From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34A14606A31A for ; Sun, 8 Nov 2026 06:48:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=rispop.dev header.i=@rispop.dev header.a=rsa-sha256 header.s=protonmail header.b=bBvOE58L Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xPwgl-0002Aj-IY; Sun, 08 Nov 2026 01:47:39 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xPwgj-00029Q-Qh; Sun, 08 Nov 2026 01:47:37 -0500 Received: from mail-08.mail-europe.com ([57.129.93.249]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xPwgi-0006ZD-0Z; Sun, 08 Nov 2026 01:47:37 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rispop.dev; s=protonmail; t=1794120450; x=1794379650; bh=ixbeA60442mQ0Q29fLlJKpd3b2QlpZNzrw5VgkVIKdI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:From:To: Cc:Date:Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=bBvOE58LrQQPT/tVaqhEFSIuRa9qUizGs8ZTEgEQxDMA7sy86xQVm9j+ThrKKa0mS o/KAiUvnTYN8phj1Utw7wnpNMKTdQSvupPAPLfyCGmkND6vx0LWGTqZUuTzt1X5yXq APBUkkxW0Lh9qujh7Se9qWUlPWnxwwVr2tJ1fqPvKCLNDgWsZeC467f7tXUwHIykLA cJIrhavQYjtcezg5V/xmMK17ZM7nFVgAEAyOFqJmUp+YckPaH4v12j3XD/aPGxNsNS nU1qNVmKaNJ+rCXjDc0H+euTrPsDRUVhq+KB1FGXWVwWV8q66FKuzwteg0oYoGltsE 4UO9rJTPZKwpw== X-Pm-Submission-Id: 4jMk4G4kpPz2ScP4 From: Rishab Pradeep To: qemu-devel@nongnu.org Cc: qemu-riscv@nongnu.org, Palmer Dabbelt , Alistair Francis , Weiwei Li , Daniel Henrique Barboza , Liu Zhiwei , Chao Liu , Tarun Patanjali , Chris Elwood , Rishab Pradeep Subject: [PATCH v2 2/2] target/riscv: Apply pointer masking to SSPUSH/SSPOPCHK addresses Date: Sun, 8 Nov 2026 00:46:41 -0600 Message-ID: <20261108064641.179764-3-rishab@rispop.dev> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261108064641.179764-1-rishab@rispop.dev> References: <20261108064641.179764-1-rishab@rispop.dev> X-Archived-By: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=57.129.93.249; envelope-from=rishab@rispop.dev; helo=mail-08.mail-europe.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-riscv@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-riscv-bounces+qemu-riscv=archiver.kernel.org@nongnu.org X-Spam-Status: No, score=-23.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_PASS,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 From: Rishab Pradeep SSPUSH and SSPOPCHK form their effective address from ssp rather than a GPR, so they bypass get_address() and the pointer-masking ignore transformation is never applied. With pointer masking enabled, a tagged ssp raises a store/AMO page fault, while SSAMOSWAP through the same tagged pointer succeeds. The Privileged Architecture Specification, Section 17.1.2.6 ("Memory Accesses Subject to Pointer Masking"), applies the ignore transformation to the effective address of explicit memory accesses. SSPUSH and SSPOPCHK perform explicit store and load accesses at ssp, so that address must be masked. Apply gen_pm_adjust_addr() to the ssp-derived address. ssp itself is still written back unmasked, and the SSPOPCHK comparison of the loaded value against rs1 is unchanged. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4758 Co-developed-by: Tarun Patanjali Signed-off-by: Tarun Patanjali Co-developed-by: Chris Elwood Signed-off-by: Chris Elwood Signed-off-by: Rishab Pradeep --- target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc index d47a9f9c7d..c2dddcc8bb 100644 --- a/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc +++ b/target/riscv/tcg/insn_trans/trans_rvzicfiss.c.inc @@ -29,6 +29,7 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a) } TCGv addr = tcg_temp_new(); + TCGv maddr = tcg_temp_new(); TCGLabel *skip = gen_new_label(); uint32_t tmp = (get_xl(ctx) == MXL_RV64) ? 8 : 4; TCGv data = tcg_temp_new(); @@ -36,8 +37,9 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a) TCGv_i64 wide_addr = tcg_temp_new_i64(); tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp)); tcg_gen_trunc_i64_tl(addr, wide_addr); + gen_pm_adjust_addr(ctx, maddr, addr); decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO); - tcg_gen_qemu_ld_tl(data, addr, SS_MMU_INDEX(ctx), + tcg_gen_qemu_ld_tl(data, maddr, SS_MMU_INDEX(ctx), mxl_memop(ctx) | MO_ALIGN); TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE); tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip); @@ -60,6 +62,7 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a) } TCGv addr = tcg_temp_new(); + TCGv maddr = tcg_temp_new(); int tmp = (get_xl(ctx) == MXL_RV64) ? -8 : -4; TCGv data = get_gpr(ctx, a->rs2, EXT_NONE); TCGv_i64 wide_addr = tcg_temp_new_i64(); @@ -67,7 +70,8 @@ static bool trans_sspush(DisasContext *ctx, arg_sspush *a) tcg_gen_ld_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp)); tcg_gen_trunc_i64_tl(addr, wide_addr); tcg_gen_addi_tl(addr, addr, tmp); - tcg_gen_qemu_st_tl(data, addr, SS_MMU_INDEX(ctx), + gen_pm_adjust_addr(ctx, maddr, addr); + tcg_gen_qemu_st_tl(data, maddr, SS_MMU_INDEX(ctx), mxl_memop(ctx) | MO_ALIGN); tcg_gen_ext_tl_i64(wide_addr, addr); tcg_gen_st_i64(wide_addr, tcg_env, offsetof(CPURISCVState, ssp)); -- 2.56.0