From: Helge Deller <deller@gmx.de> The following changes since commit f5a2438405d4ae8b62de7c9b39fac0b2155ee544: Merge tag 'pull-qapi-2026-05-21' of https://repo.or.cz/qemu/armbru into staging (2026-05-21 09:00:22 -0400) are available in the Git repository at: https://github.com/hdeller/qemu-hppa.git tags/linux-user-next-pull-request for you to fetch changes up to 975bd51a88792cb6a3596c7127a1009bb3a17f08: linux-user/sh4: add VDSO support for sh4 and sh4eb (2026-05-24 15:07:28 +0200) ---------------------------------------------------------------- linux-user updates from Matt Turner Various linux-user updates and fixes from Matt Turner regarding VDSO and coredump support for hppa, mips, mips64, riscv and sh4. ---------------------------------------------------------------- Matt Turner (6): linux-user/hppa: add coredump support linux-user/mips64: fix elf_core_copy_regs register layout in core files linux-user/mips64: fix mipsn32 elf_core_copy_regs entry width linux-user/mips: use tswap32 in elf_core_copy_regs linux-user/riscv: add coredump support linux-user/sh4: add VDSO support for sh4 and sh4eb linux-user/hppa/elfload.c | 13 +++ linux-user/hppa/target_elf.h | 21 +++++ linux-user/mips/elfload.c | 16 ++-- linux-user/mips64/elfload.c | 44 ++++++++++ linux-user/riscv/elfload.c | 9 ++ linux-user/riscv/target_elf.h | 7 ++ linux-user/sh4/Makefile.vdso | 18 ++++ linux-user/sh4/elfload.c | 14 ++++ linux-user/sh4/meson.build | 12 +++ linux-user/sh4/target_elf.h | 1 + linux-user/sh4/vdso-asmoffset.h | 45 ++++++++++ linux-user/sh4/vdso-be.so | Bin 0 -> 2704 bytes linux-user/sh4/vdso-le.so | Bin 0 -> 2704 bytes linux-user/sh4/vdso.S | 142 ++++++++++++++++++++++++++++++++ linux-user/sh4/vdso.ld | 67 +++++++++++++++ 15 files changed, 402 insertions(+), 7 deletions(-) create mode 100644 linux-user/sh4/Makefile.vdso create mode 100644 linux-user/sh4/vdso-asmoffset.h create mode 100755 linux-user/sh4/vdso-be.so create mode 100755 linux-user/sh4/vdso-le.so create mode 100644 linux-user/sh4/vdso.S create mode 100644 linux-user/sh4/vdso.ld -- 2.54.0 From: Matt Turner <mattst88@gmail.com> Add HAVE_ELF_CORE_DUMP, target_elf_gregset_t (80 entries matching arch/parisc/include/uapi/asm/ptrace.h), and elf_core_copy_regs(). The struct layout matches the kernel's struct user_regs_struct: gr[0..31] at indices [0..31] (PSW in gr[0]) sr[0..7] at indices [32..39] iaoq[0..1] at indices [40..41] (instruction address queue) iasq[0..1] at indices [42..43] sar at index [44] (shift amount / CR11) iir at index [45] (interrupt instruction register) isr at index [46] (interrupt space register) ior at index [47] (interrupt offset register) ipsw at index [48] (interrupt PSW / CR22) cr0 at index [49] (recovery counter) cr24_31[8] at indices [50..57] cr8_15[6] at indices [58..63] pad[16] at indices [64..79] elf_core_copy_regs() saves GRs, IAOQ (front/back), and SAR. Signed-off-by: Matt Turner <mattst88@gmail.com> Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/hppa/elfload.c | 13 +++++++++++++ linux-user/hppa/target_elf.h | 21 +++++++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/linux-user/hppa/elfload.c b/linux-user/hppa/elfload.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/hppa/elfload.c +++ b/linux-user/hppa/elfload.c @@ -XXX,XX +XXX,XX @@ const char *get_elf_platform(CPUState *cs) return "PARISC"; } +void elf_core_copy_regs(target_elf_gregset_t *r, const CPUArchState *env) +{ + int i; + + memset(r, 0, sizeof(*r)); + for (i = 0; i < 32; i++) { + r->gr[i] = tswapal(env->gr[i]); + } + r->iaoq[0] = tswapal(env->iaoq_f); + r->iaoq[1] = tswapal(env->iaoq_b); + r->sar = tswapal(env->cr[CR_SAR]); +} + bool init_guest_commpage(void) { /* If reserved_va, then we have already mapped 0 page on the host. */ diff --git a/linux-user/hppa/target_elf.h b/linux-user/hppa/target_elf.h index XXXXXXX..XXXXXXX 100644 --- a/linux-user/hppa/target_elf.h +++ b/linux-user/hppa/target_elf.h @@ -XXX,XX +XXX,XX @@ #define ELF_MACHINE EM_PARISC #define HAVE_ELF_PLATFORM 1 +#define HAVE_ELF_CORE_DUMP 1 + +/* + * Matches struct user_regs_struct from arch/parisc/include/uapi/asm/ptrace.h. + * ELF_NGREG = 80; register indices match those used by libunwind and gdb. + */ +typedef struct target_elf_gregset_t { + abi_ulong gr[32]; /* gr[0..31]; PSW in gr[0] [0..31] */ + abi_ulong sr[8]; /* space registers [32..39] */ + abi_ulong iaoq[2]; /* instruction address offset [40..41] */ + abi_ulong iasq[2]; /* instruction address space [42..43] */ + abi_ulong sar; /* shift amount register (CR11) [44] */ + abi_ulong iir; /* interrupt instruction register [45] */ + abi_ulong isr; /* interrupt space register [46] */ + abi_ulong ior; /* interrupt offset register [47] */ + abi_ulong ipsw; /* interrupt PSW (CR22) [48] */ + abi_ulong cr0; /* recovery counter [49] */ + abi_ulong cr24_31[8]; /* cr24..cr31 [50..57] */ + abi_ulong cr8_15[6]; /* cr8, cr9, cr12, cr13, cr10, cr15 [58..63] */ + abi_ulong pad[16]; /* pad to 80 elements [64..79] */ +} target_elf_gregset_t; #define LO_COMMPAGE 0 #define STACK_GROWS_DOWN 0 -- 2.54.0 From: Matt Turner <mattst88@gmail.com> mips64/elfload.c uses #include "../mips/elfload.c" to share code. When the compiler processes mips/elfload.c the quoted #include "target_elf.h" resolves relative to the including file's directory, so it picks up mips/target_elf.h instead of mips64/target_elf.h. mips/target_elf.h pulls in mips/target_ptrace.h, whose target_pt_regs has a pad0[6] field before regs[]. As a result elf_core_copy_regs writes: r->pt.regs[i] -> reserved[6+i] (shifted by 6 from the correct index) r->pt.cp0_epc -> reserved[40] (correct mips64 N64 index is 34) The Linux kernel and glibc both use the mips64 N64 layout (no pad0): EPC at reserved[34]. Debuggers and libunwind reading the core with N64 constants therefore see a completely wrong register set — EPC points to GP, RA holds the branch target instead of the link address, etc. Fix by: - Guarding the mips32 elf_core_copy_regs in mips/elfload.c with #ifndef TARGET_MIPS64 so it is not compiled for mips64/mipsn32 targets. - Providing a mips64-specific elf_core_copy_regs in mips64/elfload.c that writes directly to r->reserved[i] with the correct N64 indices, bypassing the struct field names that are tainted by the wrong header include. The mipsn32 (TARGET_ABI_MIPSN32) and mips64el targets are covered by the same mips64/elfload.c and benefit from the same fix. Signed-off-by: Matt Turner <mattst88@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/mips/elfload.c | 2 ++ linux-user/mips64/elfload.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/mips/elfload.c +++ b/linux-user/mips/elfload.c @@ -XXX,XX +XXX,XX @@ const char *get_elf_base_platform(CPUState *cs) #undef MATCH_PLATFORM_INSN /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs. */ +#ifndef TARGET_MIPS64 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env) { for (int i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) { @@ -XXX,XX +XXX,XX @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env) r->pt.cp0_status = tswapl(env->CP0_Status); r->pt.cp0_cause = tswapl(env->CP0_Cause); } +#endif diff --git a/linux-user/mips64/elfload.c b/linux-user/mips64/elfload.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/mips64/elfload.c +++ b/linux-user/mips64/elfload.c @@ -1 +1,30 @@ #include "../mips/elfload.c" + +/* + * mips/elfload.c defines elf_core_copy_regs guarded by #ifndef TARGET_MIPS64. + * + * We must provide the mips64 version here. We cannot use r->pt.regs[] because + * when mips/elfload.c is #include'd above its "#include "target_elf.h"" resolves + * to mips/target_elf.h (compiler searches the including file's directory first), + * which pulls in mips/target_ptrace.h. That struct has pad0[6] before regs[], + * so r->pt.regs[i] writes to reserved[6+i] — offset by 6 from what the kernel + * and glibc expect for the N64 ABI (EPC at reserved[34], not reserved[40]). + * + * Write directly to reserved[] using the mips64 N64 index layout: + * R0-R31 at reserved[0..31], LO at [32], HI at [33], EPC at [34]. + */ +void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env) +{ + /* R0 is always 0; r->reserved is zero-initialised by the caller */ + for (int i = 1; i < 32; i++) { + r->reserved[i] = tswap64(env->active_tc.gpr[i]); + } + r->reserved[26] = 0; /* k0 */ + r->reserved[27] = 0; /* k1 */ + r->reserved[32] = tswap64(env->active_tc.LO[0]); + r->reserved[33] = tswap64(env->active_tc.HI[0]); + r->reserved[34] = tswap64(env->active_tc.PC); + r->reserved[35] = tswap64(env->CP0_BadVAddr); + r->reserved[36] = tswap64(env->CP0_Status); + r->reserved[37] = tswap64(env->CP0_Cause); +} -- 2.54.0 From: Matt Turner <mattst88@gmail.com> For mipsn32 (TARGET_ABI32=y, TARGET_LONG_BITS=64): abi_ulong = uint32_t (4 bytes) — for pointers and ABI-sized fields target_ulong = uint64_t (8 bytes) — for general-purpose registers linux-user/elfload.c allocates target_elf_prstatus using the mips64/target_elf.h definition where target_elf_gregset_t has target_ulong reserved[45] (8 bytes each, 360 bytes total). However, in linux-user/mips64/elfload.c, #include "target_elf.h" inside the included mips/elfload.c resolves to mips/target_elf.h (compiler searches the file's own directory first), where the union uses abi_ulong reserved[45]. For mipsn32 this gives 4-byte entries (180 bytes), not the 8-byte entries (360 bytes) that elfload.c actually allocated. Writing via r->reserved[34] therefore lands at byte offset 34*4=136 instead of the correct 34*8=272, silently zeroing the EPC in the core file. Fix by casting the pointer to target_ulong * so writes always use 8-byte slots and land at the offsets matching the allocated layout. This does not change behavior for mips64 (N64) where abi_ulong already equals target_ulong (both 8 bytes). Signed-off-by: Matt Turner <mattst88@gmail.com> Cc: qemu-stable@nongnu.org Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/mips64/elfload.c | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-) diff --git a/linux-user/mips64/elfload.c b/linux-user/mips64/elfload.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/mips64/elfload.c +++ b/linux-user/mips64/elfload.c @@ -XXX,XX +XXX,XX @@ */ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env) { - /* R0 is always 0; r->reserved is zero-initialised by the caller */ + /* + * linux-user/elfload.c allocates target_elf_prstatus using the + * definition from mips64/target_elf.h, where target_elf_gregset_t + * has target_ulong reserved[45] (8 bytes each = 360 bytes total). + * + * But in this compilation unit, "#include target_elf.h" resolved to + * mips/target_elf.h (wrong directory), so our local target_elf_gregset_t + * has abi_ulong reserved[45] which is only 4 bytes each for mipsn32. + * Using r->reserved[i] would write to the wrong offsets for mipsn32. + * + * Cast to target_ulong * to always write 8-byte entries at the correct + * positions, matching the layout that elfload.c allocated. + */ + target_ulong *regs = (target_ulong *)r; + + /* R0 is always 0; buffer is zero-initialised by the caller */ for (int i = 1; i < 32; i++) { - r->reserved[i] = tswap64(env->active_tc.gpr[i]); + regs[i] = tswap64(env->active_tc.gpr[i]); } - r->reserved[26] = 0; /* k0 */ - r->reserved[27] = 0; /* k1 */ - r->reserved[32] = tswap64(env->active_tc.LO[0]); - r->reserved[33] = tswap64(env->active_tc.HI[0]); - r->reserved[34] = tswap64(env->active_tc.PC); - r->reserved[35] = tswap64(env->CP0_BadVAddr); - r->reserved[36] = tswap64(env->CP0_Status); - r->reserved[37] = tswap64(env->CP0_Cause); + regs[26] = 0; /* k0 */ + regs[27] = 0; /* k1 */ + regs[32] = tswap64(env->active_tc.LO[0]); + regs[33] = tswap64(env->active_tc.HI[0]); + regs[34] = tswap64(env->active_tc.PC); + regs[35] = tswap64(env->CP0_BadVAddr); + regs[36] = tswap64(env->CP0_Status); + regs[37] = tswap64(env->CP0_Cause); } -- 2.54.0 From: Matt Turner <mattst88@gmail.com> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/mips/elfload.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/mips/elfload.c +++ b/linux-user/mips/elfload.c @@ -XXX,XX +XXX,XX @@ const char *get_elf_base_platform(CPUState *cs) void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env) { for (int i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) { - r->pt.regs[i] = tswapl(env->active_tc.gpr[i]); + r->pt.regs[i] = tswap32(env->active_tc.gpr[i]); } r->pt.regs[26] = 0; r->pt.regs[27] = 0; - r->pt.lo = tswapl(env->active_tc.LO[0]); - r->pt.hi = tswapl(env->active_tc.HI[0]); - r->pt.cp0_epc = tswapl(env->active_tc.PC); - r->pt.cp0_badvaddr = tswapl(env->CP0_BadVAddr); - r->pt.cp0_status = tswapl(env->CP0_Status); - r->pt.cp0_cause = tswapl(env->CP0_Cause); + r->pt.lo = tswap32(env->active_tc.LO[0]); + r->pt.hi = tswap32(env->active_tc.HI[0]); + r->pt.cp0_epc = tswap32(env->active_tc.PC); + r->pt.cp0_badvaddr = tswap32(env->CP0_BadVAddr); + r->pt.cp0_status = tswap32(env->CP0_Status); + r->pt.cp0_cause = tswap32(env->CP0_Cause); } #endif -- 2.54.0 From: Matt Turner <mattst88@gmail.com> Define HAVE_ELF_CORE_DUMP and target_elf_gregset_t in target_elf.h, mirroring struct user_regs_struct: pc followed by x1 (ra) through x31 (t6). Implement elf_core_copy_regs() in elfload.c to populate the gregset from CPURISCVState. Without this, bprm->core_dump is NULL for RISC-V targets. When a guest signal goes unhandled, dump_core_and_abort() skips the core write and falls through to die_with_signal(), which re-raises the signal to the host. The host kernel then writes an x86-64 core file for the qemu-riscv64 process instead of a RISC-V guest core. Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/riscv/elfload.c | 9 +++++++++ linux-user/riscv/target_elf.h | 7 +++++++ 2 files changed, 16 insertions(+) diff --git a/linux-user/riscv/elfload.c b/linux-user/riscv/elfload.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/riscv/elfload.c +++ b/linux-user/riscv/elfload.c @@ -XXX,XX +XXX,XX @@ #include "qemu/osdep.h" #include "qemu.h" #include "loader.h" +#include "target_elf.h" const char *get_elf_cpu_model(uint32_t eflags) @@ -XXX,XX +XXX,XX @@ const char *get_elf_cpu_model(uint32_t eflags) return "max"; } +void elf_core_copy_regs(target_elf_gregset_t *r, const CPURISCVState *env) +{ + r->pc = tswapal(env->pc); + for (int i = 0; i < 31; i++) { + r->regs[i] = tswapal(env->gpr[i + 1]); + } +} + abi_ulong get_elf_hwcap(CPUState *cs) { #define MISA_BIT(EXT) (1 << (EXT - 'A')) diff --git a/linux-user/riscv/target_elf.h b/linux-user/riscv/target_elf.h index XXXXXXX..XXXXXXX 100644 --- a/linux-user/riscv/target_elf.h +++ b/linux-user/riscv/target_elf.h @@ -XXX,XX +XXX,XX @@ #endif #define HAVE_ELF_HWCAP 1 +#define HAVE_ELF_CORE_DUMP 1 + +/* Mirrors struct user_regs_struct: pc followed by x1 (ra) .. x31 (t6). */ +typedef struct target_elf_gregset_t { + abi_ulong pc; + abi_ulong regs[31]; +} target_elf_gregset_t; #endif -- 2.54.0 From: Matt Turner <mattst88@gmail.com> Provides replacement VDSO with sigreturn trampolines (__kernel_sigreturn, __kernel_rt_sigreturn) and syscall stubs (clock_gettime, clock_gettime64, clock_getres, gettimeofday). Both LE and BE blobs are committed and selected at compile time via TARGET_BIG_ENDIAN. The BE variant requires an sh4eb-unknown-linux-gnu toolchain; sh4-unknown-linux-gnu does not support -mb. CFI register numbers follow GCC's SH_DEBUGGER_REGNO: PR=17, GBR=18, MACH=20, MACL=21, FPUL=23, FPSCR=24, FR0-15=25-40. Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/sh4/Makefile.vdso | 18 ++++ linux-user/sh4/elfload.c | 14 ++++ linux-user/sh4/meson.build | 12 +++ linux-user/sh4/target_elf.h | 1 + linux-user/sh4/vdso-asmoffset.h | 45 ++++++++++ linux-user/sh4/vdso-be.so | Bin 0 -> 2704 bytes linux-user/sh4/vdso-le.so | Bin 0 -> 2704 bytes linux-user/sh4/vdso.S | 142 ++++++++++++++++++++++++++++++++ linux-user/sh4/vdso.ld | 67 +++++++++++++++ 9 files changed, 299 insertions(+) create mode 100644 linux-user/sh4/Makefile.vdso create mode 100644 linux-user/sh4/vdso-asmoffset.h create mode 100755 linux-user/sh4/vdso-be.so create mode 100755 linux-user/sh4/vdso-le.so create mode 100644 linux-user/sh4/vdso.S create mode 100644 linux-user/sh4/vdso.ld diff --git a/linux-user/sh4/Makefile.vdso b/linux-user/sh4/Makefile.vdso new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/linux-user/sh4/Makefile.vdso @@ -XXX,XX +XXX,XX @@ +include $(BUILD_DIR)/tests/tcg/sh4-linux-user/config-target.mak + +SUBDIR = $(SRC_PATH)/linux-user/sh4 +VPATH += $(SUBDIR) + +all: $(SUBDIR)/vdso-le.so $(SUBDIR)/vdso-be.so + +LDFLAGS = -nostdlib -shared -Wl,-h,linux-gate.so.1 \ + -Wl,--build-id=sha1 -Wl,--hash-style=both \ + -Wl,-T,$(SUBDIR)/vdso.ld + +$(SUBDIR)/vdso-le.so: vdso.S vdso.ld vdso-asmoffset.h + $(CC) -o $@ $(LDFLAGS) -ml $< + +CC_BE = sh4eb-unknown-linux-gnu-gcc + +$(SUBDIR)/vdso-be.so: vdso.S vdso.ld vdso-asmoffset.h + $(CC_BE) -o $@ $(LDFLAGS) $< diff --git a/linux-user/sh4/elfload.c b/linux-user/sh4/elfload.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/sh4/elfload.c +++ b/linux-user/sh4/elfload.c @@ -XXX,XX +XXX,XX @@ #include "loader.h" #include "target_elf.h" +#if TARGET_BIG_ENDIAN +# include "vdso-be.c.inc" +#else +# include "vdso-le.c.inc" +#endif + +const VdsoImageInfo *get_vdso_image_info(uint32_t elf_flags G_GNUC_UNUSED) +{ +#if TARGET_BIG_ENDIAN + return &vdso_be_image_info; +#else + return &vdso_le_image_info; +#endif +} const char *get_elf_cpu_model(uint32_t eflags) { diff --git a/linux-user/sh4/meson.build b/linux-user/sh4/meson.build index XXXXXXX..XXXXXXX 100644 --- a/linux-user/sh4/meson.build +++ b/linux-user/sh4/meson.build @@ -XXX,XX +XXX,XX @@ syscall_nr_generators += { arguments: [ meson.current_source_dir() / 'syscallhdr.sh', '@INPUT@', '@OUTPUT@', '@EXTRA_ARGS@' ], output: '@BASENAME@_nr.h') } + +vdso_le_inc = gen_vdso.process('vdso-le.so', + extra_args: ['-s', '__kernel_sigreturn', + '-r', '__kernel_rt_sigreturn', + '-p', 'vdso_le']) + +vdso_be_inc = gen_vdso.process('vdso-be.so', + extra_args: ['-s', '__kernel_sigreturn', + '-r', '__kernel_rt_sigreturn', + '-p', 'vdso_be']) + +linux_user_ss.add(when: 'TARGET_SH4', if_true: [vdso_le_inc, vdso_be_inc]) diff --git a/linux-user/sh4/target_elf.h b/linux-user/sh4/target_elf.h index XXXXXXX..XXXXXXX 100644 --- a/linux-user/sh4/target_elf.h +++ b/linux-user/sh4/target_elf.h @@ -XXX,XX +XXX,XX @@ #define HAVE_ELF_HWCAP 1 #define HAVE_ELF_CORE_DUMP 1 +#define HAVE_VDSO_IMAGE_INFO 1 /* * See linux kernel: arch/sh/include/asm/elf.h, where diff --git a/linux-user/sh4/vdso-asmoffset.h b/linux-user/sh4/vdso-asmoffset.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/linux-user/sh4/vdso-asmoffset.h @@ -XXX,XX +XXX,XX @@ +/* + * Offsets into target signal frames for sh4 vdso. + * + * From linux-user/sh4/signal.c: + * + * struct target_sigcontext { + * target_ulong oldmask; // 0 + * target_ulong sc_gregs[16]; // 4 + * target_ulong sc_pc; // 68 + * target_ulong sc_pr; // 72 + * target_ulong sc_sr; // 76 + * target_ulong sc_gbr; // 80 + * target_ulong sc_mach; // 84 + * target_ulong sc_macl; // 88 + * target_ulong sc_fpregs[16]; // 92 + * target_ulong sc_xfpregs[16]; // 156 + * unsigned int sc_fpscr; // 220 + * unsigned int sc_fpul; // 224 + * unsigned int sc_ownedfp; // 228 + * }; // sizeof = 232 + * + * struct sigframe { sigcontext sc; ... } + * struct rt_sigframe { siginfo info[128]; ucontext uc; } + * ucontext = { flags[4], link[4], stack[12], sigcontext mcontext; ... } + * => mcontext at rt_sigframe + 128 + 20 = rt_sigframe + 148 + */ + +/* Offset of sigcontext within sigframe (CFA base for sigreturn). */ +#define SIGFRAME_SC_OFFSET 0 + +/* Offset of tuc_mcontext within rt_sigframe (CFA base for rt_sigreturn). */ +#define RT_SIGFRAME_SC_OFFSET 148 + +/* Offsets within struct sigcontext. */ +#define SC_GREGS 4 +#define SC_PC 68 +#define SC_PR 72 +#define SC_SR 76 +#define SC_GBR 80 +#define SC_MACH 84 +#define SC_MACL 88 +#define SC_FPREGS 92 +#define SC_XFPREGS 156 +#define SC_FPSCR 220 +#define SC_FPUL 224 diff --git a/linux-user/sh4/vdso-be.so b/linux-user/sh4/vdso-be.so new file mode 100755 index XXXXXXX..XXXXXXX GIT binary patch literal 2704 zcmbtWU1%It6#iy*limF9EvdGq*2LCYiXGAtN{c?YX?`_LB~7TU)#-M3vb#;P6K5xB zw#GIOA`!t_74e~nVqcZwlY-zw!9PTViVq^<gQ7?u>VqQqGxFWJcQd=mgWwr1Gw0kh z_vhU6efL}(92+uB167G(4*+fG1ClAJ_n{jN*o_oA05k&ZtF|`)+2Vj~`hO+ypCKC( zs>cNIN2I+7$R_{K`9D4a#0qPzI*%To@2?_lCm>t2zY{=gczg=;uO6Qtc)0T6H*aRH ze*EnF`wq3;oCMGg;6k`wv(pX!`3*2f05kyRYPd&(?`8n60cZh`a)aP6AlB;!!QX(~ z$94coHwgY@oZKL|1;o1b&i{v`f%qo?S~mf$0QLg$4<h<)K>S)np911vbG^#H0K~uN z+LUep@v9O47xdZ$f?w5HXo>MZb(R#KHzlERgXc#dN`rb+=ee`5u_w7Xv64(asBH8} zT<iJ_h2BdOZSQ^A|I*6mKV4qB^h@dRTU&R1wC8!)_F}H=+Syq*J7eb^-!INN8yXMv ztuuR0S=-c~?sP6wfo;z?UdfrY%f-Cs_zPZX&E)wJ>uj;Ku(UUy@g1w|TKh0IIzIKN zz27>(t(i5C5k4JX+`0_N9NVVyNblZ=y|eJU>Z8aw8(p#c0rZCPG9Cah0vOD<Q-HyI zoCl240G<JiS-@aU6MHbuPrzIjMprALCv95*+~irx8A98A0Dh>mG5+7y**F)mqyJ@& zbB<#$ms4^Qfs4YpAk3#lY+1yg5)J1?V?`vEMDm<yS`^I-qQw`jWzpt|_9sQhyhyo1 zl*Fc4(K#bFpA}n+;*Nso%8PB&;!a0w&xyOTqWg^K$%wm8iygMu`GmOVak1-^xc4!! z`=q#iL~I$AJ0WJt1zdM0hT30YLftT~r_h2Xz-Wqmza05)Ui-#4La!zO=WgISWB9g; zQ@t<_OkB-Z<Rt3MVMay9CRWXLlbE1Ro?&Wmz0?&3B!5s>c#%9pow%W=<b_y>E$Yk% z>Rc<o3Q8yEP`{#dau4B1{L-Iir`L>lh~HL)e+v6|D9+V-Rh0ihjd>&dKdt9ioHq%z zU)6tB51{zMuj8lHI=*?mj<4RW<Eu~W_~^SD{>o;(lZQ^^@|KG#dTr0i7u}Lw_A{Qp z-t3feum?_zr;m&thHVdzPuYVb_RvK7$e=wkFadjb>}Y>_%sx6abZl_ao=o?T4cZZ` zD+=0}LTdP;o~$ASR6}4JaFyb<b;Ja#T$%GTXJD0mFMJpDSIPAqSh-3mGgr*Yk8))W zRxaabVC72-Rv}X^gm&KxEsKs<F1n=}#m>QU3ih;@nRDzy&Rf%9`OcEB&-Xt{m%0y# z6@3?zv$QCTphw*wydU(PPmC)}NI&9=bqDj@3~?v1w-UK?I3BUQU*$ewnp8Qexs0M~ z0CFsGX@)qJSY^$k?=9_j&<z6eHT_0Z4M6^>_v=?S`mL%OfpvivjmL-FAPB<oh<Ay3 zu3L}Cc(EN{t0Bk(k_(7Q#)bVle$#5dW?em`Mf>smxCZ)N37aALN{RMk%|pM&5Py<W w2DDRTUNx2$)^G;v4c1NMJ&wnHk-PNXI4onrdP0kii>UQWJQv<|Rgr%G0%o^*^#A|> literal 0 HcmV?d00001 diff --git a/linux-user/sh4/vdso-le.so b/linux-user/sh4/vdso-le.so new file mode 100755 index XXXXXXX..XXXXXXX GIT binary patch literal 2704 zcmbtWU1%It6#iy+lk6sGvbUt#nzkl3))MRxODuwYXwv*_N|H*NXw~X;yF1z4{Or`( z*)$ttn+G2vg0<>HA4C*=@u4O7AU^n35fu@k>XV3|;txJFf<^FW<ePhMGTG!o@EZ;@ z=iHw;=iYO^doT764;Y34jVL;ywQc~(I0C&JZK%NkB+-moAZTMd<#i=7AP_xX<EIz` zsS6ASA^`pf$%{ZBdi+B_c-edu(4zmN+xh+?BppB?;r12)Q2>LZ6DVKp*z@kSHx|At z{Wc;deja@L%MW^+09;W1wnTv6|M8tv1gHV996=D{vH{csxB{SoYXRUd-*>vAz~8>_ zFpj+d;sE~ieTQ-1^nIs|KmMQS0q{`_XaukwjW`J4{g8eefR&Iw0pP2c^q2kf0KSb$ z->B2Kw?h422>B<l>T^Fd=ssiOdJ^1kg8RpL7`G0Q>qSu4ZR}sSBi?>A9$%u3eS*FJ zq;+NNQdhqB^Y^y>`03J1zg(KXyz9+l#pgRe+z-o|%a$A~Gvj2Yt(@(7g;{$`<Kga2 zX4fuhn;Pj%X44f|*0k*w?HQ|7$ho#xc8lvK*9%!^3dQpL!Ccz2&5~o@hvA{oiBr}g z^KcMtB=i{SxqS1pX6D##l}Ch(-@vW%wJ6&Nz0O8!^uaE*7Do&q1t4VrrvZ!`z&QYC z4B%M+GX~IM$b2J=g)u}Hh0)sB9OU3m0KY=!2En|%7r^&bwxa;PuCk4*x?x@s%j#_` zjGaVeF&X?s;G!@th{!V{x+r2#i<$*dTM>2hB7R;Z=0ts2G<c%1B(}Mt=_%2CP9z;6 ziemeWXqgr}ro^s-xFauGb7J?T*kg;mS#f7Zw4D|0X>r#XvCk46Pl~&r5c^Mydma}D z9uv2x#LgiEHA^m_-@*C~G`+$#HEtxYHz0w8vHtyX=(|4jJqjQZj7Z=-W4n>OepSU- z4RQz(4R%g)lGK^u2<l(zGTY<QjHs#%@`h}eRY3lbx~v%Th}0$XX<mp1)di48WP2ib zlkcQX)&X8!)5$)veu=26XN?$EeeNggU!oEFAURj-VX*%Lp?D3f`s5q^f3gVkM90ha zsn7)E3$Kcwm`7p0d98}C-l^iNkE{6Tn=1Z7CQ~_n|EY(kOb2V#Yq@r=;1sQrmv+6) zX1kb$)%WOV&&bd*Sk~a^gw>z22F7|u`mI#o7_7nJ6TLmd)`@|Ell|k?cu((ezZI%= zML}Cr$OgWsCaVwuZ6L5MxJvQbCSrnFs?2)nvoK4ZE8ltjRdhTXX0}pH&lWPlN2xLk zGn@9(FmuJSnNOGU((bv^GH1J`f>Yd}SXr2M-kNmNv$mDby6YND&z|R&{%5o*PG^ei zvzX_whEBzHb$&3F^_kBamlYw;7@jqq>Wt-lJa;KesvkLk^O5HcDW2tg%ukBuGJ^dm zM-<m`KGrFP_Xt%|YyDUUx71nA`lXP6s{8dSTi{<r-Vt~&(4ddRaR9!WkM&NW-+Dfd zr#yo7I|O-vLSMKpY}e~IxpuB>ybo#Ue%w5H{z%>+cf_?*q4{{{p_vTD`v9d+PZsK@ q=hEOEZp8q2Zz4DIzl@8_rDG$m)B>w|kop%Ps`@=wC(k+!?drcIxqF)c literal 0 HcmV?d00001 diff --git a/linux-user/sh4/vdso.S b/linux-user/sh4/vdso.S new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/linux-user/sh4/vdso.S @@ -XXX,XX +XXX,XX @@ +/* + * sh4 linux replacement vdso. + * + * Copyright 2023 Linaro, Ltd. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include <asm/unistd.h> +#include "vdso-asmoffset.h" + + .text + +.macro endf name + .globl \name + .type \name, @function + .size \name, . - \name +.endm + +/* + * SH4 syscall convention: + * Syscall number in r3 (caller-saved, so no save/restore needed) + * Arguments in r4-r7 + * Return value in r0 + * Syscall instruction: trapa #0x10 + */ + +.macro vdso_syscall name, nr +\name: + .cfi_startproc + mov.l 1f, r3 + trapa #0x10 + rts + nop + .align 2 +1: .long \nr + .cfi_endproc +endf \name +.endm + +vdso_syscall __vdso_clock_gettime, __NR_clock_gettime +vdso_syscall __vdso_clock_gettime64, __NR_clock_gettime64 +vdso_syscall __vdso_clock_getres, __NR_clock_getres +vdso_syscall __vdso_gettimeofday, __NR_gettimeofday + +/* + * Signal return trampolines. + * + * For sigreturn: r15 points to struct sigframe; sigcontext is at + * offset SIGFRAME_SC_OFFSET (0). + * For rt_sigreturn: r15 points to struct rt_sigframe; sigcontext is at + * offset RT_SIGFRAME_SC_OFFSET (148). + * + * A single CFI region covers both trampolines. The CFA is set to the + * start of the relevant sigcontext; all register offsets are then + * identical for both trampolines. Between the two trampolines we use + * .cfi_def_cfa_offset to update the CFA base for the different layout. + */ + +/* + * Start the unwind info at least one instruction before the signal + * trampoline, because the unwinder will assume we are returning + * after a call site. + */ + .cfi_startproc simple + .cfi_signal_frame + .cfi_return_column 16 /* return column is PC */ + + /* CFA = r15 + SIGFRAME_SC_OFFSET = r15 (sigcontext base, sigreturn). */ + .cfi_def_cfa 15, SIGFRAME_SC_OFFSET + + /* Integer registers r0-r15: sc_gregs[n] at sigcontext + SC_GREGS + n*4. */ + .cfi_offset 0, SC_GREGS + 0 * 4 + .cfi_offset 1, SC_GREGS + 1 * 4 + .cfi_offset 2, SC_GREGS + 2 * 4 + .cfi_offset 3, SC_GREGS + 3 * 4 + .cfi_offset 4, SC_GREGS + 4 * 4 + .cfi_offset 5, SC_GREGS + 5 * 4 + .cfi_offset 6, SC_GREGS + 6 * 4 + .cfi_offset 7, SC_GREGS + 7 * 4 + .cfi_offset 8, SC_GREGS + 8 * 4 + .cfi_offset 9, SC_GREGS + 9 * 4 + .cfi_offset 10, SC_GREGS + 10 * 4 + .cfi_offset 11, SC_GREGS + 11 * 4 + .cfi_offset 12, SC_GREGS + 12 * 4 + .cfi_offset 13, SC_GREGS + 13 * 4 + .cfi_offset 14, SC_GREGS + 14 * 4 + .cfi_offset 15, SC_GREGS + 15 * 4 + + /* PC (return column). */ + .cfi_offset 16, SC_PC + + /* Control registers. */ + .cfi_offset 17, SC_PR + .cfi_offset 18, SC_GBR + .cfi_offset 20, SC_MACH + .cfi_offset 21, SC_MACL + + /* FP registers fr0-fr15: sc_fpregs[n] at sigcontext + SC_FPREGS + n*4. */ + .cfi_offset 25, SC_FPREGS + 0 * 4 + .cfi_offset 26, SC_FPREGS + 1 * 4 + .cfi_offset 27, SC_FPREGS + 2 * 4 + .cfi_offset 28, SC_FPREGS + 3 * 4 + .cfi_offset 29, SC_FPREGS + 4 * 4 + .cfi_offset 30, SC_FPREGS + 5 * 4 + .cfi_offset 31, SC_FPREGS + 6 * 4 + .cfi_offset 32, SC_FPREGS + 7 * 4 + .cfi_offset 33, SC_FPREGS + 8 * 4 + .cfi_offset 34, SC_FPREGS + 9 * 4 + .cfi_offset 35, SC_FPREGS + 10 * 4 + .cfi_offset 36, SC_FPREGS + 11 * 4 + .cfi_offset 37, SC_FPREGS + 12 * 4 + .cfi_offset 38, SC_FPREGS + 13 * 4 + .cfi_offset 39, SC_FPREGS + 14 * 4 + .cfi_offset 40, SC_FPREGS + 15 * 4 + + /* FPUL, FPSCR. */ + .cfi_offset 23, SC_FPUL + .cfi_offset 24, SC_FPSCR + + nop + +sigreturn_region_start: +__kernel_sigreturn: + mov.l 1f, r3 + trapa #0x10 + .align 2 +1: .long __NR_sigreturn +endf __kernel_sigreturn + + /* Update CFA base for the rt_sigreturn frame layout. */ + .cfi_def_cfa_offset RT_SIGFRAME_SC_OFFSET + +__kernel_rt_sigreturn: + mov.l 2f, r3 + trapa #0x10 + .align 2 +2: .long __NR_rt_sigreturn +endf __kernel_rt_sigreturn +sigreturn_region_end: + + .cfi_endproc diff --git a/linux-user/sh4/vdso.ld b/linux-user/sh4/vdso.ld new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/linux-user/sh4/vdso.ld @@ -XXX,XX +XXX,XX @@ +/* + * Linker script for linux sh4 replacement vdso. + * + * Copyright 2023 Linaro, Ltd. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +VERSION { + LINUX_2.6 { + global: + __vdso_clock_gettime; + __vdso_clock_gettime64; + __vdso_clock_getres; + __vdso_gettimeofday; + __kernel_sigreturn; + __kernel_rt_sigreturn; + local: *; + }; +} + +PHDRS { + phdr PT_PHDR FLAGS(4) PHDRS; + load PT_LOAD FLAGS(7) FILEHDR PHDRS; /* FLAGS=RWX */ + dynamic PT_DYNAMIC FLAGS(4); + eh_frame_hdr PT_GNU_EH_FRAME; + note PT_NOTE FLAGS(4); +} + +SECTIONS { + . = SIZEOF_HEADERS; + + /* + * The following, including the FILEHDRS and PHDRS, are modified + * when we relocate the binary. We want them to be initially + * writable for the relocation; we'll force them read-only after. + */ + .note : { *(.note*) } :load :note + .dynamic : { *(.dynamic) } :load :dynamic + .dynsym : { *(.dynsym) } :load + .data : { + /* + * There ought not be any real read-write data. + * But since we manipulated the segment layout, + * we have to put these sections somewhere. + */ + *(.data*) + *(.sdata*) + *(.got.plt) *(.got) + *(.gnu.linkonce.d.*) + *(.bss*) + *(.dynbss*) + *(.gnu.linkonce.b.*) + } + + .rodata : { *(.rodata*) } + .hash : { *(.hash) } + .gnu.hash : { *(.gnu.hash) } + .dynstr : { *(.dynstr) } + .gnu.version : { *(.gnu.version) } + .gnu.version_d : { *(.gnu.version_d) } + .gnu.version_r : { *(.gnu.version_r) } + .eh_frame_hdr : { *(.eh_frame_hdr) } :load :eh_frame_hdr + .eh_frame : { *(.eh_frame) } :load + + .text : { *(.text*) } :load +} -- 2.54.0 The following changes since commit 2db91528542672cf0db78b3f2cc0e22b36302b38: Merge tag 'pull-vfio-20260527' of https://github.com/legoater/qemu into staging (2026-05-27 14:45:58 -0400) are available in the Git repository at: https://github.com/hdeller/qemu-hppa.git tags/linux-user-next-pull-request for you to fetch changes up to 07e701716b43da1a86c1045871c1eb613cf5e53a: linux-user: Move cpu_copy() to user-internals.h (2026-05-29 23:40:53 +0200) ---------------------------------------------------------------- linux user patches A series of patches for linux-user, specifically many FPU fixes in signal handling code for sh4, mips, ppc and s390x (from Matt Turner), a madvise() improvement (from me), and qemu header cleanups (from Peter Maydell). --- v3: Fix build failure due to unknown MADV_COLLAPSE constant in madivise() patch v2: Dropped the "ARM cortex-m55 program loading fix" and the FPU alpha patch ---------------------------------------------------------------- Helge Deller (2): linux-user: Implement finer grained madivse() syscall linux-user: Fix typo in function documentation for pgb_addr_set() Matt Turner (6): linux-user/ppc: restore fp_status from FPSCR on sigreturn linux-user/mips: save/restore FCSR across signal delivery linux-user/sh4: preserve T/M/Q bits across signal delivery linux-user/sh4: restore FP rounding mode on sigreturn target/sh4: sync fp_status when gdb writes FPSCR linux-user/s390x: restore fpu_status rounding mode from FPC on sigreturn Peter Maydell (2): linux-user: Move init_main_thread() prototype to user-internals.h linux-user: Move cpu_copy() to user-internals.h linux-user/elfload.c | 2 +- linux-user/mips/signal.c | 7 +++++++ linux-user/mmap.c | 34 +++++++++++++++++++++++++++++++++- linux-user/ppc/signal.c | 2 +- linux-user/qemu.h | 5 ----- linux-user/s390x/signal.c | 6 +++++- linux-user/sh4/signal.c | 19 ++++++++++++++++--- linux-user/user-internals.h | 18 ++++++++++++++++++ target/mips/cpu.h | 3 +++ target/mips/fpu.c | 5 +++++ target/s390x/cpu.h | 1 + target/s390x/tcg/fpu_helper.c | 20 ++++++++++++++------ target/sh4/cpu.h | 3 +++ target/sh4/gdbstub.c | 2 +- target/sh4/op_helper.c | 7 ++++++- tests/tcg/sh4/Makefile.target | 7 ------- 16 files changed, 114 insertions(+), 27 deletions(-) -- 2.54.0 From: Matt Turner <mattst88@gmail.com> restore_user_regs() restores the PPC FPSCR with a direct assignment: env->fpscr = (uint32_t) fpscr; ppc_store_fpscr() exists precisely to write FPSCR and keep the derived env->fp_status in sync: it calls fpscr_set_rounding_mode() to update the softfloat rounding mode, and set_float_rebias_overflow/underflow() to reflect the FP_OE/FP_UE enable bits. The direct assignment bypasses all of this. On sigreturn, interrupted code resumes with whatever rounding mode and overflow/underflow-rebias state the signal handler last installed in fp_status, rather than the state that was saved at signal delivery. Replace the direct assign with ppc_store_fpscr(). The FPSCR_MTFS_MASK applied inside ppc_store_fpscr() only excludes the computed FP_FEX and FP_VX bits, which it re-derives correctly from the exception and enable bits in the restored value. Fixes: bcd4933a23 ("linux-user: ppc signal handling") Cc: qemu-stable@nongnu.org Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/ppc/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux-user/ppc/signal.c b/linux-user/ppc/signal.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/ppc/signal.c +++ b/linux-user/ppc/signal.c @@ -XXX,XX +XXX,XX @@ static void restore_user_regs(CPUPPCState *env, __get_user(*fpr, &frame->mc_fregs[i]); } __get_user(fpscr, &frame->mc_fregs[32]); - env->fpscr = (uint32_t) fpscr; + ppc_store_fpscr(env, (uint32_t) fpscr); } #if !defined(TARGET_PPC64) -- 2.54.0 From: Matt Turner <mattst88@gmail.com> QEMU keeps the MIPS FPU control/status register (FCSR, fcr31) in env->active_fpu.fcr31. The rounding mode, flush-to-zero (FS), and NaN-2008 mode bits in fcr31 are reflected into the derived env->active_fpu.fp_status via set_float_rounding_mode() and friends; every architectural write to FCSR goes through helper_ctc1() which calls restore_fp_status() to keep the two in sync. Both target_sigcontext variants (O32 and N32/N64) have an sc_fpc_csr field that holds FCSR, but setup_sigcontext() never wrote it and restore_sigcontext() never read it. As a result: - The signal frame always delivered sc_fpc_csr == 0 to the handler, so sigaction(SA_SIGINFO) handlers that inspect the interrupted context see the wrong FCSR. - On sigreturn, active_fpu.fcr31 retained whatever value the signal handler last installed (if any), and active_fpu.fp_status was never resynced. Interrupted code resumed with the wrong rounding mode, FS flag, and NaN-2008 semantics. Fix setup_sigcontext() to save fcr31 into sc_fpc_csr. Fix restore_sigcontext() to read it back (masked to fcr31_rw_bitmask as the kernel does) and call cpu_mips_restore_fp_status() to resync fp_status from the restored fcr31. Add cpu_mips_restore_fp_status() in target/mips/fpu.c (which already defines ieee_rm and includes fpu_helper.h), and declare it in cpu.h. Fixes: 084d0497a0 ("mips-linux-user: Save and restore fpu and dsp from sigcontext") Cc: qemu-stable@nongnu.org Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/mips/signal.c | 7 +++++++ target/mips/cpu.h | 3 +++ target/mips/fpu.c | 5 +++++ 3 files changed, 15 insertions(+) diff --git a/linux-user/mips/signal.c b/linux-user/mips/signal.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/mips/signal.c +++ b/linux-user/mips/signal.c @@ -XXX,XX +XXX,XX @@ static inline void setup_sigcontext(CPUMIPSState *regs, for (i = 0; i < 32; ++i) { __put_user(regs->active_fpu.fpr[i].d, &sc->sc_fpregs[i]); } + __put_user(regs->active_fpu.fcr31, &sc->sc_fpc_csr); } static inline void @@ -XXX,XX +XXX,XX @@ restore_sigcontext(CPUMIPSState *regs, struct target_sigcontext *sc) for (i = 0; i < 32; ++i) { __get_user(regs->active_fpu.fpr[i].d, &sc->sc_fpregs[i]); } + { + uint32_t fcr31; + __get_user(fcr31, &sc->sc_fpc_csr); + regs->active_fpu.fcr31 = fcr31 & regs->active_fpu.fcr31_rw_bitmask; + cpu_mips_restore_fp_status(regs); + } } /* diff --git a/target/mips/cpu.h b/target/mips/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/target/mips/cpu.h +++ b/target/mips/cpu.h @@ -XXX,XX +XXX,XX @@ void cpu_mips_clock_init(MIPSCPU *cpu); /* helper.c */ target_ulong exception_resume_pc(CPUMIPSState *env); +/* fpu.c */ +void cpu_mips_restore_fp_status(CPUMIPSState *env); + /** * mips_cpu_create_with_clock: * @typename: a MIPS CPU type. diff --git a/target/mips/fpu.c b/target/mips/fpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/mips/fpu.c +++ b/target/mips/fpu.c @@ -XXX,XX +XXX,XX @@ const FloatRoundMode ieee_rm[4] = { float_round_down }; +void cpu_mips_restore_fp_status(CPUMIPSState *env) +{ + restore_fp_status(env); +} + const char fregnames[32][4] = { "f0", "f1", "f2", "f3", "f4", "f5", "f6", "f7", "f8", "f9", "f10", "f11", "f12", "f13", "f14", "f15", -- 2.54.0 From: Matt Turner <mattst88@gmail.com> QEMU keeps the SH4 T, M and Q status-register bits outside env->sr, in the dedicated env->sr_t, env->sr_m and env->sr_q fields; cpu_read_sr() folds them back into the architectural SR value and cpu_write_sr() splits them back out. setup_sigcontext() saved the bare env->sr (so the T/M/Q bits were always zero in the signal frame) and restore_sigcontext() wrote the value straight back into env->sr without updating sr_t/sr_m/sr_q. As a result the T bit was never preserved across signal delivery: on sigreturn the interrupted code resumed with whatever T value the signal handler last left behind. Any conditional branch (or addc/subc/rotcl/div1, etc.) immediately following the interrupted instruction could then take the wrong path. This is the cause of the long-standing intermittent failures of the tests/tcg/multiarch/signals.c test on sh4, which was marked BROKEN. With a SIGRTMIN timer firing every millisecond across many threads, the race was hit a few percent of the time and corrupted the guest heap, surfacing as a SIGSEGV in memset, a malloc assertion, or an rseq registration abort. Traced on a deterministic rr recording: a cmp/hi set T=0, the timer signal interrupted the very next instruction (a bf), the handler left T=1, and the resumed bf took glibc calloc's MORECORE_CLEARS branch, using the old top-chunk size as the clear length for a freshly split small chunk and running memset off the end of the heap. Fix setup_sigcontext()/restore_sigcontext() to use cpu_read_sr() and cpu_write_sr() so the T, M and Q bits round-trip correctly, and drop the BROKEN annotation on the sh4 signals test. Fixes: c3b5bc8ab3 ("SH4: Signal handling for the user space emulator, by Magnus Damm.") Cc: qemu-stable@nongnu.org Reviewed-by: Yoshinori Sato <yoshinori.sato@nifty.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/sh4/signal.c | 12 ++++++++++-- tests/tcg/sh4/Makefile.target | 7 ------- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/linux-user/sh4/signal.c b/linux-user/sh4/signal.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/sh4/signal.c +++ b/linux-user/sh4/signal.c @@ -XXX,XX +XXX,XX @@ static void setup_sigcontext(struct target_sigcontext *sc, COPY(gregs[14]); COPY(gregs[15]); COPY(gbr); COPY(mach); COPY(macl); COPY(pr); - COPY(sr); COPY(pc); + COPY(pc); #undef COPY + /* The T, M and Q bits live outside env->sr; fold them back in. */ + __put_user(cpu_read_sr(regs), &sc->sc_sr); for (i=0; i<16; i++) { __put_user(regs->fregs[i], &sc->sc_fpregs[i]); @@ -XXX,XX +XXX,XX @@ static void restore_sigcontext(CPUSH4State *regs, struct target_sigcontext *sc) COPY(gregs[14]); COPY(gregs[15]); COPY(gbr); COPY(mach); COPY(macl); COPY(pr); - COPY(sr); COPY(pc); + COPY(pc); #undef COPY + /* The T, M and Q bits live outside env->sr; unfold them. */ + { + uint32_t sr; + __get_user(sr, &sc->sc_sr); + cpu_write_sr(regs, sr); + } for (i=0; i<16; i++) { __get_user(regs->fregs[i], &sc->sc_fpregs[i]); diff --git a/tests/tcg/sh4/Makefile.target b/tests/tcg/sh4/Makefile.target index XXXXXXX..XXXXXXX 100644 --- a/tests/tcg/sh4/Makefile.target +++ b/tests/tcg/sh4/Makefile.target @@ -XXX,XX +XXX,XX @@ # SuperH specific tweaks # -# This triggers failures for sh4-linux about 10% of the time. -# Random SIGSEGV at unpredictable guest address, cause unknown. -run-signals: signals - $(call skip-test, $<, "BROKEN") -run-plugin-signals-with-%: - $(call skip-test, $<, "BROKEN") - VPATH += $(SRC_PATH)/tests/tcg/sh4 test-macl: CFLAGS += -O -g -- 2.54.0 From: Matt Turner <mattst88@gmail.com> The SH4 FPSCR rounding-mode (RM) and denormal (DN) bits are not held only in env->fpscr: they are also reflected into the derived env->fp_status via set_float_rounding_mode()/set_flush_to_zero(). The guest keeps the two in sync by routing every write to FPSCR through helper_ld_fpscr(). restore_sigcontext() wrote the saved value straight into env->fpscr and never touched env->fp_status, so on sigreturn the interrupted code resumed with whatever FP rounding mode and flush-to-zero setting the signal handler last installed. (regs->flags = 0 forces the FR/SZ/PR TB flags to be recomputed, but fp_status is runtime float state, not a TB flag, so it was left stale.) This is the FP analogue of the T/M/Q bit problem just fixed for the integer status register. Factor the FPSCR -> fp_status synchronisation out of helper_ld_fpscr() into cpu_load_fpscr() and use it from restore_sigcontext() so the rounding mode round-trips correctly across signal delivery. Fixes: c3b5bc8ab3 ("SH4: Signal handling for the user space emulator, by Magnus Damm.") Cc: qemu-stable@nongnu.org Reviewed-by: Yoshinori Sato <yoshinori.sato@nifty.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/sh4/signal.c | 7 ++++++- target/sh4/cpu.h | 3 +++ target/sh4/op_helper.c | 7 ++++++- 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/linux-user/sh4/signal.c b/linux-user/sh4/signal.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/sh4/signal.c +++ b/linux-user/sh4/signal.c @@ -XXX,XX +XXX,XX @@ static void restore_sigcontext(CPUSH4State *regs, struct target_sigcontext *sc) for (i=0; i<16; i++) { __get_user(regs->fregs[i], &sc->sc_fpregs[i]); } - __get_user(regs->fpscr, &sc->sc_fpscr); + /* Resync the derived float_status state, not just env->fpscr. */ + { + uint32_t fpscr; + __get_user(fpscr, &sc->sc_fpscr); + cpu_load_fpscr(regs, fpscr); + } __get_user(regs->fpul, &sc->sc_fpul); regs->tra = -1; /* disable syscall checks */ diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/target/sh4/cpu.h +++ b/target/sh4/cpu.h @@ -XXX,XX +XXX,XX @@ static inline void cpu_write_sr(CPUSH4State *env, uint32_t sr) env->sr = sr & ~((1u << SR_M) | (1u << SR_Q) | (1u << SR_T)); } +/* Set FPSCR and the derived float_status rounding/flush-to-zero state. */ +void cpu_load_fpscr(CPUSH4State *env, uint32_t val); + #endif /* SH4_CPU_H */ diff --git a/target/sh4/op_helper.c b/target/sh4/op_helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/sh4/op_helper.c +++ b/target/sh4/op_helper.c @@ -XXX,XX +XXX,XX @@ void helper_macw(CPUSH4State *env, int32_t arg0, int32_t arg1) } } -void helper_ld_fpscr(CPUSH4State *env, uint32_t val) +void cpu_load_fpscr(CPUSH4State *env, uint32_t val) { env->fpscr = val & FPSCR_MASK; if ((val & FPSCR_RM_MASK) == FPSCR_RM_ZERO) { @@ -XXX,XX +XXX,XX @@ void helper_ld_fpscr(CPUSH4State *env, uint32_t val) set_flush_to_zero((val & FPSCR_DN) != 0, &env->fp_status); } +void helper_ld_fpscr(CPUSH4State *env, uint32_t val) +{ + cpu_load_fpscr(env, val); +} + static void update_fpscr(CPUSH4State *env, uintptr_t retaddr) { int xcpt, cause, enable; -- 2.54.0 From: Matt Turner <mattst88@gmail.com> sh4_cpu_gdb_write_register() wrote the incoming FPSCR value straight into env->fpscr, leaving the derived env->fp_status (rounding mode and flush-to-zero) stale, so a gdb-initiated FPSCR change did not take effect for subsequent FP operations. Use cpu_load_fpscr() instead, the same way the adjacent case already uses cpu_write_sr() for SR. Cc: qemu-stable@nongnu.org Reviewed-by: Yoshinori Sato <yoshinori.sato@nifty.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> --- target/sh4/gdbstub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/sh4/gdbstub.c b/target/sh4/gdbstub.c index XXXXXXX..XXXXXXX 100644 --- a/target/sh4/gdbstub.c +++ b/target/sh4/gdbstub.c @@ -XXX,XX +XXX,XX @@ int superh_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n) env->fpul = ldl_p(mem_buf); break; case 24: - env->fpscr = ldl_p(mem_buf); + cpu_load_fpscr(env, ldl_p(mem_buf)); break; case 25 ... 40: if (env->fpscr & FPSCR_FR) { -- 2.54.0 From: Matt Turner <mattst88@gmail.com> QEMU keeps the s390x floating-point control register (FPC) in env->fpc. The rounding mode bits [2:0] of FPC are reflected into the derived env->fpu_status via set_float_rounding_mode(); every architectural write to FPC goes through HELPER(sfpc) which keeps the two in sync. restore_sigregs() restored FPC with a direct assignment: __get_user(env->fpc, &sc->fpregs.fpc); This wrote env->fpc correctly but never updated env->fpu_status, so on sigreturn the interrupted code resumed with whatever rounding mode the signal handler last installed in fpu_status. Factor the two-step "write fpc + sync fpu_status" logic out of HELPER(sfpc) into cpu_s390x_load_fpc(), declare it in cpu.h, and call it from restore_sigregs() in place of the direct assignment. cpu_s390x_load_fpc() partially reuses the sanity check from HELPER(sfpc): if the FPC value has an invalid rounding mode or reserved bits set, it falls back to 0, matching the kernel's fpu_lfpc_safe() behavior where a corrupt signal frame value causes a specification exception and 0 is used instead. HELPER(sfpc) now calls cpu_s390x_load_fpc() after its full specification-exception check, including the FEAT_FLOATING_POINT_EXT test that is not needed for the signal restore path. Fixes: 2941e0fa05 ("linux-user/s390x: Save/restore fpc when handling a signal") Cc: qemu-stable@nongnu.org Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/s390x/signal.c | 6 +++++- target/s390x/cpu.h | 1 + target/s390x/tcg/fpu_helper.c | 20 ++++++++++++++------ 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/linux-user/s390x/signal.c b/linux-user/s390x/signal.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/s390x/signal.c +++ b/linux-user/s390x/signal.c @@ -XXX,XX +XXX,XX @@ static void restore_sigregs(CPUS390XState *env, target_sigregs *sc) for (i = 0; i < 16; i++) { __get_user(env->aregs[i], &sc->regs.acrs[i]); } - __get_user(env->fpc, &sc->fpregs.fpc); + { + uint32_t fpc; + __get_user(fpc, &sc->fpregs.fpc); + cpu_s390x_load_fpc(env, fpc); + } for (i = 0; i < 16; i++) { __get_user(*get_freg(env, i), &sc->fpregs.fprs[i]); } diff --git a/target/s390x/cpu.h b/target/s390x/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/target/s390x/cpu.h +++ b/target/s390x/cpu.h @@ -XXX,XX +XXX,XX @@ void s390_init_sigp(void); /* helper.c */ void s390_cpu_set_psw(CPUS390XState *env, uint64_t mask, uint64_t addr); uint64_t s390_cpu_get_psw_mask(CPUS390XState *env); +void cpu_s390x_load_fpc(CPUS390XState *env, uint32_t fpc); /* outside of target/s390x/ */ S390CPU *s390_cpu_addr2state(uint16_t cpu_addr); diff --git a/target/s390x/tcg/fpu_helper.c b/target/s390x/tcg/fpu_helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/s390x/tcg/fpu_helper.c +++ b/target/s390x/tcg/fpu_helper.c @@ -XXX,XX +XXX,XX @@ static const int fpc_to_rnd[8] = { float_round_to_odd, }; +void cpu_s390x_load_fpc(CPUS390XState *env, uint32_t fpc) +{ + /* + * Mimic kernel fpu_lfpc_safe(): a corrupt signal frame value that would + * trigger a specification exception instead results in FPC being set to 0. + */ + if (fpc_to_rnd[fpc & 0x7] == -1 || fpc & 0x03030088u) { + fpc = 0; + } + env->fpc = fpc; + set_float_rounding_mode(fpc_to_rnd[fpc & 0x7], &env->fpu_status); +} + /* set fpc */ void HELPER(sfpc)(CPUS390XState *env, uint64_t fpc) { @@ -XXX,XX +XXX,XX @@ void HELPER(sfpc)(CPUS390XState *env, uint64_t fpc) (!s390_has_feat(S390_FEAT_FLOATING_POINT_EXT) && fpc & 0x4)) { tcg_s390_program_interrupt(env, PGM_SPECIFICATION, GETPC()); } - - /* Install everything in the main FPC. */ - env->fpc = fpc; - - /* Install the rounding mode in the shadow fpu_status. */ - set_float_rounding_mode(fpc_to_rnd[fpc & 0x7], &env->fpu_status); + cpu_s390x_load_fpc(env, fpc); } /* set fpc and signal */ -- 2.54.0 Although most madvise() values are hints, some are important and are checked by userspace, especially by security-relevant applications like BoringSLL. So, return -EINVAL for those functions which we don't emulate. Signed-off-by: Helge Deller <deller@gmx.de> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3489 --- linux-user/mmap.c | 34 +++++++++++++++++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/linux-user/mmap.c b/linux-user/mmap.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -XXX,XX +XXX,XX @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice) case TARGET_MADV_KEEPONFORK: /* parisc */ advice = MADV_KEEPONFORK; break; - /* we do not care about the other MADV_xxx values yet */ + /* all other MADV_xxx values are the same across architectures */ } /* @@ -XXX,XX +XXX,XX @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice) */ mmap_lock(); switch (advice) { + case MADV_NORMAL: + case MADV_RANDOM: + case MADV_SEQUENTIAL: + case MADV_WILLNEED: + case MADV_DOFORK: + case MADV_FREE: + case MADV_COLD: + case MADV_PAGEOUT: + ret = 0; /* OK */ + break; + case MADV_REMOVE: + ret = -EOPNOTSUPP; + break; case MADV_DONTDUMP: page_set_flags(start, start + len - 1, PAGE_DONTDUMP, 0); break; @@ -XXX,XX +XXX,XX @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice) page_reset_target_data(start, start + len - 1); } } + break; + case MADV_DONTFORK: + case MADV_HWPOISON: + case MADV_MERGEABLE: + case MADV_UNMERGEABLE: + case MADV_HUGEPAGE: + case MADV_NOHUGEPAGE: + case MADV_POPULATE_READ: + case MADV_POPULATE_WRITE: +#ifdef MADV_COLLAPSE + case MADV_COLLAPSE: +#endif + case -1: /* BoringSSL uses -1 to check if the environment is broken */ + ret = -EINVAL; + break; + default: + qemu_log_mask(LOG_UNIMP, "Unhandled madvise(%d) call.\n", advice); + ret = -EINVAL; /* not yet known advise */ + break; } mmap_unlock(); -- 2.54.0 The third parameter is called guest_hiaddr. Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/elfload.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux-user/elfload.c b/linux-user/elfload.c index XXXXXXX..XXXXXXX 100644 --- a/linux-user/elfload.c +++ b/linux-user/elfload.c @@ -XXX,XX +XXX,XX @@ static bool pgb_try_mmap_set(const PGBAddrs *ga, uintptr_t base, uintptr_t brk) * pgb_addr_set: * @ga: output set of guest addrs * @guest_loaddr: guest image low address - * @guest_loaddr: guest image high address + * @guest_hiaddr: guest image high address * @identity: create for identity mapping * * Fill in @ga with the image, COMMPAGE and NULL page. -- 2.54.0 From: Peter Maydell <peter.maydell@linaro.org> The init_main_thread() prototype is needed only by code internal to linux-user/, so it doesn't need to be in qemu.h (which is also pulled in by various files outside linux-user/). Move the prototype to user-internals.h, and give it a documentation comment. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/qemu.h | 2 -- linux-user/user-internals.h | 15 +++++++++++++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/linux-user/qemu.h b/linux-user/qemu.h index XXXXXXX..XXXXXXX 100644 --- a/linux-user/qemu.h +++ b/linux-user/qemu.h @@ -XXX,XX +XXX,XX @@ void *lock_user_string(abi_ulong guest_addr); /* Clone cpu state */ CPUArchState *cpu_copy(CPUArchState *env); -void init_main_thread(CPUState *cs, struct image_info *info); - #endif /* QEMU_H */ diff --git a/linux-user/user-internals.h b/linux-user/user-internals.h index XXXXXXX..XXXXXXX 100644 --- a/linux-user/user-internals.h +++ b/linux-user/user-internals.h @@ -XXX,XX +XXX,XX @@ static inline void begin_parallel_context(CPUState *cs) } } +/** + * init_main_thread: Set CPU state for main thread + * @cs: CPU context to set + * @info: information about the image being loaded + * + * This function must be provided by the per-target code. It should + * set the initial CPU state based on the information about the + * starting binary in @image_info. This will be at a minimum setting + * the initial guest program counter and stack pointer; it should + * also set up any other guest register values where the Linux ABI + * defines that they start set to some other value than what the + * guest CPU architecture gives you out of reset. + */ +void init_main_thread(CPUState *cs, struct image_info *info); + /* * Include target-specific struct and function definitions; * they may need access to the target-independent structures -- 2.54.0 From: Peter Maydell <peter.maydell@linaro.org> We only use cpu_copy() inside linux-user, so we don't need to have the prototype in qemu.h available to code outside linux-user; move it to user-internals.h. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Helge Deller <deller@gmx.de> --- linux-user/qemu.h | 3 --- linux-user/user-internals.h | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/linux-user/qemu.h b/linux-user/qemu.h index XXXXXXX..XXXXXXX 100644 --- a/linux-user/qemu.h +++ b/linux-user/qemu.h @@ -XXX,XX +XXX,XX @@ void *lock_user_string(abi_ulong guest_addr); #define unlock_user_struct(host_ptr, guest_addr, copy) \ unlock_user(host_ptr, guest_addr, (copy) ? sizeof(*host_ptr) : 0) -/* Clone cpu state */ -CPUArchState *cpu_copy(CPUArchState *env); - #endif /* QEMU_H */ diff --git a/linux-user/user-internals.h b/linux-user/user-internals.h index XXXXXXX..XXXXXXX 100644 --- a/linux-user/user-internals.h +++ b/linux-user/user-internals.h @@ -XXX,XX +XXX,XX @@ static inline void begin_parallel_context(CPUState *cs) */ void init_main_thread(CPUState *cs, struct image_info *info); +/* Clone cpu state */ +CPUArchState *cpu_copy(CPUArchState *env); + /* * Include target-specific struct and function definitions; * they may need access to the target-independent structures -- 2.54.0