linux-user: retry transient private futex faults

[wojiushixiaobai]

Fixes #87

[wojiushixiaobai]

root@debian:/opt/lat# cat /etc/os-release 
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
VERSION="13 (trixie)"
VERSION_CODENAME=trixie
DEBIAN_VERSION_FULL=13.6
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
root@debian:/opt/lat# uname -a
Linux debian 6.12.107+deb13-loong64 #1 SMP Debian 6.12.107-1 (2026-08-29) loongarch64 GNU/Linux

root@debian:/opt/lat# cat /usr/local/bin/steam 
#!/bin/sh
# Run Steam's x86 client through LATX with the compatible system runtime.
export STEAMOS=1
# Keep pressure-vessel's native bubblewrap outside the translated Steam
# runtime.  This wrapper adds the WebHelper workaround without modifying
# files that Steam's updater owns.
export PRESSURE_VESSEL_BWRAP=/usr/local/libexec/steam-bwrap
# The translated 32-bit client crashes in guest radeonsi without this.
export LIBGL_ALWAYS_SOFTWARE=1
# Chromium forks zygote, GPU and network utility processes.  Unlink the
# translator's cached VCPU chains before fork so each child re-execs cleanly.
export LATX_FORK_UNLINK=1

# Steam's WebHelper is sandboxed.  Do not allow a graphical launcher started
# through privilege/session wrappers to leak another user's D-Bus or audio
# sockets into that sandbox.
steam_uid=$(id -u)
if test -d "/run/user/${steam_uid}"; then
    export XDG_RUNTIME_DIR="/run/user/${steam_uid}"
fi
if test -S "${XDG_RUNTIME_DIR}/bus"; then
    export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"
fi
if test -S "${XDG_RUNTIME_DIR}/pulse/native"; then
    export PULSE_SERVER="unix:${XDG_RUNTIME_DIR}/pulse/native"
fi
exec /usr/bin/steam -cef-disable-gpu "$@"
root@debian:/opt/lat# cat /usr/local/libexec/steam-bwrap
#!/bin/sh
# Pressure-vessel invokes this wrapper as its bubblewrap implementation.
# LATX's binfmt registration retains the guest ELF fd, so CEF utility
# processes can use their normal sandbox and process model.
exec /usr/bin/bwrap "$@"

[baibaidashixiong]

4K页也有相同的问题，可以同时支持

[wojiushixiaobai]

由于我本地并没有 4k 内核的环境，我稍后重新提交一版再帮忙审查一下。

[baibaidashixiong]

新的commit中加了对pressure-vessel的支持，这里应该暂时不需要了

[wojiushixiaobai]

合并 #458 后 steam 无法启动，我检查下哪里缺失。

[baibaidashixiong]

直接STEAMOS=1 steam可以启动吗

[baibaidashixiong]

有复现环境吗？我目前的运行环境：
系统：aosc 13.3.1
runtime：runtime
steam安装包：官网下载
运行命令：STEAMOS=1 LATX_KZT=0 usr/bin/steam

[wojiushixiaobai]

有复现环境吗？我目前的运行环境： 系统：aosc 13.3.1 runtime：runtime steam安装包：官网下载 运行命令：STEAMOS=1 LATX_KZT=0 usr/bin/steam

Debian 13，没有使用 runtime 而是通过 dpkg --add-architecture 的方式添加 i386 和 amd64 架构安装所需的依赖。

cat > /etc/apt/sources.list.d/trixie.sources << "EOF"
Types: deb
# http://snapshot.debian.org/archive/debian/20260824T000000Z
URIs: http://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp

Types: deb
# http://snapshot.debian.org/archive/debian-security/20260824T000000Z
URIs: http://deb.debian.org/debian-security
Suites: trixie-security
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp
EOF

dpkg --add-architecture i386
dpkg --add-architecture amd64

# 修改 steam.deb DEBIAN/control 重新打包安装。

[baibaidashixiong]

我这暂时没有复现这个问题...

[baibaidashixiong]

可以先合fe9c44cfc7f51e8002454213bc36e631e3b0a347这个commit，后面两个commit先撤掉吧

[LaurenIsACoder]

感谢修复！我这边测到一个边界问题。

先 mmap 一个文件，再用 ftruncate(fd, 0) 把文件清空，之后对这个地址调用 private futex WAIT。原生 x86 返回 EFAULT，这版会返回 EAGAIN。我用同一个 i386 程序在 16K 页的 LoongArch 上测的，WAIT、WAIT_BITSET，以及 futex_time64 对应的两个调用都能复现。

问题应该就在 sanitize_private_futex_fault() 这里：文件清空了，PAGE_VALID | PAGE_READ 还在，但内容已经读不了了。这种情况再试也没用，还是应该返回 EFAULT。

复现程序放下面了，不需要 32 位 libc。

repro.c

/* Freestanding i386 regression: no guest libc or multilib headers needed. */
typedef unsigned int u32;
extern int sc(int nr, u32 a, u32 b, u32 c, u32 d, u32 e, u32 f);
__asm__(
    ".text\n.globl sc\nsc:\n"
    "push %ebp; push %edi; push %esi; push %ebx;\n"
    "mov 20(%esp), %eax; mov 24(%esp), %ebx;\n"
    "mov 28(%esp), %ecx; mov 32(%esp), %edx;\n"
    "mov 36(%esp), %esi; mov 40(%esp), %edi;\n"
    "mov 44(%esp), %ebp; int $0x80;\n"
    "pop %ebx; pop %esi; pop %edi; pop %ebp; ret;\n");
#define PTR(p) ((u32)(p))
static void say(const char *s)
{
    u32 n = 0;
    while (s[n]) { n++; }
    sc(4, 1, PTR(s), n, 0, 0, 0);
}
static void number(int n)
{
    char buf[16];
    unsigned int v = n < 0 ? -n : n;
    unsigned int i = sizeof(buf);
    do { buf[--i] = '0' + v % 10; v /= 10; } while (v);
    if (n < 0) { buf[--i] = '-'; }
    sc(4, 1, PTR(buf + i), sizeof(buf) - i, 0, 0, 0);
}
static void die(const char *s, int ret)
{
    say(s); number(ret); say("\n");
    sc(1, 2, 0, 0, 0, 0, 0);
    __builtin_unreachable();
}
void _start(void)
{
    const char path[] = "futex-truncate.data";
    const u32 len = 65536;
    const unsigned long long zero[2] = {0, 0};
    const int syscalls[2] = {240, 422}; /* futex, futex_time64 */
    const int ops[2] = {128, 137}; /* PRIVATE WAIT, PRIVATE WAIT_BITSET */
    int fd = sc(5, PTR(path), 0xc2, 0600, 0, 0, 0);
    if (fd < 0) { die("open: ", fd); }
    int ret = sc(10, PTR(path), 0, 0, 0, 0, 0);
    if (ret) { die("unlink: ", ret); }
    ret = sc(93, fd, len, 0, 0, 0, 0);
    if (ret) { die("ftruncate: ", ret); }
    u32 p = sc(192, 0, len, 3, 2, fd, 0); /* mmap2, RW, MAP_PRIVATE */
    if (p >= (u32)-4095) { die("mmap2: ", p); }
    ret = sc(93, fd, 0, 0, 0, 0, 0);
    if (ret) { die("truncate zero: ", ret); }
    int failed = 0;
    /* No userspace access to p: only the kernel reads the futex word. */
    for (u32 i = 0; i < 2; i++) {
        for (u32 j = 0; j < 2; j++) {
            ret = sc(syscalls[i], p, ops[j], 0, PTR(zero), 0, 0xffffffff);
            say("syscall="); number(syscalls[i]);
            say(" op="); number(ops[j]); say(" result="); number(ret);
            say(" expected=-14 "); say(ret == -14 ? "PASS\n" : "FAIL\n");
            failed |= ret != -14;
        }
    }
    sc(91, p, len, 0, 0, 0, 0);
    sc(6, fd, 0, 0, 0, 0, 0);
    sc(1, failed, 0, 0, 0, 0, 0);
    __builtin_unreachable();
}

在 x86 Linux 上编译：

gcc -m32 -nostdlib -static -fno-pie -no-pie -fno-stack-protector \
    -fno-builtin -O2 -Wall -Wextra -Werror repro.c -o repro
./repro

再把 repro 拷到 LoongArch，在可写目录里跑：

timeout 15s /path/to/latx-i386 ./repro

原生四项都返回 -14（EFAULT），这版的结果是：

syscall=240 op=128 result=-11 expected=-14 FAIL
syscall=240 op=137 result=-11 expected=-14 FAIL
syscall=422 op=128 result=-11 expected=-14 FAIL
syscall=422 op=137 result=-11 expected=-14 FAIL

我的想法是保留现在的锁和页检查，在锁内再确认一下这 4 字节能不能读，读到了才改成 EAGAIN。下面写了个用 process_vm_readv 的参考改法，避免直接解引用这个地址。

参考 diff

--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -11061,25 +11061,34 @@
      * The i386 lock-instruction interpreter transiently moves a complete
      * host page.  A private futex in that page can observe the short gap as
      * EFAULT, including when host and target pages are both 4 KiB.  The guest
-     * mapping metadata persists across that host-only move.  Check it under
-     * mmap_lock so unmapped or unreadable guest futex addresses retain
-     * EFAULT.  For a mapped private WAIT, return EAGAIN so userspace reloads
-     * the futex word and retries.
+     * mapping metadata persists across that host-only move.  Taking
+     * mmap_lock waits for relocation to finish.  Also probe the actual
+     * word: readable guest metadata can survive truncation of a mapped
+     * file.  Only a successful read permits returning EAGAIN.
      */
     if (ret != -TARGET_EFAULT || !(op & FUTEX_PRIVATE_FLAG)) {
         return ret;
     }
     base_op = op & FUTEX_CMD_MASK;
-    if (!h2g_valid(uaddr)) {
+    if ((base_op != FUTEX_WAIT && base_op != FUTEX_WAIT_BITSET) ||
+        !h2g_valid(uaddr)) {
         return ret;
     }
     mmap_lock();
     mapped = (page_get_flags(h2g(uaddr)) & (PAGE_VALID | PAGE_READ)) ==
              (PAGE_VALID | PAGE_READ);
+    if (mapped) {
+        uint32_t word;
+        struct iovec local = { .iov_base = &word, .iov_len = sizeof(word) };
+        struct iovec remote = { .iov_base = uaddr, .iov_len = sizeof(word) };
+
+        /* Let the kernel report inaccessible backing memory as an error. */
+        if (process_vm_readv(getpid(), &local, 1, &remote, 1, 0) ==
+            sizeof(word)) {
+            ret = -TARGET_EAGAIN;
+        }
+    }
     mmap_unlock();
-    if ((base_op == FUTEX_WAIT || base_op == FUTEX_WAIT_BITSET) && mapped) {
-        return -TARGET_EAGAIN;
-    }
 #endif
     return ret;
 }

不过这个改法我还没编译实测，process_vm_readv 在 Steam 沙箱里能不能用也得确认一下。错误返回已经复现了，具体怎么修可以再商量。