From nobody Tue Sep 22 14:55:35 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=linux.alibaba.com ARC-Seal: i=1; a=rsa-sha256; t=1784127386; cv=none; d=zohomail.com; s=zohoarc; b=VNv69Tfx2jnfwzn6PCFyivb0pcwcDCFc0hdrRyIgdvoPJfZof1R9UzRDqNz39taKLLWHLUVbhvzN4Z4druusLdYZ3x10EfcDuMvMRMzxxKlUnrQnonyDUr/cR9M+wT9rIfkRy3qe1faeb8fzNCtmJA1tYEvKOO2eAP88Iu0pqo4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784127386; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=M07UVfnU/2nidLWov/BOD//BB/HPNCPhrhQsGIpMnPg=; b=F/PN7+BiSjcTFRPJsGqGN0arPfRR420lWPq5BwpehwEe5IFR0bL24u7RNWC82ODXfWDcRRz/vLGaLJ7wf63WzjcnxcYKltdF9qgpudW9ibZ/fRQ7sXD8Ogc3+SQ8nWCRtf757AqgsDP2rakKR/J+UFq2S/muWxIWA6bNabK4rTE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784127386721918.6293250392115; Wed, 15 Jul 2026 07:56:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wk128-0006kK-7e; Wed, 15 Jul 2026 10:56:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wk11w-0006eN-Sk; Wed, 15 Jul 2026 10:56:13 -0400 Received: from [115.124.30.112] (helo=out30-112.freemail.mail.aliyun.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wk11m-00053J-1q; Wed, 15 Jul 2026 10:56:12 -0400 Received: from localhost.localdomain(mailfrom:zhiwei_liu@linux.alibaba.com fp:SMTPD_---0X79XjOP_1784127032 cluster:ay36) by smtp.aliyun-inc.com; Wed, 15 Jul 2026 22:50:32 +0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1784127347; h=From:To:Subject:Date:Message-Id:MIME-Version; bh=M07UVfnU/2nidLWov/BOD//BB/HPNCPhrhQsGIpMnPg=; b=u1Z8wbfksCdi9oozLWBHXkVORQGAiWXz87GlzhkhyZRD1BSBbx+LfhrSEZBlQlsnuzj6VUUOpX4pfbf+P0JYZExPYvaDj6x53FUmQzkXNqiy81gKJv5yG2BXbfT/WhD20yfjjpWrwoLNR+9OsXI0BnrS8Cgx6prO6RDHuKLq38M= X-Alimail-AntiSpam: AC=PASS; BC=-1|-1; BR=01201311R131e4; CH=green; DM=||false|; DS=||; FP=0|-1|-1|-1|0|-1|-1|-1; HT=maildocker-contentspam033037026112; MF=zhiwei_liu@linux.alibaba.com; NM=1; PH=DS; RN=11; SR=0; TI=SMTPD_---0X79XjOP_1784127032; From: LIU Zhiwei To: qemu-devel@nongnu.org Cc: palmer@dabbelt.com, alistair.francis@wdc.com, daniel.barboza@oss.qualcomm.com, chao.liu.zevorn@gmail.com, liwei1518@gmail.com, qemu-riscv@nongnu.org, LIU Zhiwei , Huang Tao , TANG Tiancheng , Daniel Henrique Barboza Subject: [PATCH v7 04/11] target/riscv: Integrate SMMPT checks into MMU and TLB fill Date: Wed, 15 Jul 2026 22:50:09 +0800 Message-Id: <20260715145016.17369-5-zhiwei_liu@linux.alibaba.com> X-Mailer: git-send-email 2.39.3 (Apple Git-146) In-Reply-To: <20260715145016.17369-1-zhiwei_liu@linux.alibaba.com> References: <20260715145016.17369-1-zhiwei_liu@linux.alibaba.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Host-Lookup-Failed: Reverse DNS lookup failed for 115.124.30.112 (deferred) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=115.124.30.112; envelope-from=zhiwei_liu@linux.alibaba.com; helo=out30-112.freemail.mail.aliyun.com X-Spam_score_int: -166 X-Spam_score: -16.7 X-Spam_bar: ---------------- X-Spam_report: (-16.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @linux.alibaba.com) X-ZM-MESSAGEID: 1784127388231158500 Content-Type: text/plain; charset="utf-8" With the core MPT lookup logic in place, this patch integrates the permission checks into QEMU's main MMU processing functions. A new helper, `get_physical_address_mpt`, is introduced to check the permissions for a given physical address against the MPT. This helper is then called at two critical points: 1. During page table walks (`get_physical_address`): The physical address of the Page Table Entry (PTE) itself is checked to ensure the supervisor has permission to read it. 2. After successful address translation (`riscv_cpu_tlb_fill`): The final guest-physical address is checked against the MPT before the access is allowed to proceed. This ensures that SMMPT protection is enforced for both the translation process and the final memory access, as required by the specification. Co-authored-by: Huang Tao Co-authored-by: TANG Tiancheng Signed-off-by: LIU Zhiwei Reviewed-by: Daniel Henrique Barboza Reviewed-by: Chao Liu --- target/riscv/tcg/cpu_helper.c | 113 ++++++++++++++++++++++++++++++---- 1 file changed, 100 insertions(+), 13 deletions(-) diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c index 354506c565..e3aac26931 100644 --- a/target/riscv/tcg/cpu_helper.c +++ b/target/riscv/tcg/cpu_helper.c @@ -976,6 +976,53 @@ static bool check_svukte_addr(CPURISCVState *env, vadd= r addr) return !high_bit; } =20 +/* + * get_physical_address_mpt - check mpt permission for this physical addre= ss + * + * Lookup the Memory Protection Table and check permission for this + * physical address. Returns 0 if the permission checking was successful + * + * @env: CPURISCVState + * @prot: The returned protection attributes + * @addr: The physical address to be checked permission + * @access_type: The type of MMU access + * @mode: Indicates current privilege level. + */ +static int get_physical_address_mpt(CPURISCVState *env, int *prot, hwaddr = addr, + MMUAccessType access_type, int mode) +{ + /* + * If the extension is not supported or the mmpt.mode is Bare, + * there is no protection, return success. + */ + if (!riscv_cpu_cfg(env)->ext_smmpt || env->mptmode =3D=3D SMMPTBARE) { + *prot =3D PAGE_READ | PAGE_WRITE | PAGE_EXEC; + return TRANSLATE_SUCCESS; + } + + /* + * MPT is checked for all accesses to physical memory, unless the + * effective privilege mode is M. + * + * Data accesses in M-mode when the MPRV bit in mstatus is set and + * the MPP field in mstatus contains S or U are subject to MPT checks. + * + * In riscv_env_mmu_index, The MPRV and MPP bits are already checked a= nd + * encoded to mmu_idx, So we do not need to check it here. + */ + if (mode =3D=3D PRV_M) { + *prot =3D PAGE_READ | PAGE_WRITE | PAGE_EXEC; + return TRANSLATE_SUCCESS; + } + + if (!smmpt_check_access(env, addr, prot, access_type)) { + *prot =3D 0; + return TRANSLATE_MPT_FAIL; + } + + return TRANSLATE_SUCCESS; +} + /* * get_physical_address - get the physical address for this virtual address * @@ -1174,6 +1221,13 @@ static int get_physical_address(CPURISCVState *env, = hwaddr *physical, pte_addr =3D base + idx * ptesize; } =20 + int mpt_prot; + int mpt_ret =3D get_physical_address_mpt(env, &mpt_prot, pte_addr, + MMU_DATA_LOAD, PRV_S); + if (mpt_ret !=3D TRANSLATE_SUCCESS) { + return mpt_ret; + } + int pmp_prot; int pmp_ret =3D get_physical_address_pmp(env, &pmp_prot, pte_addr, sxlen_bytes, @@ -1657,7 +1711,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, = int size, CPURISCVState *env =3D &cpu->env; vaddr im_address; hwaddr pa =3D 0; - int prot, prot2, prot_pmp; + int prot, prot2, prot_pmp, mpt_prot; bool pmp_pma_violation =3D false; bool first_stage_error =3D true; bool two_stage_lookup =3D mmuidx_2stage(mmu_idx); @@ -1710,26 +1764,42 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address= , int size, prot &=3D prot2; =20 if (ret =3D=3D TRANSLATE_SUCCESS) { - ret =3D get_physical_address_pmp(env, &prot_pmp, pa, - size, access_type, mode); - tlb_size =3D pmp_get_tlb_size(env, pa); + ret =3D get_physical_address_mpt(env, &mpt_prot, pa, + access_type, mode); + if (riscv_cpu_cfg(env)->ext_smmpt) { + qemu_log_mask(CPU_LOG_MMU, + "%s MPT address=3D" HWADDR_FMT_plx " ret= %d" + " prot %d\n", + __func__, pa, ret, mpt_prot); + } + prot &=3D mpt_prot; =20 - qemu_log_mask(CPU_LOG_MMU, - "%s PMP address=3D" HWADDR_FMT_plx " ret %d = prot" - " %d tlb_size %" HWADDR_PRIu "\n", - __func__, pa, ret, prot_pmp, tlb_size); + if (ret =3D=3D TRANSLATE_SUCCESS) { + ret =3D get_physical_address_pmp(env, &prot_pmp, pa, + size, access_type, mode= ); + tlb_size =3D pmp_get_tlb_size(env, pa); + + qemu_log_mask(CPU_LOG_MMU, + "%s PMP address=3D" HWADDR_FMT_plx + " ret %d prot %d tlb_size %" + HWADDR_PRIu "\n", + __func__, pa, ret, prot_pmp, + tlb_size); =20 - prot &=3D prot_pmp; + prot &=3D prot_pmp; + } } else { /* * Guest physical address translation failed, this is a HS * level exception */ first_stage_error =3D false; - if (ret !=3D TRANSLATE_PMP_FAIL) { + if (ret !=3D TRANSLATE_PMP_FAIL && + ret !=3D TRANSLATE_MPT_FAIL) { env->guest_phys_fault_addr =3D (im_address | (address & - (TARGET_PAGE_SIZE - 1))= ) >> 2; + (TARGET_PAGE_SIZE - 1))) + >> 2; } } } @@ -1744,6 +1814,18 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address,= int size, HWADDR_FMT_plx " prot %d\n", __func__, address, ret, pa, prot); =20 + if (ret =3D=3D TRANSLATE_SUCCESS) { + ret =3D get_physical_address_mpt(env, &mpt_prot, pa, + access_type, mode); + if (riscv_cpu_cfg(env)->ext_smmpt) { + qemu_log_mask(CPU_LOG_MMU, + "%s MPT address=3D" HWADDR_FMT_plx " ret %d" + " prot %d\n", + __func__, pa, ret, mpt_prot); + } + prot &=3D mpt_prot; + } + if (ret =3D=3D TRANSLATE_SUCCESS) { ret =3D get_physical_address_pmp(env, &prot_pmp, pa, size, access_type, mode); @@ -1757,8 +1839,13 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address,= int size, prot &=3D prot_pmp; } } - - if (ret =3D=3D TRANSLATE_PMP_FAIL || ret =3D=3D TRANSLATE_PMA_FAIL) { + /* + * Both MPT (Machine-level Memory Protection Table, Smmpt extension) a= nd + * PMP (Physical Memory Protection) follow the same exception reporting + * rule when an access violation is detected + */ + if (ret =3D=3D TRANSLATE_PMP_FAIL || ret =3D=3D TRANSLATE_PMA_FAIL || + ret =3D=3D TRANSLATE_MPT_FAIL) { pmp_pma_violation =3D true; } =20 --=20 2.43.0