From nobody Fri Oct 23 21:33:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=univ-grenoble-alpes.fr ARC-Seal: i=1; a=rsa-sha256; t=1792668181; cv=none; d=zohomail.com; s=zohoarc; b=OmuJZlP/VrpNX72GiV1APsGdBSBL6TDua4QQkmCqTQH88JZF9lX/PE6gtiRGUPvfMZ1bD1wigMTT+7CC1LvFog5IOqK3YtyUKzppAA3c4omO5hKWRiL0jSTWnNS9qWwasPGQaaJqWuVuTQniJkJh5y4UAjqeDrVHJzfVT7dxTb4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792668181; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=nCEMkaaCUaPrEYF84mJQ/zkF4gnWvvk4bkl5PMxkoyc=; b=YphlezAI4RL8DuxoAxPxoMbTXfTyqPIuTbM2FBvlgaUD0uY4BDYtQiKJ84s0XmgrHASwmcw7OwMru4t2XknIO17rQ/pQx9ssCYgfLEbdrhZ5N5R1p187tcrHK8b7fEcvJ0YiNlWw46m88rxRWjmBhk2E9aZRtCWLDyMhPQ14Qgg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792668181624762.475533835601; Thu, 22 Oct 2026 04:23:01 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqs4-0000ok-NH; Thu, 22 Oct 2026 07:22:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqrr-0000kp-Bk; Thu, 22 Oct 2026 07:21:56 -0400 Received: from zm-mta-out-3.u-ga.fr ([152.77.200.56]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqrn-0004aJ-IR; Thu, 22 Oct 2026 07:21:55 -0400 Received: from mailhub-1.u-ga.fr (mailhub-1.u-ga.fr [129.88.178.98]) by zm-mta-out-3.u-ga.fr (Postfix) with ESMTP id 8DF5D4021E; Thu, 22 Oct 2026 13:21:48 +0200 (CEST) Received: from smtps.univ-grenoble-alpes.fr (smtps2.u-ga.fr [152.77.18.2]) by mailhub-1.u-ga.fr (Postfix) with ESMTP id 89F41FF853; Thu, 22 Oct 2026 13:21:48 +0200 (CEST) Received: from naga.tima.u-ga.fr (naga.tima.u-ga.fr [147.171.132.150]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: petrotf@univ-grenoble-alpes.fr) by smtps.univ-grenoble-alpes.fr (Postfix) with ESMTPSA id 5491A140049; Thu, 22 Oct 2026 13:21:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=univ-grenoble-alpes.fr; s=2020; t=1792668108; bh=5ZNU2HMQS5XM+YMyYoNZNgN+c+I3Ie5CfDbI8Jp8YHY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ftYy2Woba+hAIOItgs8bezTl2GGb0Ty/2rjU1nP9SUCW1Gd132+j87vqPdm/1CCNx FryUhENMDtbLhFXCm4u10CbrddsUaBUiRPuMVcUo2iGBLuWhC6iY9GbTunwyZmmYwN DwT4w71JxUzMuRCWiCN1Js+QmKhHX9xHsGZ9ooAjzDCqPA4yMTp4pI9TAjqF3u2H2y qBHKMr2fwmnY22wh/10DA5XhqvCbNwSArzJ0e+mGuriRMjMA2RJ0+KEIMQeGpTyflL BnZQudTWbR3QHbhFazNqAE9vvZQppmzL2m3bSEpne9+exHmvMl1OG8Vp4TNLJaP2Ki Ck9BjWPXMexEw== From: frederic.petrot@univ-grenoble-alpes.fr To: peter.maydell@linaro.org, daniel.barboza@oss.qualcomm.com, palmer@dabbelt.com, alistair.francis@wdc.com, liwei1518@gmail.com, zhiwei_liu@linux.alibaba.com, chao.liu@processmission.com, qemu-riscv@nongnu.org, qemu-devel@nongnu.org Cc: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9trot?= Subject: [PATCH v2 1/2] target/riscv: fix pmp sanitize error for x-rv128 Date: Thu, 22 Oct 2026 13:21:44 +0200 Message-ID: <20261022112145.356726-2-frederic.petrot@univ-grenoble-alpes.fr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261022112145.356726-1-frederic.petrot@univ-grenoble-alpes.fr> References: <20261022112145.356726-1-frederic.petrot@univ-grenoble-alpes.fr> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Greylist: Whitelist-UGA SMTP Authentifie (petrotf@univ-grenoble-alpes.fr) via submission-587 ACL (41) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=152.77.200.56; envelope-from=frederic.petrot@univ-grenoble-alpes.fr; helo=zm-mta-out-3.u-ga.fr X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @univ-grenoble-alpes.fr) X-ZM-MESSAGEID: 1792668183406158500 From: Fr=C3=A9d=C3=A9ric P=C3=A9trot UndefinedBehaviorSanitizer reports an undefined behavior due to shifts larger than type in the handling of the pmp configuration registers for the x-rv128 cpu. Adding an "i128" version for the functions accessing the pmpcfg registers to properly handle the 128-bit case. Reported-by: Peter Maydell Signed-off-by: Fr=C3=A9d=C3=A9ric P=C3=A9trot --- target/riscv/tcg/csr.c | 66 ++++++++++++++++++++++++++++++++---------- target/riscv/tcg/csr.h | 3 ++ target/riscv/tcg/pmp.c | 38 ++++++++++++++++++++++++ 3 files changed, 91 insertions(+), 16 deletions(-) diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c index 063590f56a..fabb95c171 100644 --- a/target/riscv/tcg/csr.c +++ b/target/riscv/tcg/csr.c @@ -5598,6 +5598,24 @@ static RISCVException write_pmpcfg(CPURISCVState *en= v, int csrno, return RISCV_EXCP_NONE; } =20 +static RISCVException read_pmpcfg_i128(CPURISCVState *env, int csrno, + Int128 *val) +{ + uint32_t reg_index =3D csrno - CSR_PMPCFG0; + + *val =3D pmpcfg_csr_read_i128(env, reg_index); + return RISCV_EXCP_NONE; +} + +static RISCVException write_pmpcfg_i128(CPURISCVState *env, int csrno, + Int128 val) +{ + uint32_t reg_index =3D csrno - CSR_PMPCFG0; + + pmpcfg_csr_write_i128(env, reg_index, val); + return RISCV_EXCP_NONE; +} + static RISCVException read_pmpaddr(CPURISCVState *env, int csrno, target_ulong *val) { @@ -6472,33 +6490,49 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] =3D { /* Physical Memory Protection */ [CSR_MSECCFG] =3D { "mseccfg", have_mseccfg, read_mseccfg, write_= mseccfg, .min_priv_ver =3D PRIV_VERSION_1_11_0 }, - [CSR_PMPCFG0] =3D { "pmpcfg0", pmp, read_pmpcfg, write_pmpcfg }, - [CSR_PMPCFG1] =3D { "pmpcfg1", pmp, read_pmpcfg, write_pmpcfg }, - [CSR_PMPCFG2] =3D { "pmpcfg2", pmp, read_pmpcfg, write_pmpcfg }, - [CSR_PMPCFG3] =3D { "pmpcfg3", pmp, read_pmpcfg, write_pmpcfg }, - [CSR_PMPCFG4] =3D { "pmpcfg4", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG0] =3D { "pmpcfg0", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128 }, + [CSR_PMPCFG1] =3D { "pmpcfg1", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128 }, + [CSR_PMPCFG2] =3D { "pmpcfg2", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128 }, + [CSR_PMPCFG3] =3D { "pmpcfg3", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128 }, + [CSR_PMPCFG4] =3D { "pmpcfg4", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG5] =3D { "pmpcfg5", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG5] =3D { "pmpcfg5", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG6] =3D { "pmpcfg6", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG6] =3D { "pmpcfg6", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG7] =3D { "pmpcfg7", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG7] =3D { "pmpcfg7", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG8] =3D { "pmpcfg8", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG8] =3D { "pmpcfg8", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG9] =3D { "pmpcfg9", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG9] =3D { "pmpcfg9", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG10] =3D { "pmpcfg10", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG10] =3D { "pmpcfg10", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG11] =3D { "pmpcfg11", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG11] =3D { "pmpcfg11", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG12] =3D { "pmpcfg12", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG12] =3D { "pmpcfg12", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG13] =3D { "pmpcfg13", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG13] =3D { "pmpcfg13", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG14] =3D { "pmpcfg14", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG14] =3D { "pmpcfg14", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, - [CSR_PMPCFG15] =3D { "pmpcfg15", pmp, read_pmpcfg, write_pmpcfg, + [CSR_PMPCFG15] =3D { "pmpcfg15", pmp, read_pmpcfg, write_pmpcfg, N= ULL, + read_pmpcfg_i128, write_pmpcfg_i128, .min_priv_ver =3D PRIV_VERSION_1_12_0 }, [CSR_PMPADDR0] =3D { "pmpaddr0", pmp, read_pmpaddr, write_pmpaddr }, [CSR_PMPADDR1] =3D { "pmpaddr1", pmp, read_pmpaddr, write_pmpaddr }, diff --git a/target/riscv/tcg/csr.h b/target/riscv/tcg/csr.h index 53ba3b4a4d..40396bafdb 100644 --- a/target/riscv/tcg/csr.h +++ b/target/riscv/tcg/csr.h @@ -91,6 +91,9 @@ extern const RISCVCSR mips_csr_list[]; void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index, target_ulong val); target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index); +void pmpcfg_csr_write_i128(CPURISCVState *env, uint32_t reg_index, + Int128 val); +Int128 pmpcfg_csr_read_i128(CPURISCVState *env, uint32_t reg_index); =20 void mseccfg_csr_write(CPURISCVState *env, uint64_t val); uint64_t mseccfg_csr_read(CPURISCVState *env); diff --git a/target/riscv/tcg/pmp.c b/target/riscv/tcg/pmp.c index 41b55519a8..6fda5192ec 100644 --- a/target/riscv/tcg/pmp.c +++ b/target/riscv/tcg/pmp.c @@ -556,6 +556,28 @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg= _index, } } =20 +void pmpcfg_csr_write_i128(CPURISCVState *env, uint32_t reg_index, + Int128 val) +{ + int i; + uint8_t cfg_val; + int pmpcfg_nums =3D 2 << riscv_cpu_mxl(env); + bool modified =3D false; + + trace_pmpcfg_csr_write(env->mhartid, reg_index, int128_getlo(val)); + trace_pmpcfg_csr_write(env->mhartid, reg_index, int128_gethi(val)); + + for (i =3D 0; i < pmpcfg_nums; i++) { + cfg_val =3D int128_getlo(int128_rshift(val, 8 * i)) & 0xff; + modified |=3D pmp_write_cfg(env, (reg_index * 4) + i, cfg_val); + } + + /* If PMP permission of any addr has been changed, flush TLB pages. */ + if (modified) { + pmp_update_rule_nums(env); + tlb_flush(env_cpu(env)); + } +} =20 /* * Handle a read from a pmpcfg CSR @@ -576,6 +598,22 @@ target_ulong pmpcfg_csr_read(CPURISCVState *env, uint3= 2_t reg_index) return cfg_val; } =20 +Int128 pmpcfg_csr_read_i128(CPURISCVState *env, uint32_t reg_index) +{ + int i; + Int128 cfg_val =3D int128_zero(); + target_ulong val =3D 0; + int pmpcfg_nums =3D 2 << riscv_cpu_mxl(env); + + for (i =3D 0; i < pmpcfg_nums; i++) { + val =3D pmp_read_cfg(env, (reg_index * 4) + i); + cfg_val =3D int128_or(cfg_val, int128_lshift(int128_make64(val), i= * 8)); + } + trace_pmpcfg_csr_read(env->mhartid, reg_index, int128_getlo(cfg_val)); + trace_pmpcfg_csr_read(env->mhartid, reg_index, int128_gethi(cfg_val)); + + return cfg_val; +} =20 /* * Handle a write to a pmpaddr CSR --=20 2.43.0 From nobody Fri Oct 23 21:33:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=univ-grenoble-alpes.fr ARC-Seal: i=1; a=rsa-sha256; t=1792668165; cv=none; d=zohomail.com; s=zohoarc; b=EuB2EkFP9R/MievhYkQP4FEjpjrxYZsB60DM3wGxt1YoWMcNPHZLLZJH1Mdg3oFI9mRu39QMWd5FKpDANtpxi1yxNllzvNnZs9vPYEtn0vSNVaV/iSkL9bkiFw1G5EslzRsCiucIERxUS2DRt5ZV1fiI8AJWnfrlJjGqG7ER5EY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792668165; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=64QwxnRwEnGfleuMdOWfcMqOFICzqEnDEybuyaaeMG8=; b=YlY/sUuSm3AalcwwuvTOI9/Q8E+BjZUrQZ++0oEqcTbmzIgQwtcbSYM3B5ifWiM/GJrmMh8Yziu/41nwyt5tJ4tnLRAg15pAqHn1vfEirzckwwFnVitinziSuNRpkfVntxqxAqC4Qkl1wyjIAzPMZd2TkvZY+hTaZYudUJssSHg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792668164914654.4555177907519; Thu, 22 Oct 2026 04:22:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJqs3-0000mq-Rt; Thu, 22 Oct 2026 07:22:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqrp-0000kb-Rg; Thu, 22 Oct 2026 07:21:54 -0400 Received: from zm-mta-out-3.u-ga.fr ([152.77.200.56]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJqrn-0004aK-Dl; Thu, 22 Oct 2026 07:21:53 -0400 Received: from mailhub-2.u-ga.fr (mailhub-2.u-ga.fr [129.88.178.102]) by zm-mta-out-3.u-ga.fr (Postfix) with ESMTP id C05DD4025A; Thu, 22 Oct 2026 13:21:48 +0200 (CEST) Received: from smtps.univ-grenoble-alpes.fr (smtps2.u-ga.fr [152.77.18.2]) by mailhub-2.u-ga.fr (Postfix) with ESMTP id BC417FF855; Thu, 22 Oct 2026 13:21:48 +0200 (CEST) Received: from naga.tima.u-ga.fr (naga.tima.u-ga.fr [147.171.132.150]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: petrotf@univ-grenoble-alpes.fr) by smtps.univ-grenoble-alpes.fr (Postfix) with ESMTPSA id 8F095140049; Thu, 22 Oct 2026 13:21:48 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=univ-grenoble-alpes.fr; s=2020; t=1792668108; bh=r0ljT3KfLB7UteheOjwLx31e7B6hdcVnVwWZ82e3C1c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JKBHKKNMtJnEvXTiIiNEwDOTxy2FbFpx+TRHq0ahyVIQwFIi2xpU2iZyjoBOo2rhZ WPNZDzF8+phSBI9jdqUxSN9rWSjRs+/WAUiVK7xB/DE0W9EMHEridGd59JKt3QuINt qYjaMeSSvMMbHgGKr+77COrgxXJVYBG9I8+ngPVHoeZB1ou6PIjiQOUK1dUFyt34zQ wObkCz3QGMfkCBZfACvpFw0IU4elHNLATOHQ6416CgL+NxGfIEpFzRDwKvYxbOTSsB 5gnc92qntvL4qx/fC4N6Wiy0VwJHnzqvkQ4+xmOKIDCZ/qStcwJEBAO1TJqSYvvnz1 g010ZjpsvflCw== From: frederic.petrot@univ-grenoble-alpes.fr To: peter.maydell@linaro.org, daniel.barboza@oss.qualcomm.com, palmer@dabbelt.com, alistair.francis@wdc.com, liwei1518@gmail.com, zhiwei_liu@linux.alibaba.com, chao.liu@processmission.com, qemu-riscv@nongnu.org, qemu-devel@nongnu.org Cc: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9trot?= Subject: [PATCH v2 2/2] target/riscv: fix riscv_cpu_do_interrupt sanitize error for x-rv128 Date: Thu, 22 Oct 2026 13:21:45 +0200 Message-ID: <20261022112145.356726-3-frederic.petrot@univ-grenoble-alpes.fr> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261022112145.356726-1-frederic.petrot@univ-grenoble-alpes.fr> References: <20261022112145.356726-1-frederic.petrot@univ-grenoble-alpes.fr> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Greylist: Whitelist-UGA SMTP Authentifie (petrotf@univ-grenoble-alpes.fr) via submission-587 ACL (41) Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=152.77.200.56; envelope-from=frederic.petrot@univ-grenoble-alpes.fr; helo=zm-mta-out-3.u-ga.fr X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @univ-grenoble-alpes.fr) X-ZM-MESSAGEID: 1792668166634158500 From: Fr=C3=A9d=C3=A9ric P=C3=A9trot UndefinedBehaviorSanitizer reports an undefined behavior when setting the Interrupt flag (msb) in the [ms]cause registers due to an out of bounds shift. We specifically correct these cases, leaving the ones depending on specific extensions untouched. Reported-by: Peter Maydell Signed-off-by: Fr=C3=A9d=C3=A9ric P=C3=A9trot --- target/riscv/cpu.h | 2 ++ target/riscv/tcg/cpu_helper.c | 14 ++++++++++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index b65d631994..17bfcf38c0 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -354,10 +354,12 @@ struct CPUArchState { uint64_t stvec; uint64_t sepc; uint64_t scause; + uint64_t scauseh; =20 uint64_t mtvec; uint64_t mepc; uint64_t mcause; + uint64_t mcauseh; uint64_t mtval; /* since: priv-1.10.0 */ =20 uint64_t mctrctl; diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c index 58e98e975c..b35b61dc01 100644 --- a/target/riscv/tcg/cpu_helper.c +++ b/target/riscv/tcg/cpu_helper.c @@ -2375,7 +2375,12 @@ void riscv_cpu_do_interrupt(CPUState *cs) } env->mstatus =3D s; sxlen =3D 16 << riscv_cpu_sxl(env); - env->scause =3D cause | ((target_ulong)async << (sxlen - 1)); + if (riscv_cpu_sxl(env) !=3D MXL_RV128) { + env->scause =3D cause | ((target_ulong)async << (sxlen - 1)); + } else { + env->scause =3D cause; + env->scauseh =3D (target_ulong)async << 63; + } env->sepc =3D env->pc; env->stval =3D tval; env->htval =3D htval; @@ -2447,7 +2452,12 @@ void riscv_cpu_do_interrupt(CPUState *cs) s =3D set_field(s, MSTATUS_MDT, 1); } env->mstatus =3D s; - env->mcause =3D cause | ((target_ulong)async << (mxlen - 1)); + if (riscv_cpu_mxl(env) !=3D MXL_RV128) { + env->mcause =3D cause | ((target_ulong)async << (mxlen - 1)); + } else { + env->mcause =3D cause; + env->mcauseh =3D (target_ulong)async << 63; + } if (smode_double_trap) { env->mtval2 =3D env->mcause; env->mcause =3D RISCV_EXCP_DOUBLE_TRAP; --=20 2.43.0