As per the spec:
the PARAMETER REGISTER contains the address of a pointer to a
four-field data block.
So we need to follow arg0 and place the results of SYS_HEAPINFO there.
Fixes: 3c37cfe0b1 ("semihosting: Change internal common-semi interfaces to use
CPUState *")
Bug: https://bugs.launchpad.net/bugs/1915925
Cc: Bug 1915925 <[email protected]>
Cc: Keith Packard <[email protected]>
Signed-off-by: Alex Bennée <[email protected]>
---
v3
- just revert the old behaviour
---
semihosting/arm-compat-semi.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index 0f0e129a7c..fe079ca93a 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -1214,7 +1214,11 @@ target_ulong do_common_semihosting(CPUState *cs)
for (i = 0; i < ARRAY_SIZE(retvals); i++) {
bool fail;
- fail = SET_ARG(i, retvals[i]);
+ if (is_64bit_semihosting(env)) {
+ fail = put_user_u64(retvals[i], arg0 + i * 8);
+ } else {
+ fail = put_user_u32(retvals[i], arg0 + i * 4);
+ }
if (fail) {
/* Couldn't write back to argument block */
--
2.20.1
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1915925
Title:
ARM semihosting HEAPINFO results wrote to wrong address
Status in QEMU:
Confirmed
Bug description:
This affects latest development branch of QEMU.
According to the ARM spec of the HEAPINFO semihosting call:
https://developer.arm.com/documentation/100863/0300/Semihosting-
operations/SYS-HEAPINFO--0x16-?lang=en
> the PARAMETER REGISTER contains the address of a pointer to a four-
field data block.
However, QEMU treated the PARAMETER REGISTER as pointing to a four-
field data block directly.
Here is a simple program that can demonstrate this problem:
https://github.com/iNvEr7/qemu-learn/tree/newlib-bug/semihosting-
newlib
This code links with newlib with semihosting mode, which will call the
HEAPINFO SVC during crt0 routine. When running in QEMU (make run), it
may crash the program either because of invalid write or memory
curruption, depending on the compiled program structure.
Also refer to my discussion with newlib folks:
https://sourceware.org/pipermail/newlib/2021/018260.html
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1915925/+subscriptions
