LoadConstant refactors broke code caching

[neobrain]

Since #5139 was merged, code cache validation fails on even the simplest programs (e.g. ls). main had already been failing without the patch from #5226, but #5139 added further divergence on top of that.

To reproduce:

• Check out 0a18ea8 and apply JIT: Ensure code cache consistency by zero-initializing padding bytes #5226 on top of it. Observe that code cache validation passes
• Check out d582356 and apply JIT: Ensure code cache consistency by zero-initializing padding bytes #5226 on top of it. Observe that code cache validation fails

@Sonicadvance1 Could you take a look at this? It's blocking me from properly rebasing the remaining code caching patches. I'm already bottlenecked by catching up on work that happened during Christmas holidays, so would appreciate not chasing down unrelated rabbit holes in the meantime (while rebasing on and checking the other patches that accumulated).

[Sonicadvance1]

$ git log --oneline
146f36fda (HEAD) JIT: Ensure code cache consistency by zero-initializing padding bytes
0a18ea8f4 Merge pull request #5138 from bylaws/eCcodecachingrelocval

Your code cache validation doesn't work for me regardless.

$ ./Bin/FEX `which ls` /
Illegal instruction        (core dumped) ./Bin/FEX `which ls` /

A 2135621|2135621 203.598 Cache validation failed at offset 0x0: f0030000 <-> 30040000 (at 0xaaaae0d3f000 <-> 0xaaaae3264000, guest block 0x1000)

[neobrain]

Can you try with the default configuration as saved by FEXConfig?

[Sonicadvance1]

ryanh@orion-o6:~/.fex-emu$ cat Config.json
{"Config":{"OutputLog":"server", "SilentLog":"0","RootFS":"Ubuntu_24_04"}}

ryanh@orion-o6:/mnt/Work/Work/work/FEXNew/Build_Radxa$ ./Bin/FEX `which ls` /
bin  boot  dev  efi  etc  home  lib  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
ryanh@orion-o6:/mnt/Work/Work/work/FEXNew/Build_Radxa$ ./Bin/FEX `which ls` /
Illegal instruction        (core dumped) ./Bin/FEX `which ls` /
ryanh@orion-o6:/mnt/Work/Work/work/FEXNew/Build_Radxa$ ./Bin/FEXGetConfig --version
FEX-2512-80-g43fc263

A 2168217|2168217 0.887 Cache validation failed at offset 0x0: f0030000 <-> 30040000 (at 0xaaaaff03e000 <-> 0xaaab1255e000, guest block 0x1000)

$ git log --oneline
43fc263a6 (HEAD) JIT: Ensure code cache consistency by zero-initializing padding bytes
0a18ea8f4 Merge pull request #5138 from bylaws/eCcodecachingrelocval

[neobrain]

That's not the default config saved by FEXConfig, but it doesn't reproduce for me with the one you used either. Did you clear the fex cache folder before trying?

If it still happens after that, can you look into how the two blocks at the printed addresses are different? We need to get this sorted, otherwise we can't meaningfully move forward with other work.

[neobrain]

Might be related to library forwarding. Try running with FEX_THUNKGUESTLIBS="idontexist" so that it skips VDSO.

If not, this must be down to hardware feature flags I guess? I tried both on my X13s and an M1 device.

[Sonicadvance1]

That's not the default config saved by FEXConfig

Default config.

$ git log --oneline
146f36fda (HEAD) JIT: Ensure code cache consistency by zero-initializing padding bytes
0a18ea8f4 Merge pull request #5138 from bylaws/eCcodecachingrelocval

$ FEXGetConfig --version
FEX-2512-80-g146f36f

$ cat $HOME/.fex-emu/Config.json
{"Config":{"DISABLE_VIXL_INDIRECT_RUNTIME_CALLS":"1","ExtendedVolatileMetadata":"","NeedsSeccomp":"0","ServerSocketPath":"","MonoHacks":"1","StartupSleepProcName":"","StartupSleep":"0","HideHypervisorBit":"0","StallProcess":"0","X87ReducedPrecision":"0","VolatileMetadata":"1","KernelUnalignedAtomicBackpatching":"1","StrictInProcessSplitLocks":"0","HalfBarrierTSOEnabled":"1","MemcpySetTSOEnabled":"0","VectorTSOEnabled":"0","TSOEnabled":"1","SMCChecks":"1","EnableGpuvisProfiling":"0","ProfileStats":"0","TelemetryDirectory":"","OutputLog":"server","SilentLog":"1","ThunkConfig":"","ThunkGuestLibs":"\/usr\/share\/fex-emu\/GuestThunks","ThunkHostLibs":"\/usr\/lib\/aarch64-linux-gnu\/fex-emu\/HostThunks","RootFS":"Ubuntu_24_04.ero","CPUFeatureRegisters":"","SmallTSCScale":"1","HostFeatures":"0","EnableCodeCacheValidation":"0","DynamicL1Cache":"0","EnableCodeCachingWIP":"0","DisableTelemetry":"0","DisableL2Cache":"0","MaxInst":"5000","ForceSVEWidth":"0","Multiblock":"1","Disassemble":"0","DynamicL1CacheIncreaseCountHeuristic":"250","DynamicL1CacheDecreaseCountHeuristic":"50","SingleStep":"0","GdbServer":"0","DumpIR":"no","PassManagerDumpIR":"0","DumpGPRs":"0","O0":"0","GlobalJITNaming":"0","LibraryJITNaming":"0","BlockJITNaming":"0","GDBSymbols":"0","InjectLibSegFault":"0"},"ThunksDB":{"fex_thunk_test":0,"asound":0,"drm":0,"Vulkan":0,"WaylandClient":0,"GL":0}}

$ FEXRootFSFetcher $HOME/.fex-emu/RootFS/Ubuntu_24_04.ero
27% hashed
57% hashed
88% hashed
/home/ryanh/.fex-emu/RootFS/Ubuntu_24_04.ero has hash: 78d0d2d661cb9737

$ curl https://rootfs.fex-emu.gg/RootFS_links.json | ag -B4 "78d0d2d661cb9737"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0   0     0   0     0     0     0  --:--:-- --:--:-- --:--:--     0    "Ubuntu 24.04 (EroFS)": {
      "DistroMatch": "ubuntu",
      "DistroVersion": "24.04",
      "URL": "https://rootfs.fex-emu.gg/Ubuntu_24_04/2025-12-27/Ubuntu_24_04.ero",
      "Hash": "78d0d2d661cb9737",

$ export FEX_ENABLECODECACHINGWIP=1
$ export FEX_ENABLECODECACHEVALIDATION=1
$ rm -Rf $HOME/.cache/fex-emu/
Second terminal $ FEXServer -f -p
erofsfuse 1.8.10
<W> erofs: /home/ryanh/.fex-emu/RootFS/Ubuntu_24_04.ero mounted on /run/user/1000/.FEXMount2199037-r2kiuB with offset 0

$ FEX /usr/bin/ls /
bin  boot  dev  efi  etc  home  lib  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
$ FEX /usr/bin/ls /
Illegal instruction        (core dumped) FEX /usr/bin/ls /

<...> FEXServer output:
Requested cache generation for /run/user/1000/.FEXMount2199037-r2kiuB/usr/bin/ls
Requested cache generation for /run/user/1000/.FEXMount2199037-r2kiuB/usr/bin/ls
Found code map /home/ryanh/.cache/fex-emu/codemap/new/ls-cfabfa0fd02686cd.0.bin, queuing for merge
Found 1 new code maps, updating reference code map
Writing 212 blocks to /home/ryanh/.cache/fex-emu/codemap/ready/libc.so.6-5c42369e0d074b84
Writing 79 blocks to /home/ryanh/.cache/fex-emu/codemap/ready/ls-cfabfa0fd02686cd
Writing 143 blocks to /home/ryanh/.cache/fex-emu/codemap/ready/ld-linux-x86-64.so.2-f1aa3838bddc35f4
Generating cache for libc.so.6-5c42369e0d074b84
Parsed 212 codemap entries for /run/user/1000/.FEXMount2199037-r2kiuB/usr/lib/x86_64-linux-gnu/libc.so.6 (5c42369e0d074b84)
Compiling code...
Successfully populated cache /home/ryanh/.cache/fex-emu/cache/libc.so.6-5c42369e0d074b84-0000000000000000 (212 blocks) via libc.so.6-5c42369e0d074b84

Generating cache for ls-cfabfa0fd02686cd
Found dependency /run/user/1000/.FEXMount2199037-r2kiuB/usr/lib/x86_64-linux-gnu/libc.so.6 (5c42369e0d074b84)
Parsed 79 codemap entries for /run/user/1000/.FEXMount2199037-r2kiuB/usr/bin/ls (cfabfa0fd02686cd)
Found dependency /run/user/1000/.FEXMount2199037-r2kiuB/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 (f1aa3838bddc35f4)
Compiling code...
Successfully populated cache /home/ryanh/.cache/fex-emu/cache/ls-cfabfa0fd02686cd-0000000000000000 (79 blocks) via ls-cfabfa0fd02686cd

Generating cache for ld-linux-x86-64.so.2-f1aa3838bddc35f4
Parsed 143 codemap entries for /run/user/1000/.FEXMount2199037-r2kiuB/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 (f1aa3838bddc35f4)
Compiling code...
Successfully populated cache /home/ryanh/.cache/fex-emu/cache/ld-linux-x86-64.so.2-f1aa3838bddc35f4-0000000000000000 (143 blocks) via ld-linux-x86-64.so.2-f1aa3838bddc35f4

Next run with additional features disabled

$ export FEX_HOSTFEATURES=disablesve,disableavx,disableafp,disablelrcpc2,disablelrcpc,disablepmull128,disableclzero,disablefcma,disableflagm2,disableflagm,disablerpres,disablesvebitperm,disablewfxt,disable3dnow,disablesse4a
$ export FEX_THUNKGUESTLIBS="idontexist"
$ FEX /usr/bin/ls /
bin  boot  dev  efi  etc  home  lib  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
$ FEX /usr/bin/ls /
Illegal instruction        (core dumped) FEX /usr/bin/ls /

[neobrain]

Reiterating this:

If it still happens after that, can you look into how the two blocks at the printed addresses are different?

Could you for example dump the assembly for these, both the data in the cache and the one compiled at runtime? That's what the error message prints the base addresses for, and it's failing at offset 0 anyway.

[neobrain]

Next run with additional features disabled

Also worth repeating that code caching isn't configuration-aware since the corresponding patches haven't landed in main yet, so if you had any caches before changing your config, it would obviously trigger validation failures.

[Sonicadvance1]

Even with MaxInst=1 and no multiblock this is still failing. Looks like cache validation fails on instruction 488d0d19cb0200 lea rcx, [rel data_7ffff7ef3b35] {"GLIBC_PRIVATE"}

I can't add disassembly at that location I no longer know how to find the beginning and ending host PC inside your validation code. Attempts to find it with CachedCode.size() and CodeBufferRangeRef.size() return buffers 0x123434 bytes in size even though 1 instruction sized blocks would never get to that size.

FEX_DISASSEMBLE=blocks has the last block before assert as follows (Which doesn't make any sense for the block if it is that instruction? Maybe it never hits the disassembly stage, so it is the block before the faulting one?):

I 2366944|2366944 1481.641 Disassemble Begin
I 2366944|2366944 1481.641 adr x0, #-0x4 (addr 0xaaab80827cd0)
I 2366944|2366944 1481.641 str x0, [x28]
I 2366944|2366944 1481.641 ldr x20, [x8], #8
I 2366944|2366944 1481.641 ldp x0, x1, [x25], #16
I 2366944|2366944 1481.641 sub x0, x0, x20
I 2366944|2366944 1481.641 cbz x0, #+0x24 (addr 0xaaab80827d0c)
I 2366944|2366944 1481.641 ldp x0, x1, [x28, #416]
I 2366944|2366944 1481.641 and x1, x1, x20, lsl #4
I 2366944|2366944 1481.641 add x0, x0, x1
I 2366944|2366944 1481.641 ldp x1, x0, [x0]
I 2366944|2366944 1481.641 sub x0, x0, x20
I 2366944|2366944 1481.641 cbz x0, #+0xc (addr 0xaaab80827d0c)
I 2366944|2366944 1481.641 ldr x1, [x28, #2816]
I 2366944|2366944 1481.641 str x20, [x28, #24]
I 2366944|2366944 1481.641 ret x1
I 2366944|2366944 1481.641 uaddl2 v4.4s, v9.8h, v16.8h
I 2366944|2366944 1481.641 udf #0xaaab
I 2366944|2366944 1481.641 Disassemble End
E 2366944|2366944 1481.665 Recorded rip 0: 0x7ffff7ec7015 (offset 0x1015)
E 2366944|2366944 1481.665 Recorded rip 1: 0x7ffff7ec7015 (offset 0x1015)
E 2366944|2366944 1481.665 IR:
        (%0) IRHeader %2, #0x7ffff7ec7015, #1, #1
        (%2) CodeBlock %3, %4
                (%3 i0) BeginBlock %2
                (%5 i0) GuestOpcode #0x0
                %6(R1) i64 = EntrypointOffset #0x2cb20
                (%7 i64) InlineEntrypointOffset #0x7
                (%9 i64) ExitFunction %7, None, %Invalid, %Invalid
                (%4 i0) EndBlock %2
A 2366944|2366944 1481.665 Cache validation failed at offset 0x32c: 00000000 <-> 01000014 (at 0xaaab6c2d6000 <-> 0xaaab80704000, guest block 0x1015)

#0  FEXCore::Assert::ForcedAssert () at /mnt/Work/Work/work/FEXNew/FEXCore/Source/Utils/ForcedAssert.cpp:9
#1  0x0000aaaaaab86494 in FEXCore::Context::CodeCache::Validate (this=<optimized out>, this@entry=0xfffff6e4c190, Section=..., GuestBlocks=..., HostBlocks=..., CachedCode=std::span of length 1193012 = {...}) at /mnt/Work/Work/work/FEXNew/FEXCore/Source/Interface/Core/CodeCache.cpp:617
#2  0x0000aaaaaab85568 in FEXCore::Context::CodeCache::LoadData (this=0xfffff6e4c190, Thread=..., MappedCacheFile=<optimized out>, BinarySection=...) at /mnt/Work/Work/work/FEXNew/FEXCore/Source/Interface/Core/CodeCache.cpp:490
#3  0x0000aaaaaaca5d94 in FEX::HLE::LoadCodeCache (Thread=..., Section=..., CodeCacheConfigId=<optimized out>) at /mnt/Work/Work/work/FEXNew/Source/Tools/LinuxEmulation/LinuxSyscalls/SyscallsSMCTracking.cpp:240
#4  0x0000aaaaaaca6750 in FEX::HLE::SyscallHandler::TriggerPostStartupCodeCacheLoad (this=0xfffff6e7d000, Thread=...) at /mnt/Work/Work/work/FEXNew/Source/Tools/LinuxEmulation/LinuxSyscalls/SyscallsSMCTracking.cpp:361
#5  0x0000aaaaaab76cac in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at /mnt/Work/Work/work/FEXNew/Source/Tools/FEXInterpreter/FEXInterpreter.cpp:567

So it doesn't even get to running before faulting out.

[neobrain]

A 2168217|2168217 0.887 Cache validation failed at offset 0x0: f0030000 <-> 30040000 (at 0xaaaaff03e000 <-> 0xaaab1255e000, guest block 0x1000)
A 2366944|2366944 1481.665 Cache validation failed at offset 0x32c: 00000000 <-> 01000014 (at 0xaaab6c2d6000 <-> 0xaaab80704000, guest block 0x1015)

Why is this a different validation failure now? Is it because of MaxInst=1 or is the failure inconsistent for you?

Even with MaxInst=1 and no multiblock this is still failing. Looks like cache validation fails on instruction 488d0d19cb0200 lea rcx, [rel data_7ffff7ef3b35] {"GLIBC_PRIVATE"}

Can you double-check that it matches whatever instruction is at offset 0x1015 in libc.so.6? (See objdump -d output)

I can't add disassembly at that location I no longer know how to find the beginning and ending host PC inside your validation code. Attempts to find it with CachedCode.size() and CodeBufferRangeRef.size() return buffers 0x123434 bytes in size even though 1 instruction sized blocks would never get to that size.

The validation failure prints the hex addresses of the buffer: 0xaaab6c2d6000 and 0xaaab80704000 in the logs above. (The first mismatching byte is at offset 0x32c in each). I typically print these using x/20i in gdb.

FEX_DISASSEMBLE=blocks has the last block before assert as follows (Which doesn't make any sense for the block if it is that instruction? Maybe it never hits the disassembly stage, so it is the block before the faulting one?):

Validation happens at the time of the cache load (for all cached blocks in the binary), so it wouldn't even have executed any block in the failing binary at all.

[Sonicadvance1]

A 2168217|2168217 0.887 Cache validation failed at offset 0x0: f0030000 <-> 30040000 (at 0xaaaaff03e000 <-> 0xaaab1255e000, guest block 0x1000)
A 2366944|2366944 1481.665 Cache validation failed at offset 0x32c: 00000000 <-> 01000014 (at 0xaaab6c2d6000 <-> 0xaaab80704000, guest block 0x1015)

Why is this a different validation failure now? Is it because of MaxInst=1 or is the failure inconsistent for you?

It's consistent, just because I've been messing with a couple options to try and see why your validation code is breaking.

Even with MaxInst=1 and no multiblock this is still failing. Looks like cache validation fails on instruction 488d0d19cb0200 lea rcx, [rel data_7ffff7ef3b35] {"GLIBC_PRIVATE"}

Can you double-check that it matches whatever instruction is at offset 0x1015 in libc.so.6? (See objdump -d output)

Yep, 1015: 48 8d 0d 19 cb 02 00 lea rcx,[rip+0x2cb19] # 2db35 <__rtld_version_placeholder@GLIBC_2.34+0x29a5>

I can't add disassembly at that location I no longer know how to find the beginning and ending host PC inside your validation code. Attempts to find it with CachedCode.size() and CodeBufferRangeRef.size() return buffers 0x123434 bytes in size even though 1 instruction sized blocks would never get to that size.

The validation failure prints the hex addresses of the buffer: 0xaaab6c2d6000 and 0xaaab80704000 in the logs above. (The first mismatching byte is at offset 0x32c in each). I typically print these using x/20i in gdb.

FEX_DISASSEMBLE=blocks has the last block before assert as follows (Which doesn't make any sense for the block if it is that instruction? Maybe it never hits the disassembly stage, so it is the block before the faulting one?):

Validation happens at the time of the cache load (for all cached blocks in the binary), so it wouldn't even have executed any block in the failing binary at all.

Disassembly happens at JIT code emission, not execution time. The code in the disassembly just doesn't seem to match that LEA.

[neobrain]

Could you just break into the debugger and print the assembly using the printed addresses and offsets as mentioned in my previous comment? Seeing the ARM disassembly for both the cache and the JIT side-by-side is likely going to make the problem apparent very quickly without having to guess where that unmatching disassembly output is coming from.

[Sonicadvance1]

ryanh@orion-o6:/mnt/Work/Work/work/FEXNew/Build_Radxa$ export FEX_SILENTLOG=0
ryanh@orion-o6:/mnt/Work/Work/work/FEXNew/Build_Radxa$ export FEX_OUTPUTLOG=stderr
ryanh@orion-o6:/mnt/Work/Work/work/FEXNew/Build_Radxa$ export FEX_ENABLECODECACHINGWIP=1
ryanh@orion-o6:/mnt/Work/Work/work/FEXNew/Build_Radxa$ export FEX_ENABLECODECACHEVALIDATION=1
ryanh@orion-o6:/mnt/Work/Work/work/FEXNew/Build_Radxa$ rm -Rf $HOME/.cache/fex-emu/
ryanh@orion-o6:/mnt/Work/Work/work/FEXNew/Build_Radxa$ FEX /usr/bin/ls /
I Cache file does not exist: /home/ryanh/.cache/fex-emu/cache/ld-linux-x86-64.so.2-f709109d2ba72822-0000000000000000
I Cache file does not exist: /home/ryanh/.cache/fex-emu/cache/ls-19497f7499b33bfb-0000000000000000
I Cache file does not exist: /home/ryanh/.cache/fex-emu/cache/libc.so.6-2e34732132fe7af4-0000000000000000
bin  boot  dev  efi  etc  home  lib  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var
ryanh@orion-o6:/mnt/Work/Work/work/FEXNew/Build_Radxa$ gdb --args FEX /usr/bin/ls /
GNU gdb (Debian 16.3-5) 16.3
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from FEX...
(gdb) r
Starting program: /usr/bin/FEX /usr/bin/ls /
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
I Cache load:  9179 blocks; base=0x7ffffffc3000; off=   0x1000-0x002c000; f709109d2ba72822 /home/ryanh/.fex-emu/RootFS/Ubuntu_24_04/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
E Recorded rip 0: 0x7ffffffc4015 (offset 0x1015)
E Recorded rip 1: 0x7ffffffc4015 (offset 0x1015)
E IR:
        (%0) IRHeader %2, #0x7ffffffc4015, #1, #1
        (%2) CodeBlock %3, %4
                (%3 i0) BeginBlock %2
                (%5 i0) GuestOpcode #0x0
                %6(R1) i64 = EntrypointOffset #0x2cb20
                (%7 i64) InlineEntrypointOffset #0x7
                (%9 i64) ExitFunction %7, None, %Invalid, %Invalid
                (%4 i0) EndBlock %2

A Cache validation failed at offset 0x32c: 00000000 <-> 01000014 (at 0xaaab6c6c8000 <-> 0xaaab80b04000, guest block 0x1015)

Program received signal SIGILL, Illegal instruction.
FEXCore::Assert::ForcedAssert () at /mnt/Work/Work/work/FEXNew/FEXCore/Source/Utils/ForcedAssert.cpp:9
9         asm volatile("hlt #1");
(gdb) x/20i 0xaaab6c6c8000
   0xaaab6c6c8000:      udf     #64
   0xaaab6c6c8004:      adr     x0, 0xaaab6c6c8000
   0xaaab6c6c8008:      str     x0, [x28]
   0xaaab6c6c800c:      b       0xaaab6c6c8010
   0xaaab6c6c8010:      b       0xaaab6c6c8018
   0xaaab6c6c8014:      br      x0
   0xaaab6c6c8018:      ldr     x0, 0xaaab6c6c8038
   0xaaab6c6c801c:      blr     x0
   0xaaab6c6c8020:      udf     #0
   0xaaab6c6c8024:      udf     #0
   0xaaab6c6c8028:      .inst   0xfffc4004 ; undefined
   0xaaab6c6c802c:      udf     #32767
   0xaaab6c6c8030:      .inst   0xfffffffc ; undefined
   0xaaab6c6c8034:      .inst   0xffffffff ; undefined
   0xaaab6c6c8038:      .inst   0x5a6c4124 ; undefined
   0xaaab6c6c803c:      udf     #43691
   0xaaab6c6c8040:      udf     #108
   0xaaab6c6c8044:      udf     #0
   0xaaab6c6c8048:      .inst   0xfffc4000 ; undefined
   0xaaab6c6c804c:      udf     #32767
(gdb) x20i 0xaaab80b04000
Undefined command: "x20i".  Try "help".
(gdb) x/20i 0xaaab80b04000
   0xaaab80b04000:      udf     #64
   0xaaab80b04004:      adr     x0, 0xaaab80b04000
   0xaaab80b04008:      str     x0, [x28]
   0xaaab80b0400c:      b       0xaaab80b04010
   0xaaab80b04010:      b       0xaaab80b04018
   0xaaab80b04014:      br      x0
   0xaaab80b04018:      ldr     x0, 0xaaab80b04038
   0xaaab80b0401c:      blr     x0
   0xaaab80b04020:      udf     #0
   0xaaab80b04024:      udf     #0
   0xaaab80b04028:      .inst   0xfffc4004 ; undefined
   0xaaab80b0402c:      udf     #32767
   0xaaab80b04030:      .inst   0xfffffffc ; undefined
   0xaaab80b04034:      .inst   0xffffffff ; undefined
   0xaaab80b04038:      .inst   0x5a6c4124 ; undefined
   0xaaab80b0403c:      udf     #43691
   0xaaab80b04040:      udf     #108
   0xaaab80b04044:      udf     #0
   0xaaab80b04048:      .inst   0xfffc4000 ; undefined
   0xaaab80b0404c:      udf     #32767
(gdb)

[neobrain]

The mentioned offset 0x32c is not covered. Needs something like x/20i 0xaaab80b0432c, but this would miss the start of the block, which I would need to see included as well.

[Sonicadvance1]

(gdb) x/20i 0xaaab6c6c832c
   0xaaab6c6c832c:      udf     #0
   0xaaab6c6c8330:      b       0xaaab6c6c8338
   0xaaab6c6c8334:      br      x0
   0xaaab6c6c8338:      ldr     x0, 0xaaab6c6c8358
   0xaaab6c6c833c:      blr     x0
   0xaaab6c6c8340:      udf     #0
   0xaaab6c6c8344:      udf     #0
   0xaaab6c6c8348:      .inst   0xfffc401c ; undefined
   0xaaab6c6c834c:      udf     #32767
   0xaaab6c6c8350:      .inst   0xfffffff8 ; undefined
   0xaaab6c6c8354:      .inst   0xffffffff ; undefined
   0xaaab6c6c8358:      .inst   0x5a6c4124 ; undefined
   0xaaab6c6c835c:      udf     #43691
   0xaaab6c6c8360:      udf     #124
   0xaaab6c6c8364:      udf     #0
   0xaaab6c6c8368:      .inst   0xfffc4015 ; undefined
   0xaaab6c6c836c:      udf     #32767
   0xaaab6c6c8370:      udf     #7
   0xaaab6c6c8374:      udf     #0
   0xaaab6c6c8378:      udf     #2
(gdb) x/20i 0xaaab80b0432c
   0xaaab80b0432c:      b       0xaaab80b04330
   0xaaab80b04330:      b       0xaaab80b04338
   0xaaab80b04334:      br      x0
   0xaaab80b04338:      ldr     x0, 0xaaab80b04358
   0xaaab80b0433c:      blr     x0
   0xaaab80b04340:      udf     #0
   0xaaab80b04344:      udf     #0
   0xaaab80b04348:      .inst   0xfffc401c ; undefined
   0xaaab80b0434c:      udf     #32767
   0xaaab80b04350:      .inst   0xfffffffc ; undefined
   0xaaab80b04354:      .inst   0xffffffff ; undefined
   0xaaab80b04358:      .inst   0x5a6c4124 ; undefined
   0xaaab80b0435c:      udf     #43691
   0xaaab80b04360:      udf     #124
   0xaaab80b04364:      udf     #0
   0xaaab80b04368:      .inst   0xfffc4015 ; undefined
   0xaaab80b0436c:      udf     #32767
   0xaaab80b04370:      udf     #7
   0xaaab80b04374:      udf     #0
   0xaaab80b04378:      udf     #2