From 8d98feef820278a43c50bf5a5bf01281fe661a23 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Tue, 26 May 2026 21:41:54 -0400
Subject: [PATCH 1/2] mips: tighten Penguin hypercall match

---
 target/mips/tcg/translate.c | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index c855c75ec4..6e5ebcd667 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -2722,7 +2722,7 @@ static void gen_cond_move(DisasContext *ctx, uint32_t opc,
 {
     TCGv t0, t1, t2;
 
-    if (rd == 0) {
+    if (opc == OPC_MOVZ && rd == 0 && rs == 0 && rt == 0) {
         gen_helper_penguin_guest_hypercall(cpu_gpr[2], tcg_env,
                                            cpu_gpr[2], cpu_gpr[4],
                                            cpu_gpr[5], cpu_gpr[6],
@@ -8521,13 +8521,6 @@ static void gen_cp0(CPUMIPSState *env, DisasContext *ctx, uint32_t opc,
     check_cp0_enabled(ctx);
     switch (opc) {
     case OPC_MFC0:
-        if (rt == 0) {
-            gen_helper_penguin_guest_hypercall(cpu_gpr[2], tcg_env,
-                                               cpu_gpr[2], cpu_gpr[4],
-                                               cpu_gpr[5], cpu_gpr[6],
-                                               cpu_gpr[7], tcg_constant_tl(0));
-            return;
-        }
         gen_mfc0(ctx, cpu_gpr[rt], rd, ctx->opcode & 0x7);
         opn = "mfc0";
         break;

From a3734fe9322462846aba633c5e524387a7c08c89 Mon Sep 17 00:00:00 2001
From: Luke Craig <lacraig3@gmail.com>
Date: Tue, 26 May 2026 21:58:45 -0400
Subject: [PATCH 2/2] penguin: tighten remaining hypercall matches

---
 hw/i386/pc.c                                      | 2 +-
 target/i386/kvm/kvm.c                             | 8 ++++----
 target/loongarch/tcg/insn_trans/trans_extra.c.inc | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index dc909f7735..ffd80ed7a4 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -225,7 +225,7 @@ static void ioport88_write(void *opaque, hwaddr addr, uint64_t data,
     CPUX86State *env;
     uint64_t ret = 0;
 
-    if (!cs || qtest_enabled()) {
+    if (size != 4 || !cs || qtest_enabled()) {
         return;
     }
 
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 0db50da68a..d5027ff7db 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -6564,12 +6564,12 @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
 
     switch (run->exit_reason) {
     case KVM_EXIT_IO:
-        if (run->io.port == 0x88 && run->io.direction == KVM_EXIT_IO_OUT) {
+        if (run->io.port == 0x88 &&
+            run->io.direction == KVM_EXIT_IO_OUT &&
+            run->io.size == 4) {
             uint64_t nr = 0;
 
-            if (run->io.size == 4) {
-                nr = *(uint32_t *)((uint8_t *)run + run->io.data_offset);
-            }
+            nr = *(uint32_t *)((uint8_t *)run + run->io.data_offset);
 
             CPUX86State *env;
             uint64_t ret_val = 0;
diff --git a/target/loongarch/tcg/insn_trans/trans_extra.c.inc b/target/loongarch/tcg/insn_trans/trans_extra.c.inc
index cdba18e5b4..61f1bd5c6d 100644
--- a/target/loongarch/tcg/insn_trans/trans_extra.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_extra.c.inc
@@ -83,7 +83,7 @@ static bool trans_cpucfg(DisasContext *ctx, arg_cpucfg *a)
 
     gen_helper_cpucfg(dest, tcg_env, src1);
     gen_set_gpr(a->rd, dest, EXT_NONE);
-    if (a->rd == 0) {
+    if (a->rd == 0 && a->rj == 0) {
         TCGv ret = tcg_temp_new();
         gen_helper_penguin_guest_hypercall(ret, tcg_env,
                                            gpr_src(ctx, 11, EXT_NONE),