[Bug 60405] New: ssbs-probe (2026-09-29 source snapshot, ARM64): SSBS cleared after RtlRestoreContext
http://bugs.winehq.org/show_bug.cgi?id=60405 Bug ID: 60405 Summary: ssbs-probe (2026-09-29 source snapshot, ARM64): SSBS cleared after RtlRestoreContext Product: Wine Version: 11.18 Hardware: arm OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs@list.winehq.org Reporter: thomasabbott916@hotmail.com Target Milestone: --- Distribution: --- Created attachment 82206 --> http://bugs.winehq.org/attachment.cgi?id=82206 All the evidence logs Summary: ssbs-probe (2026-09-29 source snapshot, ARM64): SSBS cleared after RtlRestoreContext Product: Wine Component: ntdll Version: 11.18 (exact development commit below) Severity: Normal Comments: The attached ssbs-probe.c (September 29, 2026 source snapshot; SHA256 8490049b715e78716f31367343e0cea2c4c391c25dfcf9ab3ad65187b7e7276c) is a native Windows ARM64 console reproducer. It sets PSTATE.SSBS to 1, calls RtlCaptureContext followed by RtlRestoreContext, and observes SSBS=0 afterward. The zero-state control remains zero. This reproduces with unmodified upstream development Wine in a fresh default prefix, without Proton, FEX, DXVK, Windows DLLs, or DLL overrides. Environment: - Wine reports wine-11.18, built from official WineHQ git commit 6880117619afdf62b4ccc40a8c6268c86613131f. This was the repository HEAD at both checkout and final verification on September 29, 2026. - Build: ../wine/configure --disable-tests; make -j8. No source patches; clean git diff. The option skips building Wine's own test suite, not runtime functionality. - CPU/device: Qualcomm Oryon, AYN Odin 3, aarch64; SSBS and DIT instructions are exposed by Linux. - OS: Fedora 44 userspace in a rootless Podman container on Armada 20260927.42a9d14, Linux 7.2.6. The container executes directly on the ARM64 hardware; Wine was launched directly from its build tree. - GCC 16.2.1, Clang 22.1.8, glibc 2.43. Xvfb supplied the display during prefix initialization. Reproduction: 1. On an ARM64 system exposing SSBS read/write instructions, compile attached ssbs-probe.c using LLVM-MinGW: aarch64-w64-mingw32-clang -march=armv8.5-a -O0 ssbs-probe.c -o ssbs-probe.exe 2. Launch it with native ARM64 Wine in a new prefix, leaving DLL overrides and Wine configuration at their defaults. Exact build-tree invocation and environment are attached. 3. Compare the printed before/after SSBS values for requested=1 and requested=0. The raw register value 4096 means SSBS=1; zero means SSBS=0. Actual: requesting 1 produces before=4096 and after=0. Requesting 0 produces before=0 and after=0. Both first-run and repeat invocations exit successfully and reproduce the same result. Expected/proposed behavior: restoring Windows CPU context should not unintentionally discard the host thread's speculative-store-bypass state when the supplied context only contains arithmetic flags. A native Linux control on the same hardware preserves both SSBS values across ordinary signal delivery/return. I do not have native Windows ARM64 hardware, so I have NOT verified Windows behavior or which non-NZCV Cpsr bits Windows permits applications to change; please confirm the intended compatibility semantics. Analysis: In dlls/ntdll/unix/signal_arm64.c, restore_context assigns context->Cpsr to the whole signal-frame PSTATE, and usr2_handler does the same with frame->cpsr. RtlCaptureContext and the syscall dispatcher can supply NZCV without SSBS. Earlier observation of the Proton-shipped handler directly recorded PSTATE changing from 0x60001000 to 0x60000000. The upstream reproduction above does not use that observer or any modified binary. The attachment includes an extended suspend/GetThreadContext/SetThreadContext/resume diagnostic. Supplying the opposite SSBS bit in Cpsr changes the worker's SSBS in either direction. This demonstrates the second write path; it is not presented as proof of the native Windows filtering contract. Attachments: One archive contains both small source reproducers, native Linux control, complete first-run and repeat terminal output, exact build/environment information, source/binary checksums, duplicate-search notes, and a narrowly scoped SSBS-only candidate patch. The candidate was previously validated as equivalent binary edits in Proton Wine; it has NOT been source-built/tested against this upstream build and is offered for review only. It passes git apply --check against the tested source. It preserves incoming SSBS=0 as well as 1 and does not force speculation on. Searches: Bugzilla ALL SSBS and ALL "RtlRestoreContext" ARM64 returned no matches. Known Issues and FF13's AppDB linked bug list were also checked. Details and links are attached. Limitations: native Windows ARM64 comparison, other CPUs, and macOS are untested. Fresh-prefix logs retain all initialization diagnostics, including Mono helper-architecture, Xvfb/DRI3 and container Bluetooth messages. Repeat runs reproduce the state loss after initialization without the Mono helper messages. The probes are native console programs and do not use .NET, graphics acceleration or Bluetooth. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60405 --- Comment #1 from thomasabbott916@hotmail.com --- I want to add for some context: 1. This was found by debugging why the perf of non-ARM proton was outperforming ARM64 proton for Final Fantasy XIII. It was found that this issue is not present in the x86_64 stack, only on the ARM64 stack... With the fix fps goes from 48 -> 66 fps (37.5% increase). 2. SSBS is just one of many flags being cleared. Some small exploration showed other flags (like DIT) might also need to be preserved ideally. I think a fix for this should explore it through a general lens. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60405 Ken Sharp <imwellcushtymelike@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Hardware|arm |aarch64 Keywords| |download, source URL| |https://bugs.winehq.org/att | |achment.cgi?id=82206 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60405 Jacek Caban <jacek@codeweavers.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |7fb24b7056e8b0297dcd1705f92 | |00bed0edf9ea7 CC| |jacek@codeweavers.com Status|UNCONFIRMED |RESOLVED Resolution|--- |FIXED --- Comment #2 from Jacek Caban <jacek@codeweavers.com> --- Fixed by https://gitlab.winehq.org/wine/wine/-/merge_requests/12262, thanks for the report. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60405 Alexandre Julliard <julliard@winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #3 from Alexandre Julliard <julliard@winehq.org> --- Closing bugs fixed in 11.20. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla