From nobody Fri Oct 23 21:33:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=univ-grenoble-alpes.fr ARC-Seal: i=1; a=rsa-sha256; t=1792655625; cv=none; d=zohomail.com; s=zohoarc; b=ixE0w2zcSt7YtrWn0mJqKZ7RroRou+Kunp2Pz/NoNcoa1T5zbGXjJsPpKicY4AQKAY5yFe+MWRcaGOm5AdX61aL5r1/OsepI3YxIhz9dJ/2qYzzeFahcFpDzjBXYa7T84FG7Fr6iY/TAohqkCeA4GY7N30sEusAaPZ21p757Ah8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792655625; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=mAQggYb9rx3ENcIlxScTPVY6twgHrRbXCh7D47asnxM=; b=NbFSst8yVN1YF9js/q6sUnBzjz90s148cneVTogNwmmnKQIM2T1AxHicXVC/ifaIyfRfxmlj4So9a/xeuIKnhJjDq05uqO40gbHpj+pe9F4BSUwH0IXpwi/5KPsOYod18h0+RTuVwZNkBBP5Pb9OeD2t5SJPLy3LLO4bmPrxg1w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792655625437695.4660069508164; Thu, 22 Oct 2026 00:53:45 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJnbT-0003VP-3g; Thu, 22 Oct 2026 03:52:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJnbH-0003Ta-U9; Thu, 22 Oct 2026 03:52:36 -0400 Received: from zm-mta-out-3.u-ga.fr ([152.77.200.56]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJnbD-0003Cs-UD; Thu, 22 Oct 2026 03:52:35 -0400 Received: from mailhub-2.u-ga.fr (mailhub-2.u-ga.fr [129.88.178.102]) by zm-mta-out-3.u-ga.fr (Postfix) with ESMTP id 9F1CD4027D; Thu, 22 Oct 2026 09:52:28 +0200 (CEST) Received: from smtps.univ-grenoble-alpes.fr (smtps3.u-ga.fr [195.83.24.62]) by mailhub-2.u-ga.fr (Postfix) with ESMTP id 996A4FF856; Thu, 22 Oct 2026 09:52:28 +0200 (CEST) Received: from naga.home (88-170-236-106.subs.proxad.net [88.170.236.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: petrotf@univ-grenoble-alpes.fr) by smtps.univ-grenoble-alpes.fr (Postfix) with ESMTPSA id 382534004A; Thu, 22 Oct 2026 09:52:28 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=univ-grenoble-alpes.fr; s=2020; t=1792655548; bh=9iLVwWFckkLO/M4oIrOHE9dO6Xn8zkBqYYU1VXpPTXU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=3fWYTju3ehkV2/K67BAtvlYDxGb/VAamAqEspwdd0ufOuezL/QXO1Za58Vplhmr0V ASoAH/D5yevlWeBmnKfJhABxMx1PAl9AESkLxJ+8qqzgIOZXB7hnTYIVjSy7wlNlcs xYkM1NAtda1fnnNrhMNCxKAP3AnPbcTbH6MzEbx79wyWfZke5f9qKiD0ib5aiYEjha NLPhDWs86y4c4BJqF6e/sWndouWLzF6J0G0sZ2yHGGayqbVc1db1o5ivBtVJ6+Bwkx d+vwaUbwII+TEM6nzGYBXqS74gTVKn+tuTF2ZWVG1Vd00Bz5fdJJnmU/mOkEuJsb2i Uh2e0ZzCWgU4w== From: frederic.petrot@univ-grenoble-alpes.fr To: peter.maydell@linaro.org, daniel.barboza@oss.qualcomm.com, palmer@dabbelt.com, alistair.francis@wdc.com, liwei1518@gmail.com, zhiwei_liu@linux.alibaba.com, chao.liu@processmission.com, qemu-riscv@nongnu.org, qemu-devel@nongnu.org Cc: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9trot?= Subject: [PATCH 1/2] target/riscv: fix pmp sanitize error for x-rv128 Date: Thu, 22 Oct 2026 09:52:17 +0200 Message-ID: <20261022075219.312757-2-frederic.petrot@univ-grenoble-alpes.fr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261022075219.312757-1-frederic.petrot@univ-grenoble-alpes.fr> References: <20261022075219.312757-1-frederic.petrot@univ-grenoble-alpes.fr> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Greylist: Whitelist-UGA SMTP Authentifie (petrotf@univ-grenoble-alpes.fr) via submission-587 ACL (41) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=152.77.200.56; envelope-from=frederic.petrot@univ-grenoble-alpes.fr; helo=zm-mta-out-3.u-ga.fr X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @univ-grenoble-alpes.fr) X-ZM-MESSAGEID: 1792655630529158500 From: Fr=C3=A9d=C3=A9ric P=C3=A9trot UndefinedBehaviorSanitizer reports an undefined behavior due to shifts larger than type in the handling of the pmp configuration registers for the x-rv128 cpu. Adding an "i128" version for the functions accessing the pmpcfg registers to properly handle the 128-bit case. Reported-by: Peter Maydell Signed-off-by: Fr=C3=A9d=C3=A9ric P=C3=A9trot --- target/riscv/tcg/csr.c | 66 ++++++++++++++++++++++++++++++++---------- target/riscv/tcg/csr.h | 3 ++ target/riscv/tcg/pmp.c | 38 ++++++++++++++++++++++++ 3 files changed, 91 insertions(+), 16 deletions(-) diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c index 063590f56a..fabb95c171 100644 --- a/target/riscv/tcg/csr.c +++ b/target/riscv/tcg/csr.c @@ -5598,6 +5598,24 @@ static RISCVException write_pmpcfg(CPURISCVState *en= v, int csrno, return RISCV_EXCP_NONE; } =20 +static RISCVException read_pmpcfg_i128(CPURISCVState *env, int csrno, + Int128 *val) +{ + uint32_t reg_index =3D csrno - CSR_PMPCFG0; + + *val =3D pmpcfg_csr_read_i128(env, reg_index); + return RISCV_EXCP_NONE; +} + +static RISCVException write_pmpcfg_i128(CPURISCVState *env, int csrno, + Int128 val) +{ + uint32_t reg_index =3D csrno - CSR_PMPCFG0; + + pmpcfg_csr_write_i128(env, reg_index, val); + return RISCV_EXCP_NONE; +} + static RISCVException read_pmpaddr(CPURISCVState *env, int csrno, target_ulong *val) { @@ -6472,33 +6490,49 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] =3D { /* Physical Memory Protection */ [CSR_MSECCFG] =3D { "mseccfg", have_mseccfg, read_mseccfg, write_= mseccfg, .min_priv_ver =3D PRIV_VERSION_1_11_0 }, - [CSR_PMPCFG0] =3D { "pmpcfg0", pmp, read_pmpcfg, write_pmpcfg }, - [CSR_PMPCFG1] =3D { "pmpcfg1", pmp, read_pmpcfg, write_pmpcfg }, - [CSR_PMPCFG2] =3D { "pmpcfg2", pmp, read_pmpcfg, write_pmpcfg }, - [CSR_PMPCFG3] =3D { "pmpcfg3", pmp, read_pmpcfg, write_pmpcfg }, - [CSR_PMPCFG4] =3D { "pmpcfg4", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG0] =3D { "pmpcfg0", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128 }, + [CSR_PMPCFG1] =3D { "pmpcfg1", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128 }, + [CSR_PMPCFG2] =3D { "pmpcfg2", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128 }, + [CSR_PMPCFG3] =3D { "pmpcfg3", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128 }, + [CSR_PMPCFG4] =3D { "pmpcfg4", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG5] =3D { "pmpcfg5", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG5] =3D { "pmpcfg5", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG6] =3D { "pmpcfg6", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG6] =3D { "pmpcfg6", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG7] =3D { "pmpcfg7", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG7] =3D { "pmpcfg7", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG8] =3D { "pmpcfg8", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG8] =3D { "pmpcfg8", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG9] =3D { "pmpcfg9", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG9] =3D { "pmpcfg9", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG10] =3D { "pmpcfg10", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG10] =3D { "pmpcfg10", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG11] =3D { "pmpcfg11", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG11] =3D { "pmpcfg11", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG12] =3D { "pmpcfg12", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG12] =3D { "pmpcfg12", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG13] =3D { "pmpcfg13", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG13] =3D { "pmpcfg13", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG14] =3D { "pmpcfg14", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG14] =3D { "pmpcfg14", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG15] =3D { "pmpcfg15", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG15] =3D { "pmpcfg15", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, [CSR_PMPADDR0] =3D { "pmpaddr0", pmp, read_pmpaddr, write_pmpaddr }, [CSR_PMPADDR1] =3D { "pmpaddr1", pmp, read_pmpaddr, write_pmpaddr }, diff --git a/target/riscv/tcg/csr.h b/target/riscv/tcg/csr.h index 53ba3b4a4d..40396bafdb 100644 --- a/target/riscv/tcg/csr.h +++ b/target/riscv/tcg/csr.h @@ -91,6 +91,9 @@ extern const RISCVCSR mips_csr_list[]; void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index, target_ulong val); target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index); +void pmpcfg_csr_write_i128(CPURISCVState *env, uint32_t reg_index, + Int128 val); +Int128 pmpcfg_csr_read_i128(CPURISCVState *env, uint32_t reg_index); =20 void mseccfg_csr_write(CPURISCVState *env, uint64_t val); uint64_t mseccfg_csr_read(CPURISCVState *env); diff --git a/target/riscv/tcg/pmp.c b/target/riscv/tcg/pmp.c index 41b55519a8..5601a81337 100644 --- a/target/riscv/tcg/pmp.c +++ b/target/riscv/tcg/pmp.c @@ -556,6 +556,28 @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg= _index, } } =20 +void pmpcfg_csr_write_i128(CPURISCVState *env, uint32_t reg_index, + Int128 val) +{ + int i; + uint8_t cfg_val; + int pmpcfg_nums =3D 2 << riscv_cpu_mxl(env); + bool modified =3D false; + + trace_pmpcfg_csr_write(env->mhartid, reg_index, int128_getlo(val)); + trace_pmpcfg_csr_write(env->mhartid, reg_index, int128_gethi(val)); + + for (i =3D 0; i < pmpcfg_nums; i++) { + cfg_val =3D int128_getlo(int128_rshift(val, 8 * i)) & 0xff; + modified |=3D pmp_write_cfg(env, (reg_index * 4) + i, cfg_val); + } + + /* If PMP permission of any addr has been changed, flush TLB pages. */ + if (modified) { + pmp_update_rule_nums(env); + tlb_flush(env_cpu(env)); + } +} =20 /* * Handle a read from a pmpcfg CSR @@ -576,6 +598,22 @@ target_ulong pmpcfg_csr_read(CPURISCVState *env, uint3= 2_t reg_index) return cfg_val; } =20 +Int128 pmpcfg_csr_read_i128(CPURISCVState *env, uint32_t reg_index) +{ + int i; + Int128 cfg_val =3D 0; + target_ulong val =3D 0; + int pmpcfg_nums =3D 2 << riscv_cpu_mxl(env); + + for (i =3D 0; i < pmpcfg_nums; i++) { + val =3D pmp_read_cfg(env, (reg_index * 4) + i); + cfg_val =3D int128_or(cfg_val, int128_lshift(int128_make64(val), i= * 8)); + } + trace_pmpcfg_csr_read(env->mhartid, reg_index, int128_getlo(cfg_val)); + trace_pmpcfg_csr_read(env->mhartid, reg_index, int128_gethi(cfg_val)); + + return cfg_val; +} =20 /* * Handle a write to a pmpaddr CSR --=20 2.43.0 From nobody Fri Oct 23 21:33:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=univ-grenoble-alpes.fr ARC-Seal: i=1; a=rsa-sha256; t=1792655603; cv=none; d=zohomail.com; s=zohoarc; b=dLLctJSBwQSqHKs8fSeSx5OnIWBanrIXW8tg6tTTgGNu6jpqBxv/lKuu/Y14lh/JX96fwfyvDBZ0vs+AdmYW+2USA75410I3rfRnDIVBh/VdpIuD8OuJqOwHcvRaDMTb3mnJZ0RfanuRq5gYWsl9YUKnFpOZXotHlijt5PYUfgU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792655603; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=64QwxnRwEnGfleuMdOWfcMqOFICzqEnDEybuyaaeMG8=; b=jxjkYb8KkO3hADjJWBjdOOgn+MPhjbzoWhu+VHspSPzEWqs6Pn/AMXv2zxYQ5uy7AgrHO0S37rxpZyFys1HTNm1KbKwOm9I6lKI9GmoRs3WQtyWwYXVq5iTW3tKnhPiKIeO7vYc2AUTujdJDA8oYU9zneDQZgvdcqEvxrLiiPcg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792655602559268.82907598807947; Thu, 22 Oct 2026 00:53:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJnbP-0003Tt-3x; Thu, 22 Oct 2026 03:52:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJnbG-0003TB-6N; Thu, 22 Oct 2026 03:52:35 -0400 Received: from zm-mta-out-3.u-ga.fr ([152.77.200.56]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJnbD-0003Cv-O2; Thu, 22 Oct 2026 03:52:33 -0400 Received: from mailhub-1.u-ga.fr (mailhub-1.u-ga.fr [129.88.178.98]) by zm-mta-out-3.u-ga.fr (Postfix) with ESMTP id 1FB524028A; Thu, 22 Oct 2026 09:52:29 +0200 (CEST) Received: from smtps.univ-grenoble-alpes.fr (smtps3.u-ga.fr [195.83.24.62]) by mailhub-1.u-ga.fr (Postfix) with ESMTP id 19B4DFF856; Thu, 22 Oct 2026 09:52:29 +0200 (CEST) Received: from naga.home (88-170-236-106.subs.proxad.net [88.170.236.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: petrotf@univ-grenoble-alpes.fr) by smtps.univ-grenoble-alpes.fr (Postfix) with ESMTPSA id A66CC4004A; Thu, 22 Oct 2026 09:52:28 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=univ-grenoble-alpes.fr; s=2020; t=1792655549; bh=r0ljT3KfLB7UteheOjwLx31e7B6hdcVnVwWZ82e3C1c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eOj2shHSzI9AMa2wcXaormzCdI1xGNmwpMd/6FpJir2Ue0ixKN8EfQENlAx15GSBz qDdyV3HjScD7SPJjyKuYQCMeXYwGEdXBLdHI+7DZBwIM8k1TemjxDHwsLOh2kOz5+j CuQduT8qtp06eBBkH342q8YDf92rf2+gZFELAi4824G4Z+P3r6aA1tOvRR8qeLnXLE 40X7a0UA272nikDjs7KORc+P1KNRsXm+W/V19EGbKOFhvEl+8yOlNRkbBr7uffNPh6 s3x8GoVw12KYnaoTrjyLeotv0Er0JyvGj9aFAj61LqF47ez/A+sm0qVnsdhpxmueS/ JFSibLSMQ17gQ== From: frederic.petrot@univ-grenoble-alpes.fr To: peter.maydell@linaro.org, daniel.barboza@oss.qualcomm.com, palmer@dabbelt.com, alistair.francis@wdc.com, liwei1518@gmail.com, zhiwei_liu@linux.alibaba.com, chao.liu@processmission.com, qemu-riscv@nongnu.org, qemu-devel@nongnu.org Cc: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9trot?= Subject: [PATCH 2/2] target/riscv: fix riscv_cpu_do_interrupt sanitize error for x-rv128 Date: Thu, 22 Oct 2026 09:52:18 +0200 Message-ID: <20261022075219.312757-3-frederic.petrot@univ-grenoble-alpes.fr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261022075219.312757-1-frederic.petrot@univ-grenoble-alpes.fr> References: <20261022075219.312757-1-frederic.petrot@univ-grenoble-alpes.fr> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Greylist: Whitelist-UGA SMTP Authentifie (petrotf@univ-grenoble-alpes.fr) via submission-587 ACL (41) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=152.77.200.56; envelope-from=frederic.petrot@univ-grenoble-alpes.fr; helo=zm-mta-out-3.u-ga.fr X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @univ-grenoble-alpes.fr) X-ZM-MESSAGEID: 1792655609229158500 From: Fr=C3=A9d=C3=A9ric P=C3=A9trot UndefinedBehaviorSanitizer reports an undefined behavior when setting the Interrupt flag (msb) in the [ms]cause registers due to an out of bounds shift. We specifically correct these cases, leaving the ones depending on specific extensions untouched. Reported-by: Peter Maydell Signed-off-by: Fr=C3=A9d=C3=A9ric P=C3=A9trot --- target/riscv/cpu.h | 2 ++ target/riscv/tcg/cpu_helper.c | 14 ++++++++++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index b65d631994..17bfcf38c0 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -354,10 +354,12 @@ struct CPUArchState { uint64_t stvec; uint64_t sepc; uint64_t scause; + uint64_t scauseh; =20 uint64_t mtvec; uint64_t mepc; uint64_t mcause; + uint64_t mcauseh; uint64_t mtval; /* since: priv-1.10.0 */ =20 uint64_t mctrctl; diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c index 58e98e975c..b35b61dc01 100644 --- a/target/riscv/tcg/cpu_helper.c +++ b/target/riscv/tcg/cpu_helper.c @@ -2375,7 +2375,12 @@ void riscv_cpu_do_interrupt(CPUState *cs) } env->mstatus =3D s; sxlen =3D 16 << riscv_cpu_sxl(env); - env->scause =3D cause | ((target_ulong)async << (sxlen - 1)); + if (riscv_cpu_sxl(env) !=3D MXL_RV128) { + env->scause =3D cause | ((target_ulong)async << (sxlen - 1)); + } else { + env->scause =3D cause; + env->scauseh =3D (target_ulong)async << 63; + } env->sepc =3D env->pc; env->stval =3D tval; env->htval =3D htval; @@ -2447,7 +2452,12 @@ void riscv_cpu_do_interrupt(CPUState *cs) s =3D set_field(s, MSTATUS_MDT, 1); } env->mstatus =3D s; - env->mcause =3D cause | ((target_ulong)async << (mxlen - 1)); + if (riscv_cpu_mxl(env) !=3D MXL_RV128) { + env->mcause =3D cause | ((target_ulong)async << (mxlen - 1)); + } else { + env->mcause =3D cause; + env->mcauseh =3D (target_ulong)async << 63; + } if (smode_double_trap) { env->mtval2 =3D env->mcause; env->mcause =3D RISCV_EXCP_DOUBLE_TRAP; --=20 2.43.0