linux user patches
Two patches from Peter Maydell for linux-user:
One fixes the signal context on loongarch64 and the other replaces an old
pthread implementation by an QemuSemaphore implementation which better mimics
the wanted semantics.
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCauDJXgAKCRD3ErUQojoP
# X9KlAQC1swml5OfHmoSjygV0Sqs26cWHKeUCHHPRHU4RCd4afQD5AX8Eup+fbj/l
# uN+pz+sAYl1/4hdvkx/9pmz0XCs6sgo=
# =vrCI
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 27 Oct 2026 10:55:10 AM CDT
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'linux-user-next-pull-request' of https://github.com/hdeller/qemu-hppa:
linux-user: Use QemuSemaphore to wait for clone child thread
linux-user/loongarch64: In extframe_alloc, align before subtracting sctx_info size
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Add decode and translation for trap2 and the vallocframe and vdeallocframe
instruction forms introduced with v83. Model vector stack overflow as a
precise exception and report it to linux-user as SIGSEGV.
Teach the IDEF parser about VSP and vector frame checks. Describe the
vallocframe and vdeallocframe instruction semantics in system.idef, and move
the vector stack overflow check into a shared TCG generator helper.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
In do_fork() and clone_func() we currently use a pthread_mutex_t and
a pthread_cond_t to allow the parent thread to wait until the child
thread has started and e.g. set fields like info->tid, before the
parent reads those fields and otherwise proceeds.
Coverity points out that this use of a pthread condition variable
isn't reliable: pthread_cond_wait() may wake up spuriously, so the
idiom for "wait on a condition" should be "loop around calling
pthread_cond_wait() until a predicate that was updated by the caller
of pthread_cond_broadcast() is true".
This is quite old code; rather than fixing up its use of raw pthread
condition variables, we can use a QemuSemaphore. This gives us the
"thread A waits until thread B signals it" semantics we want. (Under
the hood it is implemented with a mutex and condition variable.)
Cc: qemu-stable@nongnu.org
Resolves: CID 1527417
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Helge Deller <deller@gmx.de>
In extframe_alloc() we allocate space on the guest stack for a
context struct, which consists of a target_sctx_info plus a more
specific struct such as target_lasx_context. The specific struct may
have a higher alignment requirement than the basic target_sctx_info.
The Linux kernel code for this is in arch/loongarch/kernel/signal.c
in extframe_alloc():
unsigned long new_base = base - size;
new_base = round_down(new_base, (align < 16 ? 16 : align));
new_base -= sizeof(struct sctx_info);
and it first adjusts the base (SP) address down by the size of the
specific struct, then rounds that down to provide the required
alignment, and finally subtracts the size of the sctx_info.
QEMU's version does this in the wrong order, subtracting both the
specific struct size and the sctx_info size before rounding down for
alignment. This means that for the target_lasx_context which needs
32-alignment, we instead give the start of sctx_info 32-alignment,
which (since that is 16 bytes long) means that the
target_lasx_context is only 16-aligned.
This manifests as a failure in the TCG tests such as
loongarch64-linux-user-signals.test if you build with the clang
sanitizers enabled:
../../linux-user/loongarch64/signal.c:182:13: runtime error: member access within misaligned address 0x7dc793950b90 for type 'struct target_lasx_context', which requires 32 byte alignment
0x7dc793950b90: note: pointer points here
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
#0 0x57216113d881 in setup_sigframe /home/pm215/qemu/build/clang/../../linux-user/loongarch64/signal.c:182:13
#1 0x57216113d881 in setup_rt_frame /home/pm215/qemu/build/clang/../../linux-user/loongarch64/signal.c:389:5
#2 0x5721612a5041 in handle_pending_signal /home/pm215/qemu/build/clang/../../linux-user/signal.c:1349:9
#3 0x5721612a46ef in process_pending_signals /home/pm215/qemu/build/clang/../../linux-user/signal.c:1401:17
#4 0x57216113baa3 in cpu_loop /home/pm215/qemu/build/clang/../../linux-user/loongarch64/cpu_loop.c:121:9
Correct setup_extcontext() to match the order the kernel does it.
Cc: qemu-stable@nongnu.org
Fixes: 9d5cd6587a ("linux-user: Add LoongArch signal support")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
linux user patches
One patch from Andreas Schwab to not trash the guest console when
warning about unhandled core dumps.
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCatPazwAKCRD3ErUQojoP
# XwkiAP9B4pgmw1JsQhdmJUxwPhAMuyx5+ZQ7aZAJNu7kGQmyiwD/R0DLFL0URPe8
# g0W11YhEqnzbT0Tp/zeJPln63nlHxQ4=
# =yAw3
# -----END PGP SIGNATURE-----
# gpg: Signature made Sat 17 Oct 2026 10:30:07 PM CEST
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'linux-user-next-pull-request' of https://github.com/hdeller/qemu-hppa:
linux-user: don't print core dump message by default
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
This reverts commit 5089493e45.
Rick reported that this patch results in large slowdowns when using
multiple threads. The original patch serialises all stores, resulting in
all vCPUs stopping for every store, which would explain the slowdown.
The results from Rick show
xz compressing 2 MB at -6, without and with the patch:
without patch with patch
xz -T1 5 s 122 s (identical output)
xz -T8 1 s no output after 600 s
That is too large of an overhead, so let's revert this patch until a
better solution is found.
Reported-by: Rick <rick@sloservers.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Message-ID: <20261001232119.1765494-1-alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
When the target binary is killed by a signal with core dump print a
message to the guest_errors log instead of stderr. This avoids breaking
various testsuites due to the extra output produced by the emulation.
Signed-off-by: Andreas Schwab <schwab@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Set llsc_addr to ~0 during reset and soft reset, and whenever linux-user
returns to guest code for a trap or a signal.
Reset previously left llsc_addr zero-initialized, so a store-conditional
issued without a matching load-locked could match a guest address of
zero.
Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Before this patch, we'd pick MIPS64R2-generic which does not have 2008 mode, so
the binary would just fail to run without an explicit -cpu flag. Now it'll just
work as in the pre-r6 mips32 case.
Signed-off-by: Alex Rønne Petersen <alex@alexrp.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Since commit 8c94db0ae97c ("binfmt_elf: preserve original ELF e_flags
for core dumps"), Linux writes the main executable's e_flags into RISC-V
core files, so debuggers can see the float ABI and RVC. QEMU wrote 0.
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
mipsn32 core files had e_flags 0, so gdb took them for o32, found no
general-purpose registers and failed with an internal error in
frame_unwind_find_by_frame.
Linux sets e_flags to EF_MIPS_ABI2 for n32 cores (user_mipsn32_view in
arch/mips/kernel/ptrace.c).
Signed-off-by: Helge Deller <deller@gmx.de>
mincore(2) rejects a misaligned start address before it looks the range
up, so a start that is both misaligned and unmapped is EINVAL. Here
lock_user() runs first and fails, and the call reports ENOMEM instead.
When the range is mapped this changes nothing -- the host syscall
receives the misaligned pointer and answers EINVAL by itself -- which is
why only the unmapped case is visibly wrong.
Caught by glibc's misc/test-errno-linux.
Signed-off-by: Igor Shevlyakov <igor@tachyum.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
The kernel looks the fd up before validating the rest of the call, so a
negative fd is EBADF whatever else is wrong with the arguments. Several
arms of do_setsockopt()/do_getsockopt() reject optlen or optname and
return without ever reaching the host syscall, so the host never gets to
supply that EBADF and the guest sees the argument error instead:
setsockopt(-1, SOL_TCP, TCP_NODELAY, ptr, 0) EINVAL, want EBADF
setsockopt(-1, 0x4321, 1, ptr, sizeof(int)) ENOPROTOOPT
getsockopt(-1, 0x4321, 1, ptr, &len) EOPNOTSUPP
Caught by glibc's posix/test-errno.
Signed-off-by: Igor Shevlyakov <igor@tachyum.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
libunwind's unw_is_signal_frame() reads the trampoline as 32-bit words,
but __kernel_sigreturn is only 2-byte aligned. Align both trampolines
to 4 bytes, as the kernel's vsyscall-sigreturn.S does (with .balign 32).
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
The unwinder looks up a return address as IP - 1 (hence the nop before
sigreturn_region_start). For a frame returning to __kernel_rt_sigreturn
that is the last byte of __kernel_sigreturn, which still has the
sigreturn CFA, so the rt_sigreturn frame is unwound with the wrong
sigcontext offset. _Unwind_Backtrace() from an SA_SIGINFO handler stops
after three frames.
Add a nop after .cfi_def_cfa_offset, as linux-user/i386/vdso.S does.
Fixes: 975bd51a88 ("linux-user/sh4: add VDSO support for sh4 and sh4eb")
Cc: qemu-stable@nongnu.org
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
With the vdso, default_sigreturn and default_rt_sigreturn point at
__kernel_sigreturn and __kernel_rt_sigreturn and setup_sigtramp() is no
longer used. The vdso trampolines load the syscall number with mov.l
instead of the kernel's mov.w/trapa/or r0,r0 sequence, which undoes
commit 9ac5aa7227 ("linux-user/sh4: Fix setup_sigtramp to match Linux
kernel trampoline pattern"): libunwind's unw_is_signal_frame() no longer
recognizes the signal frame, so unwinding through a signal handler stops
there.
Use the sequence from the kernel's own vdso,
arch/sh/kernel/vsyscall/vsyscall-sigreturn.S.
Fixes: 975bd51a88 ("linux-user/sh4: add VDSO support for sh4 and sh4eb")
Cc: qemu-stable@nongnu.org
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
linux-user patches for mlock syscall and loongarch64 and riscv fixes
Add support for the mlock syscall, and some fixes for loongarch64 and riscv.
# -----BEGIN PGP SIGNATURE-----
#
# iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCaq2fIQAKCRD3ErUQojoP
# X6vSAQDr8AQ6dnfVXxdsJ0hRaI5xd7ay6J7zwVuV209qDHyNdQD6ApKoPorWNFnH
# Yblvf7s2QrqQjWPP37AuwCps1mJPegU=
# =vd9Q
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 18 Sep 2026 10:29:21 AM HST
# gpg: using EDDSA key BCE9123E1AD29F07C049BBDEF712B510A23A0F5F
# gpg: Good signature from "Helge Deller <deller@gmx.de>" [unknown]
# gpg: aka "Helge Deller <deller@kernel.org>" [unknown]
# gpg: aka "Helge Deller <deller@debian.org>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 4544 8228 2CD9 10DB EF3D 25F8 3E5F 3D04 A7A2 4603
# Subkey fingerprint: BCE9 123E 1AD2 9F07 C049 BBDE F712 B510 A23A 0F5F
* tag 'linux-user-pull-request' of https://github.com/hdeller/qemu-hppa:
linux-user/loongarch64: Detect vector stores in host_signal_write()
linux-user: implement mlock2(2) syscall
linux-user/riscv: invalidate reservations after stores
linux-user/riscv: honor zicntr=false for base counterCSRs
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Recognize LSX/LASX stores in the LoongArch host signal handler to fix
internal QEMU crashes when RISC-V vector stores hit write-protected code
pages through host memcpy.
Signed-off-by: Felix Yan <felixonmars@archlinux.org>
Signed-off-by: SignKirigami <prcups@krgm.moe>
Signed-off-by: Helge Deller <deller@gmx.de>
TARGET_NR_mlock2 is defined for every target's syscall table (it has
been available on all Linux architectures since it was added in
kernel 4.4), and linux-user/strace.list already has an entry for it,
but linux-user/syscall.c has no case handler for it. A guest mlock2()
call therefore falls through to the default case and gets -ENOSYS
instead of being emulated, on every target.
mlock2() differs from mlock() only by a third `flags` argument
(MLOCK_ONFAULT). Add TARGET_MLOCK_ONFAULT and a case that validates
the flags argument and forwards to the host mlock2(), mirroring the
existing TARGET_NR_mlock case immediately above it.
Signed-off-by: Michael Morrell <mmorrell@tachyum.com>
Signed-off-by: Helge Deller <deller@gmx.de>
In linux-user parallel execution, AMO and ordinary integer stores do not
invalidate load reservations held by another hart. A store that preserves
the numeric value can therefore leave the reservation intact and allow a
later SC to succeed.
Use the existing EXCP_ATOMIC path to re-execute LR, SC, AMO, and ordinary
integer store instructions in a serial context. The completed store and
reservation invalidation then cannot be interleaved with another guest
hart. Track the LR access size and invalidate every other-hart reservation
whose byte range overlaps the completed store. A successful SC uses the
same invalidation helper.
Clear the reservation when cloning a new linux-user RISC-V hart so that a
child cannot inherit the parent's reservation state.
The change is limited to linux-user TCG and the base scalar integer/
A-extension translator paths.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4149
Signed-off-by: wangyang <wangyang25@otcaix.iscas.ac.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Mem api pull
- Peter's patchset to drop some dead code for 32bit hosts
- Phil/Bin's patch to enhance error message for mem allocations
- Cam's fix to virtio-mem crash in multi-source work
# -----BEGIN PGP SIGNATURE-----
#
# iIgEABYKADAWIQS5GE3CDMRX2s990ak7X8zN86vXBgUCaq0ivhIccGV0ZXJ4QHJl
# ZGhhdC5jb20ACgkQO1/MzfOr1wbtGQD/djQyYM2zWEh5SyDDhbT4cj7iPIkvFtCM
# MVQNJPFkZLUBANMM8sWaoEaIsehh+tLq+6zvqyAB5U9yF8ecuYgR6iEH
# =n5bF
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 18 Sep 2026 01:38:38 AM HST
# gpg: using EDDSA key B9184DC20CC457DACF7DD1A93B5FCCCDF3ABD706
# gpg: issuer "peterx@redhat.com"
# gpg: Good signature from "Peter Xu <xzpeter@gmail.com>" [unknown]
# gpg: aka "Peter Xu <peterx@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B918 4DC2 0CC4 57DA CF7D D1A9 3B5F CCCD F3AB D706
* tag 'next-pull-request' of https://gitlab.com/peterx/qemu:
system/ram-discard-manager: fix offset_within_address_space in replay_by_populated_state()
system/physmem: Improve guest memory allocation failure error message
machine: Remove 32bit limitation on ram size
hw/arm/raspi4b: Drop board_rev for 32bit hosts
arm/aspeed: Drop ASPEED_RAM_SIZE
linux-user: Remove 32bit host support in thunk_convert|print()
bsd-user: Remove 32bit host support in thunk_convert|print()
xen-mapcache: Remove 32bit support
arm/mps: Remove 32bit define for MPS3_DDR_SIZE
hw/vexpress.c: Remove forced cast to u64
system: Define ram_addr_t to be always uint64_t
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
All the tcg tests are in meson now so there is no reason to put the
config-target.mak files in those directories. We also don't need the
GDB feature tests or to emit prerequsistes.
The vdso re-build blob does use the compiler definitions though so
we can emit the details for that and tweak the vdso makefiles to point
at the right place. Note some of the vdso makefiles build both 32 and
64 bit versions from the same compiler.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Tested-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260917165602.3405537-5-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
v73 is currently the newest core this target implements.
Add the v75, v79, v81 CPUs. New instructions to follow in subsequent
commits.
Reviewed-by: Marco Liebel <marco.liebel@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
A guest core carried only the general-purpose registers, so a debugger
opening one reported the x87 stack and every SSE register as
unavailable.
Implement HAVE_ELF_CORE_FPREGS for x86_64: define target_elf_fpregset_t
to match the kernel's elf_fpregset_t, i.e. struct user_i387_struct from
arch/x86/include/asm/user_64.h, which is the 512 byte FXSAVE image, and
fill it with the existing cpu_x86_fxsave(). As on the signal path, the
helper writes in target byte order, so there is nothing to swap.
QEMU's FXSAVE writes zero for the instruction and operand pointers and
never writes the opcode field, as it does everywhere else, so those
three fields are not recovered from a core.
Checked with gdb on a core from a program that faults with live values
on the x87 stack and in xmm0 and xmm1: "info float" reads back the stack
and the tag word, and the xmm registers and $mxcsr read correctly.
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
A guest core carried only the general-purpose registers, so a debugger
opening one reported the x87 stack as unavailable.
Implement HAVE_ELF_CORE_FPREGS for i386: define target_elf_fpregset_t to
match the kernel's elf_fpregset_t, i.e. struct user_i387_struct from
arch/x86/include/asm/user_32.h, which is the legacy FSAVE image without
the trailing software status word that FSAVE does not write either.
cpu_x86_fsave_noinit() produces exactly that, already in target byte
order.
The SSE registers are still absent: the kernel dumps those in a separate
NT_PRXFPREG note, which the generic core dump code has no support for.
Checked with gdb on a core from a program that faults with 1.5 and 2.25
live on the x87 stack: "info float" reads both back, along with the tag
word and the instruction and operand pointers.
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Per madvise(2) and the Linux kernel implementation (madvise_walk_vmas),
madvise() must validate that the requested range is currently mapped
and return -ENOMEM if any page in the range is unmapped.
Add a page_check_range(start, len, PAGE_VALID) check for valid advice
values before proceeding with the advice actions. In addition, extend the
tcg multiarch test linux-madvise.c to test this behaviour.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4382
AI-used-for: importing and validating test case
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
setup_sigcontext() fills sigcontext.trapno from CPUState::exception_index, but
by the time a signal frame is built that field has already been reset to -1:
cpu_exec() copies the exception number into its return value and clears
exception_index before returning to cpu_loop(), which is where the signal is
queued. Guests therefore see trapno == -1 for every cpu exception.
#include <signal.h>
#include <stdio.h>
#include <ucontext.h>
static void h(int sig, siginfo_t *si, void *uc_)
{
ucontext_t *uc = uc_;
printf("sig=%d trapno=%d err=%#x\n", sig,
(int)uc->uc_mcontext.gregs[REG_TRAPNO],
(unsigned)uc->uc_mcontext.gregs[REG_ERR]);
fflush(stdout);
_exit(0);
}
int main(void)
{
struct sigaction sa = { .sa_sigaction = h, .sa_flags = SA_SIGINFO };
sigaction(SIGSEGV, &sa, 0);
*(volatile int *)0 = 1;
}
Natively this prints trapno=14 err=0x6; under qemu it prints trapno=-1 err=0x6.
A SIGILL likewise reports -1 instead of 6, and SIGFPE -1 instead of 0. Both
qemu-i386 and qemu-x86_64 are affected, and both report the expected 14/6/0
with this patch applied. Only trapno is wrong; error_code lives in
CPUX86State and survives.
x86_cpu_record_sigsegv() already notes the coupling, observing that we cannot
let the caller clobber exception_index "short of inventing a new place to store
the trapno". Invent it: record the exception in env->trap_nr, mirroring linux's
thread.trap_nr, which is exactly what the kernel reports in sigcontext.trapno
and which likewise persists beyond the exception that set it. Only hardware
vectors are recorded; the EXCP_* values at 0x100 and above are emulation
internals and never appear in a signal frame.
This matters to wine, whose segv_handler() dispatches on the trap number and
cannot service a fault it sees as -1, so 32-bit module loading fails under
qemu-i386. The equivalent 64-bit handler dispatches the same way, so the same
failure is expected under qemu-x86_64. Discussed at
https://gitlab.winehq.org/wine/wine/-/merge_requests/11737 , where the
suggestion was that qemu is the right place to fix this.
Signed-off-by: Nat Brown <natbro@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Helge Deller <deller@gmx.de>
init_main_thread() is registered as Object::free() hook, thus
take an Object* argument. Uncast the void pointer as such.
While now cpu_env() accept any pointer type, next commit will
restrict it to CPUState* type. QOM-cast the Object to CPU type,
otherwise we will get:
../linux-user/i386/cpu_loop.c: In function ‘target_cpu_free’:
include/hw/core/cpu.h:604:31: error: ‘_Generic’ selector of type ‘void’ is not compatible with any association
../linux-user/x86_64/../i386/cpu_loop.c:331:19: note: in expansion of macro ‘cpu_env’
331 | target_munmap(cpu_env(obj)->gdt.base,
| ^~~~~~~
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20260901095229.72018-3-philmd@oss.qualcomm.com>
System mode reports an exception as cs->exception_index = HEX_EVENT_* plus
env->cause_code = HEX_CAUSE_*, but translated code in user mode put the cause
code straight into exception_index, so cpu_loop() was decoding both forms.
gen_exception_decode_fail() and the misaligned-PC check used the raw form
unconditionally, so in system mode the cause code was misread as an event
number.
Use the {event, cause} everywhere and drop the duplicated cases
from cpu_loop(), which fixes HEX_CAUSE_PRIV_USER_NO_SINSN and
HEX_CAUSE_PRIV_USER_NO_GINSN. The misaligned PC is no longer zeroed
on its way out either, so it reaches the signal frame as si_addr instead
of whatever r31 held.
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
Richard Henderson