On Wed, 2026-10-14 at 21:16 +0200, Helge Deller wrote: > On 10/14/26 20:15, wangyang wrote: > > helper_cbo_zero() aligns the address down to the cache-block size > > before > > probe_write(), and accel/tcg/user-exec.c:probe_access_internal() > > reports > > that aligned address to cpu_loop_exit_sigsegv(), so a store fault > > from a > > legal cbo.zero (e.g. on a read-only page) reports the aligned block > > base > > as si_addr instead of the rs1 value supplied by the program. Native > > RISC-V Linux reports the exact rs1 address. Keep the original > > address in > > CPUState and use it when the fault is reported. > > > > The saved address must not outlive the instruction that produced > > it. The > > helper alone cannot guarantee that, because a store trigger or > > breakpoint on the cbo.zero access leaves through the debug path > > instead > > of one of the four fault consumers, and a later unrelated fault > > would > > then report the stale cbo.zero address. Also drop the pending > > override > > on every trap delivery: at the top of riscv_cpu_do_interrupt() and > > in > > riscv_cpu_debug_excp_handler() for system mode, and right after > > cpu_exec() returns in the linux-user cpu loop. > > > > Tested: the read-only-page reproducer reports rs1 for offsets 1, 65 > > and > > 129; an mcontrol store-trigger reproducer reports the follow-up > > load's > > own access-fault address instead of the earlier cbo.zero rs1. > > > > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4151 > > Suggested-by: David Harris <[email protected]> > > Signed-off-by: wangyang <[email protected]> > > --- > > accel/tcg/user-exec.c | 7 ++++++- > > include/hw/core/cpu.h | 2 ++ > > linux-user/riscv/cpu_loop.c | 3 +++ > > target/riscv/tcg/cpu_helper.c | 27 ++++++++++++++++++++++++--- > > target/riscv/tcg/debug.c | 3 +++ > > target/riscv/tcg/op_helper.c | 5 +++++ > > 6 files changed, 43 insertions(+), 4 deletions(-) > queued up in linux-user-next. > I'm happy to include upcoming R-b or A-b tags.
We might want this to get some more eyes on it before queuing it up. It touches mostly RISC-V softmmu code and 1 hour is not long enough for people to have a chance to review it. Alistair > > Helge
