From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0A1CCC43458 for ; Sun, 5 Jul 2026 13:18:21 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgMjY-0002Jt-Su; Sun, 05 Jul 2026 09:18:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgMjY-0002Je-15 for qemu-riscv@nongnu.org; Sun, 05 Jul 2026 09:18:08 -0400 Received: from mail-wm1-x334.google.com ([2a00:1450:4864:20::334]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1wgMjV-0003po-RK for qemu-riscv@nongnu.org; Sun, 05 Jul 2026 09:18:07 -0400 Received: by mail-wm1-x334.google.com with SMTP id 5b1f17b1804b1-493b77b150aso19488685e9.2 for ; Sun, 05 Jul 2026 06:18:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783257483; x=1783862283; darn=nongnu.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=3iQ6foKp7BWXNI7l7JdIldcj04hpvpDIkEePupB9eIQ=; b=poaQrKri+3Fu+zOE//3MG5qV8kAkwGsqKRDOWI0YPxQXR1gZ+9SfnYxHjRhQx296/2 jrpPNJponyqhVczUTLpQEUaxRvO5ZhcMVT9Qo4x7B0lvgi/3kYbGJ+T9SRk3vTjC5QYO gFgiuAcSSyr54luC7ELLa37tPUf6RFviU6skqEl9frWV86x4KopIDoPKLlSvGc2etCf+ RXj1Wmo1YwzwL9Ycv1uKKbcWG22ZLZi2n336jf9RpbIn02yJcpPv30QAo42SQuvZfNB+ rfncCTR90YVJw8j/YvBHVTTbG1/hXxlXmMKcC0rELkx5KuLkWDZSAhP7ZQ6kRvsPLroa NKmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783257483; x=1783862283; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3iQ6foKp7BWXNI7l7JdIldcj04hpvpDIkEePupB9eIQ=; b=j6dG9mTr+aYR9I7Vl8Nj2+/1sT9kL0boDZfhZY561+NdaGKA3dbcX80cKZzrTAUqcI sgqHQi0JljIddGu0wMMwMjTmt3OOnAntxZjQTGHCQGlxVx8RQ3jLCsTpGjT9I+vsbIpM D2pK2gIqV6BrNixDUQVjkZ8CaNPm0bDnsOIiZvu4shKFgXIb6CmMhywCFLL0J8KcI3qc Ik/7g9SvPRaaFktqtI3XILpL58+ypU9ZG59fZj2KtznKcH/tZRrDlZUeKZSA3BUW/4qX Lr+/GO5YixYkmBc1gtAtr1cfNTW15uTX1w/DsyekJDJyPMtwfT0ArDi1JrXAUH6UTyVA QiKg== X-Forwarded-Encrypted: i=1; AFNElJ96Isl9pieYQKgiv1xmXBBLOdRq0upHYSfAEGxmCcaC70xSQllL8XOEEUksss61jQ2Xr6afXg/w7JYo@nongnu.org X-Gm-Message-State: AOJu0YwoWRhWVaubQlwH+vU+9qVFK5Megb08+hpYj4idTB2rC0kzBwZv qeEYFBLzOhv1xQegvlWYhmsgVpPNjKXGNIeYG1vg5eGZ76EUqlMxd2tY X-Gm-Gg: AfdE7ckvqucoen416HN/3+IrtQ5zID0VPqvTBb8WsbAYwzqCQtSB0i53YWCqMkU3DG3 enlj3R9TfxNYiA08RviRT4UygET+/cjRBkvjKnL2snzOgVHDVfW0a1gGVYKbR+PVLa9Fc2UVcV8 x/TwKQfAgRQB8+3F5FC39THe2r23IqKaFoEyww6XJhgvExQltFW/ZWvoSaMC0HSsCKFdg/JWUEa zM25QyQ3zDJn8geeF+FFbOCJSFYKMOvTq3ej7ZKEbH2jJWB9h1SnLFOyxgcs30Lve38FmAIlb79 ahZBd2OB5faBCVeXtCVNsPKWPZlJwiT6Ah6SDdYirs2wmLZykzq6aOrEJL+s+xGs88ItH6oJhSQ 9ROxKtQJHsbASTeL1N2mjQtN010UOAhfHJn0jEA5jbo04otZnRASjjfL7ThAV4R1+Io2dry1Wfj 0ZA5+UrkYTMF3bIy9v9edmfckst33tAVXsW40PPpQCloQkpxlximSQEnw1I6fMjWWupYmF X-Received: by 2002:a05:600c:529a:b0:493:b7cb:c5f with SMTP id 5b1f17b1804b1-493d11d7f58mr79902045e9.11.1783257482717; Sun, 05 Jul 2026 06:18:02 -0700 (PDT) Received: from user-Legion-Pro-5-16ARX8.. (cable-94-189-254-58.dynamic.sbb.rs. [94.189.254.58]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493ccd9d607sm259916135e9.2.2026.07.05.06.18.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 05 Jul 2026 06:18:02 -0700 (PDT) From: imaginos To: Palmer Dabbelt , Alistair Francis Cc: Weiwei Li , Daniel Henrique Barboza , Liu Zhiwei , Chao Liu , qemu-riscv@nongnu.org, qemu-devel@nongnu.org, imaginos Subject: [PATCH] target/riscv: check G-stage write permission for VS-stage A/D updates Date: Sun, 5 Jul 2026 15:16:40 +0200 Message-ID: <20260705131734.13792-1-imaginos32@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2a00:1450:4864:20::334; envelope-from=imaginos32@gmail.com; helo=mail-wm1-x334.google.com X-Spam_score_int: -17 X-Spam_score: -1.8 X-Spam_bar: - X-Spam_report: (-1.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-riscv@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-riscv-bounces+qemu-riscv=archiver.kernel.org@nongnu.org Sender: qemu-riscv-bounces+qemu-riscv=archiver.kernel.org@nongnu.org During a two-stage (VS-stage + G-stage) page-table walk with hardware A/D updating enabled (Svadu / menvcfg.ADUE), a store that reaches a VS-stage leaf PTE whose accessed or dirty bit is clear triggers a hardware write-back of those bits into the PTE. That write-back is an implicit store to the PTE's guest-physical address, so it must be permitted by G-stage. Fix this by re-running the G-stage translation of the guest PTE's address with store semantics. get_physical_address() then also checks that G-stage permits the guest PTE to be written, and raises a guest-page store fault when it does not. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3426 Signed-off-by: imaginos --- target/riscv/cpu_helper.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) Verified against Spike, with this patch QEMU's reported values match Spike. Spike (reference): QEMU, before this patch: mcause 0x17 mcause 0x17 mtval 0x80000000 mtval 0x80000000 mtval2 0x20001004 mtval2 0x20000000 mtinst 0x3020 mtinst 0x6a704073 If I've misread any of the A/D-update semantics here, I'd appreciate the correction. diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 2db07f5dfb..3b4d2aea96 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -1370,6 +1370,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical, int ptshift; target_ulong pte; hwaddr pte_addr; + hwaddr pte_gpa = 0; const hwaddr base_root = base; const bool be = mo_endian_env(env) == MO_BE; int i; @@ -1407,6 +1408,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical, } pte_addr = vbase + idx * ptesize; + pte_gpa = base + idx * ptesize; } else { pte_addr = base + idx * ptesize; } @@ -1661,6 +1663,28 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical, return TRANSLATE_FAIL; } + /* + * The implicit store that writes updated A/D bits back to a VS-stage + * (first-stage) PTE must itself be permitted by G-stage. Re-run the + * second-stage translation of the PTE's guest-physical address with + * store semantics; if G-stage denies write, G-stage store fault + * against the PTE address. + */ + if (two_stage && first_stage) { + int gpa_prot; + hwaddr gpa_paddr; + int gpa_ret = get_physical_address(env, &gpa_paddr, &gpa_prot, + pte_gpa, NULL, MMU_DATA_STORE, + MMUIdx_U, false, true, + is_debug, false); + if (gpa_ret != TRANSLATE_SUCCESS) { + if (fault_pte_addr) { + *fault_pte_addr = pte_gpa >> 2; + } + return TRANSLATE_G_STAGE_FAIL; + } + } + pmp_ret = get_physical_address_pmp(env, &pmp_prot, pte_addr, sxlen_bytes, MMU_DATA_STORE, PRV_S); if (pmp_ret != TRANSLATE_SUCCESS) { @@ -2345,6 +2369,10 @@ void riscv_cpu_do_interrupt(CPUState *cs) * doing VS-stage page table walk. */ tinst = (riscv_cpu_xlen(env) == 32) ? 0x00002000 : 0x00003000; + + if (cause == RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT) { + tinst |= 0x20; + } } else { /* * The "Addr. Offset" field in transformed instruction is -- 2.43.0