From nobody Sat Jul 25 18:54:50 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=kernel.org ARC-Seal: i=1; a=rsa-sha256; t=1784043649; cv=none; d=zohomail.com; s=zohoarc; b=cb741w3qvd34zcXjnYTCRdY/wINk4nd5oCGrPsdL8VwtvOYfEaX6OAUX26QKTE0YEUFY3bad1VJXWXAjg2K7UPSUuxTCZk0WYqwtZFycFuKpJ2eJ6vTGJbvZKc+Z/nZOkvf4E+xfxdFp0LTskZ/NHPAy1UBX1Ii1bJI/pz1tOwA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784043649; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:Sender:Subject:Subject:To:To:Message-Id; bh=jL+EV3jCk8h7MuijZ0PZNPxKuZLnsjFUwqoAOSopaSI=; b=ZgAYZc4WkQ2HUKeosb9C0Nl16eObfNg5wu0w5FrWkPX8BTYrSfo4VINsWEnU/cOIGOuA2H5tZYVVnaMUbhAszBNNASHGoHrS1BEH3N7a/XBCEQVcm7ENgqeYMNWZ5tne+Sf3voAmk4LyIIF5TD/mZqj9WSt9YXH3+FWEOBTIeqE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784043649419497.7185370095759; Tue, 14 Jul 2026 08:40:49 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wjfFM-0000ot-2K; Tue, 14 Jul 2026 11:40:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wjfFK-0000ol-Ra for qemu-devel@nongnu.org; Tue, 14 Jul 2026 11:40:34 -0400 Received: from sea.source.kernel.org ([172.234.252.31]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wjfFI-0007aK-JP for qemu-devel@nongnu.org; Tue, 14 Jul 2026 11:40:34 -0400 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 8CA9B4099D; Tue, 14 Jul 2026 15:40:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPS id 6CCCEC2BCB8; Tue, 14 Jul 2026 15:40:29 +0000 (UTC) Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47634C44508; Tue, 14 Jul 2026 15:40:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1784043629; bh=jzalEuqQmgfjIjTDyacrkbipmaq+mizkVzuEZhGodg8=; h=From:Date:Subject:To:Cc:Reply-To:From; b=G8efqVUmL7zPWQxexUB5PppGuKaflNszeN0Y8OVZj5BGC3J0RPi001NS3x+zsAfwf W9J2in6lOdO/PmyaCrOZbnF8cJ4DXaReWOERK6em5OcrUVPDpUJmChoM7bAMo4a26Z 0A3nNbGJpgP2Erlqy1LQmKdA6Qg7za37dmsOqm4k6DNVE03MQ22cs7WsbAsef41Oh5 5b7kRp67gr1SKqbfhawnbpXVwLuw+wjEE+mKuD6eaP0HNdrGpe0N3B+nUwg3G6UXAG SsUFq9RORow0a+GXpx++HQAY4F2OzV4YWVjcZZcN8CqUPRHkL0/STBQJWd9GgazSEo 7qZLke8p/+yeA== From: Miao Wang via B4 Relay Date: Tue, 14 Jul 2026 23:40:15 +0800 Subject: [PATCH] target/loongarch: fix data race in CSR_ESTAT MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260714-loong-race-v1-1-54111549c95e@gmail.com> X-B4-Tracking: v=1; b=H4sIAF5YVmoC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzMDcwNz3Zz8/Lx03aLE5FRdM2MzY8tUizTTxLQkJaCGgqLUtMwKsGHRsbW 1ACVye/dcAAAA X-Change-ID: 20260707-loong-race-63639e8f5afb To: qemu-devel@nongnu.org Cc: Song Gao <17746591750@163.com>, Bibo Mao , Xianglai Li , Jiaxun Yang , Xi Ruoyao , b4-sent@kernel.org, Miao Wang X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=11865; i=shankerwangmiao@gmail.com; s=20250715; h=from:subject:message-id; bh=26m/D8Nn8FBL6ASV4PW3nCdwwQJNgRyJtYWGM2ZFKX4=; b=owEBbQKS/ZANAwAKAbAx48p7/tluAcsmYgBqVlhhJT+idv3rV7TICfNeWT9dWKT242xqI2CX3 SqLlhq8op2JAjMEAAEKAB0WIQREqPWPgPJBxluezBOwMePKe/7ZbgUCalZYYQAKCRCwMePKe/7Z blGREACaIoI04vRX8AnwQA3Zxim+z6PqIA6JcqObuAeUUAh5Rt73FjvjioeLXOJhEVwgjVaQ5Jx ZOB62gGhKXdr+mSUxO0bw7A2CoyZeJ+JltfdC63toesz+cWjcz2W5/BxHtD3QP4SnlxHojEKqbw w32v3wuWc8okjelgRQyCsxPrxUkuessk7xtcaqQCtZ/924QKcLq+2Q/AXzJeV9NUfCsgnzYogfg gCh8fUszHJpdAcYQZBfaXU8OOoZycfyHwvzucuqLQFGEkkyry8w4xOtKjXvjv3aY8FsfQnGCS1V B8n2gU5ZRLCxjXjbXGkY2JI2kT17s2NMDdYaIcOf/KBTSfOqtbzSuJBOrTxF2F6v/CHdkiVAcsR NfCbnfdJtjRJF2KZILj5AFJpXbexofeBxos3SxS1kWvggWwNpwDJM1gX1PQGxp4lAN8FctsJAYq 8ZgLlnXNe3VKB/0XNfQ2nEa6NngE49TelUmHI7PNVf0zIIRKecBsEKGLMEAfAEU+A/oKj3bkR1Q Bll/bpsjmiBvVeUvwX4YxxR5z47YxMnIbEewRmOMfTY5Wjn0kvDDW5ghn1iFqPxG3Ci5eiQwfs2 Zrf5iO7kcgI+RAr7DxaKQodO7SYbQuN994uAEKoTGj8R+KNwlYrXyMDSNgMJ2CGRnLeeNdzHgf/ OnXjGFRwuf8MF+w== X-Developer-Key: i=shankerwangmiao@gmail.com; a=openpgp; fpr=6FAEFF06B7D212A774C60BFDFA0D166D6632EF4A X-Endpoint-Received: by B4 Relay for shankerwangmiao@gmail.com/20250715 with auth_id=462 X-Original-From: Miao Wang Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=172.234.252.31; envelope-from=devnull+shankerwangmiao.gmail.com@kernel.org; helo=sea.source.kernel.org X-Spam_score_int: 0 X-Spam_score: -0.0 X-Spam_bar: / X-Spam_report: (-0.0 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FORGED_REPLYTO=2.095, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: shankerwangmiao@gmail.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @kernel.org) X-ZM-MESSAGEID: 1784043651535158500 From: Miao Wang The CSR_ESTAT register of a CPU can be read and written by both the CPU thread and other threads (e.g., the interrupt controller thread). Currently the possible readers and writers of CSR_ESTAT are: - Readers - tcg generated by trans_csrrd(, CSR_ESTAT) - loongarch_cpu_has_work() - Writers - tcg generated by trans_csrxchg(, CSR_ESTAT) - helper_csrwr_estat() - helper_csrrd_msgir() - loongarch_cpu_set_irq() - loongarch_cpu_do_interrupt() - loongarch_cpu_exec_interrupt() The access from the CPU thread is not synchronized with the access from other threads, which may lead to data races. To fix this, use atomic operations to read and write CSR_ESTAT. The data race has been identified while running the test cases from dracut, which is using QEMU to boot a LoongArch guest. By running the tests repeatedly (about 30 times) in the following conditions, the guest will hang in the middle of booting: - Host architecture: LoongArch64 or Aarch64 - Guest kernel: 7.1.3+deb14-loong64 - Number of vCPUs: 1 or 2 - CPU Features: max, la464,msgint=3Doff,ptw=3Doff, or la464,msgint=3Doff,pt= w=3Don - Accelerator: tcg When the guest hangs, the guest kernel log shows various errors related to RCU stalls or other Soft Lockup or Hard Lockup issues. When running with 1 vCPU and the guest hangs, the guest kernel directly hangs without any messages and stucks at idle_exit. With this patch, the guest can boot successfully without any hangs during repeated runs of the test cases. Signed-off-by: Miao Wang --- target/loongarch/cpu.c | 8 +++---- target/loongarch/internals.h | 27 ++++++++++++++++++= +++ target/loongarch/tcg/csr_helper.c | 28 +++++++++++++++++-= ---- target/loongarch/tcg/helper.h | 2 ++ .../tcg/insn_trans/trans_privileged.c.inc | 13 ++++++++-- target/loongarch/tcg/tcg_cpu.c | 12 ++++------ 6 files changed, 71 insertions(+), 19 deletions(-) diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c index fb03424ffa8cd5e5d250531cc2a36fa789fc25a9..be53307997d60ceaa404a6187ee= df96dc51d82ff 100644 --- a/target/loongarch/cpu.c +++ b/target/loongarch/cpu.c @@ -71,8 +71,8 @@ void loongarch_cpu_set_irq(void *opaque, int irq, int lev= el) if (kvm_enabled()) { kvm_loongarch_set_interrupt(cpu, irq, level); } else if (tcg_enabled()) { - sys->CSR_ESTAT =3D deposit64(sys->CSR_ESTAT, irq, 1, level !=3D 0); - if (FIELD_EX64(sys->CSR_ESTAT, CSR_ESTAT, IS)) { + cpu_csr_estat_deposit64(sys, irq, 1, level !=3D 0); + if (FIELD_EX64(cpu_csr_estat_get(sys), CSR_ESTAT, IS)) { cpu_interrupt(cs, CPU_INTERRUPT_HARD); } else { cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD); @@ -87,7 +87,7 @@ bool cpu_loongarch_hw_interrupts_pending(CPULoongArchStat= e *env) uint32_t status; CPUSysState *sys =3D env_sys(env); =20 - pending =3D FIELD_EX64(sys->CSR_ESTAT, CSR_ESTAT, IS); + pending =3D FIELD_EX64(cpu_csr_estat_get(sys), CSR_ESTAT, IS); status =3D FIELD_EX64(sys->CSR_ECFG, CSR_ECFG, LIE); =20 return (pending & status) !=3D 0; @@ -641,7 +641,7 @@ static void loongarch_cpu_reset_hold(Object *obj, Reset= Type type) sys->CSR_ECFG =3D FIELD_DP64(sys->CSR_ECFG, CSR_ECFG, VS, 0); sys->CSR_ECFG =3D FIELD_DP64(sys->CSR_ECFG, CSR_ECFG, LIE, 0); =20 - sys->CSR_ESTAT =3D sys->CSR_ESTAT & (~MAKE_64BIT_MASK(0, 2)); + qatomic_and(&sys->CSR_ESTAT, ~MAKE_64BIT_MASK(0, 2)); sys->CSR_RVACFG =3D FIELD_DP64(sys->CSR_RVACFG, CSR_RVACFG, RBITS, 0); sys->CSR_CPUID =3D cs->cpu_index; sys->CSR_TCFG =3D FIELD_DP64(sys->CSR_TCFG, CSR_TCFG, EN, 0); diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h index e01dbed40f6c7d02d2180d9dd5e17dacdd31755a..b94d229b2e0a4d48a5b712ad5ee= 364fb4a402055 100644 --- a/target/loongarch/internals.h +++ b/target/loongarch/internals.h @@ -28,6 +28,33 @@ int ieee_ex_to_loongarch(int xcpt); void restore_fp_status(CPULoongArchState *env); #endif =20 +static inline uint64_t cpu_csr_estat_get(CPUSysState *sys) +{ + return qatomic_read(&sys->CSR_ESTAT); +} + +#define cpu_csr_estat_set(sys, field, val) \ + do { \ + uint64_t _estat =3D cpu_csr_estat_get(sys); \ + uint64_t _new =3D FIELD_DP64(_estat, CSR_ESTAT, field, (val)); \ + if (qatomic_cmpxchg(&(sys)->CSR_ESTAT, _estat, _new) =3D=3D _estat= ) { \ + break; \ + } \ + } while (1) + +static inline uint64_t cpu_csr_estat_deposit64(CPUSysState *sys, int start, + int len, uint64_t val) +{ + do { + uint64_t _estat =3D cpu_csr_estat_get(sys); + uint64_t _new =3D deposit64(_estat, start, len, val); + if (qatomic_cmpxchg(&(sys)->CSR_ESTAT, _estat, _new) =3D=3D _estat= ) { + return _estat; + } + } while (1); +} + + #ifndef CONFIG_USER_ONLY extern const VMStateDescription vmstate_loongarch_cpu; =20 diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_h= elper.c index 7dc33bc1802e5d4efc72648174bbf5e9baeaea54..023a6b1dc44f0df38c8c2f46b0b= 07eda88ddb3de 100644 --- a/target/loongarch/tcg/csr_helper.c +++ b/target/loongarch/tcg/csr_helper.c @@ -90,7 +90,7 @@ target_ulong helper_csrrd_msgir(CPULoongArchState *env) return irq; } =20 - sys->CSR_ESTAT =3D FIELD_DP64(sys->CSR_ESTAT, CSR_ESTAT, MSGINT, 0= ); + cpu_csr_estat_set(sys, MSGINT, 0); } else { /* bit 31 set 1 for no invalid irq */ irq =3D BIT(31); @@ -99,15 +99,31 @@ target_ulong helper_csrrd_msgir(CPULoongArchState *env) return irq; } =20 -target_ulong helper_csrwr_estat(CPULoongArchState *env, target_ulong val) +target_ulong helper_csrrd_estat(CPULoongArchState *env) { CPUSysState *sys =3D env_sys(env); - int64_t old_v =3D sys->CSR_ESTAT; + return cpu_csr_estat_get(sys); +} =20 - /* Only IS[1:0] can be written */ - sys->CSR_ESTAT =3D deposit64(sys->CSR_ESTAT, 0, 2, val); +target_ulong helper_csrwr_estat(CPULoongArchState *env, target_ulong val) +{ + CPUSysState *sys =3D env_sys(env); + return cpu_csr_estat_deposit64(sys, 0, 2, val); +} =20 - return old_v; +target_ulong helper_csrxhg_estat(CPULoongArchState *env, target_ulong val, + target_ulong mask) +{ + CPUSysState *sys =3D env_sys(env); + mask &=3D MAKE_64BIT_MASK(0, 2); + val &=3D mask; + do { + uint64_t _estat =3D cpu_csr_estat_get(sys); + uint64_t _new =3D (_estat & ~mask) | val; + if (qatomic_cmpxchg(&(sys)->CSR_ESTAT, _estat, _new) =3D=3D _estat= ) { + return _estat; + } + } while (1); } =20 target_ulong helper_csrwr_asid(CPULoongArchState *env, target_ulong val) diff --git a/target/loongarch/tcg/helper.h b/target/loongarch/tcg/helper.h index 8a6c62f11618d7125122831f4a9fe0d0fab73364..58089e84c60fa49524b4705981d= 0f677cfb439d2 100644 --- a/target/loongarch/tcg/helper.h +++ b/target/loongarch/tcg/helper.h @@ -101,8 +101,10 @@ DEF_HELPER_1(csrrd_pgd, i64, env) DEF_HELPER_1(csrrd_cpuid, i64, env) DEF_HELPER_1(csrrd_tval, i64, env) DEF_HELPER_1(csrrd_msgir, i64, env) +DEF_HELPER_1(csrrd_estat, i64, env) DEF_HELPER_2(csrwr_stlbps, i64, env, tl) DEF_HELPER_2(csrwr_estat, i64, env, tl) +DEF_HELPER_3(csrxhg_estat, i64, env, tl, tl) DEF_HELPER_2(csrwr_asid, i64, env, tl) DEF_HELPER_2(csrwr_tcfg, i64, env, tl) DEF_HELPER_2(csrwr_ticlr, i64, env, tl) diff --git a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc b/targe= t/loongarch/tcg/insn_trans/trans_privileged.c.inc index 6728ce5ec9387d1f66d68cf36abbe6e0997c639a..e6e9072518767479f66bae1cf1c= 72844df4343d4 100644 --- a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc +++ b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc @@ -75,7 +75,7 @@ static bool set_csr_trans_func(unsigned int csr_num, GenC= SRRead readfn, void loongarch_csr_translate_init(void) { SET_CSR_FUNC(STLBPS, NULL, gen_helper_csrwr_stlbps); - SET_CSR_FUNC(ESTAT, NULL, gen_helper_csrwr_estat); + SET_CSR_FUNC(ESTAT, gen_helper_csrrd_estat, gen_helper_csrwr_estat); SET_CSR_FUNC(ASID, NULL, gen_helper_csrwr_asid); SET_CSR_FUNC(PGD, gen_helper_csrrd_pgd, NULL); SET_CSR_FUNC(PWCL, NULL, gen_helper_csrwr_pwcl); @@ -187,7 +187,16 @@ static bool trans_csrxchg(DisasContext *ctx, arg_csrxc= hg *a) return false; } =20 - /* So far only readonly csrs have readfn. */ + if (a->csr =3D=3D LOONGARCH_CSR_ESTAT) { + src1 =3D gpr_src(ctx, a->rd, EXT_NONE); + mask =3D gpr_src(ctx, a->rj, EXT_NONE); + oldv =3D tcg_temp_new(); + gen_helper_csrxhg_estat(oldv, tcg_env, src1, mask); + gen_set_gpr(a->rd, oldv, EXT_NONE); + return true; + } + + /* So far only readonly csrs have readfn, except ESTAT. */ assert(csr->readfn =3D=3D NULL); =20 src1 =3D gpr_src(ctx, a->rd, EXT_NONE); diff --git a/target/loongarch/tcg/tcg_cpu.c b/target/loongarch/tcg/tcg_cpu.c index 4b1d44a16445841de8b9a7d69d8f389c357e6abf..64a28c7dcbbce2f2ce476404716= 02485344ca8e3 100644 --- a/target/loongarch/tcg/tcg_cpu.c +++ b/target/loongarch/tcg/tcg_cpu.c @@ -160,10 +160,8 @@ static void loongarch_cpu_do_interrupt(CPUState *cs) sys->CSR_TLBRERA =3D FIELD_DP64(sys->CSR_TLBRERA, CSR_TLBRERA, PC, (env->pc >> 2)); } else { - sys->CSR_ESTAT =3D FIELD_DP64(sys->CSR_ESTAT, CSR_ESTAT, ECODE, - EXCODE_MCODE(cause)); - sys->CSR_ESTAT =3D FIELD_DP64(sys->CSR_ESTAT, CSR_ESTAT, ESUBCODE, - EXCODE_SUBCODE(cause)); + cpu_csr_estat_set(sys, ECODE, EXCODE_MCODE(cause)); + cpu_csr_estat_set(sys, ESUBCODE, EXCODE_SUBCODE(cause)); sys->CSR_PRMD =3D FIELD_DP64(sys->CSR_PRMD, CSR_PRMD, PPLV, FIELD_EX64(sys->CSR_CRMD, CSR_CRMD, PLV= )); sys->CSR_PRMD =3D FIELD_DP64(sys->CSR_PRMD, CSR_PRMD, PIE, @@ -181,7 +179,7 @@ static void loongarch_cpu_do_interrupt(CPUState *cs) if (cs->exception_index =3D=3D EXCCODE_INT) { /* Interrupt */ uint32_t vector =3D 0; - uint32_t pending =3D FIELD_EX64(sys->CSR_ESTAT, CSR_ESTAT, IS); + uint32_t pending =3D FIELD_EX64(cpu_csr_estat_get(sys), CSR_ESTAT,= IS); pending &=3D FIELD_EX64(sys->CSR_ECFG, CSR_ECFG, LIE); =20 /* Find the highest-priority interrupt. */ @@ -195,7 +193,7 @@ static void loongarch_cpu_do_interrupt(CPUState *cs) TARGET_FMT_lx "\n", __func__, env->pc, sys->CSR_ERA, cause, sys->CSR_BADV, sys->CSR_DERA, vector, - sys->CSR_ECFG, sys->CSR_ESTAT); + sys->CSR_ECFG, cpu_csr_estat_get(sys)); qemu_plugin_vcpu_interrupt_cb(cs, last_pc); } else { if (tlbfill) { @@ -210,7 +208,7 @@ static void loongarch_cpu_do_interrupt(CPUState *cs) "BADI " TARGET_FMT_lx " SYS_NUM " TARGET_FMT_lu " cpu %d asid " TARGET_FMT_lx "\n", __func__, env->p= c, tlbfill ? sys->CSR_TLBRERA : sys->CSR_ERA, - cause, tlbfill ? "(refill)" : "", sys->CSR_ESTAT, + cause, tlbfill ? "(refill)" : "", cpu_csr_estat_get(= sys), sys->CSR_ECFG, tlbfill ? sys->CSR_TLBRBADV : sys->CSR_BADV, sys->CSR_BADI, env->gpr[11], cs->cpu_index, --- base-commit: 499039798cdad7d86b787fec0eaf1da4151c0f05 change-id: 20260707-loong-race-63639e8f5afb Best regards, --=20 Miao Wang