From: Richard Henderson <richard.henderson@linaro.org>
To: qemu-devel@nongnu.org
Cc: "Helge Deller" <deller@gmx.de>,
qemu-stable@nongnu.org,
"Markus F.X.J. Oberhumer" <markus@oberhumer.com>,
"John Reiser" <jreiser@BitWagon.com>,
"Philippe Mathieu-Daudé" <philmd@linaro.org>
Subject: [PULL 09/10] linux-user/armeb: Fix __kernel_cmpxchg() for armeb
Date: Mon, 31 Jul 2023 14:02:10 -0700 [thread overview]
Message-ID: <20230731210211.137353-10-richard.henderson@linaro.org> (raw)
In-Reply-To: <20230731210211.137353-1-richard.henderson@linaro.org>
From: Helge Deller <deller@gmx.de>
Commit 7f4f0d9ea870 ("linux-user/arm: Implement __kernel_cmpxchg with host
atomics") switched to use qatomic_cmpxchg() to swap a word with the memory
content, but missed to endianess-swap the oldval and newval values when
emulating an armeb CPU, which expects words to be stored in big endian in
the guest memory.
The bug can be verified with qemu >= v7.0 on any little-endian host, when
starting the armeb binary of the upx program, which just hangs without
this patch.
Cc: qemu-stable@nongnu.org
Signed-off-by: Helge Deller <deller@gmx.de>
Reported-by: "Markus F.X.J. Oberhumer" <markus@oberhumer.com>
Reported-by: John Reiser <jreiser@BitWagon.com>
Closes: https://github.com/upx/upx/issues/687
Message-Id: <ZMQVnqY+F+5sTNFd@p100>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
linux-user/arm/cpu_loop.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index a992423257..b404117ff3 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -117,8 +117,9 @@ static void arm_kernel_cmpxchg32_helper(CPUARMState *env)
{
uint32_t oldval, newval, val, addr, cpsr, *host_addr;
- oldval = env->regs[0];
- newval = env->regs[1];
+ /* Swap if host != guest endianness, for the host cmpxchg below */
+ oldval = tswap32(env->regs[0]);
+ newval = tswap32(env->regs[1]);
addr = env->regs[2];
mmap_lock();
@@ -174,6 +175,10 @@ static void arm_kernel_cmpxchg64_helper(CPUARMState *env)
return;
}
+ /* Swap if host != guest endianness, for the host cmpxchg below */
+ oldval = tswap64(oldval);
+ newval = tswap64(newval);
+
#ifdef CONFIG_ATOMIC64
val = qatomic_cmpxchg__nocheck(host_addr, oldval, newval);
cpsr = (val == oldval) * CPSR_C;
--
2.34.1
next prev parent reply other threads:[~2023-07-31 21:03 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-31 21:02 [PULL 00/10] tcg patch queue for rc2 Richard Henderson
2023-07-31 21:02 ` [PULL 01/10] util/interval-tree: Use qatomic_read for left/right while searching Richard Henderson
2023-07-31 21:02 ` [PULL 02/10] util/interval-tree: Use qatomic_set_mb in rb_link_node Richard Henderson
2023-08-04 9:02 ` Michael Tokarev
2023-08-04 13:41 ` Richard Henderson
2023-08-04 16:22 ` Michael Tokarev
2023-07-31 21:02 ` [PULL 03/10] util/interval-tree: Introduce pc_parent Richard Henderson
2023-07-31 21:02 ` [PULL 04/10] util/interval-tree: Use qatomic_read/set for rb_parent_color Richard Henderson
2023-07-31 21:02 ` [PULL 05/10] accel/tcg: Clear tcg_ctx->gen_tb on buffer overflow Richard Henderson
2023-07-31 21:02 ` [PULL 06/10] bsd-user: Allocate guest virtual address space Richard Henderson
2023-07-31 21:02 ` [PULL 07/10] bsd-user: Specify host page alignment if none specified Richard Henderson
2023-07-31 21:02 ` [PULL 08/10] target/ppc: Disable goto_tb with architectural singlestep Richard Henderson
2023-08-01 6:05 ` Michael Tokarev
2023-08-01 6:08 ` Michael Tokarev
2023-07-31 21:02 ` Richard Henderson [this message]
2023-07-31 21:02 ` [PULL 10/10] target/s390x: Move trans_exc_code update to do_program_interrupt Richard Henderson
2023-08-01 4:08 ` [PULL 00/10] tcg patch queue for rc2 Richard Henderson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230731210211.137353-10-richard.henderson@linaro.org \
--to=richard.henderson@linaro.org \
--cc=deller@gmx.de \
--cc=jreiser@BitWagon.com \
--cc=markus@oberhumer.com \
--cc=philmd@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-stable@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).