On 10/26/26 09:09, Peter Maydell wrote:
The Arm architecture requires that for PC alignment fault exceptions take precedence over Instruction Abort exceptions. We get this wrong for linux-user mode, because QEMU detects the lack of any backing memory via probe_access_internal(), and calls arm_cpu_record_sigsegv(), which always reports either a Translation or Permission fault:#3 0x0000649548976b94 in arm_deliver_fault (cpu=0x649555ce5920, addr=1, access_type=MMU_INST_FETCH, mmu_idx=0, fi=0x7fff87e4c940) at ../../target/arm/tcg/tlb_helper.c:274 #4 0x0000649548976d69 in arm_cpu_record_sigsegv (cs=0x649555ce5920, addr=1, access_type=MMU_INST_FETCH, maperr=true, ra=0) at ../../target/arm/tcg/tlb_helper.c:421 #5 0x0000649548c97650 in cpu_loop_exit_sigsegv (cpu=0x649555ce5920, addr=1, access_type=MMU_INST_FETCH, maperr=true, ra=0) at ../../linux-user/signal.c:761 #6 0x00006495488f8235 in probe_access_internal (env=0x649555ce99a0, addr=1, fault_size=1, access_type=MMU_INST_FETCH, nonfault=false, ra=0) at ../../accel/tcg/user-exec.c:790 #7 0x00006495488f850d in get_page_addr_code_hostp (env=0x649555ce99a0, addr=1, hostp=0x7fff87e4ca70) at ../../accel/tcg/user-exec.c:828 #8 0x00006495488e5433 in get_page_addr_code (env=0x649555ce99a0, addr=1) at ../../accel/tcg/internal-common.h:116 #9 0x00006495488e56bd in tb_htable_lookup (cpu=0x649555ce5920, s=...) at ../../accel/tcg/cpu-exec.c:206 #10 0x00006495488e58c8 in tb_lookup (cpu=0x649555ce5920, s=...) at ../../accel/tcg/cpu-exec.c:251 #11 0x00006495488e5d2a in helper_lookup_tb_ptr (env=0x649555ce99a0) at ../../accel/tcg/cpu-exec.c:398 #12 0x00007d973c000270 in code_gen_buffer () Make arm_cpu_record_sigsegv() report a PC alignment fault for MMU_INST_FETCH accesses to non-4-aligned addresses for A64 and A32, matching the logic used in arm_cpu_tlb_fill_align() for system emulation. (Unaligned PC faults can't happen for Thumb.) This is then passed to the guest binary as SIGBUS rather than SIGSEGV. (The Fixes tag is for the commit that introduced this function, but the bug was also present in the previous implementation. It's an odd corner case so it's not worth the effort to try to backport the fix beyond that.) Cc:[email protected] Fixes: 9b12b6b44250c2 ("target/arm: Implement arm_cpu_record_sigsegv") Resolves:https://gitlab.com/qemu-project/qemu/-/work_items/4699 Signed-off-by: Peter Maydell<[email protected]> --- target/arm/tcg/tlb_helper.c | 4 ++++ 1 file changed, 4 insertions(+)
Reviewed-by: Richard Henderson <[email protected]> r~
