* [PATCH 1/3] sparc32: support futexes on SMP
2026-09-27 0:58 [PATCH 0/3] sparc32: SMP futexes, casa and idiv emulation Imre Kaloz
@ 2026-09-27 0:58 ` Imre Kaloz
2026-09-27 0:58 ` [PATCH 2/3] sparc32: emulate casa on V8 CPUs Imre Kaloz
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Imre Kaloz @ 2026-09-27 0:58 UTC (permalink / raw)
To: Andreas Larsson, sparclinux
Cc: David S. Miller, linux-kernel, Magnus Lindholm
asm-generic/futex.h provides the futex atomic ops for UP only, so FUTEX
has depended on !(SPARC32 && SMP).
Implement them in atomic32.c for both. LEON parts that implement casa
run it on the user word, as user code updates the word with casa there
and takes no kernel lock. Other CPUs have no compare-and-swap; the ops
serialize on __atomic_hash, which lets a kernel emulation of user casa
share the lock.
casa is optional on LEON, so it is probed once at boot. On a part
without it the kernel-mode illegal_instruction is fixed up from the
exception table.
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
---
arch/sparc/include/asm/futex_32.h | 6 +-
arch/sparc/kernel/traps_32.c | 13 +++-
arch/sparc/lib/atomic32.c | 122 ++++++++++++++++++++++++++++++
init/Kconfig | 1 -
4 files changed, 139 insertions(+), 3 deletions(-)
diff --git a/arch/sparc/include/asm/futex_32.h b/arch/sparc/include/asm/futex_32.h
index 6a332a9f099c..2271aad566f8 100644
--- a/arch/sparc/include/asm/futex_32.h
+++ b/arch/sparc/include/asm/futex_32.h
@@ -1,6 +1,10 @@
#ifndef _ASM_FUTEX_H
#define _ASM_FUTEX_H
-#include <asm-generic/futex.h>
+#include <linux/types.h>
+
+int arch_futex_atomic_op_inuser(int op, u32 oparg, int *oval, u32 __user *uaddr);
+int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ u32 oldval, u32 newval);
#endif
diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
index bb149f6cc34b..e1d50820c376 100644
--- a/arch/sparc/kernel/traps_32.c
+++ b/arch/sparc/kernel/traps_32.c
@@ -11,6 +11,7 @@
*/
#include <linux/cpu.h>
+#include <linux/extable.h>
#include <linux/sched/mm.h>
#include <linux/sched/debug.h>
#include <linux/mm_types.h>
@@ -108,8 +109,18 @@ void do_hw_interrupt(struct pt_regs *regs, unsigned long type)
void do_illegal_instruction(struct pt_regs *regs, unsigned long pc, unsigned long npc,
unsigned long psr)
{
- if(psr & PSR_PS)
+ if (psr & PSR_PS) {
+ const struct exception_table_entry *entry;
+
+ /* The casa probe on a CPU without casa. */
+ entry = search_exception_tables(pc);
+ if (entry) {
+ regs->pc = entry->fixup;
+ regs->npc = regs->pc + 4;
+ return;
+ }
die_if_kernel("Kernel illegal instruction", regs);
+ }
#ifdef TRAP_DEBUG
printk("Ill instr. at pc=%08lx instruction is %08lx\n",
regs->pc, *(unsigned long *)regs->pc);
diff --git a/arch/sparc/lib/atomic32.c b/arch/sparc/lib/atomic32.c
index 8ae880ebf07a..be712c2917d5 100644
--- a/arch/sparc/lib/atomic32.c
+++ b/arch/sparc/lib/atomic32.c
@@ -9,8 +9,13 @@
*/
#include <linux/atomic.h>
+#include <linux/futex.h>
+#include <linux/init.h>
#include <linux/spinlock.h>
#include <linux/module.h>
+#include <linux/uaccess.h>
+#include <asm/cpu_type.h>
+#include <asm/futex.h>
#ifdef CONFIG_SMP
#define ATOMIC_HASH_SIZE 4
@@ -195,3 +200,120 @@ unsigned long __xchg_u32(volatile u32 *ptr, u32 new)
return (unsigned long)prev;
}
EXPORT_SYMBOL(__xchg_u32);
+
+/* Only some LEON parts implement casa. */
+static bool sparc32_casa __ro_after_init;
+
+static int __casa_user(u32 *uval, u32 __user *uaddr, u32 oldval, u32 newval)
+{
+ /*
+ * casa [%o0] 0xb, %o1, %o2, as a word any assembler accepts. ASI
+ * 0x0b is the supervisor address space; the emulated casa in
+ * cas_emu_32.c instead accepts the user ASIs 0x0a and 0x80.
+ */
+ register u32 __user *uaddr_r asm("o0") = uaddr;
+ register u32 oldval_r asm("o1") = oldval;
+ register u32 newval_r asm("o2") = newval;
+ int ret = 0;
+
+ __asm__ __volatile__(
+ "1: .word 0xd5e20169\n"
+ "2:\n"
+ " .section .fixup,#alloc,#execinstr\n"
+ " .align 4\n"
+ "3: sethi %%hi(2b), %0\n"
+ " jmpl %0 + %%lo(2b), %%g0\n"
+ " mov %4, %0\n"
+ " .previous\n"
+ " .section __ex_table,#alloc\n"
+ " .align 4\n"
+ " .word 1b, 3b\n"
+ " .previous\n"
+ : "+r" (ret), "+r" (newval_r)
+ : "r" (uaddr_r), "r" (oldval_r), "i" (-EFAULT)
+ : "memory");
+
+ *uval = newval_r;
+ return ret;
+}
+
+/* Without casa the illegal_instruction trap takes the fixup above. */
+static int __init sparc32_casa_probe(void)
+{
+ u32 word = 0, val;
+
+ if (sparc_cpu_model == sparc_leon)
+ sparc32_casa = !__casa_user(&val, (u32 __force __user *)&word,
+ 0, 1);
+ return 0;
+}
+early_initcall(sparc32_casa_probe);
+
+/*
+ * Without casa, user CAS is emulated under the same lock. ATOMIC_HASH()
+ * uses page offset bits only, so every mapping of a word takes one lock.
+ */
+int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ u32 oldval, u32 newval)
+{
+ unsigned long flags;
+ u32 val;
+ int ret;
+
+ if (!access_ok(uaddr, sizeof(u32)))
+ return -EFAULT;
+ if (sparc32_casa)
+ return __casa_user(uval, uaddr, oldval, newval);
+
+ /* Every caller already runs with page faults disabled. */
+ spin_lock_irqsave(ATOMIC_HASH(uaddr), flags);
+ ret = __get_user(val, uaddr);
+ if (!ret && val == oldval)
+ ret = __put_user(newval, uaddr);
+ spin_unlock_irqrestore(ATOMIC_HASH(uaddr), flags);
+
+ if (!ret)
+ *uval = val;
+ return ret;
+}
+
+int arch_futex_atomic_op_inuser(int op, u32 oparg, int *oval, u32 __user *uaddr)
+{
+ u32 oldval, newval, val;
+ int ret;
+
+ if (get_user(oldval, uaddr))
+ return -EFAULT;
+
+ for (;;) {
+ switch (op) {
+ case FUTEX_OP_SET:
+ newval = oparg;
+ break;
+ case FUTEX_OP_ADD:
+ newval = oldval + oparg;
+ break;
+ case FUTEX_OP_OR:
+ newval = oldval | oparg;
+ break;
+ case FUTEX_OP_ANDN:
+ newval = oldval & ~oparg;
+ break;
+ case FUTEX_OP_XOR:
+ newval = oldval ^ oparg;
+ break;
+ default:
+ return -ENOSYS;
+ }
+
+ ret = futex_atomic_cmpxchg_inatomic(&val, uaddr, oldval, newval);
+ if (ret)
+ return ret;
+ if (val == oldval)
+ break;
+ oldval = val;
+ }
+
+ *oval = oldval;
+ return 0;
+}
diff --git a/init/Kconfig b/init/Kconfig
index 8583d9f06c52..9eb8086af7db 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1875,7 +1875,6 @@ config BASE_SMALL
config FUTEX
bool "Enable futex support" if EXPERT
- depends on !(SPARC32 && SMP)
default y
imply RT_MUTEXES
help
--
2.47.3
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 2/3] sparc32: emulate casa on V8 CPUs
2026-09-27 0:58 [PATCH 0/3] sparc32: SMP futexes, casa and idiv emulation Imre Kaloz
2026-09-27 0:58 ` [PATCH 1/3] sparc32: support futexes on SMP Imre Kaloz
@ 2026-09-27 0:58 ` Imre Kaloz
2026-09-27 0:58 ` [PATCH 3/3] sparc32: emulate integer divide taken as illegal_instruction Imre Kaloz
2026-09-27 21:42 ` [PATCH 0/3] sparc32: SMP futexes, casa and idiv emulation Magnus Lindholm
3 siblings, 0 replies; 6+ messages in thread
From: Imre Kaloz @ 2026-09-27 0:58 UTC (permalink / raw)
To: Andreas Larsson, sparclinux
Cc: David S. Miller, linux-kernel, Magnus Lindholm
sun4m implements no compare-and-swap instruction, only ldstub and swap,
so the V9 casa opcode is undefined there and raises illegal_instruction.
Complete the immediate-ASI form from do_illegal_instruction() for both
ASIs a compiler emits -- 0x80, the V9 primary address space, and 0x0A
from gcc -mcpu=leon3 -- so a C library can use one casa for its 32-bit
atomics on any V8 part. The opcode is unimplemented, so the ASI carries
no distinction the emulated CAS has to honour. LEON parts built without
casa take the same trap and are the LEON parts this serves.
The CAS is futex_atomic_cmpxchg_inatomic(), so it is atomic against the
futex operations and against itself on SMP. Everything else, including
the register-ASI form and casxa, raises SIGILL.
Confirmed on a dual-SuperSPARC SPARCstation 20.
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
---
arch/sparc/kernel/Makefile | 1 +
arch/sparc/kernel/cas_emu_32.c | 117 +++++++++++++++++++++++++++++++++
arch/sparc/kernel/entry.h | 1 +
arch/sparc/kernel/traps_32.c | 7 ++
arch/sparc/kernel/unimp_32.h | 71 ++++++++++++++++++++
5 files changed, 197 insertions(+)
create mode 100644 arch/sparc/kernel/cas_emu_32.c
create mode 100644 arch/sparc/kernel/unimp_32.h
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index 497b5714fa8f..fbea79a4ab58 100644
--- a/arch/sparc/kernel/Makefile
+++ b/arch/sparc/kernel/Makefile
@@ -40,6 +40,7 @@ obj-y += sys_sparc_$(BITS).o
obj-$(CONFIG_SPARC32) += systbls_32.o
obj-y += time_$(BITS).o
obj-$(CONFIG_SPARC32) += windows.o
+obj-$(CONFIG_SPARC32) += cas_emu_32.o
obj-y += cpu.o
obj-$(CONFIG_SPARC32) += devices.o
obj-y += ptrace_$(BITS).o
diff --git a/arch/sparc/kernel/cas_emu_32.c b/arch/sparc/kernel/cas_emu_32.c
new file mode 100644
index 000000000000..257f528d9a2c
--- /dev/null
+++ b/arch/sparc/kernel/cas_emu_32.c
@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Emulation of the V9 casa compare-and-swap for V8 CPUs.
+ *
+ * Copyright (C) 2026 Imre Kaloz <kaloz@kernel.org>
+ *
+ * sun4m implements no compare-and-swap at all, only ldstub and swap, and
+ * casa is optional on LEON. Where it is missing, casa is an undefined opcode
+ * and raises illegal_instruction (tt 0x02).
+ *
+ * Both immediate ASIs a compiler emits are accepted: 0x80, the V9 primary
+ * address space, and 0x0A, which gcc -mcpu=leon3 uses. The opcode is
+ * unimplemented wherever this runs, so the ASI carries no distinction the
+ * emulated CAS has to honour.
+ *
+ * The register-ASI form is not emulated: it reads %asi, which V8 does not
+ * have. casxa is a 64-bit CAS and is meaningless on a 32-bit CPU.
+ *
+ * The CAS takes the futex ops' lock, so it is atomic against them and
+ * against itself, but not against a plain store to the same word.
+ */
+
+#include <linux/kernel.h>
+#include <linux/sched/signal.h>
+#include <linux/mm.h>
+#include <linux/uaccess.h>
+#include <linux/ptrace.h>
+#include <asm/futex.h>
+#include <asm/ptrace.h>
+
+#include "entry.h"
+#include "unimp_32.h"
+
+#define CASA_OP 3 /* insn[31:30] */
+#define CASA_OP3 0x3c /* insn[24:19] */
+
+#define ASI_P 0x80
+#define ASI_LEON 0x0a
+
+/* A fault returns -EFAULT, and the caller pages the word in. */
+static int cas_try(u32 __user *uaddr, u32 cmp, u32 newval, u32 *oldval)
+{
+ int ret;
+
+ pagefault_disable();
+ ret = futex_atomic_cmpxchg_inatomic(oldval, uaddr, cmp, newval);
+ pagefault_enable();
+ return ret;
+}
+
+/*
+ * Returns 1 if the trap was consumed, either by emulating the CAS and
+ * advancing the PC or by delivering a fault signal for a bad address, and 0
+ * if this is not a casa we emulate, in which case the caller raises SIGILL.
+ */
+int try_emulate_casa(struct pt_regs *regs, unsigned int insn)
+{
+ unsigned int rd, rs1, rs2, asi;
+ unsigned long addr;
+ u32 cmp, newval, old;
+ int fault = 0, ret;
+
+ if ((insn >> 30) != CASA_OP)
+ return 0;
+ if (((insn >> 19) & 0x3f) != CASA_OP3)
+ return 0;
+ if (insn & (1 << 13)) /* i == 1: register ASI */
+ return 0;
+ asi = (insn >> 5) & 0xff;
+ if (asi != ASI_P && asi != ASI_LEON)
+ return 0;
+
+ rd = (insn >> 25) & 0x1f;
+ rs1 = (insn >> 14) & 0x1f;
+ rs2 = insn & 0x1f;
+
+ unimp_flush_windows(rs1, rs2, rd);
+
+ addr = unimp_get_reg(rs1, regs, &fault);
+ cmp = unimp_get_reg(rs2, regs, &fault);
+ newval = unimp_get_reg(rd, regs, &fault);
+ if (fault)
+ goto sigsegv;
+
+ if (addr & 3) { /* CAS is naturally aligned */
+ send_sig_fault(SIGBUS, BUS_ADRALN, (void __user *)addr, current);
+ return 1;
+ }
+ if (!access_ok((void __user *)addr, sizeof(u32)))
+ goto sigsegv;
+
+ while ((ret = cas_try((u32 __user *)addr, cmp, newval, &old)) == -EFAULT) {
+ /*
+ * Page the word in writably and retry, as
+ * fault_in_user_writeable() does.
+ */
+ struct mm_struct *mm = current->mm;
+ int fx;
+
+ mmap_read_lock(mm);
+ fx = fixup_user_fault(mm, addr, FAULT_FLAG_WRITE, NULL);
+ mmap_read_unlock(mm);
+ if (fx)
+ goto sigsegv;
+ }
+
+ if (unimp_put_reg(rd, old, regs))
+ goto sigsegv;
+
+ regs->pc = regs->npc;
+ regs->npc += 4;
+ return 1;
+
+sigsegv:
+ send_sig_fault(SIGSEGV, SEGV_MAPERR, (void __user *)addr, current);
+ return 1;
+}
diff --git a/arch/sparc/kernel/entry.h b/arch/sparc/kernel/entry.h
index c746c0fd5d6b..2eb2b0be90df 100644
--- a/arch/sparc/kernel/entry.h
+++ b/arch/sparc/kernel/entry.h
@@ -14,6 +14,7 @@ void handler_irq(int irq, struct pt_regs *regs);
void do_hw_interrupt(struct pt_regs *regs, unsigned long type);
void do_illegal_instruction(struct pt_regs *regs, unsigned long pc,
unsigned long npc, unsigned long psr);
+int try_emulate_casa(struct pt_regs *regs, unsigned int insn);
void do_priv_instruction(struct pt_regs *regs, unsigned long pc,
unsigned long npc, unsigned long psr);
diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
index e1d50820c376..69851b19766a 100644
--- a/arch/sparc/kernel/traps_32.c
+++ b/arch/sparc/kernel/traps_32.c
@@ -109,6 +109,8 @@ void do_hw_interrupt(struct pt_regs *regs, unsigned long type)
void do_illegal_instruction(struct pt_regs *regs, unsigned long pc, unsigned long npc,
unsigned long psr)
{
+ unsigned int insn;
+
if (psr & PSR_PS) {
const struct exception_table_entry *entry;
@@ -126,6 +128,11 @@ void do_illegal_instruction(struct pt_regs *regs, unsigned long pc, unsigned lon
regs->pc, *(unsigned long *)regs->pc);
#endif
+ if (!get_user(insn, (unsigned int __user *)pc)) {
+ if (try_emulate_casa(regs, insn))
+ return;
+ }
+
send_sig_fault(SIGILL, ILL_ILLOPC, (void __user *)pc, current);
}
diff --git a/arch/sparc/kernel/unimp_32.h b/arch/sparc/kernel/unimp_32.h
new file mode 100644
index 000000000000..9ab1705b9d04
--- /dev/null
+++ b/arch/sparc/kernel/unimp_32.h
@@ -0,0 +1,71 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2026 Imre Kaloz <kaloz@kernel.org>
+ */
+#ifndef _SPARC_UNIMP_32_H
+#define _SPARC_UNIMP_32_H
+
+#include <linux/uaccess.h>
+#include <asm/ptrace.h>
+
+/*
+ * Operand access for instructions completed out of do_illegal_instruction().
+ *
+ * Like maybe_flush_windows() in unaligned_32.c this has to be inlined: the
+ * save/restore chain must run in the trapping window, not one level deeper
+ * behind a call, or the outermost user window is left un-flushed and
+ * try_to_clear_window_buffer() kills the task on its next fork.
+ */
+static __always_inline void unimp_flush_windows(unsigned int rs1,
+ unsigned int rs2,
+ unsigned int rd)
+{
+ if (rs1 >= 16 || rs2 >= 16 || rd >= 16)
+ __asm__ __volatile__("save %sp, -0x40, %sp\n\t"
+ "save %sp, -0x40, %sp\n\t"
+ "save %sp, -0x40, %sp\n\t"
+ "save %sp, -0x40, %sp\n\t"
+ "save %sp, -0x40, %sp\n\t"
+ "save %sp, -0x40, %sp\n\t"
+ "save %sp, -0x40, %sp\n\t"
+ "restore; restore; restore; restore;\n\t"
+ "restore; restore; restore;\n\t");
+}
+
+/*
+ * Globals and outs come from pt_regs, locals and ins from the flushed window
+ * on the user stack. %g0 reads as zero.
+ */
+static inline unsigned long unimp_get_reg(unsigned int reg,
+ struct pt_regs *regs, int *fault)
+{
+ struct reg_window32 __user *win;
+ unsigned long val;
+
+ if (reg < 16)
+ return reg ? regs->u_regs[reg] : 0;
+
+ win = (struct reg_window32 __user *)regs->u_regs[UREG_FP];
+ if (get_user(val, &win->locals[reg - 16])) {
+ *fault = 1;
+ return 0;
+ }
+ return val;
+}
+
+/* %g0 discards the result. */
+static inline int unimp_put_reg(unsigned int reg, unsigned long val,
+ struct pt_regs *regs)
+{
+ struct reg_window32 __user *win;
+
+ if (reg < 16) {
+ if (reg)
+ regs->u_regs[reg] = val;
+ return 0;
+ }
+ win = (struct reg_window32 __user *)regs->u_regs[UREG_FP];
+ return put_user(val, &win->locals[reg - 16]);
+}
+
+#endif /* _SPARC_UNIMP_32_H */
--
2.47.3
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 3/3] sparc32: emulate integer divide taken as illegal_instruction
2026-09-27 0:58 [PATCH 0/3] sparc32: SMP futexes, casa and idiv emulation Imre Kaloz
2026-09-27 0:58 ` [PATCH 1/3] sparc32: support futexes on SMP Imre Kaloz
2026-09-27 0:58 ` [PATCH 2/3] sparc32: emulate casa on V8 CPUs Imre Kaloz
@ 2026-09-27 0:58 ` Imre Kaloz
2026-09-27 21:25 ` Magnus Lindholm
2026-09-27 21:42 ` [PATCH 0/3] sparc32: SMP futexes, casa and idiv emulation Magnus Lindholm
3 siblings, 1 reply; 6+ messages in thread
From: Imre Kaloz @ 2026-09-27 0:58 UTC (permalink / raw)
To: Andreas Larsson, sparclinux
Cc: David S. Miller, linux-kernel, Magnus Lindholm
SuperSPARC and SuperSPARC-II implement a 52-bit by 32-bit integer divide
and raise illegal_instruction for udiv and sdiv when the 64-bit dividend
{Y, rs1} has significant bits above bit 51, as the SuperSPARC II
Addendum documents, so whether a divide traps depends on its operands.
gcc emits udiv under -mcpu=v8, including in libgcc's __udivdi3, so
64-bit division in user code on these CPUs dies with SIGILL.
Complete udiv and sdiv, and their -cc forms, from
do_illegal_instruction(), sharing the windowed-operand helpers with the
casa emulation. A CPU that executes the instruction never reaches the
handler, nor does a kernel-mode illegal instruction. A fault reading a
windowed operand raises SIGSEGV, as the casa emulation does. On overflow
the quotient saturates to 0xffffffff for udiv and to 0x7fffffff or
0x80000000 for sdiv, and the -cc forms set V, as the architecture
specifies.
Signed-off-by: Imre Kaloz <kaloz@kernel.org>
---
arch/sparc/kernel/Makefile | 1 +
arch/sparc/kernel/div_emu_32.c | 127 +++++++++++++++++++++++++++++++++
arch/sparc/kernel/entry.h | 1 +
arch/sparc/kernel/traps_32.c | 3 +
4 files changed, 132 insertions(+)
create mode 100644 arch/sparc/kernel/div_emu_32.c
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index fbea79a4ab58..43e15b46b8dd 100644
--- a/arch/sparc/kernel/Makefile
+++ b/arch/sparc/kernel/Makefile
@@ -41,6 +41,7 @@ obj-$(CONFIG_SPARC32) += systbls_32.o
obj-y += time_$(BITS).o
obj-$(CONFIG_SPARC32) += windows.o
obj-$(CONFIG_SPARC32) += cas_emu_32.o
+obj-$(CONFIG_SPARC32) += div_emu_32.o
obj-y += cpu.o
obj-$(CONFIG_SPARC32) += devices.o
obj-y += ptrace_$(BITS).o
diff --git a/arch/sparc/kernel/div_emu_32.c b/arch/sparc/kernel/div_emu_32.c
new file mode 100644
index 000000000000..208b4071a525
--- /dev/null
+++ b/arch/sparc/kernel/div_emu_32.c
@@ -0,0 +1,127 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2026 Imre Kaloz <kaloz@kernel.org>
+ *
+ * SuperSPARC and SuperSPARC-II implement a 52-bit by 32-bit integer divide
+ * and raise illegal_instruction for udiv and sdiv when the dividend {Y, rs1}
+ * has significant bits above bit 51. Complete those divides here.
+ *
+ * Format 3 (op = 2), op3 0x0e udiv, 0x0f sdiv, plus 0x10 for the forms that
+ * set %icc. {Y, rs1} / rs2 saturates on overflow and leaves Y alone.
+ */
+
+#include <linux/kernel.h>
+#include <linux/sched/signal.h>
+#include <linux/uaccess.h>
+#include <asm/ptrace.h>
+#include <asm/psr.h>
+
+#include "entry.h"
+#include "unimp_32.h"
+
+int try_emulate_div(struct pt_regs *regs, unsigned int insn)
+{
+ unsigned int op3, rd, rs1, rs2;
+ unsigned long r1, r2, result = 0;
+ int fault = 0, is_signed, cc, ovf = 0;
+
+ if ((insn >> 30) != 2)
+ return 0;
+ op3 = (insn >> 19) & 0x3f;
+ switch (op3) {
+ case 0x0e: case 0x0f: case 0x1e: case 0x1f:
+ break;
+ default:
+ return 0;
+ }
+ is_signed = op3 & 0x01;
+ cc = op3 & 0x10;
+
+ rd = (insn >> 25) & 0x1f;
+ rs1 = (insn >> 14) & 0x1f;
+ rs2 = (insn & (1 << 13)) ? 0 : (insn & 0x1f);
+
+ unimp_flush_windows(rs1, rs2, rd);
+
+ r1 = unimp_get_reg(rs1, regs, &fault);
+ if (insn & (1 << 13)) { /* i == 1: sign-extended simm13 */
+ long simm = insn & 0x1fff;
+
+ if (simm & 0x1000)
+ simm |= ~0x1fffL;
+ r2 = (unsigned long)simm;
+ } else {
+ r2 = unimp_get_reg(rs2, regs, &fault);
+ }
+ if (fault) {
+ /* A windowed operand could not be read from the user stack. */
+ send_sig_fault(SIGSEGV, SEGV_MAPERR,
+ (void __user *)regs->u_regs[UREG_FP], current);
+ return 1;
+ }
+
+ if ((unsigned int)r2 == 0) {
+ send_sig_fault(SIGFPE, FPE_INTDIV,
+ (void __user *)regs->pc, current);
+ return 1;
+ }
+ if (is_signed) {
+ long long num = ((long long)(int)regs->y << 32) |
+ (unsigned int)r1;
+
+ /*
+ * INT64_MIN / -1 is undefined in C; the quotient is +2^63,
+ * a positive overflow.
+ */
+ if (num == LLONG_MIN && (int)r2 == -1) {
+ result = 0x7fffffff;
+ ovf = 1;
+ } else {
+ long long q = num / (int)r2;
+
+ if (q > 2147483647LL) {
+ result = 0x7fffffff;
+ ovf = 1;
+ } else if (q < -2147483647LL - 1) {
+ result = 0x80000000;
+ ovf = 1;
+ } else {
+ result = (unsigned long)(unsigned int)q;
+ }
+ }
+ } else {
+ unsigned long long num =
+ ((unsigned long long)(unsigned int)regs->y << 32) |
+ (unsigned int)r1;
+ unsigned long long q = num / (unsigned int)r2;
+
+ if (q > 0xffffffffULL) {
+ result = 0xffffffff;
+ ovf = 1;
+ } else {
+ result = (unsigned long)(unsigned int)q;
+ }
+ }
+
+ if (unimp_put_reg(rd, result, regs)) {
+ send_sig_fault(SIGSEGV, SEGV_MAPERR,
+ (void __user *)regs->u_regs[UREG_FP], current);
+ return 1;
+ }
+
+ if (cc) {
+ unsigned long psr = regs->psr & ~PSR_ICC;
+
+ if (result & 0x80000000)
+ psr |= PSR_N;
+ if (result == 0)
+ psr |= PSR_Z;
+ if (ovf)
+ psr |= PSR_V;
+ regs->psr = psr;
+ }
+
+ regs->pc = regs->npc;
+ regs->npc += 4;
+ return 1;
+}
diff --git a/arch/sparc/kernel/entry.h b/arch/sparc/kernel/entry.h
index 2eb2b0be90df..4911cfd07d60 100644
--- a/arch/sparc/kernel/entry.h
+++ b/arch/sparc/kernel/entry.h
@@ -15,6 +15,7 @@ void do_hw_interrupt(struct pt_regs *regs, unsigned long type);
void do_illegal_instruction(struct pt_regs *regs, unsigned long pc,
unsigned long npc, unsigned long psr);
int try_emulate_casa(struct pt_regs *regs, unsigned int insn);
+int try_emulate_div(struct pt_regs *regs, unsigned int insn);
void do_priv_instruction(struct pt_regs *regs, unsigned long pc,
unsigned long npc, unsigned long psr);
diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
index 69851b19766a..f9050dee0f1c 100644
--- a/arch/sparc/kernel/traps_32.c
+++ b/arch/sparc/kernel/traps_32.c
@@ -131,6 +131,9 @@ void do_illegal_instruction(struct pt_regs *regs, unsigned long pc, unsigned lon
if (!get_user(insn, (unsigned int __user *)pc)) {
if (try_emulate_casa(regs, insn))
return;
+ /* SuperSPARC traps divides wider than 52 bits. */
+ if (try_emulate_div(regs, insn))
+ return;
}
send_sig_fault(SIGILL, ILL_ILLOPC, (void __user *)pc, current);
--
2.47.3
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH 3/3] sparc32: emulate integer divide taken as illegal_instruction
2026-09-27 0:58 ` [PATCH 3/3] sparc32: emulate integer divide taken as illegal_instruction Imre Kaloz
@ 2026-09-27 21:25 ` Magnus Lindholm
0 siblings, 0 replies; 6+ messages in thread
From: Magnus Lindholm @ 2026-09-27 21:25 UTC (permalink / raw)
To: Imre Kaloz; +Cc: Andreas Larsson, sparclinux, David S. Miller, linux-kernel
Hi Imre,
Great to see some activity on sparc32, thanks for taking the time to do this.
On Sun, Sep 27, 2026 at 2:59 AM Imre Kaloz <kaloz@kernel.org> wrote:
>
> SuperSPARC and SuperSPARC-II implement a 52-bit by 32-bit integer divide
> and raise illegal_instruction for udiv and sdiv when the 64-bit dividend
> {Y, rs1} has significant bits above bit 51, as the SuperSPARC II
> Addendum documents, so whether a divide traps depends on its operands.
> gcc emits udiv under -mcpu=v8, including in libgcc's __udivdi3, so
> 64-bit division in user code on these CPUs dies with SIGILL.
>
> Complete udiv and sdiv, and their -cc forms, from
> do_illegal_instruction(), sharing the windowed-operand helpers with the
> casa emulation. A CPU that executes the instruction never reaches the
> handler, nor does a kernel-mode illegal instruction. A fault reading a
> windowed operand raises SIGSEGV, as the casa emulation does. On overflow
> the quotient saturates to 0xffffffff for udiv and to 0x7fffffff or
> 0x80000000 for sdiv, and the -cc forms set V, as the architecture
> specifies.
>
> Signed-off-by: Imre Kaloz <kaloz@kernel.org>
I stumbled upon the same issue trying to boot Linux on my SPARCstation, and
posted a fix for it on the 24th, same diagnosis, same saturating quotient and
condition-code handling, same window-flush-then-fetch structure:
https://lore.kernel.org/sparclinux/20260924205646.870950-1-linmag7@gmail.com/
Yours factors the windowed-operand helpers into div_emu_32.c so the casa
emulation can share them; mine keeps it in traps_32.c. Either does the job, so
I'll leave it to the maintainers which they'd rather take.
Regards
Magnus
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/3] sparc32: SMP futexes, casa and idiv emulation
2026-09-27 0:58 [PATCH 0/3] sparc32: SMP futexes, casa and idiv emulation Imre Kaloz
` (2 preceding siblings ...)
2026-09-27 0:58 ` [PATCH 3/3] sparc32: emulate integer divide taken as illegal_instruction Imre Kaloz
@ 2026-09-27 21:42 ` Magnus Lindholm
3 siblings, 0 replies; 6+ messages in thread
From: Magnus Lindholm @ 2026-09-27 21:42 UTC (permalink / raw)
To: Imre Kaloz; +Cc: Andreas Larsson, sparclinux, David S. Miller, linux-kernel
Hi Imre,
On Sun, Sep 27, 2026 at 2:59 AM Imre Kaloz <kaloz@kernel.org> wrote:
>
> sun4m has no compare-and-swap instruction and casa is optional on
> LEON, so SMP sparc32 has had no futexes, and user code on those CPUs
> has no CAS to build locks from.
>
> Patch 1 implements the futex atomic ops in atomic32.c and drops the
> !(SPARC32 && SMP) dependency of FUTEX. A LEON part that implements
> casa, found by a boot-time probe, runs casa on the user word; other
> CPUs take the __atomic_hash spinlocks.
>
> Patch 2 completes user casa from illegal_instruction on CPUs without
> it, through patch 1's futex_atomic_cmpxchg_inatomic(), so emulated
> casa and the futex ops serialize on the same lock. It is atomic
> against itself and against the futex ops, not against a plain store
> to the same word, so a C library using it has to do its atomic stores
> with casa too.
>
> Patch 3 completes udiv, sdiv and their -cc forms from the same
> do_illegal_instruction() dispatch: SuperSPARC and SuperSPARC-II trap
> those when the {Y, rs1} dividend has significant bits above bit 51,
> which gcc -mcpu=v8 output, including libgcc's __udivdi3, can produce.
> It shares patch 2's windowed-operand helpers and the dispatch block,
> which is why it comes last.
>
> Patch 1 comes first because patch 2 is built on it. On its own it
> races nothing: without patch 2, user casa on these CPUs is SIGILL.
>
> Magnus Lindholm has an independent RFC covering the same ground from
> a different ABI: "[RFC PATCH 0/5] sparc32: kernel assisted
> compare-and-swap, and futex on SMP" (patchwork sparclinux, Message-Id
> 20260923201830.865553-1-linmag7@gmail.com), with a companion glibc
> series (patchwork glibc, Message-Id
> 20260924064228.867909-1-linmag7@gmail.com). That RFC adds a new
> software trap, ta 0x11 (trap type 0x91), extending David Miller's
> 2016 CAS-trap prototype at ta 0x23 rather than completing it, so
> userspace has to be rebuilt to call it. This series instead
> completes the casa opcode itself, so a binary already emitting casa
> (gcc -mcpu=leon3 or -mcpu=v9 output, or a C library that encodes it
> as a .word) runs unmodified on a CPU without hardware casa, with no
> new trap number and no libc rebuild. Happy to share the futex and
> do_illegal_instruction() plumbing with whichever ABI lands.
>
For context on the userspace half: the glibc side of this was declined.
Adhemerval's position is that glibc will not carry arch-specific atomics again,
and that v8 support should come "first get the support on kernel, then add the
support on libgcc, and finally on glibc transparently through GCC atomic
builtins".
That goes against my ta 0x11 trap and in favour of completing casa: a new trap
number has to be taught to userspace, whereas an emulated casa lets libgcc and
glibc use plain __atomic builtins with no arch-specific code. Your series looks
like the better fit for what glibc actually asked for. I'm happy to
drop the trap
and help with the futex and do_illegal_instruction plumbing instead.
> Andreas: do LEON3FT parts want the GRLIB-TN-0010/0011 "nop; .balignl
> 16" alignment before the casa word here, or is the plain encoding as
> posted fine for them?
>
> Notes, not for the log:
>
> - checkpatch on patch 1: "Lines should not end with a '('" is the
> __asm__ __volatile__( idiom of uaccess_32.h; the -ENOSYS warning is
> the futex API's return for an unknown op, as on every architecture.
> "does MAINTAINERS need updating?" on patches 2 and 3 is covered by
> the F: arch/sparc/ entry.
> - On qemu's SS-20 with two SuperSPARCs and the casa emulation alone,
> futex() returns ENOSYS and musl's mutex, PI mutex and robust mutex
> tests fail. With patches 1 and 2 they pass, as does a PI lock
> contended between user casa and FUTEX_LOCK_PI/FUTEX_UNLOCK_PI on
> both CPUs.
> - The casa branch of the futex ops has not run on LEON hardware. The
> probe runs on LEON only; its fixup path, which a LEON without casa
> takes, has run only in a test kernel that forced the probe on
> qemu's SS-20.
> - The divide emulation has run on no CPU that traps it. No sparc32
> model in qemu raises the trap, and no SuperSPARC or SuperSPARC-II
> was available for this series; it is exercised only by build and
> link.
>
FWIW, I have access to both SuperSPARC or SuperSPARC-II hardware,
SS-10 and SS-20. I'd be happy to assist here with testing on real
hardware.
Magnus
> Imre Kaloz (3):
> sparc32: support futexes on SMP
> sparc32: emulate casa on V8 CPUs
> sparc32: emulate integer divide taken as illegal_instruction
>
> arch/sparc/include/asm/futex_32.h | 6 +-
> arch/sparc/kernel/Makefile | 2 +
> arch/sparc/kernel/cas_emu_32.c | 117 +++++++++++++++++++++++++++
> arch/sparc/kernel/div_emu_32.c | 127 ++++++++++++++++++++++++++++++
> arch/sparc/kernel/entry.h | 2 +
> arch/sparc/kernel/traps_32.c | 23 +++++-
> arch/sparc/kernel/unimp_32.h | 71 +++++++++++++++++
> arch/sparc/lib/atomic32.c | 122 ++++++++++++++++++++++++++++
> init/Kconfig | 1 -
> 9 files changed, Magnus468 insertions(+), 3 deletions(-)
> create mode 100644 arch/sparc/kernel/cas_emu_32.c
> create mode 100644 arch/sparc/kernel/div_emu_32.c
> create mode 100644 arch/sparc/kernel/unimp_32.h
>
>
> base-commit: 62f4c998b297cf233997a2b4cd6fc2d2df0319c9
> --
> 2.47.3
>
^ permalink raw reply [flat|nested] 6+ messages in thread