* [PATCH 0/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
0 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
SSPUSH and SSPOPCHK form their effective address from ssp rather than
a GPR, so they bypass get_address() and never apply the pointer-masking
ignore transformation. With pointer masking enabled, a tagged ssp
raises a store/AMO page fault, whereas Spike, Sail and Whisper mask
the access.
Patch 1 factors the address adjustment out of get_address() and
get_address_indexed() into gen_pm_adjust_addr(), with no functional
change. Patch 2 applies it to the SSPUSH/SSPOPCHK address. ssp is still
written back unmasked, and the SSPOPCHK value comparison is unchanged.
Tested with the reproducer from the issue; all four cases now match
Spike.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758
Rishab Pradeep (2):
target/riscv: Factor out pointer-masking address adjustment
target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses
.../tcg/insn_trans/trans_rvzicfiss.c.inc | 8 +++++--
target/riscv/tcg/translate.c | 21 ++++++++++---------
2 files changed, 17 insertions(+), 12 deletions(-)
--
2.54.0 (Apple Git-157)
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 0/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
0 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via qemu development @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
SSPUSH and SSPOPCHK form their effective address from ssp rather than
a GPR, so they bypass get_address() and never apply the pointer-masking
ignore transformation. With pointer masking enabled, a tagged ssp
raises a store/AMO page fault, whereas Spike, Sail and Whisper mask
the access.
Patch 1 factors the address adjustment out of get_address() and
get_address_indexed() into gen_pm_adjust_addr(), with no functional
change. Patch 2 applies it to the SSPUSH/SSPOPCHK address. ssp is still
written back unmasked, and the SSPOPCHK value comparison is unchanged.
Tested with the reproducer from the issue; all four cases now match
Spike.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758
Rishab Pradeep (2):
target/riscv: Factor out pointer-masking address adjustment
target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses
.../tcg/insn_trans/trans_rvzicfiss.c.inc | 8 +++++--
target/riscv/tcg/translate.c | 21 ++++++++++---------
2 files changed, 17 insertions(+), 12 deletions(-)
--
2.54.0 (Apple Git-157)
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] target/riscv: Factor out pointer-masking address adjustment
2026-10-29 18:37 ` Rishab Pradeep via qemu development
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
-1 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
Move the addr_xl/addr_signed extract, which applies address-width
truncation and the pointer-masking ignore transformation, out of
get_address() and get_address_indexed() into a new helper,
gen_pm_adjust_addr(), so it can be applied to addresses that are not
formed from a GPR. No functional change.
Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
---
target/riscv/tcg/translate.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/target/riscv/tcg/translate.c b/target/riscv/tcg/translate.c
index 79b0f444ef..72d36764d8 100644
--- a/target/riscv/tcg/translate.c
+++ b/target/riscv/tcg/translate.c
@@ -654,6 +654,15 @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
ctx->base.is_jmp = DISAS_NORETURN;
}
+static void gen_pm_adjust_addr(DisasContext *ctx, TCGv dest, TCGv src)
+{
+ if (ctx->addr_signed) {
+ tcg_gen_sextract_tl(dest, src, 0, ctx->addr_xl);
+ } else {
+ tcg_gen_extract_tl(dest, src, 0, ctx->addr_xl);
+ }
+}
+
/* Compute a canonical address from a register plus offset. */
static TCGv get_address(DisasContext *ctx, int rs1, int imm)
{
@@ -661,11 +670,7 @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
tcg_gen_addi_tl(addr, src1, imm);
- if (ctx->addr_signed) {
- tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
- } else {
- tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
- }
+ gen_pm_adjust_addr(ctx, addr, addr);
return addr;
}
@@ -677,11 +682,7 @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
tcg_gen_add_tl(addr, src1, offs);
- if (ctx->addr_signed) {
- tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
- } else {
- tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
- }
+ gen_pm_adjust_addr(ctx, addr, addr);
return addr;
}
--
2.54.0 (Apple Git-157)
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 1/2] target/riscv: Factor out pointer-masking address adjustment
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
0 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via qemu development @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
Move the addr_xl/addr_signed extract, which applies address-width
truncation and the pointer-masking ignore transformation, out of
get_address() and get_address_indexed() into a new helper,
gen_pm_adjust_addr(), so it can be applied to addresses that are not
formed from a GPR. No functional change.
Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
---
target/riscv/tcg/translate.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/target/riscv/tcg/translate.c b/target/riscv/tcg/translate.c
index 79b0f444ef..72d36764d8 100644
--- a/target/riscv/tcg/translate.c
+++ b/target/riscv/tcg/translate.c
@@ -654,6 +654,15 @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
ctx->base.is_jmp = DISAS_NORETURN;
}
+static void gen_pm_adjust_addr(DisasContext *ctx, TCGv dest, TCGv src)
+{
+ if (ctx->addr_signed) {
+ tcg_gen_sextract_tl(dest, src, 0, ctx->addr_xl);
+ } else {
+ tcg_gen_extract_tl(dest, src, 0, ctx->addr_xl);
+ }
+}
+
/* Compute a canonical address from a register plus offset. */
static TCGv get_address(DisasContext *ctx, int rs1, int imm)
{
@@ -661,11 +670,7 @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
tcg_gen_addi_tl(addr, src1, imm);
- if (ctx->addr_signed) {
- tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
- } else {
- tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
- }
+ gen_pm_adjust_addr(ctx, addr, addr);
return addr;
}
@@ -677,11 +682,7 @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
tcg_gen_add_tl(addr, src1, offs);
- if (ctx->addr_signed) {
- tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
- } else {
- tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
- }
+ gen_pm_adjust_addr(ctx, addr, addr);
return addr;
}
--
2.54.0 (Apple Git-157)
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses
2026-10-29 18:37 ` Rishab Pradeep via qemu development
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
-1 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
SSPUSH and SSPOPCHK form their effective address from ssp rather than
a GPR, so they bypass get_address() and the pointer-masking ignore
transformation is never applied. With pointer masking enabled, a
tagged ssp raises a store/AMO page fault, while SSAMOSWAP through the
same tagged pointer succeeds.
Apply gen_pm_adjust_addr() to the ssp-derived address. ssp itself is
still written back unmasked, and the SSPOPCHK comparison of the loaded
value against rs1 is unchanged.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758
Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
---
target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
index d47a9f9c7d..c2dddcc8bb 100644
--- a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
@@ -29,6 +29,7 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
}
TCGv addr = tcg_temp_new();
+ TCGv maddr = tcg_temp_new();
TCGLabel *skip = gen_new_label();
uint32_t tmp = (get_xl(ctx) == MXL_RV64) ? 8 : 4;
TCGv data = tcg_temp_new();
@@ -36,8 +37,9 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
TCGv_i64 wide_addr = tcg_temp_new_i64();
tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
tcg_gen_trunc_i64_tl(addr, wide_addr);
+ gen_pm_adjust_addr(ctx, maddr, addr);
decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
- tcg_gen_qemu_ld_tl(data, addr, SS_MMU_INDEX(ctx),
+ tcg_gen_qemu_ld_tl(data, maddr, SS_MMU_INDEX(ctx),
mxl_memop(ctx) | MO_ALIGN);
TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip);
@@ -60,6 +62,7 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
}
TCGv addr = tcg_temp_new();
+ TCGv maddr = tcg_temp_new();
int tmp = (get_xl(ctx) == MXL_RV64) ? -8 : -4;
TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
TCGv_i64 wide_addr = tcg_temp_new_i64();
@@ -67,7 +70,8 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
tcg_gen_trunc_i64_tl(addr, wide_addr);
tcg_gen_addi_tl(addr, addr, tmp);
- tcg_gen_qemu_st_tl(data, addr, SS_MMU_INDEX(ctx),
+ gen_pm_adjust_addr(ctx, maddr, addr);
+ tcg_gen_qemu_st_tl(data, maddr, SS_MMU_INDEX(ctx),
mxl_memop(ctx) | MO_ALIGN);
tcg_gen_ext_tl_i64(wide_addr, addr);
tcg_gen_st_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
--
2.54.0 (Apple Git-157)
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
0 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via qemu development @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
SSPUSH and SSPOPCHK form their effective address from ssp rather than
a GPR, so they bypass get_address() and the pointer-masking ignore
transformation is never applied. With pointer masking enabled, a
tagged ssp raises a store/AMO page fault, while SSAMOSWAP through the
same tagged pointer succeeds.
Apply gen_pm_adjust_addr() to the ssp-derived address. ssp itself is
still written back unmasked, and the SSPOPCHK comparison of the loaded
value against rs1 is unchanged.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758
Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
---
target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
index d47a9f9c7d..c2dddcc8bb 100644
--- a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
@@ -29,6 +29,7 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
}
TCGv addr = tcg_temp_new();
+ TCGv maddr = tcg_temp_new();
TCGLabel *skip = gen_new_label();
uint32_t tmp = (get_xl(ctx) == MXL_RV64) ? 8 : 4;
TCGv data = tcg_temp_new();
@@ -36,8 +37,9 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
TCGv_i64 wide_addr = tcg_temp_new_i64();
tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
tcg_gen_trunc_i64_tl(addr, wide_addr);
+ gen_pm_adjust_addr(ctx, maddr, addr);
decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
- tcg_gen_qemu_ld_tl(data, addr, SS_MMU_INDEX(ctx),
+ tcg_gen_qemu_ld_tl(data, maddr, SS_MMU_INDEX(ctx),
mxl_memop(ctx) | MO_ALIGN);
TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip);
@@ -60,6 +62,7 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
}
TCGv addr = tcg_temp_new();
+ TCGv maddr = tcg_temp_new();
int tmp = (get_xl(ctx) == MXL_RV64) ? -8 : -4;
TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
TCGv_i64 wide_addr = tcg_temp_new_i64();
@@ -67,7 +70,8 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
tcg_gen_trunc_i64_tl(addr, wide_addr);
tcg_gen_addi_tl(addr, addr, tmp);
- tcg_gen_qemu_st_tl(data, addr, SS_MMU_INDEX(ctx),
+ gen_pm_adjust_addr(ctx, maddr, addr);
+ tcg_gen_qemu_st_tl(data, maddr, SS_MMU_INDEX(ctx),
mxl_memop(ctx) | MO_ALIGN);
tcg_gen_ext_tl_i64(wide_addr, addr);
tcg_gen_st_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
--
2.54.0 (Apple Git-157)
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-29 19:47 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-29 18:37 [PATCH 0/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK Rishab Pradeep via
2026-10-29 18:37 ` Rishab Pradeep via qemu development
2026-10-29 18:37 ` [PATCH 1/2] target/riscv: Factor out pointer-masking address adjustment Rishab Pradeep via
2026-10-29 18:37 ` Rishab Pradeep via qemu development
2026-10-29 18:37 ` [PATCH 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses Rishab Pradeep via
2026-10-29 18:37 ` Rishab Pradeep via qemu development
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.