Paul Floyd [Mon, 2 Mar 2026 20:12:13 +0000 (21:12 +0100)]
FreeBSD syscall: clean up sigwait wrapper
This is another that returns 0 / errno code. The POST was already
doing the right thing. Changed the PRE to always set SfMayBlock
rather than only if ARG1 is safe to dereference.
Paul Floyd [Mon, 2 Mar 2026 19:15:32 +0000 (20:15 +0100)]
Bug 516748 - clock_nanosleep was also wrong
clock_nanosleep returns 0 or an errno error code, not 0/-1 and it does not set errno.
The code was copied and pasted from Linux which does return 0/-1.
That means that the POST only needs a POST_MEM_WRITE for ARG4 if
the remainder timespec pointer is not NULL and RES is EINTR.
The error flag is not set so the syscall appears to have succeeded.
Paul Floyd [Fri, 27 Feb 2026 20:26:23 +0000 (21:26 +0100)]
Clean up setting carry flag in VG_(fixup_guest_state_after_syscall_interrupted)
This wasn't consistent (not at all for Darwin, not checking SfNoWriteResult
on Solaris and a bit long winded on FreeBSD). Simplify the code for all
3 platforms.
Paul Floyd [Fri, 20 Feb 2026 21:26:40 +0000 (22:26 +0100)]
Solaris debuglog: fix clobber list for local_sys_write_stderr
There were no registers in the clobber list. RDI is clobbered by the
value 2 for stderr. So back in 'add_to_buf' the next character to
be added to the VG_(debugLog) buffer was getting clobbered with a 2.
Also clobber RCX and R11 (syscall scratch registers).
Add support for the vector instructions VD, VDL, VR, and VRL. These
perform integer division and remainder operations for lane widths of 32,
64, and 128 bits.
For lane widths up to 64 bit emulate them with existing instructions, by
handling each lane individually. Also emulate the masking of bad
divisions when the "integer-divide control" bit is set.
For 128-bit integers exploit the new instructions in the emitted code,
since no previous instructions can perform the required calculations, and
emulation would be quite expensive. Represent the operations in IR with
the existing Iop_DivS128, Iop_DivU128, Iop_ModS128, and Iop_ModU128, and
handle those in host_s390_isel.c appropriately.
This concludes vector-enhancements facility 3 support, so set facility bit
198 on CPUs that have the facility installed.
So far the instructions VCEQ, VMAH, VMALH, VCH, and VCHL had been
implemented with the use of dirty helpers. Replace this by full
emulation. In particular, now generate IR that calculates the resulting
condition code of VCEQ, VCH, and VCHL. Since that calculation works the
same for VCEQ, VCH, and VCHL, move it to a new helper routine,
s390_V128_setcc_for_cmp().
Add more routines for common logic where appropriate, such as
s390_V128_add(), s390_V128_CmpGTU(), etc. This results in code changes
for some instructions that are not touched by the new facility, such as VA
and VREPI.
Since the new support results in fewer specification exceptions, adjust
disasm-test accordingly.
Andreas Arnez [Thu, 19 Feb 2026 13:44:17 +0000 (14:44 +0100)]
Bug 503238 - s390x: Support misc.-instruction-extensions facility 4
Enable Valgrind to provide the "miscellaneous-instruction-extensions
facility 4", which is first introduced in IBM z17 CPUs and may be
exploited by the compiler when specifying `march=z17'.
In particular, the following new instructions are added:
* BDEPG and BEXTG -- "bit deposit" and "bit extract"
* CLZG and CTZG -- "count leading/trailing zeros"
* LXAB, LLXAB, LXAH, LLXAH, LXAF, LLXAF, LXAG, LLXAG, LXAQ, and LLXAQ --
"load indexed" and "load logical indexed" with various element sizes
The new instructions are fully emulated. Still, as usual, Valgrind will
only set the respective facility bit on CPUs that have the bit set
themselves.
Florian Krohm [Tue, 17 Feb 2026 19:32:53 +0000 (19:32 +0000)]
s390: Use Iop_PopCount64 and emit "popcnt" insn when possible
This requires the miscellaneous-instruction-extensions facility 3.
Detect it in m_machine.c, test for it in s390x_features.c.
Add VEX_HWCAPS_S390X_MI3, s390_host_has_mi3 and S390_INSN_POPCNT.
New functions s390_insn_popcnt and s390_insn_popcnt_emit and s390_emit_POPCNT.
New testcase popcnt-mi3.c carved out of misc3.c
Mark Wielaard [Sat, 14 Feb 2026 20:36:47 +0000 (21:36 +0100)]
Replace which and type with command -v
which is an external (csh) command which might not be available. type
is a bourn shell builtin, but not necessarily available outside bash.
Use command -v which is POSIX and should work everywhere.
Paul Floyd [Sat, 14 Feb 2026 15:57:45 +0000 (16:57 +0100)]
Solaris regtest: make Solaris specific procfs-cmdline-exe.c
Use /proc/pid_or_self/path/a.out rather than /proc/pid_or_self/exe
as in the parent directory.
I'm going to split this test into versions for each platform,
Darwin (with no /proc) can use the Linux one. FreeBSD optionally
has /proc but uses currproc instead of self.
Paul Floyd [Sat, 14 Feb 2026 15:12:21 +0000 (16:12 +0100)]
Solaris syswrap: make handle_auxx_open a static function
handle_psinfo_open and handle_cmdline_open are Solaris statics but
ML_(handle_auxv_open) was shared between Linux and Solaris. There is
some common code but I find it less confusing to have all 3 statics
in the same place for Solaris.
Paul Floyd [Sat, 14 Feb 2026 13:22:18 +0000 (14:22 +0100)]
Solaris syscall wrapper: add procfs cmdline sp[ecial handling to sys_open
Generally it seems that older Solaris (11.3) and OpenIndiana use 'old'
sys_open and do not have procfs cmdline. Newer Solaris (11.4) uses
sys_openat and has procfs cmdline.
OmniOS mixes both, it uses old sys_open and has procfs cmdline.
Andreas Arnez [Fri, 13 Feb 2026 16:12:00 +0000 (17:12 +0100)]
s390x: Rename s390_format_VRR*() functions
After having renamed most of the s390_format_*() functions to match the
names in the z/Architecture Principles of Operation, the last remaining
format functions yet to be renamed are the ones dealing with variants of
the VRR format.
Note that none of these directly cover the VISTR instruction. But that
can be treated as the VRRa format, where m4 is left unused. So do that
and remove s390_VRR_VVMM(), which previously existed just for this
purpose.
Also, adjust the names of the VRR*() macros to match the format names.
Drop VRRa_v*() and VRRd_v*() and use VRR_v*() instead, since the vector
fields' positions don't depend on the VRR format variant.
Andreas Arnez [Fri, 13 Feb 2026 11:38:52 +0000 (12:38 +0100)]
s390x: Simplify interface of non-vector insn format functions
Each of the format functions in the translator provides common logic for
handling a specific instruction format. So far a format function's
interface is defined such that it receives instruction operands as
individual arguments.
This means that the extraction of operands from the opcode -- despite
being common for all invocations of the same format function -- is
duplicated every time. This is error-prone, results in longer code
overall, and makes the invocations more difficult to read.
The code duplication can be avoided by moving the operand extraction to
the format functions themselves.
Martin Cermak [Fri, 13 Feb 2026 11:26:52 +0000 (12:26 +0100)]
Update the LTP version in valgrind testsuite to v20260130
Update the LTP version in valgrind testsuite to v20260130.
All patches from auxprogs/ltp-patches were accepted by LTP
upstream and included in the release, so these can now be
dropped locally.
Andreas Arnez [Tue, 10 Feb 2026 11:57:48 +0000 (12:57 +0100)]
s390x: Fix handling of KIMD-GHASH
The KIMD-GHASH function of the "compute intermediate message digest"
instruction is missing from the list returned by KIMD-Query, because the
appropriate bit is set in the wrong field of the returned array. Fix
this.
This causes something to end up in stderr.out in regression tests.
There is a filter for it, but that does not apply to tests like
iropt-test that really expect no output and have no stderr filter.
Paul Floyd [Sun, 8 Feb 2026 16:57:30 +0000 (17:57 +0100)]
FreeBSD reallocarray: behaves like realloc on allocation failure
It was behaving like reallocf which frees the ptr if the allocation
fails. That's wrong, it behaves like realloc which does not free
ptr. Updated the one regression test.
I also noticed that the error message always mentions realloc
even for reallocf and reallocarray.
Mark Wielaard [Fri, 6 Feb 2026 12:57:24 +0000 (13:57 +0100)]
Sanity check VG_(realpath) and VG_(readlink) return values
When VG_(realpath) calls VG_(readlink) it failed to check if
VG_(readlink) succeeds, possibly writing to tmp[-1] (on the stack). It
also didn't check the getcwd syscall succeeded, which would cause the
resolved name to start with undefined bits (from the stack).
VG_(data_size) was using too small a (stack) buffer for the
VG_(realpath) call and didn't check whether the call actually
succeeded.
At startup initimg-{darwin,freebsd,linux,solaris} also didn't check
VG_(realpath) would resolve before setting VG_(resolved_exename) to
possibly random bits on the stack. Fix that by using the (unresolved)
exe_name in those cases.
Florian Krohm [Thu, 5 Feb 2026 17:39:49 +0000 (17:39 +0000)]
s390: Change s390_disasm and tweak specification exception message
s390_disasm now returns a pointer to the disassembled insn string or NULL.
A new parameter controls whether the mnemonic should be padded with blanks
to the max. insn length.
When reporting a specification exception also write out the disassembled insn.
Florian Krohm [Wed, 4 Feb 2026 22:34:30 +0000 (22:34 +0000)]
s390: Fix s390_irgen_VGE[FG] and s390_irgen_VSCE[FG]
Instead of creating a specification exception these run into an assertion:
VEX: s390_vr_offset_by_index: invalid index for given type
There are proper s390_insn_assert in s390_irgen_VGEF etc. However, the
vassert happens in s390_format_VRV --> get_vr --> s390_vr_offset_by_index
prior to s390_irgen_... being called.
Fixed by adding s390_insn_assert to s390_format_VRV.
Add decode_sse4_blend_imm which allows to reuse BLENDPD decoder code
for BLENDPS and PBLENDW. Moved math_BLENDPS_128, math_PBLENDW_128
and math_PBLENDVB_128 from VEX/priv/guest_amd64_toIR.c
to VEX/priv/guest_generic_sse.h to be able to reuse existing amd64 code
for x86 implementation.
Moved test_BLENDPS and test_PBLENDW from none/tests/amd64/sse4-64.c to
none/tests/sse4-common.h and updated the expected tests output to match
the new implementation. Removed vassert(0) in VEX/priv/host_x86_defs.c
in push_word_from_tags in order for test_PBLENDW to be able to pass.
Florian Krohm [Wed, 4 Feb 2026 16:03:30 +0000 (16:03 +0000)]
s390: The 2nd coming of disasm-test
With the advent of objdump-based disassembly there is no need anymore to
ensure that the disassembled insns out of valgrind match those from objdump.
This is now correct by construction.
In this patch the disasm-test functionality is changed to ensure that all
expected specification exceptions as specified in the Principles of
Operations are detected and no unexpected specification exceptions are found.
For a given opcode 2 sets of testcases will now be generated:
- one where every insn causes a specification exception
This catches missed specification exceptions.
- one where no insn causes a specification exception
This catches unexpected specification exceptions.
Changes:
Remove command line options --generate and --verify. Those were useful
in the early stages of development but not anymore.
Remove command line options --show-spec-exc and --no-show-miscompares
which are obsolete now.
Replace command line option --check-prereq with --check-march=ARCH.
Remove command line option --all-except-exrl. Add --exclude option which
is more general.
Add command line options --spec-exc and --no-spec-exc.
Remove functions check_objdump and disasm_same.
From verify_stats remove num_mismatch and num_verified members.
Rename verify_stats --> test_stats and add num_generated member.
Rename verify_disassembly --> verify_spec_exceptions.
No longer write .vex file. Write .spec-exc file instead.
Factor out functions run_opcode and choose_int_and_iterate.
New functions asm_detects_spec_exc and insn_bytes_as_string.
Opcode table in opcode.c:
- Remove all constraints that do not cause a specification exception.
- Change modelling of the "Rotate and ...." opcodes. Previously the
i3, i4 and i5 fields are modelled as masks. That was a work-around in
order to be able to specify interesting values and is no longer
needed. Model those fields as integers instead.
Update disasm-test.vgtest.
Update README.
Copyright year updated.
Mark Wielaard [Tue, 3 Feb 2026 18:28:46 +0000 (19:28 +0100)]
Fix asserts in testcases close_range, bug514094 and readlinkat_self.
These tests did an assert (errno = EFAULT) instead of an assert on
errno == EFAULT. close_range was also using an valid flag 2
(CLOSE_RANGE_UNSHARE) instead of a bad one.
Paul Floyd [Thu, 29 Jan 2026 19:32:05 +0000 (20:32 +0100)]
More warning cleanup
Fix a cast from volatile that has been bothering me for a while.
Also a warning dur to some Darwin code that reuses a ULong
for a memory address. That causes a warning on 32bits because
pointers are 32bit but ULong is always 64bit.
Paul Floyd [Wed, 28 Jan 2026 12:38:39 +0000 (13:38 +0100)]
Bug 514613 again (closing </still_reachable> xml tag)
Always close the tag after the heuristic details.
Add 4 testcases, one with no errors, one with a simple leak,
one with a simple reachable and one "Xmas tree" test (in
reference to the TCP/IP Christmas tree packet
https://en.wikipedia.org/wiki/Christmas_tree_packet). That
has most of the errors that memcheck can produce.
Florian Krohm [Thu, 22 Jan 2026 20:03:37 +0000 (20:03 +0000)]
s390: Merge s390_format_VRS_VRDV and s390_format_VRS_VRDVM
Add unused m4 parameter to s390_irgen_VLM / _VSTM. That way we no longer need
to distinguish between s390_format_VRS_VRDV and s390_format_VRS_VRDVM.
Rename remaining function to s390_format_VRSa and use it throughout.
Florian Krohm [Thu, 22 Jan 2026 17:05:42 +0000 (17:05 +0000)]
s390: Merge s390_format_VRX_VRRDM and s390_format_VRX_VRRD
Add unused m3 parameter to s390_irgen_VL / _VST. That way we no longer need
to distinguish between s390_format_VRX_VRRDM and s390_format_VRX_VRRD.
Rename remaining function to s390_format_VRX and use it throughout.
Add field access macros for formats RRFa, RRFb, RRFc, RRFd and RRFe
as per Principles of Ops.
Add field access macros RRD_r1, RRD_r2, RRD_m3.
Remove field access macros RRF_..., RRF2_..., RRF3_..., RRF4_... and RRF5_...
Support blendpd (Blend Packed Double Precision Floating-Point
Values (XMM)) instruction in guest_x86_toIR.c. To be able to
use amd64 math_BLENDPD_128 function for x86 implementation, add
a new VEX/priv/guest_generic_sse.h header and move math_BLENDPD_128
there.
mkV128() was moveda from line 1671 in guest_amd64_toIR.c to line 295,
grouping it with other mkU* constant-creation helpers (mkU8, mkU16,
mkU32, mkU64). This allows guest_generic_sse.h to be included much
earlier (line 300 vs. line 1676), making the code organization more
natural.
The header includes an explaination why it must be included mid-file
(after IR helpers like newTemp, assign, binop, etc. are defined) and
why those helpers cannot be moved to a shared header (they depend on
file-local global state, particularly the 'irsb'
variable).
Add test function to sse4-common.h and update none/tests/x86/sse4-x86.c
to test the instruction.