From nobody Sat Sep 26 20:00:21 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178912962657692.64856324824086; Fri, 11 Sep 2026 05:27:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x50LF-0004i4-9B; Fri, 11 Sep 2026 08:26:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x50Kn-00045x-NT; Fri, 11 Sep 2026 08:26:26 -0400 Received: from smtp25.cstnet.cn ([159.226.251.25] helo=cstnet.cn) by eggs.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1x50Ki-0006CX-W6; Fri, 11 Sep 2026 08:26:25 -0400 Received: from [172.21.96.1] (unknown [124.16.137.194]) by APP-05 (Coremail) with SMTP id zQCowABHtD5k86NqyHDqBw--.17498S3; Fri, 11 Sep 2026 20:26:13 +0800 (CST) Message-ID: In-Reply-To: References: From: wangyang Date: Fri, 4 Sep 2026 21:49:06 +0800 Subject: [PATCH v4 1/5] target/riscv: enforce XTheadCmo U-mode privilege checks To: qemu-devel@nongnu.org Cc: Palmer Dabbelt , Alistair Francis , Weiwei Li , Daniel Henrique Barboza , Liu Zhiwei , Chao Liu , Christoph Muellner , qemu-riscv@nongnu.org X-CM-TRANSID: zQCowABHtD5k86NqyHDqBw--.17498S3 X-Coremail-Antispam: 1UD129KBjvJXoWxJr47XFyUurWftFyfGrW3Jrb_yoW8ZF1rpF WDKayYkrZ5JF15A3Zxur47Za97JFZ8Gw47X3W3Z398Aa15CrW7W3Z7K3y2gw48Cr40gr1q kF1qyr15Zr1jyaUanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQab7Iv0xC_tr1lb4IE77IF4wAFF20E14v26ryj6rWUM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M280x2IEY4vE77IFxV WkZVCq3wA2048vs2IY020E87I2jVAFwI0_Jr4l82xGYIkIc2x26xkF7I0E14v26r1I6r4U M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Jr 0_JF4l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1l84ACjcxK6I8E87Iv67AKxVW8 JVWxJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr1j6F4UJwAac4AC62xK8xCEY4vEwIxC4w AS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IY x2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Gr0_Cr1lOx8S6xCaFVCjc4AY6r1j6r4UM4 x0Y48IcVAKI48JMxkF7I0En4kS14v26r1q6r43MxkIecxEwVAFwVW5JwCF04k20xvY0x0E wIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E74 80Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0 I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1lIxAIcVCF04 k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7Cj xVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x07jsAwxUUUUU= X-Originating-IP: [124.16.137.194] X-CM-SenderInfo: 5zdqw5xdqjjk46rwut1l0ox2xfdvhtffof0/ Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=159.226.251.25; envelope-from=wangyang25@otcaix.iscas.ac.cn; helo=cstnet.cn X-Spam_score_int: 15 X-Spam_score: 1.5 X-Spam_bar: + X-Spam_report: (1.5 / 5.0 requ) BAYES_00=-1.9, DATE_IN_PAST_96_XX=3.405, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1789129630485158500 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The XTheadCmo specification restricts th.dcache.cva and th.dcache.iva to privilege modes above U, while th.dcache.civa remains available in U-mode. Both restricted instructions currently use the empty REQUIRE_PRIV_MSU macro, so they retire in U-mode. Use REQUIRE_PRIV_MS for the two restricted instructions. Tested: RV32/RV64 Linux-user test cases with xtheadcmo enabled and disabled. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4412 Reviewed-by: Daniel Henrique Barboza Signed-off-by: wangyang --- target/riscv/tcg/insn_trans/trans_xthead.c.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/target/riscv/tcg/insn_trans/trans_xthead.c.inc b/target/riscv/= tcg/insn_trans/trans_xthead.c.inc index f4e3051000..681f70e5bc 100644 --- a/target/riscv/tcg/insn_trans/trans_xthead.c.inc +++ b/target/riscv/tcg/insn_trans/trans_xthead.c.inc @@ -289,9 +289,9 @@ NOP_PRIVCHECK(th_dcache_iall, REQUIRE_XTHEADCMO, REQUIR= E_PRIV_MS) NOP_PRIVCHECK(th_dcache_cpa, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS) NOP_PRIVCHECK(th_dcache_cipa, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS) NOP_PRIVCHECK(th_dcache_ipa, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS) -NOP_PRIVCHECK(th_dcache_cva, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MSU) +NOP_PRIVCHECK(th_dcache_cva, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS) NOP_PRIVCHECK(th_dcache_civa, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MSU) -NOP_PRIVCHECK(th_dcache_iva, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MSU) +NOP_PRIVCHECK(th_dcache_iva, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS) NOP_PRIVCHECK(th_dcache_csw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS) NOP_PRIVCHECK(th_dcache_cisw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS) NOP_PRIVCHECK(th_dcache_isw, REQUIRE_XTHEADCMO, REQUIRE_PRIV_MS) --=20 2.55.0.windows.2 From nobody Sat Sep 26 20:00:21 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1789129611765757.3634910749149; Fri, 11 Sep 2026 05:26:51 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x50Kp-00047t-SA; Fri, 11 Sep 2026 08:26:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x50Kl-000434-Sv; Fri, 11 Sep 2026 08:26:24 -0400 Received: from smtp25.cstnet.cn ([159.226.251.25] helo=cstnet.cn) by eggs.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1x50Ki-0006CU-PU; Fri, 11 Sep 2026 08:26:23 -0400 Received: from [172.21.96.1] (unknown [124.16.137.194]) by APP-05 (Coremail) with SMTP id zQCowABHtD5k86NqyHDqBw--.17498S4; Fri, 11 Sep 2026 20:26:13 +0800 (CST) Message-ID: In-Reply-To: References: From: wangyang Date: Fri, 11 Sep 2026 19:07:51 +0800 Subject: [PATCH v4 2/5] target/riscv: decode RV32 XTheadBb th.srri shift amount To: qemu-devel@nongnu.org Cc: Palmer Dabbelt , Alistair Francis , Weiwei Li , Daniel Henrique Barboza , Liu Zhiwei , Chao Liu , Christoph Muellner , qemu-riscv@nongnu.org X-CM-TRANSID: zQCowABHtD5k86NqyHDqBw--.17498S4 X-Coremail-Antispam: 1UD129KBjvJXoW7ZFW5Xr4rKw43WFy3Zr45Awb_yoW8Kr17pa 10k34UCFs5Wryavr97tw45JF15GFs3ZayUt3WSqwn3WFW5XFWUJ34xtrW7KrW3ZrWkXrWj kF48Ar98trZ5JaDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUmFb7Iv0xC_KF4lb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI 8067AKxVWUXwA2048vs2IY020Ec7CjxVAFwI0_Gr0_Xr1l8cAvFVAK0II2c7xJM28CjxkF 64kEwVA0rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVWUJVWUCwA2z4x0Y4vE2Ix0cI8IcV CY1x0267AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIE14v26r4j6F4UM28EF7xvwVC2z280aVCY 1x0267AKxVW8Jr0_Cr1UM2vYz4IE04k24VAvwVAKI4IrM2AIxVAIcxkEcVAq07x20xvEnc xIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E 87Iv67AKxVW8JVWxJwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IY64vIr41lc7CjxVAaw2 AFwI0_Jw0_GFylc2xSY4AK67AK6ryUMxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY 6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17 CEb7AF67AKxVWUtVW8ZwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF 0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIx AIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2 KfnxnUUI43ZEXa7IU0_nYUUUUUU== X-Originating-IP: [124.16.137.194] X-CM-SenderInfo: 5zdqw5xdqjjk46rwut1l0ox2xfdvhtffof0/ Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=159.226.251.25; envelope-from=wangyang25@otcaix.iscas.ac.cn; helo=cstnet.cn X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1789129616683158500 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The XTheadBb th.srri instruction uses the low log2(XLEN) bits of imm6. The generic shift helper rejects values greater than or equal to XLEN, which incorrectly rejects imm6 values 32 through 63 on RV32. Decode the RV32 form with a five-bit shift field so the shared helper receives the width-correct operand. Tested: RV32 imm6 0, 31, 32, and 63 test cases with XTheadBb enabled and disabled; RV64 imm6 63 with XTheadBb enabled and disabled. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4413 Signed-off-by: wangyang --- target/riscv/tcg/insn_trans/trans_xthead.c.inc | 8 ++++++++ target/riscv/xthead.decode | 5 ++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/target/riscv/tcg/insn_trans/trans_xthead.c.inc b/target/riscv/= tcg/insn_trans/trans_xthead.c.inc index 681f70e5bc..d47b5a85c6 100644 --- a/target/riscv/tcg/insn_trans/trans_xthead.c.inc +++ b/target/riscv/tcg/insn_trans/trans_xthead.c.inc @@ -145,6 +145,14 @@ static bool trans_th_srri(DisasContext *ctx, arg_th_sr= ri * a) tcg_gen_rotri_tl, gen_roriw, NULL); } =20 +static bool trans_th_srri_rv32(DisasContext *ctx, arg_th_srri_rv32 *a) +{ + REQUIRE_XTHEADBB(ctx); + REQUIRE_32BIT(ctx); + return gen_shift_imm_fn_per_ol(ctx, a, EXT_NONE, + tcg_gen_rotri_tl, gen_roriw, NULL); +} + /* th.srriw is an alternate encoding for roriw (from Zbb) */ static bool trans_th_srriw(DisasContext *ctx, arg_th_srriw *a) { diff --git a/target/riscv/xthead.decode b/target/riscv/xthead.decode index d1d104bcf2..33995168c4 100644 --- a/target/riscv/xthead.decode +++ b/target/riscv/xthead.decode @@ -64,7 +64,10 @@ th_ext ...... ...... ..... 010 ..... 0001011 @= th_bfext th_extu ...... ...... ..... 011 ..... 0001011 @th_bfext th_ff0 1000010 00000 ..... 001 ..... 0001011 @r2 th_ff1 1000011 00000 ..... 001 ..... 0001011 @r2 -th_srri 000100 ...... ..... 001 ..... 0001011 @sh6 +{ + th_srri_rv32 000100 -..... ..... 001 ..... 0001011 @sh5 + th_srri 000100 ...... ..... 001 ..... 0001011 @sh6 +} th_srriw 0001010 ..... ..... 001 ..... 0001011 @sh5 th_rev 1000001 00000 ..... 001 ..... 0001011 @r2 th_revw 1001000 00000 ..... 001 ..... 0001011 @r2 --=20 2.55.0.windows.2 From nobody Sat Sep 26 20:00:21 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1789129634111959.9287606365814; Fri, 11 Sep 2026 05:27:14 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x50Kr-0004Ek-LC; Fri, 11 Sep 2026 08:26:29 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x50Kn-000462-UF; Fri, 11 Sep 2026 08:26:26 -0400 Received: from smtp25.cstnet.cn ([159.226.251.25] helo=cstnet.cn) by eggs.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1x50Ki-0006Cn-Qy; Fri, 11 Sep 2026 08:26:25 -0400 Received: from [172.21.96.1] (unknown [124.16.137.194]) by APP-05 (Coremail) with SMTP id zQCowABHtD5k86NqyHDqBw--.17498S5; Fri, 11 Sep 2026 20:26:13 +0800 (CST) Message-ID: <53f8aa792aebae30eb18e018e8ad514c9ad59bed.1789125266.git.wangyang25@otcaix.iscas.ac.cn> In-Reply-To: References: From: wangyang Date: Fri, 4 Sep 2026 21:49:11 +0800 Subject: [PATCH v4 3/5] target/riscv: require read permission for HLVX accesses To: qemu-devel@nongnu.org Cc: Palmer Dabbelt , Alistair Francis , Weiwei Li , Daniel Henrique Barboza , Liu Zhiwei , Chao Liu , Christoph Muellner , qemu-riscv@nongnu.org X-CM-TRANSID: zQCowABHtD5k86NqyHDqBw--.17498S5 X-Coremail-Antispam: 1UD129KBjvJXoW3Jw4fCrWxZr13uw47Aw1xuFg_yoW7Zr1Upr WrCrZIkw4kKFZrXayxtF1jyF15CF43GFWjg3Z7WwsY93Wav3yru3WkKa42gFs8GFWkWw1j ga1qyF1jk3WjqFDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQab7Iv0xC_Kw4lb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M280x2IEY4vE77IFxV WkZVCq3wA2048vs2IY020E87I2jVAFwI0_JrWl82xGYIkIc2x26xkF7I0E14v26ryj6s0D M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Jr 0_JF4l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1l84ACjcxK6I8E87Iv67AKxVW8 JVWxJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr1j6F4UJwAac4AC62xK8xCEY4vEwIxC4w AS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IY x2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Gr0_Cr1lOx8S6xCaFVCjc4AY6r1j6r4UM4 x0Y48IcVAKI48JMxkF7I0En4kS14v26r1q6r43MxkIecxEwVAFwVW5JwCF04k20xvY0x0E wIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E74 80Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0 I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1lIxAIcVCF04 k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7Cj xVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x07bwcTdUUUUU= X-Originating-IP: [124.16.137.194] X-CM-SenderInfo: 5zdqw5xdqjjk46rwut1l0ox2xfdvhtffof0/ Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=159.226.251.25; envelope-from=wangyang25@otcaix.iscas.ac.cn; helo=cstnet.cn X-Spam_score_int: 15 X-Spam_score: 1.5 X-Spam_bar: + X-Spam_report: (1.5 / 5.0 requ) BAYES_00=-1.9, DATE_IN_PAST_96_XX=3.405, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1789129636582158500 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" HLVX address translation uses execute permission, but the final PMP check on the supervisor physical address must also require read permission. Carry the HLVX operation through the MMU index and include PMP_READ in the final check so execute-only pages fault. Tested: RV32 system-mode RWX, HLV, HLVX.HU, and HLVX.WU PMP test cases. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4414 Signed-off-by: wangyang --- target/riscv/internals.h | 6 ++++++ target/riscv/tcg/cpu_helper.c | 24 ++++++++++++++++-------- target/riscv/tcg/op_helper.c | 11 +++++------ 3 files changed, 27 insertions(+), 14 deletions(-) diff --git a/target/riscv/internals.h b/target/riscv/internals.h index 5d84e4de96..832c6406bc 100644 --- a/target/riscv/internals.h +++ b/target/riscv/internals.h @@ -42,6 +42,7 @@ #define MMUIdx_M 3 #define MMU_2STAGE_BIT (1 << 2) #define MMU_IDX_SS_WRITE (1 << 3) +#define MMU_IDX_HLVX (1 << 4) =20 static inline privilege_mode_t mmuidx_priv(int mmu_idx) { @@ -62,6 +63,11 @@ static inline bool mmuidx_2stage(int mmu_idx) return mmu_idx & MMU_2STAGE_BIT; } =20 +static inline bool mmuidx_hlvx(int mmu_idx) +{ + return mmu_idx & MMU_IDX_HLVX; +} + /* * Return the endianness for the current privilege * level, based on the MSTATUS MBE/SBE/UBE bits. diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c index 07d9222652..ad41de9d06 100644 --- a/target/riscv/tcg/cpu_helper.c +++ b/target/riscv/tcg/cpu_helper.c @@ -905,6 +905,7 @@ void riscv_cpu_set_mode(CPURISCVState *env, privilege_m= ode_t newpriv, */ static int get_physical_address_pmp(CPURISCVState *env, int *prot, hwaddr = addr, int size, MMUAccessType access_type, + pmp_priv_t extra_privs, privilege_mode_t mode) { pmp_priv_t pmp_priv; @@ -915,7 +916,8 @@ static int get_physical_address_pmp(CPURISCVState *env,= int *prot, hwaddr addr, return TRANSLATE_SUCCESS; } =20 - pmp_has_privs =3D pmp_hart_has_privs(env, addr, size, 1 << access_type, + pmp_has_privs =3D pmp_hart_has_privs(env, addr, size, + (1 << access_type) | extra_privs, &pmp_priv, mode); if (!pmp_has_privs) { *prot =3D 0; @@ -1177,7 +1179,7 @@ static int get_physical_address(CPURISCVState *env, h= waddr *physical, int pmp_prot; int pmp_ret =3D get_physical_address_pmp(env, &pmp_prot, pte_addr, sxlen_bytes, - MMU_DATA_LOAD, PRV_S); + MMU_DATA_LOAD, 0, PRV_S); if (pmp_ret !=3D TRANSLATE_SUCCESS) { return TRANSLATE_PMP_FAIL; } @@ -1425,7 +1427,8 @@ static int get_physical_address(CPURISCVState *env, h= waddr *physical, } =20 pmp_ret =3D get_physical_address_pmp(env, &pmp_prot, pte_addr, - sxlen_bytes, MMU_DATA_STORE, PR= V_S); + sxlen_bytes, MMU_DATA_STORE, 0, + PRV_S); if (pmp_ret !=3D TRANSLATE_SUCCESS) { return TRANSLATE_PMP_FAIL; } @@ -1711,7 +1714,9 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, = int size, =20 if (ret =3D=3D TRANSLATE_SUCCESS) { ret =3D get_physical_address_pmp(env, &prot_pmp, pa, - size, access_type, mode); + size, access_type, + mmuidx_hlvx(mmu_idx) ? + PMP_READ : 0, mode); tlb_size =3D pmp_get_tlb_size(env, pa); =20 qemu_log_mask(CPU_LOG_MMU, @@ -1746,7 +1751,9 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, = int size, =20 if (ret =3D=3D TRANSLATE_SUCCESS) { ret =3D get_physical_address_pmp(env, &prot_pmp, pa, - size, access_type, mode); + size, access_type, + mmuidx_hlvx(mmu_idx) ? + PMP_READ : 0, mode); tlb_size =3D pmp_get_tlb_size(env, pa); =20 qemu_log_mask(CPU_LOG_MMU, @@ -1786,9 +1793,10 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address,= int size, cpu_check_watchpoint(cs, address, size, MEMTXATTRS_UNSPECIFIED, wp_access, retaddr); =20 - raise_mmu_exception(env, address, access_type, pmp_pma_violation, - first_stage_error, two_stage_lookup, - two_stage_indirect_error); + raise_mmu_exception(env, address, + mmuidx_hlvx(mmu_idx) ? MMU_DATA_LOAD : access_= type, + pmp_pma_violation, first_stage_error, + two_stage_lookup, two_stage_indirect_error); cpu_loop_exit_restore(cs, retaddr); } =20 diff --git a/target/riscv/tcg/op_helper.c b/target/riscv/tcg/op_helper.c index 3e94005d2b..060d97ee9c 100644 --- a/target/riscv/tcg/op_helper.c +++ b/target/riscv/tcg/op_helper.c @@ -650,7 +650,7 @@ static int check_access_hlsv(CPURISCVState *env, bool x= , uintptr_t ra) if (!x && mode =3D=3D PRV_S && get_field(env->vsstatus, MSTATUS_SUM)) { mode =3D MMUIdx_S_SUM; } - return mode | MMU_2STAGE_BIT; + return mode | MMU_2STAGE_BIT | (x ? MMU_IDX_HLVX : 0); } =20 target_ulong helper_hyp_hlv_bu(CPURISCVState *env, target_ulong addr) @@ -726,11 +726,10 @@ void helper_hyp_hsv_d(CPURISCVState *env, target_ulon= g addr, target_ulong val) } =20 /* - * TODO: These implementations are not quite correct. They perform the - * access using execute permission just fine, but the final PMP check - * is supposed to have read permission as well. Without replicating - * a fair fraction of cputlb.c, fixing this requires adding new mmu_idx - * which would imply that exact check in tlb_fill. + * HLVX accesses are translated with execute permission (first stage), + * but the final PMP check on the supervisor physical address must + * require read permission as well. The MMU_IDX_HLVX mmu_idx bit set + * by check_access_hlsv() makes riscv_cpu_tlb_fill() enforce this. */ target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong addr) { --=20 2.55.0.windows.2 From nobody Sat Sep 26 20:00:21 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1789129626626473.0164224979312; Fri, 11 Sep 2026 05:27:06 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x50Ku-0004If-7F; Fri, 11 Sep 2026 08:26:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x50Kn-00045I-D5; Fri, 11 Sep 2026 08:26:25 -0400 Received: from smtp25.cstnet.cn ([159.226.251.25] helo=cstnet.cn) by eggs.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1x50Ki-0006CV-Qh; Fri, 11 Sep 2026 08:26:25 -0400 Received: from [172.21.96.1] (unknown [124.16.137.194]) by APP-05 (Coremail) with SMTP id zQCowABHtD5k86NqyHDqBw--.17498S6; Fri, 11 Sep 2026 20:26:13 +0800 (CST) Message-ID: In-Reply-To: References: From: wangyang Date: Fri, 4 Sep 2026 21:49:13 +0800 Subject: [PATCH v4 4/5] target/riscv: prioritize Zicfilp checks for misaligned JALR To: qemu-devel@nongnu.org Cc: Palmer Dabbelt , Alistair Francis , Weiwei Li , Daniel Henrique Barboza , Liu Zhiwei , Chao Liu , Christoph Muellner , qemu-riscv@nongnu.org X-CM-TRANSID: zQCowABHtD5k86NqyHDqBw--.17498S6 X-Coremail-Antispam: 1UD129KBjvJXoW7tF4UWF17Zr1fWF4DJryDtrb_yoW8WrW8pr 40k3yUKrZ5tFWkZF4SqF48tF43Xw4fWa10qws7X3Z5tF4YyrW3tF4vkryagFyUCF4kur1a 9FWqya45WFWUJ3JanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQvb7Iv0xC_KF4lb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M280x2IEY4vE77IFxV WkZVCq3wA2048vs2IY020E87I2jVAFwI0_JF0E3s1l82xGYIkIc2x26xkF7I0E14v26ryj 6s0DM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI 0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1l84ACjcxK6I8E87Iv67AK xVW8JVWxJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr1j6F4UJwAac4AC62xK8xCEY4vEwI xC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Gr0_Cr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcVAKI48JMxkF7I0En4kS14v26r1q6r43MxkIecxEwVAFwVW5JwCF04k20xvY 0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I 0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAI cVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr0_Cr1lIxAIcV CF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIE c7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x07j4byAUUUUU= X-Originating-IP: [124.16.137.194] X-CM-SenderInfo: 5zdqw5xdqjjk46rwut1l0ox2xfdvhtffof0/ Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=159.226.251.25; envelope-from=wangyang25@otcaix.iscas.ac.cn; helo=cstnet.cn X-Spam_score_int: 15 X-Spam_score: 1.5 X-Spam_bar: + X-Spam_report: (1.5 / 5.0 requ) BAYES_00=-1.9, DATE_IN_PAST_96_XX=3.405, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1789129628362158500 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" When Zicfilp tracking is active, a misaligned indirect JALR target also violates the landing-pad requirement. Generate the landing-pad software-check before the generic instruction-address-misaligned exception for tracked targets, while retaining the existing exception for untracked targets. Tested: RV64 M-mode and S-mode Zicfilp tracked and untracked misaligned targets with c=3Dtrue and c=3Dfalse. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4415 Reviewed-by: Daniel Henrique Barboza Signed-off-by: wangyang --- target/riscv/tcg/insn_trans/trans_rvi.c.inc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/target/riscv/tcg/insn_trans/trans_rvi.c.inc b/target/riscv/tcg= /insn_trans/trans_rvi.c.inc index cc1b5dbbad..aa79a5ef3c 100644 --- a/target/riscv/tcg/insn_trans/trans_rvi.c.inc +++ b/target/riscv/tcg/insn_trans/trans_rvi.c.inc @@ -187,7 +187,14 @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a) =20 if (misaligned) { gen_set_label(misaligned); - gen_exception_inst_addr_mis(ctx, target_pc); + if (ctx->fcfi_enabled && + a->rs1 !=3D xRA && a->rs1 !=3D xT0 && a->rs1 !=3D xT2) { + tcg_gen_st8_i32(tcg_constant_i32(RISCV_EXCP_SW_CHECK_FCFI_TVAL= ), + tcg_env, offsetof(CPURISCVState, sw_check_code= )); + generate_exception(ctx, RISCV_EXCP_SW_CHECK); + } else { + gen_exception_inst_addr_mis(ctx, target_pc); + } } ctx->base.is_jmp =3D DISAS_NORETURN; =20 --=20 2.55.0.windows.2 From nobody Sat Sep 26 20:00:21 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178912963009430.472368923377644; Fri, 11 Sep 2026 05:27:10 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x50Kr-0004GB-Cr; Fri, 11 Sep 2026 08:26:29 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x50Ko-000463-16; Fri, 11 Sep 2026 08:26:26 -0400 Received: from smtp25.cstnet.cn ([159.226.251.25] helo=cstnet.cn) by eggs.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1x50Kj-0006CW-8Q; Fri, 11 Sep 2026 08:26:25 -0400 Received: from [172.21.96.1] (unknown [124.16.137.194]) by APP-05 (Coremail) with SMTP id zQCowABHtD5k86NqyHDqBw--.17498S7; Fri, 11 Sep 2026 20:26:13 +0800 (CST) Message-ID: <52562c735098160d9e3944994f6f635d9f69c9f8.1789125266.git.wangyang25@otcaix.iscas.ac.cn> In-Reply-To: References: From: wangyang Date: Fri, 4 Sep 2026 21:49:14 +0800 Subject: [PATCH v4 5/5] target/riscv: canonicalize reserved CBIE encoding To: qemu-devel@nongnu.org Cc: Palmer Dabbelt , Alistair Francis , Weiwei Li , Daniel Henrique Barboza , Liu Zhiwei , Chao Liu , Christoph Muellner , qemu-riscv@nongnu.org X-CM-TRANSID: zQCowABHtD5k86NqyHDqBw--.17498S7 X-Coremail-Antispam: 1UD129KBjvJXoW7CFy3Wr48uF1kXr15urW7Jwb_yoW8tF48pF 4UWF45KrWq9ryI9a93Jr1UWF13Kr4rGay5Wwnruw4kXa13CFyftFnrK345Kr4UXFWxK3sF 9wsxGry5Cws5JFDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQlb7Iv0xC_tr1lb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M280x2IEY4vE77IFxV WkZVCq3wA2048vs2IY020E87I2jVAFwI0_JF0E3s1l82xGYIkIc2x26xkF7I0E14v26ryj 6s0DM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI 0_JFI_Gr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Cr0_Gr1UM28EF7xvwVC2z280aVAF wI0_Gr0_Cr1l84ACjcxK6I8E87Iv6xkF7I0E14v26r4UJVWxJr1lnxkEFVAIw20F6cxK64 vIFxWle2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E 2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r4j6F4UMcvjeVCFs4IE7xkEbVWUJV W8JwACjcxG0xvEwIxGrwCY1x0262kKe7AKxVWUtVW8ZwCY02Avz4vE14v_Xr1l42xK82IY c2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s 026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q6r43MIIYrxkI7VAKI48JMIIF 0xvE2Ix0cI8IcVAFwI0_JFI_Gr1lIxAIcVC0I7IYx2IY6xkF7I0E14v26F4j6r4UJwCI42 IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280 aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7IU0Yii7UUUUU== X-Originating-IP: [124.16.137.194] X-CM-SenderInfo: 5zdqw5xdqjjk46rwut1l0ox2xfdvhtffof0/ Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=159.226.251.25; envelope-from=wangyang25@otcaix.iscas.ac.cn; helo=cstnet.cn X-Spam_score_int: 15 X-Spam_score: 1.5 X-Spam_bar: + X-Spam_report: (1.5 / 5.0 requ) BAYES_00=-1.9, DATE_IN_PAST_96_XX=3.405, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1789129632188158500 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" CBIE encoding 10 is reserved when Zicbom is implemented, while encoding 11 has defined behavior. Canonicalize only encoding 10 in the menvcfg, senvcfg, and henvcfg write paths so the reserved value is not retained and the defined encoding remains unchanged. Tested: RV64 menvcfg, senvcfg, and henvcfg CBIE 10 and CBIE 11 write/readback test cases. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4416 Signed-off-by: wangyang --- target/riscv/tcg/csr.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c index bd4b6dc114..cf59f9ae54 100644 --- a/target/riscv/tcg/csr.c +++ b/target/riscv/tcg/csr.c @@ -3260,6 +3260,16 @@ static RISCVException write_menvcfg(CPURISCVState *e= nv, int csrno, stce_changed =3D true; } } + + /* + * CBIE is a WARL field: encoding 10 is reserved. A software write of + * this encoding must canonicalize to a supported value instead of bei= ng + * retained in the readback. + */ + if (cfg->ext_zicbom && get_field(val, MENVCFG_CBIE) =3D=3D 2) { + val &=3D ~MENVCFG_CBIE; + } + env->menvcfg =3D (env->menvcfg & ~mask) | (val & mask); =20 if (stce_changed) { @@ -3354,6 +3364,16 @@ static RISCVException write_senvcfg(CPURISCVState *e= nv, int csrno, mask |=3D SENVCFG_UKTE; } =20 + /* + * CBIE is a WARL field: encoding 10 is reserved. A software write of + * this encoding must canonicalize to a supported value instead of bei= ng + * retained in the readback. + */ + if (env_archcpu(env)->cfg.ext_zicbom && + get_field(val, SENVCFG_CBIE) =3D=3D 2) { + val &=3D ~SENVCFG_CBIE; + } + env->senvcfg =3D (env->senvcfg & ~mask) | (val & mask); return RISCV_EXCP_NONE; } @@ -3422,6 +3442,15 @@ static RISCVException write_henvcfg(CPURISCVState *e= nv, int csrno, } } =20 + /* + * CBIE is a WARL field: encoding 10 is reserved. A software write of + * this encoding must canonicalize to a supported value instead of bei= ng + * retained in the readback. + */ + if (cfg->ext_zicbom && get_field(val, HENVCFG_CBIE) =3D=3D 2) { + val &=3D ~HENVCFG_CBIE; + } + if (riscv_cpu_mxl(env) =3D=3D MXL_RV32) { /* * RV32 stores STCE/ADUE/PBMTE/DTE in henvcfgh, so a low-half henv= cfg --=20 2.55.0.windows.2