[PULL 0/4] Linux user patches

[PULL 0/4] Linux user patches

[Helge Deller]

From: Helge Deller <deller@gmx.de>

The following changes since commit ec6a1f43989c6bbf2de1ab84959a70ee35fa1b57:

  Merge tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-06-11 13:22:50 -0400)

are available in the Git repository at:

  https://github.com/hdeller/qemu-hppa.git tags/linux-user-pull-request

for you to fetch changes up to 6858e3a71cc41510937bec0950eb4e42e33ba5f2:

  linux-user/xtensa: save/restore FP registers across signal delivery (2026-06-12 17:47:27 +0200)

----------------------------------------------------------------
linux-user patches

Add preadv2/preadv2 syscalls, fix FP registers across signals on xtensa, and
add emulation for /proc/cpuinfo for ppc CPUs

----------------------------------------------------------------

Dominique Martinet (1):
  linux-user: add preadv2/preadv2

Helge Deller (1):
  linux-user: Implement /proc/cpuinfo for ppc cpus

Matt Turner (2):
  target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status
  linux-user/xtensa: save/restore FP registers across signal delivery

 linux-user/ppc/cpu_loop.c    |  2 +-
 linux-user/ppc/target_proc.h | 91 +++++++++++++++++++++++++++++++++-
 linux-user/syscall.c         | 38 ++++++++++++++
 linux-user/xtensa/signal.c   | 96 +++++++++++++++++++++++++++++++++---
 target/xtensa/cpu.h          |  4 ++
 target/xtensa/fpu_helper.c   | 71 ++++++++++++++------------
 6 files changed, 261 insertions(+), 41 deletions(-)

-- 
2.54.0

Re: [PULL 0/4] Linux user patches

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[PULL 0/4] Linux user patches

[Helge Deller]

From: Helge Deller <deller@gmx.de>

The following changes since commit c7cf7c810153d6f5f31aa2d5c0dee9087f6b4dff:

  Merge tag 'firmware-20260617-pull-request' of https://gitlab.com/kraxel/qemu into staging (2026-06-17 10:17:29 -0400)

are available in the Git repository at:

  https://github.com/hdeller/qemu-hppa.git tags/linux-user-pull-request

for you to fetch changes up to 54e08dbe8f2aeca57e3b1a5eab09a9fec88c1c67:

  linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn (2026-06-18 23:43:35 +0200)

----------------------------------------------------------------
linux-user patches

One frame pointer memory locking fix for the xtensa architecture, a generic
loader fix for programs with modified headers, and two patches to emulate
/proc/cpuinfo for loogarch and m68k CPUs.

----------------------------------------------------------------

Akshit Yadav (1):
  linux-user: Fix AT_PHDR when program headers are relocated into their
    own segment

Helge Deller (2):
  linux-user: Implement /proc/cpuinfo for loongarch cpus
  linux-user: Implement /proc/cpuinfo for m68k CPU

Matt Turner (1):
  linux-user/xtensa: fix unlock of uninitialized frame pointer on
    sigreturn

 linux-user/elfload.c                 | 21 +++++++-
 linux-user/loongarch64/elfload.c     | 20 +++++++
 linux-user/loongarch64/target_proc.h | 79 +++++++++++++++++++++++++++-
 linux-user/m68k/target_proc.h        | 46 ++++++++++++++++
 linux-user/qemu.h                    |  1 +
 linux-user/xtensa/signal.c           |  3 +-
 6 files changed, 167 insertions(+), 3 deletions(-)

-- 
2.54.0

Re: [PULL 0/4] Linux user patches

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[PULL 0/4] Linux user patches

[Helge Deller]

From: Helge Deller <deller@gmx.de>

The following changes since commit e8dca265c91b45f4cde746e5094d7b763444eb6a:

  Merge tag 'pull-11.1-more-check-tcg-docker-meson-180926-1' of https://gitlab.com/stsquad/qemu into staging (2026-09-18 07:52:24 -1000)

are available in the Git repository at:

  https://github.com/hdeller/qemu-hppa.git tags/linux-user-pull-request

for you to fetch changes up to e95f53e30be7935d98e38eb09cd6360fe2886249:

  linux-user/loongarch64: Detect vector stores in host_signal_write() (2026-09-18 22:20:21 +0200)

----------------------------------------------------------------
linux-user patches for mlock syscall and loongarch64 and riscv fixes

Add support for the mlock syscall, and some fixes for loongarch64 and riscv.

----------------------------------------------------------------

Michael Morrell (1):
  linux-user: implement mlock2(2) syscall

SignKirigami (1):
  linux-user/loongarch64: Detect vector stores in host_signal_write()

wangyang (2):
  linux-user/riscv: honor zicntr=false for base counterCSRs
  linux-user/riscv: invalidate reservations after stores

 .../include/host/loongarch64/host-signal.h    |  6 +++
 linux-user/riscv/target_cpu.h                 |  2 +
 linux-user/syscall.c                          |  9 +++++
 linux-user/syscall_defs.h                     |  4 ++
 target/riscv/cpu.c                            |  3 ++
 target/riscv/cpu.h                            |  3 ++
 target/riscv/helper.h                         |  5 +++
 target/riscv/tcg/csr.c                        | 11 ++++--
 target/riscv/tcg/insn_trans/trans_rva.c.inc   | 24 ++++++++++++
 target/riscv/tcg/insn_trans/trans_rvi.c.inc   | 11 ++++++
 .../riscv/tcg/insn_trans/trans_rvzawrs.c.inc  |  3 ++
 target/riscv/tcg/op_helper.c                  | 35 +++++++++++++++++
 target/riscv/tcg/translate.c                  | 38 +++++++++++++++++++
 13 files changed, 150 insertions(+), 4 deletions(-)

-- 
2.54.0

[PULL 1/4] linux-user/riscv: honor zicntr=false for base counterCSRs

[Helge Deller]

From: wangyang <wangyang25@otcaix.iscas.ac.cn>

In user-only builds, the base cycle and instret CSRs bypass the zicntr
feature gate because the check is inside the system-mode block. Move the
check before the conditional block so an explicitly disabled zicntr
extension makes the CSRs illegal in linux-user mode.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4148

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: wangyang <wangyang25@otcaix.iscas.ac.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 target/riscv/tcg/csr.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
index bd4b6dc114..061bc9db77 100644
--- a/target/riscv/tcg/csr.c
+++ b/target/riscv/tcg/csr.c
@@ -111,6 +111,13 @@ static RISCVException vs(CPURISCVState *env, int csrno)
 
 static RISCVException ctr(CPURISCVState *env, int csrno)
 {
+    if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) ||
+        (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) {
+        if (!riscv_cpu_cfg(env)->ext_zicntr) {
+            return RISCV_EXCP_ILLEGAL_INST;
+        }
+    }
+
 #if !defined(CONFIG_USER_ONLY)
     RISCVCPU *cpu = env_archcpu(env);
     int ctr_index;
@@ -127,10 +134,6 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 
     if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) ||
         (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) {
-        if (!riscv_cpu_cfg(env)->ext_zicntr) {
-            return RISCV_EXCP_ILLEGAL_INST;
-        }
-
         goto skip_ext_pmu_check;
     }
 
-- 
2.54.0

[PULL 2/4] linux-user/riscv: invalidate reservations after stores

[Helge Deller]

From: wangyang <wangyang25@otcaix.iscas.ac.cn>

In linux-user parallel execution, AMO and ordinary integer stores do not
invalidate load reservations held by another hart. A store that preserves
the numeric value can therefore leave the reservation intact and allow a
later SC to succeed.

Use the existing EXCP_ATOMIC path to re-execute LR, SC, AMO, and ordinary
integer store instructions in a serial context. The completed store and
reservation invalidation then cannot be interleaved with another guest
hart. Track the LR access size and invalidate every other-hart reservation
whose byte range overlaps the completed store. A successful SC uses the
same invalidation helper.

Clear the reservation when cloning a new linux-user RISC-V hart so that a
child cannot inherit the parent's reservation state.

The change is limited to linux-user TCG and the base scalar integer/
A-extension translator paths.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4149

Signed-off-by: wangyang <wangyang25@otcaix.iscas.ac.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/riscv/target_cpu.h                 |  2 +
 target/riscv/cpu.c                            |  3 ++
 target/riscv/cpu.h                            |  3 ++
 target/riscv/helper.h                         |  5 +++
 target/riscv/tcg/insn_trans/trans_rva.c.inc   | 24 ++++++++++++
 target/riscv/tcg/insn_trans/trans_rvi.c.inc   | 11 ++++++
 .../riscv/tcg/insn_trans/trans_rvzawrs.c.inc  |  3 ++
 target/riscv/tcg/op_helper.c                  | 35 +++++++++++++++++
 target/riscv/tcg/translate.c                  | 38 +++++++++++++++++++
 9 files changed, 124 insertions(+)

diff --git a/linux-user/riscv/target_cpu.h b/linux-user/riscv/target_cpu.h
index 9c642367a3..eff18b37ba 100644
--- a/linux-user/riscv/target_cpu.h
+++ b/linux-user/riscv/target_cpu.h
@@ -9,6 +9,8 @@ static inline void cpu_clone_regs_child(CPURISCVState *env, target_ulong newsp,
     }
 
     env->gpr[xA0] = 0;
+    env->load_res = -1;
+    env->load_res_size = 0;
 }
 
 static inline void cpu_clone_regs_parent(CPURISCVState *env, unsigned flags)
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 5fff9d745e..da4c1a090b 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1084,6 +1084,9 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
     env->xl = riscv_cpu_mxl(env);
     cs->exception_index = RISCV_EXCP_NONE;
     env->load_res = -1;
+#ifdef CONFIG_USER_ONLY
+    env->load_res_size = 0;
+#endif
     set_default_nan_mode(1, &env->fp_status);
     /* Default NaN value: sign bit clear, frac msb set */
     set_float_default_nan_pattern(0b01000000, &env->fp_status);
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index c2138dbd4b..8c8ffe94cd 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -264,6 +264,9 @@ struct CPUArchState {
 
     uint64_t pc;
     uint64_t load_res;
+#ifdef CONFIG_USER_ONLY
+    uint64_t load_res_size;
+#endif
     uint64_t load_val;
 
     /* Floating-Point state */
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index 4fc2d3a155..aab92bf132 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -1357,3 +1357,8 @@ DEF_HELPER_1(ssamoswap_disabled, void, env)
 
 /* Zalrsc SC write probe */
 DEF_HELPER_FLAGS_3(sc_probe_write, TCG_CALL_NO_WG, void, env, tl, tl)
+
+#ifdef CONFIG_USER_ONLY
+/* Invalidate reservations overlapping a completed linux-user store. */
+DEF_HELPER_3(riscv_invalidate_reservations, void, env, tl, tl)
+#endif
diff --git a/target/riscv/tcg/insn_trans/trans_rva.c.inc b/target/riscv/tcg/insn_trans/trans_rva.c.inc
index 44c1696fe4..248a8c60d7 100644
--- a/target/riscv/tcg/insn_trans/trans_rva.c.inc
+++ b/target/riscv/tcg/insn_trans/trans_rva.c.inc
@@ -32,6 +32,11 @@
 
 static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop)
 {
+#ifdef CONFIG_USER_ONLY
+    if (!gen_riscv_reservation_serialize(ctx)) {
+        return false;
+    }
+#endif
     TCGv src1;
 
     mop |= MO_ALIGN;
@@ -53,6 +58,9 @@ static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop)
 
     /* Put addr in load_res, data in load_val.  */
     tcg_gen_mov_tl(load_res, src1);
+#ifdef CONFIG_USER_ONLY
+    tcg_gen_movi_tl(load_res_size, memop_size(mop));
+#endif
     gen_set_gpr(ctx, a->rd, load_val);
 
     return true;
@@ -60,9 +68,17 @@ static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop)
 
 static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
 {
+#ifdef CONFIG_USER_ONLY
+    if (!gen_riscv_reservation_serialize(ctx)) {
+        return false;
+    }
+#endif
     TCGv dest, src1, src2;
     TCGLabel *l1 = gen_new_label();
     TCGLabel *l2 = gen_new_label();
+#ifdef CONFIG_USER_ONLY
+    TCGLabel *l3 = gen_new_label();
+#endif
 
     mop |= MO_ALIGN;
     mop |= ctx->mo_endianness;
@@ -79,6 +95,11 @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
     src2 = get_gpr(ctx, a->rs2, EXT_NONE);
     tcg_gen_atomic_cmpxchg_tl(dest, load_res, load_val, src2,
                               ctx->mem_idx, mop);
+#ifdef CONFIG_USER_ONLY
+    tcg_gen_brcond_tl(TCG_COND_NE, dest, load_val, l3);
+    gen_riscv_invalidate_reservations(src1, mop);
+    gen_set_label(l3);
+#endif
     tcg_gen_setcond_tl(TCG_COND_NE, dest, dest, load_val);
     gen_set_gpr(ctx, a->rd, dest);
     tcg_gen_br(l2);
@@ -104,6 +125,9 @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
      * an SC to any address, in between an LR and SC pair.
      */
     tcg_gen_movi_tl(load_res, -1);
+#ifdef CONFIG_USER_ONLY
+    tcg_gen_movi_tl(load_res_size, 0);
+#endif
 
     return true;
 }
diff --git a/target/riscv/tcg/insn_trans/trans_rvi.c.inc b/target/riscv/tcg/insn_trans/trans_rvi.c.inc
index cc1b5dbbad..40b4c9aa4a 100644
--- a/target/riscv/tcg/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/tcg/insn_trans/trans_rvi.c.inc
@@ -489,6 +489,9 @@ static bool gen_store_tl(DisasContext *ctx, arg_sb *a, MemOp memop)
     }
 
     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, memop);
+#ifdef CONFIG_USER_ONLY
+    gen_riscv_invalidate_reservations(addr, memop);
+#endif
     return true;
 }
 
@@ -518,11 +521,19 @@ static bool gen_store_i128(DisasContext *ctx, arg_sb *a, MemOp memop)
         }
         tcg_gen_qemu_st_i128(t16, addrl, ctx->mem_idx, memop);
     }
+#ifdef CONFIG_USER_ONLY
+    gen_riscv_invalidate_reservations(addrl, memop);
+#endif
     return true;
 }
 
 static bool gen_store(DisasContext *ctx, arg_sb *a, MemOp memop)
 {
+#ifdef CONFIG_USER_ONLY
+    if (!gen_riscv_reservation_serialize(ctx)) {
+        return false;
+    }
+#endif
     memop |= ctx->mo_endianness;
     if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
diff --git a/target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc b/target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc
index 0eef033838..1831bbcfc0 100644
--- a/target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc
+++ b/target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc
@@ -32,6 +32,9 @@ static bool trans_wrs_sto(DisasContext *ctx, arg_wrs_sto *a)
 
     /* Clear the load reservation  (if any).  */
     tcg_gen_movi_tl(load_res, -1);
+#ifdef CONFIG_USER_ONLY
+    tcg_gen_movi_tl(load_res_size, 0);
+#endif
 
     gen_update_pc(ctx, ctx->cur_insn_len);
     tcg_gen_exit_tb(NULL, 0);
diff --git a/target/riscv/tcg/op_helper.c b/target/riscv/tcg/op_helper.c
index 3e94005d2b..b67c7718db 100644
--- a/target/riscv/tcg/op_helper.c
+++ b/target/riscv/tcg/op_helper.c
@@ -19,6 +19,9 @@
  */
 
 #include "qemu/osdep.h"
+#ifdef CONFIG_USER_ONLY
+#include "qemu/rcu.h"
+#endif
 #include "cpu.h"
 #include "target/riscv/tcg/csr.h"
 #ifndef CONFIG_USER_ONLY
@@ -298,6 +301,38 @@ void helper_sc_probe_write(CPURISCVState *env, target_ulong addr,
     probe_write(env, addr, size, mmu_idx, ra);
 }
 
+#ifdef CONFIG_USER_ONLY
+
+void helper_riscv_invalidate_reservations(CPURISCVState *env,
+                                          target_ulong addr,
+                                          target_ulong size)
+{
+    CPUState *cpu;
+
+    /* EXCP_ATOMIC keeps other guest harts out while this list is updated. */
+    WITH_RCU_READ_LOCK_GUARD() {
+        CPU_FOREACH(cpu) {
+            CPURISCVState *other_env = cpu_env(cpu);
+            target_ulong reservation = other_env->load_res;
+            target_ulong reservation_size = other_env->load_res_size;
+            bool overlap;
+
+            if (other_env == env || reservation == (target_ulong)-1) {
+                continue;
+            }
+            overlap = reservation < addr
+                ? addr - reservation < reservation_size
+                : reservation - addr < size;
+            if (overlap) {
+                other_env->load_res = -1;
+                other_env->load_res_size = 0;
+            }
+        }
+    }
+}
+
+#endif
+
 #ifndef CONFIG_USER_ONLY
 
 target_ulong helper_sret(CPURISCVState *env)
diff --git a/target/riscv/tcg/translate.c b/target/riscv/tcg/translate.c
index 9684dbe752..cce3b6dc72 100644
--- a/target/riscv/tcg/translate.c
+++ b/target/riscv/tcg/translate.c
@@ -42,6 +42,9 @@ static TCGv cpu_gpr[32], cpu_gprh[32], cpu_pc;
 static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */
 static TCGv_i32 cpu_vl, cpu_vstart;
 static TCGv load_res;
+#ifdef CONFIG_USER_ONLY
+static TCGv load_res_size;
+#endif
 static TCGv load_val;
 
 /*
@@ -1141,10 +1144,34 @@ static bool gen_unary_per_ol(DisasContext *ctx, arg_r2 *a, DisasExtend ext,
     return gen_unary(ctx, a, ext, f_tl);
 }
 
+#ifdef CONFIG_USER_ONLY
+static bool gen_riscv_reservation_serialize(DisasContext *ctx)
+{
+    /* Keep the memory operation and reservation update in one guest step. */
+    if (tb_cflags(ctx->base.tb) & CF_PARALLEL) {
+        gen_helper_exit_atomic(tcg_env);
+        ctx->base.is_jmp = DISAS_NORETURN;
+        return false;
+    }
+    return true;
+}
+
+static void gen_riscv_invalidate_reservations(TCGv addr, MemOp mop)
+{
+    gen_helper_riscv_invalidate_reservations(tcg_env, addr,
+                                             tcg_constant_tl(memop_size(mop)));
+}
+#endif
+
 static bool gen_amo(DisasContext *ctx, arg_atomic *a,
                     void(*func)(TCGv, TCGv, TCGv, TCGArg, MemOp),
                     MemOp mop)
 {
+#ifdef CONFIG_USER_ONLY
+    if (!gen_riscv_reservation_serialize(ctx)) {
+        return false;
+    }
+#endif
     TCGv dest = dest_gpr(ctx, a->rd);
     TCGv src1, src2 = get_gpr(ctx, a->rs2, EXT_NONE);
     MemOp size = mop & MO_SIZE;
@@ -1159,6 +1186,9 @@ static bool gen_amo(DisasContext *ctx, arg_atomic *a,
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
     src1 = get_address(ctx, a->rs1, 0);
     func(dest, src1, src2, ctx->mem_idx, mop);
+#ifdef CONFIG_USER_ONLY
+    gen_riscv_invalidate_reservations(src1, mop);
+#endif
 
     gen_set_gpr(ctx, a->rd, dest);
     return true;
@@ -1482,6 +1512,10 @@ void riscv_translate_init(void)
     size_t pc_offset     = offsetof(CPURISCVState, pc) + field_offset;
     size_t res_offset    = offsetof(CPURISCVState, load_res) + field_offset;
     size_t val_offset    = offsetof(CPURISCVState, load_val) + field_offset;
+#ifdef CONFIG_USER_ONLY
+    size_t res_size_offset = offsetof(CPURISCVState, load_res_size)
+                             + field_offset;
+#endif
 
     for (i = 1; i < 32; i++) {
         cpu_gpr[i] = tcg_global_mem_new(tcg_env,
@@ -1501,5 +1535,9 @@ void riscv_translate_init(void)
     cpu_vl = tcg_global_mem_new_i32(tcg_env, vl_offset, "vl");
     cpu_vstart = tcg_global_mem_new_i32(tcg_env, vstart_offset, "vstart");
     load_res = tcg_global_mem_new(tcg_env, res_offset, "load_res");
+#ifdef CONFIG_USER_ONLY
+    load_res_size = tcg_global_mem_new(tcg_env, res_size_offset,
+                                       "load_res_size");
+#endif
     load_val = tcg_global_mem_new(tcg_env, val_offset, "load_val");
 }
-- 
2.54.0

[PULL 3/4] linux-user: implement mlock2(2) syscall

[Helge Deller]

From: Michael Morrell <mmorrell@tachyum.com>

TARGET_NR_mlock2 is defined for every target's syscall table (it has
been available on all Linux architectures since it was added in
kernel 4.4), and linux-user/strace.list already has an entry for it,
but linux-user/syscall.c has no case handler for it. A guest mlock2()
call therefore falls through to the default case and gets -ENOSYS
instead of being emulated, on every target.

mlock2() differs from mlock() only by a third `flags` argument
(MLOCK_ONFAULT). Add TARGET_MLOCK_ONFAULT and a case that validates
the flags argument and forwards to the host mlock2(), mirroring the
existing TARGET_NR_mlock case immediately above it.

Signed-off-by: Michael Morrell <mmorrell@tachyum.com>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/syscall.c      | 9 +++++++++
 linux-user/syscall_defs.h | 4 ++++
 2 files changed, 13 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index cfa68dfbdb..9f454502cb 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -11230,6 +11230,15 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
     case TARGET_NR_mlock:
         return get_errno(mlock(g2h(cpu, arg1), arg2));
 #endif
+#ifdef TARGET_NR_mlock2
+    case TARGET_NR_mlock2:
+        if (arg3 & ~TARGET_MLOCK_ONFAULT) {
+            return -TARGET_EINVAL;
+        }
+        return get_errno(mlock2(g2h(cpu, arg1), arg2,
+                                 (arg3 & TARGET_MLOCK_ONFAULT) ?
+                                 MLOCK_ONFAULT : 0));
+#endif
 #ifdef TARGET_NR_munlock
     case TARGET_NR_munlock:
         return get_errno(munlock(g2h(cpu, arg1), arg2));
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index e28853c93b..f5831a6bad 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -2795,6 +2795,10 @@ struct target_mount_attr_ver0 {
 #ifndef RESOLVE_IN_ROOT
 #define RESOLVE_IN_ROOT         0x10
 #endif
+
+/* flags for mlock2() */
+#define TARGET_MLOCK_ONFAULT    0x01
+
 #if (defined(TARGET_I386) && defined(TARGET_ABI32)) || \
     (defined(TARGET_ARM) && defined(TARGET_ABI32)) || \
     defined(TARGET_M68K) || defined(TARGET_MICROBLAZE) || \
-- 
2.54.0

[PULL 4/4] linux-user/loongarch64: Detect vector stores in host_signal_write()

[Helge Deller]

From: SignKirigami <prcups@krgm.moe>

Recognize LSX/LASX stores in the LoongArch host signal handler to fix
internal QEMU crashes when RISC-V vector stores hit write-protected code
pages through host memcpy.

Signed-off-by: Felix Yan <felixonmars@archlinux.org>
Signed-off-by: SignKirigami <prcups@krgm.moe>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 linux-user/include/host/loongarch64/host-signal.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/linux-user/include/host/loongarch64/host-signal.h b/linux-user/include/host/loongarch64/host-signal.h
index d33c3fc03e..eb4308cf09 100644
--- a/linux-user/include/host/loongarch64/host-signal.h
+++ b/linux-user/include/host/loongarch64/host-signal.h
@@ -61,6 +61,10 @@ static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
             return true;
         }
         break;
+    case 0b001011: /* v{ld,st}, xv{ld,st} */
+        return (insn >> 22) & 1;
+    case 0b001100: /* v{ldrepl,stelm}, xv{ldrepl,stelm} */
+        return (insn >> 24) & 1;
     case 0b001110: /* indexed, atomic, bounds-checking memory operations */
         switch ((insn >> 15) & 0b11111111111) {
         case 0b00000100000: /* stx.b */
@@ -69,6 +73,8 @@ static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc)
         case 0b00000111000: /* stx.d */
         case 0b00001110000: /* fstx.s */
         case 0b00001111000: /* fstx.d */
+        case 0b00010001000: /* vstx */
+        case 0b00010011000: /* xvstx */
         case 0b00011101100: /* fstgt.s */
         case 0b00011101101: /* fstgt.d */
         case 0b00011101110: /* fstle.s */
-- 
2.54.0

Re: [PULL 0/4] Linux user patches

[Richard Henderson]

On 9/18/26 10:29, Helge Deller wrote:
> From: Helge Deller<deller@gmx.de>
> 
> The following changes since commit e8dca265c91b45f4cde746e5094d7b763444eb6a:
> 
>    Merge tag 'pull-11.1-more-check-tcg-docker-meson-180926-1' ofhttps://gitlab.com/stsquad/qemu into staging (2026-09-18 07:52:24 -1000)
> 
> are available in the Git repository at:
> 
>    https://github.com/hdeller/qemu-hppa.git tags/linux-user-pull-request
> 
> for you to fetch changes up to e95f53e30be7935d98e38eb09cd6360fe2886249:
> 
>    linux-user/loongarch64: Detect vector stores in host_signal_write() (2026-09-18 22:20:21 +0200)
> 
> ----------------------------------------------------------------
> linux-user patches for mlock syscall and loongarch64 and riscv fixes
> 
> Add support for the mlock syscall, and some fixes for loongarch64 and riscv.

Applied, thanks.

r~

Re: [PULL 0/4] Linux user patches

[Michael Tokarev]

On 9/18/26 23:29, Helge Deller wrote:

> linux-user patches for mlock syscall and loongarch64 and riscv fixes
> 
> Add support for the mlock syscall, and some fixes for loongarch64 and riscv.
> 
> ----------------------------------------------------------------
> 
> Michael Morrell (1):
>    linux-user: implement mlock2(2) syscall
> 
> SignKirigami (1):
>    linux-user/loongarch64: Detect vector stores in host_signal_write()
> 
> wangyang (2):
>    linux-user/riscv: honor zicntr=false for base counterCSRs
>    linux-user/riscv: invalidate reservations after stores
> 
>   .../include/host/loongarch64/host-signal.h    |  6 +++
>   linux-user/riscv/target_cpu.h                 |  2 +
>   linux-user/syscall.c                          |  9 +++++
>   linux-user/syscall_defs.h                     |  4 ++
>   target/riscv/cpu.c                            |  3 ++
>   target/riscv/cpu.h                            |  3 ++
>   target/riscv/helper.h                         |  5 +++
>   target/riscv/tcg/csr.c                        | 11 ++++--
>   target/riscv/tcg/insn_trans/trans_rva.c.inc   | 24 ++++++++++++
>   target/riscv/tcg/insn_trans/trans_rvi.c.inc   | 11 ++++++
>   .../riscv/tcg/insn_trans/trans_rvzawrs.c.inc  |  3 ++
>   target/riscv/tcg/op_helper.c                  | 35 +++++++++++++++++
>   target/riscv/tcg/translate.c                  | 38 +++++++++++++++++++
>   13 files changed, 150 insertions(+), 4 deletions(-)
I'm picking up this whole pull request for 11.1.x stable series, and
3 out of 4 changes for 10.0.x and 11.0.x series:

     linux-user: implement mlock2(2) syscall
     linux-user/riscv: honor zicntr=false for base counterCSRs
     linux-user/loongarch64: Detect vector stores in host_signal_write()

Please let me know if I should not.

The "invalidate reservations" change requires quite some tweaking
for older releases, so I'm skipping it for now.  Please tell me if
I should try harder and pick it up for older series too.

Thanks,

/mjt

Re: [PULL 0/4] Linux user patches

[Helge Deller]

On 9/21/26 08:54, Michael Tokarev wrote:
> On 9/18/26 23:29, Helge Deller wrote:
> 
>> linux-user patches for mlock syscall and loongarch64 and riscv fixes
>>
>> Add support for the mlock syscall, and some fixes for loongarch64 and riscv.
>>
>> ----------------------------------------------------------------
>>
>> Michael Morrell (1):
>>    linux-user: implement mlock2(2) syscall
>>
>> SignKirigami (1):
>>    linux-user/loongarch64: Detect vector stores in host_signal_write()
>>
>> wangyang (2):
>>    linux-user/riscv: honor zicntr=false for base counterCSRs
>>    linux-user/riscv: invalidate reservations after stores
>>
>>   .../include/host/loongarch64/host-signal.h    |  6 +++
>>   linux-user/riscv/target_cpu.h                 |  2 +
>>   linux-user/syscall.c                          |  9 +++++
>>   linux-user/syscall_defs.h                     |  4 ++
>>   target/riscv/cpu.c                            |  3 ++
>>   target/riscv/cpu.h                            |  3 ++
>>   target/riscv/helper.h                         |  5 +++
>>   target/riscv/tcg/csr.c                        | 11 ++++--
>>   target/riscv/tcg/insn_trans/trans_rva.c.inc   | 24 ++++++++++++
>>   target/riscv/tcg/insn_trans/trans_rvi.c.inc   | 11 ++++++
>>   .../riscv/tcg/insn_trans/trans_rvzawrs.c.inc  |  3 ++
>>   target/riscv/tcg/op_helper.c                  | 35 +++++++++++++++++
>>   target/riscv/tcg/translate.c                  | 38 +++++++++++++++++++
>>   13 files changed, 150 insertions(+), 4 deletions(-)
> I'm picking up this whole pull request for 11.1.x stable series, and
> 3 out of 4 changes for 10.0.x and 11.0.x series:
> 
>      linux-user: implement mlock2(2) syscall
>      linux-user/riscv: honor zicntr=false for base counterCSRs
>      linux-user/loongarch64: Detect vector stores in host_signal_write()
> 
> Please let me know if I should not.

That's ok. 
> The "invalidate reservations" change requires quite some tweaking
> for older releases, so I'm skipping it for now.  Please tell me if
> I should try harder and pick it up for older series too.
No, just leave it out then.

Thank you for your efforts!
Helge