A recent change to the kernel (Linux commit b376108e1f88
"arm64/fpsimd: signal: Clear TPIDR2 when delivering signals") updated
the signal-handler entry code to always clear TPIDR2_EL0.

This is necessary for the userspace ZA lazy saving scheme to work
correctly when unwinding exceptions across a signal boundary.
(For the essay-length description of the incorrect behaviour and
why this is the correct fix, see the commit message for the
kernel commit.)

Make QEMU also clear TPIDR2_EL0 on signal entry, applying the
equivalent bugfix to our implementation.

Note that getting this unwinding to work correctly also requires
changes to the userspace code, e.g.  as implemented in gcc in
https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=b5ffc8e75a8

This change is technically an ABI change; from the kernel's
point of view SME was never enabled (it was hidden behind
CONFIG_BROKEN) before the change. From QEMU's point of view
our SME-related signal handling was broken anyway as we weren't
saving and restoring TPIDR2_EL0.

Cc: qemu-stable@nongnu.org
Fixes: 78011586b90d1 ("target/arm: Enable SME for user-only")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/aarch64/signal.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/linux-user/aarch64/signal.c b/linux-user/aarch64/signal.c
index d50cab78d83..b4bab7c040d 100644
--- a/linux-user/aarch64/signal.c
+++ b/linux-user/aarch64/signal.c
@@ -668,6 +668,9 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
 
     /* Invoke the signal handler with both SM and ZA disabled. */
     aarch64_set_svcr(env, 0, R_SVCR_SM_MASK | R_SVCR_ZA_MASK);
+    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
+        env->cp15.tpidr2_el0 = 0;
+    }
 
     if (info) {
         frame->info = *info;
-- 
2.43.0

On 7/25/25 04:22, Peter Maydell wrote:
> A recent change to the kernel (Linux commit b376108e1f88
> "arm64/fpsimd: signal: Clear TPIDR2 when delivering signals") updated
> the signal-handler entry code to always clear TPIDR2_EL0.

Ah, I missed seeing that.

>       /* Invoke the signal handler with both SM and ZA disabled. */
>       aarch64_set_svcr(env, 0, R_SVCR_SM_MASK | R_SVCR_ZA_MASK);
> +    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
> +        env->cp15.tpidr2_el0 = 0;
> +    }

You can omit the IF and unconditionally clear the memory.


Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


r~

On Fri, 25 Jul 2025 at 17:46, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> On 7/25/25 04:22, Peter Maydell wrote:
> > A recent change to the kernel (Linux commit b376108e1f88
> > "arm64/fpsimd: signal: Clear TPIDR2 when delivering signals") updated
> > the signal-handler entry code to always clear TPIDR2_EL0.
>
> Ah, I missed seeing that.
>
> >       /* Invoke the signal handler with both SM and ZA disabled. */
> >       aarch64_set_svcr(env, 0, R_SVCR_SM_MASK | R_SVCR_ZA_MASK);
> > +    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
> > +        env->cp15.tpidr2_el0 = 0;
> > +    }
>
> You can omit the IF and unconditionally clear the memory.
>
>
> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Thanks -- just noticed also that it would be reasonable to
update the comment:

+    /*
+     * Invoke the signal handler with a clean SME state: both SM and ZA
+     * disabled and TPIDR2_EL0 cleared.
+     */

since all three things are SME related.

-- PMM