Skip to content

x86_64 cmpxchg behavior in qemu tcg does not match the real CPU

Copied from https://bugs.launchpad.net/qemu/+bug/1915327

Still broken in f2da205c


Consider the following little program:

$ cat 1.c
#include <stdio.h>
int main() {
  int mem = 0x12345678;
  register long rax asm("rax") = 0x1234567812345678;
  register int edi asm("edi") = 0x77777777;
  asm("cmpxchg %[edi],%[mem]"
      : [ mem ] "+m"(mem), [ rax ] "+r"(rax)
      : [ edi ] "r"(edi));
  long rax2 = rax;
  printf("rax2 = %lx\n", rax2);
}

According to the Intel Manual, cmpxchg should not touch the accumulator in case the values are equal, which is indeed the case on the real CPU:

$ gcc 1.c
$ ./a.out
rax2 = 1234567812345678

However, QEMU appears to zero extend EAX to RAX:

$ qemu-x86_64 ./a.out
rax2 = 12345678

This is also the case for lock cmpxchg.

Edited by Ilya Leoshkevich
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information