<!--This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, ensure this ticket is marked 'confidential' before submission. See https://www.qemu.org/contribute/security-process/ for additional guidance--> ## Host environment - Operating system: MacOS - OS/kernel version: <!--For POSIX hosts, use `uname -a`--> - Architecture: ARM - QEMU flavor: qemu-aarch64 - QEMU version: qemu-aarch64 11.1.50, git 3375621e78 (master, 2026-08-21) - Architecture: ARM64 aarch64-linux-user ## Description of problem A retry loop that stores to the reserved address between the load-exclusive and the store-exclusive never terminates under \`qemu-aarch64\`. The same binary on a real Cortex-A72 finishes on the first attempt. Disclosure: OpenAI Codex (LLM agent) assisted with investigating the discrepancy. Reported QEMU and real-hardware tests were run and verified by me. [livelock.c](/uploads/b18a61ad54c8d764cd71cd2e9bdbd2cd/livelock.c) ## Steps to reproduce <!--Note: if this issue was discovered with the assistance of automated tooling LLM, static analysis, fuzzers), the reporter must disclose that in the description. The steps to reproduce, and any other findings, must be fully validated by the user of the tool prior to submission.--> ## Additional information ```c #include <stdio.h> #include <stdint.h> #define CAP 1000000 static uint64_t buf[8] __attribute__((aligned(64))); /* retry loop with an ordinary store to the reserved address */ static long own_store(void) { uint32_t res = 1; long tries = 0; uint64_t v; while (res != 0 && tries < CAP) { __asm__ volatile("ldxr %0, [%1]" : "=r"(v) : "r"(buf) : "memory"); buf[0] = v + 1; __asm__ volatile("stxr %w0, %1, [%2]" : "=&r"(res) : "r"(v), "r"(buf) : "memory"); tries++; } __asm__ volatile("clrex" ::: "memory"); return res == 0 ? tries : -tries; } /* same loop without the store, as a control */ static long clean(void) { uint32_t res = 1; long tries = 0; uint64_t v; while (res != 0 && tries < CAP) { __asm__ volatile("ldxr %0, [%1]" : "=r"(v) : "r"(buf) : "memory"); __asm__ volatile("stxr %w0, %1, [%2]" : "=&r"(res) : "r"(v), "r"(buf) : "memory"); tries++; } return res == 0 ? tries : -tries; } int main(void) { long a = clean(), b = own_store(); printf("clean loop : %ld\n", a); printf("loop with store : %ld (negative = never succeeded)\n", b); return 0; } ``` <!--The line below ensures that proper tags are added to the issue. Please do not remove it.-->