* [PULL 0/4] Linux user patches
@ 2026-09-18 20:29 Helge Deller
2026-09-18 20:29 ` [PULL 1/4] linux-user/riscv: honor zicntr=false for base counterCSRs Helge Deller
` (5 more replies)
0 siblings, 6 replies; 12+ messages in thread
From: Helge Deller @ 2026-09-18 20:29 UTC (permalink / raw)
To: qemu-devel
Cc: Weiwei Li, Helge Deller, qemu-riscv, Palmer Dabbelt, Liu Zhiwei,
Pierrick Bouvier, Laurent Vivier, Alistair Francis, Chao Liu,
Daniel Henrique Barboza
From: Helge Deller <deller@gmx.de>
The following changes since commit e8dca265c91b45f4cde746e5094d7b763444eb6a:
Merge tag 'pull-11.1-more-check-tcg-docker-meson-180926-1' of https://gitlab.com/stsquad/qemu into staging (2026-09-18 07:52:24 -1000)
are available in the Git repository at:
https://github.com/hdeller/qemu-hppa.git tags/linux-user-pull-request
for you to fetch changes up to e95f53e30be7935d98e38eb09cd6360fe2886249:
linux-user/loongarch64: Detect vector stores in host_signal_write() (2026-09-18 22:20:21 +0200)
----------------------------------------------------------------
linux-user patches for mlock syscall and loongarch64 and riscv fixes
Add support for the mlock syscall, and some fixes for loongarch64 and riscv.
----------------------------------------------------------------
Michael Morrell (1):
linux-user: implement mlock2(2) syscall
SignKirigami (1):
linux-user/loongarch64: Detect vector stores in host_signal_write()
wangyang (2):
linux-user/riscv: honor zicntr=false for base counterCSRs
linux-user/riscv: invalidate reservations after stores
.../include/host/loongarch64/host-signal.h | 6 +++
linux-user/riscv/target_cpu.h | 2 +
linux-user/syscall.c | 9 +++++
linux-user/syscall_defs.h | 4 ++
target/riscv/cpu.c | 3 ++
target/riscv/cpu.h | 3 ++
target/riscv/helper.h | 5 +++
target/riscv/tcg/csr.c | 11 ++++--
target/riscv/tcg/insn_trans/trans_rva.c.inc | 24 ++++++++++++
target/riscv/tcg/insn_trans/trans_rvi.c.inc | 11 ++++++
.../riscv/tcg/insn_trans/trans_rvzawrs.c.inc | 3 ++
target/riscv/tcg/op_helper.c | 35 +++++++++++++++++
target/riscv/tcg/translate.c | 38 +++++++++++++++++++
13 files changed, 150 insertions(+), 4 deletions(-)
--
2.54.0
^ permalink raw reply [flat|nested] 12+ messages in thread* [PULL 1/4] linux-user/riscv: honor zicntr=false for base counterCSRs 2026-09-18 20:29 [PULL 0/4] Linux user patches Helge Deller @ 2026-09-18 20:29 ` Helge Deller 2026-09-18 20:29 ` [PULL 2/4] linux-user/riscv: invalidate reservations after stores Helge Deller ` (4 subsequent siblings) 5 siblings, 0 replies; 12+ messages in thread From: Helge Deller @ 2026-09-18 20:29 UTC (permalink / raw) To: qemu-devel Cc: Weiwei Li, Helge Deller, qemu-riscv, Palmer Dabbelt, Liu Zhiwei, Pierrick Bouvier, Laurent Vivier, Alistair Francis, Chao Liu, Daniel Henrique Barboza From: wangyang <wangyang25@otcaix.iscas.ac.cn> In user-only builds, the base cycle and instret CSRs bypass the zicntr feature gate because the check is inside the system-mode block. Move the check before the conditional block so an explicitly disabled zicntr extension makes the CSRs illegal in linux-user mode. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4148 Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Signed-off-by: wangyang <wangyang25@otcaix.iscas.ac.cn> Signed-off-by: Helge Deller <deller@gmx.de> --- target/riscv/tcg/csr.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c index bd4b6dc114..061bc9db77 100644 --- a/target/riscv/tcg/csr.c +++ b/target/riscv/tcg/csr.c @@ -111,6 +111,13 @@ static RISCVException vs(CPURISCVState *env, int csrno) static RISCVException ctr(CPURISCVState *env, int csrno) { + if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) || + (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) { + if (!riscv_cpu_cfg(env)->ext_zicntr) { + return RISCV_EXCP_ILLEGAL_INST; + } + } + #if !defined(CONFIG_USER_ONLY) RISCVCPU *cpu = env_archcpu(env); int ctr_index; @@ -127,10 +134,6 @@ static RISCVException ctr(CPURISCVState *env, int csrno) if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) || (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) { - if (!riscv_cpu_cfg(env)->ext_zicntr) { - return RISCV_EXCP_ILLEGAL_INST; - } - goto skip_ext_pmu_check; } -- 2.54.0 ^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PULL 2/4] linux-user/riscv: invalidate reservations after stores 2026-09-18 20:29 [PULL 0/4] Linux user patches Helge Deller 2026-09-18 20:29 ` [PULL 1/4] linux-user/riscv: honor zicntr=false for base counterCSRs Helge Deller @ 2026-09-18 20:29 ` Helge Deller 2026-09-18 20:29 ` [PULL 3/4] linux-user: implement mlock2(2) syscall Helge Deller ` (3 subsequent siblings) 5 siblings, 0 replies; 12+ messages in thread From: Helge Deller @ 2026-09-18 20:29 UTC (permalink / raw) To: qemu-devel Cc: Weiwei Li, Helge Deller, qemu-riscv, Palmer Dabbelt, Liu Zhiwei, Pierrick Bouvier, Laurent Vivier, Alistair Francis, Chao Liu, Daniel Henrique Barboza From: wangyang <wangyang25@otcaix.iscas.ac.cn> In linux-user parallel execution, AMO and ordinary integer stores do not invalidate load reservations held by another hart. A store that preserves the numeric value can therefore leave the reservation intact and allow a later SC to succeed. Use the existing EXCP_ATOMIC path to re-execute LR, SC, AMO, and ordinary integer store instructions in a serial context. The completed store and reservation invalidation then cannot be interleaved with another guest hart. Track the LR access size and invalidate every other-hart reservation whose byte range overlaps the completed store. A successful SC uses the same invalidation helper. Clear the reservation when cloning a new linux-user RISC-V hart so that a child cannot inherit the parent's reservation state. The change is limited to linux-user TCG and the base scalar integer/ A-extension translator paths. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4149 Signed-off-by: wangyang <wangyang25@otcaix.iscas.ac.cn> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/riscv/target_cpu.h | 2 + target/riscv/cpu.c | 3 ++ target/riscv/cpu.h | 3 ++ target/riscv/helper.h | 5 +++ target/riscv/tcg/insn_trans/trans_rva.c.inc | 24 ++++++++++++ target/riscv/tcg/insn_trans/trans_rvi.c.inc | 11 ++++++ .../riscv/tcg/insn_trans/trans_rvzawrs.c.inc | 3 ++ target/riscv/tcg/op_helper.c | 35 +++++++++++++++++ target/riscv/tcg/translate.c | 38 +++++++++++++++++++ 9 files changed, 124 insertions(+) diff --git a/linux-user/riscv/target_cpu.h b/linux-user/riscv/target_cpu.h index 9c642367a3..eff18b37ba 100644 --- a/linux-user/riscv/target_cpu.h +++ b/linux-user/riscv/target_cpu.h @@ -9,6 +9,8 @@ static inline void cpu_clone_regs_child(CPURISCVState *env, target_ulong newsp, } env->gpr[xA0] = 0; + env->load_res = -1; + env->load_res_size = 0; } static inline void cpu_clone_regs_parent(CPURISCVState *env, unsigned flags) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 5fff9d745e..da4c1a090b 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1084,6 +1084,9 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type) env->xl = riscv_cpu_mxl(env); cs->exception_index = RISCV_EXCP_NONE; env->load_res = -1; +#ifdef CONFIG_USER_ONLY + env->load_res_size = 0; +#endif set_default_nan_mode(1, &env->fp_status); /* Default NaN value: sign bit clear, frac msb set */ set_float_default_nan_pattern(0b01000000, &env->fp_status); diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index c2138dbd4b..8c8ffe94cd 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -264,6 +264,9 @@ struct CPUArchState { uint64_t pc; uint64_t load_res; +#ifdef CONFIG_USER_ONLY + uint64_t load_res_size; +#endif uint64_t load_val; /* Floating-Point state */ diff --git a/target/riscv/helper.h b/target/riscv/helper.h index 4fc2d3a155..aab92bf132 100644 --- a/target/riscv/helper.h +++ b/target/riscv/helper.h @@ -1357,3 +1357,8 @@ DEF_HELPER_1(ssamoswap_disabled, void, env) /* Zalrsc SC write probe */ DEF_HELPER_FLAGS_3(sc_probe_write, TCG_CALL_NO_WG, void, env, tl, tl) + +#ifdef CONFIG_USER_ONLY +/* Invalidate reservations overlapping a completed linux-user store. */ +DEF_HELPER_3(riscv_invalidate_reservations, void, env, tl, tl) +#endif diff --git a/target/riscv/tcg/insn_trans/trans_rva.c.inc b/target/riscv/tcg/insn_trans/trans_rva.c.inc index 44c1696fe4..248a8c60d7 100644 --- a/target/riscv/tcg/insn_trans/trans_rva.c.inc +++ b/target/riscv/tcg/insn_trans/trans_rva.c.inc @@ -32,6 +32,11 @@ static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop) { +#ifdef CONFIG_USER_ONLY + if (!gen_riscv_reservation_serialize(ctx)) { + return false; + } +#endif TCGv src1; mop |= MO_ALIGN; @@ -53,6 +58,9 @@ static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop) /* Put addr in load_res, data in load_val. */ tcg_gen_mov_tl(load_res, src1); +#ifdef CONFIG_USER_ONLY + tcg_gen_movi_tl(load_res_size, memop_size(mop)); +#endif gen_set_gpr(ctx, a->rd, load_val); return true; @@ -60,9 +68,17 @@ static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop) static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop) { +#ifdef CONFIG_USER_ONLY + if (!gen_riscv_reservation_serialize(ctx)) { + return false; + } +#endif TCGv dest, src1, src2; TCGLabel *l1 = gen_new_label(); TCGLabel *l2 = gen_new_label(); +#ifdef CONFIG_USER_ONLY + TCGLabel *l3 = gen_new_label(); +#endif mop |= MO_ALIGN; mop |= ctx->mo_endianness; @@ -79,6 +95,11 @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop) src2 = get_gpr(ctx, a->rs2, EXT_NONE); tcg_gen_atomic_cmpxchg_tl(dest, load_res, load_val, src2, ctx->mem_idx, mop); +#ifdef CONFIG_USER_ONLY + tcg_gen_brcond_tl(TCG_COND_NE, dest, load_val, l3); + gen_riscv_invalidate_reservations(src1, mop); + gen_set_label(l3); +#endif tcg_gen_setcond_tl(TCG_COND_NE, dest, dest, load_val); gen_set_gpr(ctx, a->rd, dest); tcg_gen_br(l2); @@ -104,6 +125,9 @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop) * an SC to any address, in between an LR and SC pair. */ tcg_gen_movi_tl(load_res, -1); +#ifdef CONFIG_USER_ONLY + tcg_gen_movi_tl(load_res_size, 0); +#endif return true; } diff --git a/target/riscv/tcg/insn_trans/trans_rvi.c.inc b/target/riscv/tcg/insn_trans/trans_rvi.c.inc index cc1b5dbbad..40b4c9aa4a 100644 --- a/target/riscv/tcg/insn_trans/trans_rvi.c.inc +++ b/target/riscv/tcg/insn_trans/trans_rvi.c.inc @@ -489,6 +489,9 @@ static bool gen_store_tl(DisasContext *ctx, arg_sb *a, MemOp memop) } tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, memop); +#ifdef CONFIG_USER_ONLY + gen_riscv_invalidate_reservations(addr, memop); +#endif return true; } @@ -518,11 +521,19 @@ static bool gen_store_i128(DisasContext *ctx, arg_sb *a, MemOp memop) } tcg_gen_qemu_st_i128(t16, addrl, ctx->mem_idx, memop); } +#ifdef CONFIG_USER_ONLY + gen_riscv_invalidate_reservations(addrl, memop); +#endif return true; } static bool gen_store(DisasContext *ctx, arg_sb *a, MemOp memop) { +#ifdef CONFIG_USER_ONLY + if (!gen_riscv_reservation_serialize(ctx)) { + return false; + } +#endif memop |= ctx->mo_endianness; if (ctx->cfg_ptr->ext_zama16b) { memop |= MO_ATOM_WITHIN16; diff --git a/target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc b/target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc index 0eef033838..1831bbcfc0 100644 --- a/target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc +++ b/target/riscv/tcg/insn_trans/trans_rvzawrs.c.inc @@ -32,6 +32,9 @@ static bool trans_wrs_sto(DisasContext *ctx, arg_wrs_sto *a) /* Clear the load reservation (if any). */ tcg_gen_movi_tl(load_res, -1); +#ifdef CONFIG_USER_ONLY + tcg_gen_movi_tl(load_res_size, 0); +#endif gen_update_pc(ctx, ctx->cur_insn_len); tcg_gen_exit_tb(NULL, 0); diff --git a/target/riscv/tcg/op_helper.c b/target/riscv/tcg/op_helper.c index 3e94005d2b..b67c7718db 100644 --- a/target/riscv/tcg/op_helper.c +++ b/target/riscv/tcg/op_helper.c @@ -19,6 +19,9 @@ */ #include "qemu/osdep.h" +#ifdef CONFIG_USER_ONLY +#include "qemu/rcu.h" +#endif #include "cpu.h" #include "target/riscv/tcg/csr.h" #ifndef CONFIG_USER_ONLY @@ -298,6 +301,38 @@ void helper_sc_probe_write(CPURISCVState *env, target_ulong addr, probe_write(env, addr, size, mmu_idx, ra); } +#ifdef CONFIG_USER_ONLY + +void helper_riscv_invalidate_reservations(CPURISCVState *env, + target_ulong addr, + target_ulong size) +{ + CPUState *cpu; + + /* EXCP_ATOMIC keeps other guest harts out while this list is updated. */ + WITH_RCU_READ_LOCK_GUARD() { + CPU_FOREACH(cpu) { + CPURISCVState *other_env = cpu_env(cpu); + target_ulong reservation = other_env->load_res; + target_ulong reservation_size = other_env->load_res_size; + bool overlap; + + if (other_env == env || reservation == (target_ulong)-1) { + continue; + } + overlap = reservation < addr + ? addr - reservation < reservation_size + : reservation - addr < size; + if (overlap) { + other_env->load_res = -1; + other_env->load_res_size = 0; + } + } + } +} + +#endif + #ifndef CONFIG_USER_ONLY target_ulong helper_sret(CPURISCVState *env) diff --git a/target/riscv/tcg/translate.c b/target/riscv/tcg/translate.c index 9684dbe752..cce3b6dc72 100644 --- a/target/riscv/tcg/translate.c +++ b/target/riscv/tcg/translate.c @@ -42,6 +42,9 @@ static TCGv cpu_gpr[32], cpu_gprh[32], cpu_pc; static TCGv_i64 cpu_fpr[32]; /* assume F and D extensions */ static TCGv_i32 cpu_vl, cpu_vstart; static TCGv load_res; +#ifdef CONFIG_USER_ONLY +static TCGv load_res_size; +#endif static TCGv load_val; /* @@ -1141,10 +1144,34 @@ static bool gen_unary_per_ol(DisasContext *ctx, arg_r2 *a, DisasExtend ext, return gen_unary(ctx, a, ext, f_tl); } +#ifdef CONFIG_USER_ONLY +static bool gen_riscv_reservation_serialize(DisasContext *ctx) +{ + /* Keep the memory operation and reservation update in one guest step. */ + if (tb_cflags(ctx->base.tb) & CF_PARALLEL) { + gen_helper_exit_atomic(tcg_env); + ctx->base.is_jmp = DISAS_NORETURN; + return false; + } + return true; +} + +static void gen_riscv_invalidate_reservations(TCGv addr, MemOp mop) +{ + gen_helper_riscv_invalidate_reservations(tcg_env, addr, + tcg_constant_tl(memop_size(mop))); +} +#endif + static bool gen_amo(DisasContext *ctx, arg_atomic *a, void(*func)(TCGv, TCGv, TCGv, TCGArg, MemOp), MemOp mop) { +#ifdef CONFIG_USER_ONLY + if (!gen_riscv_reservation_serialize(ctx)) { + return false; + } +#endif TCGv dest = dest_gpr(ctx, a->rd); TCGv src1, src2 = get_gpr(ctx, a->rs2, EXT_NONE); MemOp size = mop & MO_SIZE; @@ -1159,6 +1186,9 @@ static bool gen_amo(DisasContext *ctx, arg_atomic *a, decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO); src1 = get_address(ctx, a->rs1, 0); func(dest, src1, src2, ctx->mem_idx, mop); +#ifdef CONFIG_USER_ONLY + gen_riscv_invalidate_reservations(src1, mop); +#endif gen_set_gpr(ctx, a->rd, dest); return true; @@ -1482,6 +1512,10 @@ void riscv_translate_init(void) size_t pc_offset = offsetof(CPURISCVState, pc) + field_offset; size_t res_offset = offsetof(CPURISCVState, load_res) + field_offset; size_t val_offset = offsetof(CPURISCVState, load_val) + field_offset; +#ifdef CONFIG_USER_ONLY + size_t res_size_offset = offsetof(CPURISCVState, load_res_size) + + field_offset; +#endif for (i = 1; i < 32; i++) { cpu_gpr[i] = tcg_global_mem_new(tcg_env, @@ -1501,5 +1535,9 @@ void riscv_translate_init(void) cpu_vl = tcg_global_mem_new_i32(tcg_env, vl_offset, "vl"); cpu_vstart = tcg_global_mem_new_i32(tcg_env, vstart_offset, "vstart"); load_res = tcg_global_mem_new(tcg_env, res_offset, "load_res"); +#ifdef CONFIG_USER_ONLY + load_res_size = tcg_global_mem_new(tcg_env, res_size_offset, + "load_res_size"); +#endif load_val = tcg_global_mem_new(tcg_env, val_offset, "load_val"); } -- 2.54.0 ^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PULL 3/4] linux-user: implement mlock2(2) syscall 2026-09-18 20:29 [PULL 0/4] Linux user patches Helge Deller 2026-09-18 20:29 ` [PULL 1/4] linux-user/riscv: honor zicntr=false for base counterCSRs Helge Deller 2026-09-18 20:29 ` [PULL 2/4] linux-user/riscv: invalidate reservations after stores Helge Deller @ 2026-09-18 20:29 ` Helge Deller 2026-09-18 20:29 ` [PULL 4/4] linux-user/loongarch64: Detect vector stores in host_signal_write() Helge Deller ` (2 subsequent siblings) 5 siblings, 0 replies; 12+ messages in thread From: Helge Deller @ 2026-09-18 20:29 UTC (permalink / raw) To: qemu-devel Cc: Weiwei Li, Helge Deller, qemu-riscv, Palmer Dabbelt, Liu Zhiwei, Pierrick Bouvier, Laurent Vivier, Alistair Francis, Chao Liu, Daniel Henrique Barboza From: Michael Morrell <mmorrell@tachyum.com> TARGET_NR_mlock2 is defined for every target's syscall table (it has been available on all Linux architectures since it was added in kernel 4.4), and linux-user/strace.list already has an entry for it, but linux-user/syscall.c has no case handler for it. A guest mlock2() call therefore falls through to the default case and gets -ENOSYS instead of being emulated, on every target. mlock2() differs from mlock() only by a third `flags` argument (MLOCK_ONFAULT). Add TARGET_MLOCK_ONFAULT and a case that validates the flags argument and forwards to the host mlock2(), mirroring the existing TARGET_NR_mlock case immediately above it. Signed-off-by: Michael Morrell <mmorrell@tachyum.com> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/syscall.c | 9 +++++++++ linux-user/syscall_defs.h | 4 ++++ 2 files changed, 13 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index cfa68dfbdb..9f454502cb 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -11230,6 +11230,15 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1, case TARGET_NR_mlock: return get_errno(mlock(g2h(cpu, arg1), arg2)); #endif +#ifdef TARGET_NR_mlock2 + case TARGET_NR_mlock2: + if (arg3 & ~TARGET_MLOCK_ONFAULT) { + return -TARGET_EINVAL; + } + return get_errno(mlock2(g2h(cpu, arg1), arg2, + (arg3 & TARGET_MLOCK_ONFAULT) ? + MLOCK_ONFAULT : 0)); +#endif #ifdef TARGET_NR_munlock case TARGET_NR_munlock: return get_errno(munlock(g2h(cpu, arg1), arg2)); diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h index e28853c93b..f5831a6bad 100644 --- a/linux-user/syscall_defs.h +++ b/linux-user/syscall_defs.h @@ -2795,6 +2795,10 @@ struct target_mount_attr_ver0 { #ifndef RESOLVE_IN_ROOT #define RESOLVE_IN_ROOT 0x10 #endif + +/* flags for mlock2() */ +#define TARGET_MLOCK_ONFAULT 0x01 + #if (defined(TARGET_I386) && defined(TARGET_ABI32)) || \ (defined(TARGET_ARM) && defined(TARGET_ABI32)) || \ defined(TARGET_M68K) || defined(TARGET_MICROBLAZE) || \ -- 2.54.0 ^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PULL 4/4] linux-user/loongarch64: Detect vector stores in host_signal_write() 2026-09-18 20:29 [PULL 0/4] Linux user patches Helge Deller ` (2 preceding siblings ...) 2026-09-18 20:29 ` [PULL 3/4] linux-user: implement mlock2(2) syscall Helge Deller @ 2026-09-18 20:29 ` Helge Deller 2026-09-19 20:41 ` [PULL 0/4] Linux user patches Richard Henderson 2026-09-21 6:54 ` Michael Tokarev 5 siblings, 0 replies; 12+ messages in thread From: Helge Deller @ 2026-09-18 20:29 UTC (permalink / raw) To: qemu-devel Cc: Weiwei Li, Helge Deller, qemu-riscv, Palmer Dabbelt, Liu Zhiwei, Pierrick Bouvier, Laurent Vivier, Alistair Francis, Chao Liu, Daniel Henrique Barboza From: SignKirigami <prcups@krgm.moe> Recognize LSX/LASX stores in the LoongArch host signal handler to fix internal QEMU crashes when RISC-V vector stores hit write-protected code pages through host memcpy. Signed-off-by: Felix Yan <felixonmars@archlinux.org> Signed-off-by: SignKirigami <prcups@krgm.moe> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/include/host/loongarch64/host-signal.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/linux-user/include/host/loongarch64/host-signal.h b/linux-user/include/host/loongarch64/host-signal.h index d33c3fc03e..eb4308cf09 100644 --- a/linux-user/include/host/loongarch64/host-signal.h +++ b/linux-user/include/host/loongarch64/host-signal.h @@ -61,6 +61,10 @@ static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc) return true; } break; + case 0b001011: /* v{ld,st}, xv{ld,st} */ + return (insn >> 22) & 1; + case 0b001100: /* v{ldrepl,stelm}, xv{ldrepl,stelm} */ + return (insn >> 24) & 1; case 0b001110: /* indexed, atomic, bounds-checking memory operations */ switch ((insn >> 15) & 0b11111111111) { case 0b00000100000: /* stx.b */ @@ -69,6 +73,8 @@ static inline bool host_signal_write(siginfo_t *info, host_sigcontext *uc) case 0b00000111000: /* stx.d */ case 0b00001110000: /* fstx.s */ case 0b00001111000: /* fstx.d */ + case 0b00010001000: /* vstx */ + case 0b00010011000: /* xvstx */ case 0b00011101100: /* fstgt.s */ case 0b00011101101: /* fstgt.d */ case 0b00011101110: /* fstle.s */ -- 2.54.0 ^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PULL 0/4] Linux user patches 2026-09-18 20:29 [PULL 0/4] Linux user patches Helge Deller ` (3 preceding siblings ...) 2026-09-18 20:29 ` [PULL 4/4] linux-user/loongarch64: Detect vector stores in host_signal_write() Helge Deller @ 2026-09-19 20:41 ` Richard Henderson 2026-09-21 6:54 ` Michael Tokarev 5 siblings, 0 replies; 12+ messages in thread From: Richard Henderson @ 2026-09-19 20:41 UTC (permalink / raw) To: Helge Deller, qemu-devel Cc: Weiwei Li, Helge Deller, qemu-riscv, Palmer Dabbelt, Liu Zhiwei, Pierrick Bouvier, Laurent Vivier, Alistair Francis, Chao Liu, Daniel Henrique Barboza On 9/18/26 10:29, Helge Deller wrote: > From: Helge Deller<deller@gmx.de> > > The following changes since commit e8dca265c91b45f4cde746e5094d7b763444eb6a: > > Merge tag 'pull-11.1-more-check-tcg-docker-meson-180926-1' ofhttps://gitlab.com/stsquad/qemu into staging (2026-09-18 07:52:24 -1000) > > are available in the Git repository at: > > https://github.com/hdeller/qemu-hppa.git tags/linux-user-pull-request > > for you to fetch changes up to e95f53e30be7935d98e38eb09cd6360fe2886249: > > linux-user/loongarch64: Detect vector stores in host_signal_write() (2026-09-18 22:20:21 +0200) > > ---------------------------------------------------------------- > linux-user patches for mlock syscall and loongarch64 and riscv fixes > > Add support for the mlock syscall, and some fixes for loongarch64 and riscv. Applied, thanks. r~ ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PULL 0/4] Linux user patches 2026-09-18 20:29 [PULL 0/4] Linux user patches Helge Deller ` (4 preceding siblings ...) 2026-09-19 20:41 ` [PULL 0/4] Linux user patches Richard Henderson @ 2026-09-21 6:54 ` Michael Tokarev 2026-09-21 12:37 ` Helge Deller 5 siblings, 1 reply; 12+ messages in thread From: Michael Tokarev @ 2026-09-21 6:54 UTC (permalink / raw) To: Helge Deller, qemu-devel Cc: Weiwei Li, Helge Deller, qemu-riscv, Palmer Dabbelt, Liu Zhiwei, Pierrick Bouvier, Laurent Vivier, Alistair Francis, Chao Liu, Daniel Henrique Barboza, QEMU Stable On 9/18/26 23:29, Helge Deller wrote: > linux-user patches for mlock syscall and loongarch64 and riscv fixes > > Add support for the mlock syscall, and some fixes for loongarch64 and riscv. > > ---------------------------------------------------------------- > > Michael Morrell (1): > linux-user: implement mlock2(2) syscall > > SignKirigami (1): > linux-user/loongarch64: Detect vector stores in host_signal_write() > > wangyang (2): > linux-user/riscv: honor zicntr=false for base counterCSRs > linux-user/riscv: invalidate reservations after stores > > .../include/host/loongarch64/host-signal.h | 6 +++ > linux-user/riscv/target_cpu.h | 2 + > linux-user/syscall.c | 9 +++++ > linux-user/syscall_defs.h | 4 ++ > target/riscv/cpu.c | 3 ++ > target/riscv/cpu.h | 3 ++ > target/riscv/helper.h | 5 +++ > target/riscv/tcg/csr.c | 11 ++++-- > target/riscv/tcg/insn_trans/trans_rva.c.inc | 24 ++++++++++++ > target/riscv/tcg/insn_trans/trans_rvi.c.inc | 11 ++++++ > .../riscv/tcg/insn_trans/trans_rvzawrs.c.inc | 3 ++ > target/riscv/tcg/op_helper.c | 35 +++++++++++++++++ > target/riscv/tcg/translate.c | 38 +++++++++++++++++++ > 13 files changed, 150 insertions(+), 4 deletions(-) I'm picking up this whole pull request for 11.1.x stable series, and 3 out of 4 changes for 10.0.x and 11.0.x series: linux-user: implement mlock2(2) syscall linux-user/riscv: honor zicntr=false for base counterCSRs linux-user/loongarch64: Detect vector stores in host_signal_write() Please let me know if I should not. The "invalidate reservations" change requires quite some tweaking for older releases, so I'm skipping it for now. Please tell me if I should try harder and pick it up for older series too. Thanks, /mjt ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PULL 0/4] Linux user patches 2026-09-21 6:54 ` Michael Tokarev @ 2026-09-21 12:37 ` Helge Deller 0 siblings, 0 replies; 12+ messages in thread From: Helge Deller @ 2026-09-21 12:37 UTC (permalink / raw) To: Michael Tokarev, Helge Deller, qemu-devel Cc: Weiwei Li, qemu-riscv, Palmer Dabbelt, Liu Zhiwei, Pierrick Bouvier, Laurent Vivier, Alistair Francis, Chao Liu, Daniel Henrique Barboza, QEMU Stable On 9/21/26 08:54, Michael Tokarev wrote: > On 9/18/26 23:29, Helge Deller wrote: > >> linux-user patches for mlock syscall and loongarch64 and riscv fixes >> >> Add support for the mlock syscall, and some fixes for loongarch64 and riscv. >> >> ---------------------------------------------------------------- >> >> Michael Morrell (1): >> linux-user: implement mlock2(2) syscall >> >> SignKirigami (1): >> linux-user/loongarch64: Detect vector stores in host_signal_write() >> >> wangyang (2): >> linux-user/riscv: honor zicntr=false for base counterCSRs >> linux-user/riscv: invalidate reservations after stores >> >> .../include/host/loongarch64/host-signal.h | 6 +++ >> linux-user/riscv/target_cpu.h | 2 + >> linux-user/syscall.c | 9 +++++ >> linux-user/syscall_defs.h | 4 ++ >> target/riscv/cpu.c | 3 ++ >> target/riscv/cpu.h | 3 ++ >> target/riscv/helper.h | 5 +++ >> target/riscv/tcg/csr.c | 11 ++++-- >> target/riscv/tcg/insn_trans/trans_rva.c.inc | 24 ++++++++++++ >> target/riscv/tcg/insn_trans/trans_rvi.c.inc | 11 ++++++ >> .../riscv/tcg/insn_trans/trans_rvzawrs.c.inc | 3 ++ >> target/riscv/tcg/op_helper.c | 35 +++++++++++++++++ >> target/riscv/tcg/translate.c | 38 +++++++++++++++++++ >> 13 files changed, 150 insertions(+), 4 deletions(-) > I'm picking up this whole pull request for 11.1.x stable series, and > 3 out of 4 changes for 10.0.x and 11.0.x series: > > linux-user: implement mlock2(2) syscall > linux-user/riscv: honor zicntr=false for base counterCSRs > linux-user/loongarch64: Detect vector stores in host_signal_write() > > Please let me know if I should not. That's ok. > The "invalidate reservations" change requires quite some tweaking > for older releases, so I'm skipping it for now. Please tell me if > I should try harder and pick it up for older series too. No, just leave it out then. Thank you for your efforts! Helge ^ permalink raw reply [flat|nested] 12+ messages in thread
* [PULL 0/4] Linux user patches
@ 2026-06-18 21:54 Helge Deller
2026-06-20 12:40 ` Stefan Hajnoczi
0 siblings, 1 reply; 12+ messages in thread
From: Helge Deller @ 2026-06-18 21:54 UTC (permalink / raw)
To: qemu-devel, Stefan Hajnoczi; +Cc: Pierrick Bouvier, Laurent Vivier, deller
From: Helge Deller <deller@gmx.de>
The following changes since commit c7cf7c810153d6f5f31aa2d5c0dee9087f6b4dff:
Merge tag 'firmware-20260617-pull-request' of https://gitlab.com/kraxel/qemu into staging (2026-06-17 10:17:29 -0400)
are available in the Git repository at:
https://github.com/hdeller/qemu-hppa.git tags/linux-user-pull-request
for you to fetch changes up to 54e08dbe8f2aeca57e3b1a5eab09a9fec88c1c67:
linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn (2026-06-18 23:43:35 +0200)
----------------------------------------------------------------
linux-user patches
One frame pointer memory locking fix for the xtensa architecture, a generic
loader fix for programs with modified headers, and two patches to emulate
/proc/cpuinfo for loogarch and m68k CPUs.
----------------------------------------------------------------
Akshit Yadav (1):
linux-user: Fix AT_PHDR when program headers are relocated into their
own segment
Helge Deller (2):
linux-user: Implement /proc/cpuinfo for loongarch cpus
linux-user: Implement /proc/cpuinfo for m68k CPU
Matt Turner (1):
linux-user/xtensa: fix unlock of uninitialized frame pointer on
sigreturn
linux-user/elfload.c | 21 +++++++-
linux-user/loongarch64/elfload.c | 20 +++++++
linux-user/loongarch64/target_proc.h | 79 +++++++++++++++++++++++++++-
linux-user/m68k/target_proc.h | 46 ++++++++++++++++
linux-user/qemu.h | 1 +
linux-user/xtensa/signal.c | 3 +-
6 files changed, 167 insertions(+), 3 deletions(-)
--
2.54.0
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PULL 0/4] Linux user patches 2026-06-18 21:54 Helge Deller @ 2026-06-20 12:40 ` Stefan Hajnoczi 0 siblings, 0 replies; 12+ messages in thread From: Stefan Hajnoczi @ 2026-06-20 12:40 UTC (permalink / raw) To: Helge Deller Cc: qemu-devel, Stefan Hajnoczi, Pierrick Bouvier, Laurent Vivier, deller [-- Attachment #1: Type: text/plain, Size: 116 bytes --] Applied, thanks. Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes. [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 488 bytes --] ^ permalink raw reply [flat|nested] 12+ messages in thread
* [PULL 0/4] Linux user patches @ 2026-06-12 15:50 Helge Deller 2026-06-13 23:40 ` Stefan Hajnoczi 0 siblings, 1 reply; 12+ messages in thread From: Helge Deller @ 2026-06-12 15:50 UTC (permalink / raw) To: Stefan Hajnoczi, qemu-devel Cc: Helge Deller, Pierrick Bouvier, Laurent Vivier, Max Filippov From: Helge Deller <deller@gmx.de> The following changes since commit ec6a1f43989c6bbf2de1ab84959a70ee35fa1b57: Merge tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-06-11 13:22:50 -0400) are available in the Git repository at: https://github.com/hdeller/qemu-hppa.git tags/linux-user-pull-request for you to fetch changes up to 6858e3a71cc41510937bec0950eb4e42e33ba5f2: linux-user/xtensa: save/restore FP registers across signal delivery (2026-06-12 17:47:27 +0200) ---------------------------------------------------------------- linux-user patches Add preadv2/preadv2 syscalls, fix FP registers across signals on xtensa, and add emulation for /proc/cpuinfo for ppc CPUs ---------------------------------------------------------------- Dominique Martinet (1): linux-user: add preadv2/preadv2 Helge Deller (1): linux-user: Implement /proc/cpuinfo for ppc cpus Matt Turner (2): target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status linux-user/xtensa: save/restore FP registers across signal delivery linux-user/ppc/cpu_loop.c | 2 +- linux-user/ppc/target_proc.h | 91 +++++++++++++++++++++++++++++++++- linux-user/syscall.c | 38 ++++++++++++++ linux-user/xtensa/signal.c | 96 +++++++++++++++++++++++++++++++++--- target/xtensa/cpu.h | 4 ++ target/xtensa/fpu_helper.c | 71 ++++++++++++++------------ 6 files changed, 261 insertions(+), 41 deletions(-) -- 2.54.0 ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PULL 0/4] Linux user patches 2026-06-12 15:50 Helge Deller @ 2026-06-13 23:40 ` Stefan Hajnoczi 0 siblings, 0 replies; 12+ messages in thread From: Stefan Hajnoczi @ 2026-06-13 23:40 UTC (permalink / raw) To: Helge Deller Cc: Stefan Hajnoczi, qemu-devel, Helge Deller, Pierrick Bouvier, Laurent Vivier, Max Filippov [-- Attachment #1: Type: text/plain, Size: 116 bytes --] Applied, thanks. Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes. [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 488 bytes --] ^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2026-09-21 12:42 UTC | newest] Thread overview: 12+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-09-18 20:29 [PULL 0/4] Linux user patches Helge Deller 2026-09-18 20:29 ` [PULL 1/4] linux-user/riscv: honor zicntr=false for base counterCSRs Helge Deller 2026-09-18 20:29 ` [PULL 2/4] linux-user/riscv: invalidate reservations after stores Helge Deller 2026-09-18 20:29 ` [PULL 3/4] linux-user: implement mlock2(2) syscall Helge Deller 2026-09-18 20:29 ` [PULL 4/4] linux-user/loongarch64: Detect vector stores in host_signal_write() Helge Deller 2026-09-19 20:41 ` [PULL 0/4] Linux user patches Richard Henderson 2026-09-21 6:54 ` Michael Tokarev 2026-09-21 12:37 ` Helge Deller -- strict thread matches above, loose matches on Subject: below -- 2026-06-18 21:54 Helge Deller 2026-06-20 12:40 ` Stefan Hajnoczi 2026-06-12 15:50 Helge Deller 2026-06-13 23:40 ` Stefan Hajnoczi
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.