* [PATCH 0/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
0 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via qemu development @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
SSPUSH and SSPOPCHK form their effective address from ssp rather than
a GPR, so they bypass get_address() and never apply the pointer-masking
ignore transformation. With pointer masking enabled, a tagged ssp
raises a store/AMO page fault, whereas Spike, Sail and Whisper mask
the access.
Patch 1 factors the address adjustment out of get_address() and
get_address_indexed() into gen_pm_adjust_addr(), with no functional
change. Patch 2 applies it to the SSPUSH/SSPOPCHK address. ssp is still
written back unmasked, and the SSPOPCHK value comparison is unchanged.
Tested with the reproducer from the issue; all four cases now match
Spike.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758
Rishab Pradeep (2):
target/riscv: Factor out pointer-masking address adjustment
target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses
.../tcg/insn_trans/trans_rvzicfiss.c.inc | 8 +++++--
target/riscv/tcg/translate.c | 21 ++++++++++---------
2 files changed, 17 insertions(+), 12 deletions(-)
--
2.54.0 (Apple Git-157)
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/2] target/riscv: Factor out pointer-masking address adjustment
2026-10-29 18:37 ` Rishab Pradeep via qemu development
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
-1 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
Move the addr_xl/addr_signed extract, which applies address-width
truncation and the pointer-masking ignore transformation, out of
get_address() and get_address_indexed() into a new helper,
gen_pm_adjust_addr(), so it can be applied to addresses that are not
formed from a GPR. No functional change.
Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
---
target/riscv/tcg/translate.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/target/riscv/tcg/translate.c b/target/riscv/tcg/translate.c
index 79b0f444ef..72d36764d8 100644
--- a/target/riscv/tcg/translate.c
+++ b/target/riscv/tcg/translate.c
@@ -654,6 +654,15 @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
ctx->base.is_jmp = DISAS_NORETURN;
}
+static void gen_pm_adjust_addr(DisasContext *ctx, TCGv dest, TCGv src)
+{
+ if (ctx->addr_signed) {
+ tcg_gen_sextract_tl(dest, src, 0, ctx->addr_xl);
+ } else {
+ tcg_gen_extract_tl(dest, src, 0, ctx->addr_xl);
+ }
+}
+
/* Compute a canonical address from a register plus offset. */
static TCGv get_address(DisasContext *ctx, int rs1, int imm)
{
@@ -661,11 +670,7 @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
tcg_gen_addi_tl(addr, src1, imm);
- if (ctx->addr_signed) {
- tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
- } else {
- tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
- }
+ gen_pm_adjust_addr(ctx, addr, addr);
return addr;
}
@@ -677,11 +682,7 @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
tcg_gen_add_tl(addr, src1, offs);
- if (ctx->addr_signed) {
- tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
- } else {
- tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
- }
+ gen_pm_adjust_addr(ctx, addr, addr);
return addr;
}
--
2.54.0 (Apple Git-157)
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 1/2] target/riscv: Factor out pointer-masking address adjustment
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
0 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via qemu development @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
Move the addr_xl/addr_signed extract, which applies address-width
truncation and the pointer-masking ignore transformation, out of
get_address() and get_address_indexed() into a new helper,
gen_pm_adjust_addr(), so it can be applied to addresses that are not
formed from a GPR. No functional change.
Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
---
target/riscv/tcg/translate.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/target/riscv/tcg/translate.c b/target/riscv/tcg/translate.c
index 79b0f444ef..72d36764d8 100644
--- a/target/riscv/tcg/translate.c
+++ b/target/riscv/tcg/translate.c
@@ -654,6 +654,15 @@ static void gen_jal(DisasContext *ctx, int rd, target_ulong imm)
ctx->base.is_jmp = DISAS_NORETURN;
}
+static void gen_pm_adjust_addr(DisasContext *ctx, TCGv dest, TCGv src)
+{
+ if (ctx->addr_signed) {
+ tcg_gen_sextract_tl(dest, src, 0, ctx->addr_xl);
+ } else {
+ tcg_gen_extract_tl(dest, src, 0, ctx->addr_xl);
+ }
+}
+
/* Compute a canonical address from a register plus offset. */
static TCGv get_address(DisasContext *ctx, int rs1, int imm)
{
@@ -661,11 +670,7 @@ static TCGv get_address(DisasContext *ctx, int rs1, int imm)
TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
tcg_gen_addi_tl(addr, src1, imm);
- if (ctx->addr_signed) {
- tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
- } else {
- tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
- }
+ gen_pm_adjust_addr(ctx, addr, addr);
return addr;
}
@@ -677,11 +682,7 @@ static TCGv get_address_indexed(DisasContext *ctx, int rs1, TCGv offs)
TCGv src1 = get_gpr(ctx, rs1, EXT_NONE);
tcg_gen_add_tl(addr, src1, offs);
- if (ctx->addr_signed) {
- tcg_gen_sextract_tl(addr, addr, 0, ctx->addr_xl);
- } else {
- tcg_gen_extract_tl(addr, addr, 0, ctx->addr_xl);
- }
+ gen_pm_adjust_addr(ctx, addr, addr);
return addr;
}
--
2.54.0 (Apple Git-157)
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses
2026-10-29 18:37 ` Rishab Pradeep via qemu development
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
-1 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
SSPUSH and SSPOPCHK form their effective address from ssp rather than
a GPR, so they bypass get_address() and the pointer-masking ignore
transformation is never applied. With pointer masking enabled, a
tagged ssp raises a store/AMO page fault, while SSAMOSWAP through the
same tagged pointer succeeds.
Apply gen_pm_adjust_addr() to the ssp-derived address. ssp itself is
still written back unmasked, and the SSPOPCHK comparison of the loaded
value against rs1 is unchanged.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758
Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
---
target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
index d47a9f9c7d..c2dddcc8bb 100644
--- a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
@@ -29,6 +29,7 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
}
TCGv addr = tcg_temp_new();
+ TCGv maddr = tcg_temp_new();
TCGLabel *skip = gen_new_label();
uint32_t tmp = (get_xl(ctx) == MXL_RV64) ? 8 : 4;
TCGv data = tcg_temp_new();
@@ -36,8 +37,9 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
TCGv_i64 wide_addr = tcg_temp_new_i64();
tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
tcg_gen_trunc_i64_tl(addr, wide_addr);
+ gen_pm_adjust_addr(ctx, maddr, addr);
decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
- tcg_gen_qemu_ld_tl(data, addr, SS_MMU_INDEX(ctx),
+ tcg_gen_qemu_ld_tl(data, maddr, SS_MMU_INDEX(ctx),
mxl_memop(ctx) | MO_ALIGN);
TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip);
@@ -60,6 +62,7 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
}
TCGv addr = tcg_temp_new();
+ TCGv maddr = tcg_temp_new();
int tmp = (get_xl(ctx) == MXL_RV64) ? -8 : -4;
TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
TCGv_i64 wide_addr = tcg_temp_new_i64();
@@ -67,7 +70,8 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
tcg_gen_trunc_i64_tl(addr, wide_addr);
tcg_gen_addi_tl(addr, addr, tmp);
- tcg_gen_qemu_st_tl(data, addr, SS_MMU_INDEX(ctx),
+ gen_pm_adjust_addr(ctx, maddr, addr);
+ tcg_gen_qemu_st_tl(data, maddr, SS_MMU_INDEX(ctx),
mxl_memop(ctx) | MO_ALIGN);
tcg_gen_ext_tl_i64(wide_addr, addr);
tcg_gen_st_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
--
2.54.0 (Apple Git-157)
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses
@ 2026-10-29 18:37 ` Rishab Pradeep via qemu development
0 siblings, 0 replies; 6+ messages in thread
From: Rishab Pradeep via qemu development @ 2026-10-29 18:37 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-riscv, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, Chao Liu, Tarun Patanjali,
Chris Elwood, Rishab Pradeep
SSPUSH and SSPOPCHK form their effective address from ssp rather than
a GPR, so they bypass get_address() and the pointer-masking ignore
transformation is never applied. With pointer masking enabled, a
tagged ssp raises a store/AMO page fault, while SSAMOSWAP through the
same tagged pointer succeeds.
Apply gen_pm_adjust_addr() to the ssp-derived address. ssp itself is
still written back unmasked, and the SSPOPCHK comparison of the loaded
value against rs1 is unchanged.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758
Co-developed-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Signed-off-by: Tarun Patanjali <tarun.patanjali@utexas.edu>
Co-developed-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Chris Elwood <christopher.elwood2024@gmail.com>
Signed-off-by: Rishab Pradeep <rishab@rispop.dev>
---
target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
index d47a9f9c7d..c2dddcc8bb 100644
--- a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc
@@ -29,6 +29,7 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
}
TCGv addr = tcg_temp_new();
+ TCGv maddr = tcg_temp_new();
TCGLabel *skip = gen_new_label();
uint32_t tmp = (get_xl(ctx) == MXL_RV64) ? 8 : 4;
TCGv data = tcg_temp_new();
@@ -36,8 +37,9 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
TCGv_i64 wide_addr = tcg_temp_new_i64();
tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
tcg_gen_trunc_i64_tl(addr, wide_addr);
+ gen_pm_adjust_addr(ctx, maddr, addr);
decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
- tcg_gen_qemu_ld_tl(data, addr, SS_MMU_INDEX(ctx),
+ tcg_gen_qemu_ld_tl(data, maddr, SS_MMU_INDEX(ctx),
mxl_memop(ctx) | MO_ALIGN);
TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip);
@@ -60,6 +62,7 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
}
TCGv addr = tcg_temp_new();
+ TCGv maddr = tcg_temp_new();
int tmp = (get_xl(ctx) == MXL_RV64) ? -8 : -4;
TCGv data = get_gpr(ctx, a->rs2, EXT_NONE);
TCGv_i64 wide_addr = tcg_temp_new_i64();
@@ -67,7 +70,8 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a)
tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
tcg_gen_trunc_i64_tl(addr, wide_addr);
tcg_gen_addi_tl(addr, addr, tmp);
- tcg_gen_qemu_st_tl(data, addr, SS_MMU_INDEX(ctx),
+ gen_pm_adjust_addr(ctx, maddr, addr);
+ tcg_gen_qemu_st_tl(data, maddr, SS_MMU_INDEX(ctx),
mxl_memop(ctx) | MO_ALIGN);
tcg_gen_ext_tl_i64(wide_addr, addr);
tcg_gen_st_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp));
--
2.54.0 (Apple Git-157)
^ permalink raw reply related [flat|nested] 6+ messages in thread