## Host environment - Operating system: Ubuntu 24.04.4 LTS in the project test harness for the QEMU runs; Debian 13 on the native RV64 host - Architecture: x86_64 emulator host; native riscv64 reference (multithreaded guest) - QEMU flavor: `qemu-riscv64` linux-user - QEMU versions: - baseline target: 11.0.50 - current build: 11.0.91 ## Emulated/Virtualized environment - Static RV64 Linux test ELF (two pthreads) under `qemu-riscv64` linux-user - RV64GCA (Zalrsc), `-cpu max` ## Description of the problem In QEMU linux-user, an AMO performed by one hart that stores the same numeric value (e.g. `amoswap.w` with the same value, `amoadd.w +0`, `amoor.w 0`, `amoxor.w 0`, `amoand.w -1`) does not invalidate the LR reservation held by another hart. A later `sc.w` from the reserving hart therefore succeeds and overwrites memory, while native RISC-V hardware always fails the SC and leaves memory unchanged. The RISC-V A-extension specification states: > The SC must fail if a store to the reservation set from another hart can > be observed to occur between the LR and SC. A competing AMO performs a real atomic store event even when the final value is numerically unchanged; the reservation must still be invalidated. Witnesses (all confirmed 3/3 on native RV64 hardware vs QEMU): - same-value `amoswap.w` / `amoswap.d` - `amoadd.w +0` - preserve-value family screen (`amoadd +0`, `amoswap same`, `amoor 0`, `amoxor 0`, `amoand -1`) for word and doubleword Native RV64 (native RISC-V hardware, Linux 6.6.63): the later SC fails, memory stays unchanged. QEMU 11.0.50 and 11.0.91: the later SC succeeds and overwrites the memory word. ## Expected behavior `sc.w`/`sc.d` must fail when any other hart performed a store (including an AMO with an unchanged value) to the reservation set between the LR and SC. In linux-user mode QEMU simulates multiple harts with multiple threads and must propagate store events from AMOs to all other threads' reservations. ## Steps to reproduce 1. Build the witness from the referenced issue body as a static RV64 ELF (two threads, shared cell). 2. Run it under QEMU: ```text ./qemu-riscv64 -cpu max ./witness.elf ``` 3. Observe `SC succeeded` (BAD); the same ELF on native RV64 prints `SC failed` and the memory cell stays unchanged. ## Additional context Root cause: `gen_amo`/`gen_lr`/`gen_sc` in `target/riscv/tcg/insn_trans/trans_rva.c.inc` implement SC as a host cmpxchg against `load_val`, and AMO store events are never propagated to other harts' `load_res` reservations. The attached experimental patch adds an `amo_invalidate_reservations` helper that walks all CPUs under RCU and clears matching reservations after a successful AMO store; it makes the word/doubleword screens pass, but a complete upstream fix should design the reservation-set linearization (the patch is provided as a starting point). ## Disclosure This issue was found with the assistance of automated differential testing tooling and LLM-assisted analysis. The results were independently validated by the reporter on native RV64 hardware and on two QEMU builds before submission. ## Attachments - [qemu-riscv-linux-user-lrw-scw-otherhart-preservevalue-amo-reservation.md](/uploads/364ed39dd83914008e832d44b6af22c6/qemu-riscv-linux-user-lrw-scw-otherhart-preservevalue-amo-reservation.md) - [0002-linux-user-riscv-invalidate-other-hart-reservations-.patch](/uploads/7e9fe873be402f0e6140fc90494ea38a/0002-linux-user-riscv-invalidate-other-hart-reservations-.patch)