L"Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe" 520 0x40d1f7b8 (nil)) 002e:trace:file:RtlDosPathNameToNtPathName_U (L"Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe",0x40d1f740,(nil),(nil)) 002e:trace:file:RtlGetFullPathName_U (L"Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe" 520 0x40d1f4c0 (nil)) 002e:trace:file:wine_nt_to_unix_file_name L"\\??\\Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe" -> "/home/linaro/.wine/dosdevices/z:/home/linaro/wine-apps/windefender/unpacked/MPSigStub.exe" 002e:trace:file:RtlGetFullPathName_U (L"Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe" 520 0x40d1f7b4 (nil)) 002e:trace:file:OpenFile found "Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe" 002e:trace:file:_lopen ("Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe",0000) 002e:trace:file:CreateFileW L"Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe" GENERIC_READ FILE_SHARE_READ FILE_SHARE_WRITE creation 3 attributes 0x80 002e:trace:file:RtlDosPathNameToNtPathName_U (L"Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe",0x40d1f900,(nil),(nil)) 002e:trace:file:RtlGetFullPathName_U (L"Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe" 520 0x40d1f670 (nil)) 002e:trace:file:wine_nt_to_unix_file_name L"\\??\\Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe" -> "/home/linaro/.wine/dosdevices/z:/home/linaro/wine-apps/windefender/unpacked/MPSigStub.exe" 002e:trace:file:CreateFileW returning 0x2c 002e:trace:seh:raise_exception info[0]=00000000 002e:trace:seh:raise_exception info[1]=30435454 002e:trace:seh:raise_exception Pc:30435454 Sp:40d1f884 Lr:0a30 Cpsr:600f0030 r0:0004 r1:401f3005 r2:0000 r3:168f8 002e:trace:seh:raise_exception r4:0004 r5:40d1f880 r6:168f8 r7:40d1f894 r8:0004 r9:81a3f10 r10:0000 Fp:4033a950 Ip:0000 002e:trace:seh:call_stack_handlers calling handler at 0x403f487c code=c0000005 flags=0 002e:Call KERNEL32.UnhandledExceptionFilter(40d1f6d8) ret=403f48e0 wine: Unhandled page fault on read access to 0x30435454 at address 0x30435454 (thread 002e), starting debugger... 002e:trace:seh:start_debugger Starting debugger "winedbg --auto 45 48" --- snip --- First approach was using winedbg with Cpsr-fixed (=usable) gdbstub: --- snip --- Wine-gdb> b FileTimeToDosDateTime ... Wine-gdb> bt #0 FileTimeToDosDateTime (ft=0x40d5fac8, fatdate=0x40d5fad0, fattime=0x40d5fad2) at /home/linaro/wine/wine-git/dlls/kernel32/time.c:1053 #1 0x40a5f378 in OpenFile (name=0x40901618 "Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe", ofs=0x40d5fbe4, mode=0) at /home/linaro/wine/wine-git/dlls/kernel32/file.c:2596 #2 0x40a785a8 in LZOpenFileA (fn=0x40901618 "Z:\\home\\linaro\\wine-apps\\windefender\\unpacked\\MPSigStub.exe", ofs=0x40d5fbe4, mode=0) at /home/linaro/wine/wine-git/dlls/kernel32/lzexpand.c:540 #3 0x40a7871c in LZOpenFileW (fn=0x40901598, ofs=0x40d5fbe4, mode=0) at /home/linaro/wine/wine-git/dlls/kernel32/lzexpand.c:566 #4 0x4046bcec in GetFileVersionInfoSizeW (filename=0x40901598, handle=0x40d5fc8c) at /home/linaro/wine/wine-git/dlls/version/version.c:590 #5 0x0041cd82 in ?? () #6 0x0041cd82 in ?? () Backtrace stopped: previous frame identical to this frame (corrupt stack?) --- snip --- --- snip --- 1052 unixtime = t; >1053 tm = gmtime( &unixtime ); 1054 if (fattime) => 0x40aa363c <+144>: sub r3, r11, #12 0x40aa3640 <+148>: mov r0, r3 0x40aa3644 <+152>: bl 0x40a1f1dc 0x40aa3648 <+156>: str r0, [r11, #-8] 0x40aa364c <+160>: ldr r3, [r11, #-40] ; 0x28 0x40aa3650 <+164>: cmp r3, #0 0x40aa3654 <+168>: beq 0x40aa36b0 <FileTimeToDosDateTime+260> --- snip --- Thumb veneer to glibc code because my userland is thumb2: --- snip --- 0x40a1f1dc add r12, pc, #0, 12 0x40a1f1e0 add r12, r12, #729088 ; 0xb2000 0x40a1f1e4 ldr pc, [r12, #3932]! ; 0xf5c --- snip --- Arriving at gmtime() code (in thumb mode): --- snip --- 0x402b60bc <gmtime> ldr r2, [pc, #8] ; (0x402b60c8 <gmtime+12>) 0x402b60be <gmtime+2> movs r1, #0 0x402b60c0 <gmtime+4> add r2, pc 0x402b60c2 <gmtime+6> b.w 0x402b7210 0x402b60c6 <gmtime+10> nop 0x402b60c8 <gmtime+12> b.n 0x402b64ac 0x402b60ca <gmtime+14> movs r7, r0 --- snip --- Unfortunately winedbg crashed all time while trying to dig deeper into glibc code. So I switched over to a commercial JTAG debugger solution - not these toys ;-) After some hours of debugging I finally nailed it ... The problem appears here: gmtime() -> __tz_convert() -> tzset_internal() -> __tzfile_read() http://www.eglibc.org/cgi-bin/viewvc.cgi/trunk/libc/time/tzfile.c?revision=… --- snip --- void __tzfile_read (const char *file, size_t extra, char **extrap) { static const char default_tzdir[] = TZDIR; size_t num_isstd, num_isgmt; register FILE *f; ... /* Read the POSIX TZ-style information if possible. */ if (sizeof (time_t) == 8 && tzspec != NULL) { /* Skip over the newline first. */ if (getc_unlocked (f) != '\n' || (fread_unlocked (tzspec, 1, tzspec_len - 1, f) != tzspec_len - 1)) tzspec = NULL; else tzspec[tzspec_len - 1] = '\0'; } else if (sizeof (time_t) == 4 && tzhead.tzh_version[0] != '\0') { /* Get the TZ string. */ ... tzspec_len = st.st_size - off - 1; char *tzstr = alloca (tzspec_len); if (getc_unlocked (f) != '\n' || (fread_unlocked (tzstr, 1, tzspec_len - 1, f) != tzspec_len - 1)) goto lose; tzstr[tzspec_len - 1] = '\0'; tzspec = __tzstring (tzstr); } ... --- snip --- "fread_unlocked (tzstr, 1, tzspec_len - 1, f)" didn't come back, as it overwrote parts of the stack in fread_unlocked() -> _IO_sgetn(). The interesting part is the call to alloca() which looks like gcc builtin alloca code used to get a stack-based buffer for "tzstr" argument. It seems that alloca() depends on proper stack alignment in caller. In relay case it always resulted in less than stack pointer during aligning of buffer. = Without relay: tz_convert entry: r13 = 0x409CFA58 __tzfile_read+0x714: r13 = 0x409CF938 -> r5 = 0x409CF938 (tzstr aligned) = With relay: tz_convert entry: r13 = 0x40A3F9A4 __tzfile_read+0x714: r13 = 0x40A3F884 -> r5 = 0x40A3F880 (tzstr aligned) The ARM ABI requires that the stack be aligned to 8 bytes as it is noted in Procedure Call Standard for the ARM Architecture: http://infocenter.arm.com/help/topic/com.arm.doc.ihi0042d/index.html "SP must be 8-byte aligned on entry to AAPCS-conforming functions" http://infocenter.arm.com/help/topic/com.arm.doc.ihi0046b/IHI0046B_ABI_Advi… The origin of the problem (misaligned stack) can be traced back to Wine's relay debugging, specifically the "call_entry_point" function for ARM. Source: http://source.winehq.org/git/wine.git/blob/1ceec8c78982d7ef5124e86a8da53166… --- snip --- 358 #elif defined(__arm__) 359 __ASM_GLOBAL_FUNC( call_entry_point, 360 "push {r4, r5, LR}\n\t" 361 "mov r4, r0\n\t" 362 "mov r5, SP\n\t" 363 "lsl r3, r1, #2\n\t" 364 "cmp r3, #0\n\t" 365 "beq 5f\n\t" 366 "sub SP, SP, r3\n\t" 367 "bic SP, SP, #15\n\t" 368 "1:\tsub r3, r3, #4\n\t" 369 "ldr r0, [r2, r3]\n\t" 370 "str r0, [SP, r3]\n\t" 371 "cmp r3, #0\n\t" 372 "bgt 1b\n\t" 373 "cmp r1, #1\n\t" 374 "bgt 2f\n\t" 375 "pop {r0}\n\t" 376 "b 5f\n\t" 377 "2:\tcmp r1, #2\n\t" 378 "bgt 3f\n\t" 379 "pop {r0-r1}\n\t" 380 "b 5f\n\t" 381 "3:\tcmp r1, #3\n\t" 382 "bgt 4f\n\t" 383 "pop {r0-r2}\n\t" 384 "b 5f\n\t" 385 "4:\tpop {r0-r3}\n\t" 386 "5:\tblx r4\n\t" 387 "mov SP, r5\n\t" 388 "pop {r4, r5, PC}" ) --- snip --- After the stack area for entry point register arguments has been reserved, the stack is aligned to 16 bytes (why here?). The entry point r0-rN values get written to the stack. Finally these values are put into r0-rN through "pop" instructions before calling the real entry point. Unfortunately if the entry point has an odd number of arguments the "pop" instructions cause a misalignment of the stack. While this is not a problem for "pure" Wine code this is bad for glibc. If you make sure that the stack is at least 8-byte aligned before "blx" then relay tracing works properly for ARM. Already tested ;-) Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 7

[Bug 21924] New: Unhandled privileged instruction at address 0x49acb7
by wine-bugs＠winehq.org May 5, 2020

May 5, 2020

http://bugs.winehq.org/show_bug.cgi?id=21924 Summary: Unhandled privileged instruction at address 0x49acb7 Product: Wine Version: 1.1.39 Platform: x86 OS/Version: Mac OS X 10.6 Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: wine(a)raccoonfink.com Created an attachment (id=26605) --> (http://bugs.winehq.org/attachment.cgi?id=26605) crash log Interstate '76 Arsenal (from GOG: http://www.gog.com/en/gamecard/interstate_’76_arsenal/) fails with an unhandled privileged instruction. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 11