Brothers in Arms Series MMU fault causing the games to crash

[Triticum0]

Title

https://xemu.app/titles/5553003c/#Brothers-in-Arms-Road-to-Hill-30
https://xemu.app/titles/5553005a/#Brothers-in-Arms-Earned-in-Blood

Bug Description

When trying to go in-game use abaire/xemu@bb5e9c0 These games crash with an MMU Fault
Brothers in Arms Road to Hill 30:
MMU fault: ExceptionIndex: EXCP0E ErrorCode: 0 ReturnAddr: 7FECA9D31F73 EIP: 31D96C
MMU fault: ExceptionIndex: EXCP0E ErrorCode: 0 ReturnAddr: 7FECA9D49DB5 EIP: 80049FE1

Brothers in Arms Earned in Blood:
MMU fault: ExceptionIndex: EXCP0E ErrorCode: 0 ReturnAddr: 7F897B95F9F3 EIP: 33409D
MMU fault: ExceptionIndex: EXCP0E ErrorCode: 0 ReturnAddr: 7F897B979CB5 EIP: 80049FE1

Expected Behavior

The should be able to make it in-game

xemu Version

Version: 0.6.2
Branch: master
Commit: 69ceec4
Date: Wed Nov 24 02:59:42 UTC 2021
Last-known Working: Unknown

System Information

System Information

Field	Value
OS	Ubuntu 20.04.3 LTS
CPU	Intel(R) Pentium(R) CPU 3825U @ 1.90GHz
Graphics Device	Mesa Intel(R) HD Graphics (BDW GT1)
Graphics Driver	Drivers: 4.6 (Core Profile) Mesa 21.0.3

Additional Context

Thank for Abaire for finding the issue causing the crash

[Triticum0]

When testing Gungriffon Allied Strike mashing through the intros the game crashed with this MMU Fault.
MMU fault: ExceptionIndex: EXCP0E ErrorCode: 2 ReturnAddr: 7F20207E7EC3 EIP: 22F501
MMU fault: ExceptionIndex: EXCP0E ErrorCode: 0 ReturnAddr: 7F20207F5375 EIP: 80049FE1

This was random so, I won't but it as an issue, but it might be useful to know.
Edit it happen all the time, It seems like my cache has been corrupted as I replaced my save data with a working save, and it didn't stop the game from crashing off the HDD.

[abaire]

Spent a little time looking into this for Hill 30, findings so far:

There is a looping function that is copying memory around at 0xBC347. On HW EAX stays consistent throughout the looping over this method, on xemu EAX is consistent for 3 loops but is cleared to 0 on the fourth, leading to the segfault crash.

The method at 0x0002ab14 seems to control the copying (the actual copy is at 0x00034b44 which is called by this method). On HW this function appears to execute fine, on xemu EIP usually ends up jumping around when moving from 0x02ab15 to 0x0002ab17 (the subsequent instruction, I think it typically jumps back to 0x0bc34a). Occasionally this behavior differs and EIP will end up looping between 0x0bc34a and 0x0bc34d (again consecutive instructions).

[abaire]

There's some kind of race condition involved. If I set a few breakpoints in the aforementioned loop method and manually step around, I can get things to progress to the loading screen after the menu, and even past the loading screen, though eventually I got a dirty/damaged disc error.

[abaire]

The jumping may be an artifact of the way the qemu gdb stub works (looks like it only exposes a thread per CPU, so gdb only thinks there's ever 1 thread despite there being multiple OS threads). Will do future investigation via XBDM / xbdm_gdb_bridge.

[mborgerson]

I think this should be fixed now with latest build. Let me know if it's still broken.

[abaire]

Tested with a HEAD build as of this morning and both games still appear to crash in about the same way. I did not run with debugger attached to verify that it's exactly the same, but the observed behavior is still that both games halt during playback of the intro movies. I believe it may now crash slightly earlier, previously ttps://xemu.app/titles/5553003c/#Brothers-in-Arms-Road-to-Hill-30 would pretty consistently crash on the Gearbox movie on my machine, now it consistently crashes on the previous movie.

Maybe @Triticum0 will have a different experience indicating that my dumps are somehow bad (I've redumped Hill 30 a couple times already trying to rule that out, but only with extract-xiso).

[Triticum0]

@abaire I retested bother in arms earned in blood and it now makes it in-game but it doesn't display anything but the hud elements.

[Triticum0]

@abaire Does your game still crash?

[abaire]

@Triticum0 if it's not crashing for you anymore, let's close this. I haven't re-tested but given that I run a devkit it's likely that if it crashes for me it's because of that.

[MarcoLoves360]

Mine hangs on loading screen after picking difficulty.
Specs:
i7 11700
16gb
RTX 3070
Windows 11 all on latest drivers.