* [PATCH v2 1/6] target/riscv: fix address masking
2025-11-21 5:04 [PATCH v2 0/6] Fix Zjpm implementation frank.chang
@ 2025-11-21 5:04 ` frank.chang
2025-11-21 5:04 ` [PATCH v2 2/6] target/riscv: Add a helper to return the current effective priv mode frank.chang
` (4 subsequent siblings)
5 siblings, 0 replies; 13+ messages in thread
From: frank.chang @ 2025-11-21 5:04 UTC (permalink / raw)
To: qemu-devel
Cc: Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
Yong-Xuan Wang
From: Yong-Xuan Wang <yongxuan.wang@sifive.com>
The pmlen should get the corresponding value before shifting address.
Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
---
target/riscv/internals.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 172296f12e2..9b3f01144d2 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -203,8 +203,8 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
if (!is_virt_addr) {
signext = riscv_cpu_virt_mem_enabled(env);
}
- addr = addr << pmlen;
pmlen = riscv_pm_get_pmlen(pmm);
+ addr = addr << pmlen;
/* sign/zero extend masked address by N-1 bit */
if (signext) {
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH v2 2/6] target/riscv: Add a helper to return the current effective priv mode
2025-11-21 5:04 [PATCH v2 0/6] Fix Zjpm implementation frank.chang
2025-11-21 5:04 ` [PATCH v2 1/6] target/riscv: fix address masking frank.chang
@ 2025-11-21 5:04 ` frank.chang
2025-11-25 14:59 ` Radim Krčmář
2025-11-21 5:04 ` [PATCH v2 3/6] target/riscv: Fix pointer masking PMM field selection logic frank.chang
` (3 subsequent siblings)
5 siblings, 1 reply; 13+ messages in thread
From: frank.chang @ 2025-11-21 5:04 UTC (permalink / raw)
To: qemu-devel
Cc: Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
Frank Chang
From: Frank Chang <frank.chang@sifive.com>
This helper returns the current effective privilege mode.
Signed-off-by: Frank Chang <frank.chang@sifive.com>
---
target/riscv/cpu.h | 1 +
target/riscv/cpu_helper.c | 55 ++++++++++++++++++++++++++++++++-------
2 files changed, 46 insertions(+), 10 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 8899bf7667a..ab285d7a6d1 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -607,6 +607,7 @@ target_ulong riscv_cpu_get_geilen(CPURISCVState *env);
void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen);
bool riscv_cpu_vector_enabled(CPURISCVState *env);
void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
+bool riscv_cpu_eff_priv(CPURISCVState *env, int *priv, bool *virt);
int riscv_env_mmu_index(CPURISCVState *env, bool ifetch);
bool cpu_get_fcfien(CPURISCVState *env);
bool cpu_get_bcfien(CPURISCVState *env);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index dd6c861a90e..fbab8177092 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -38,6 +38,46 @@
#include "pmp.h"
#include "qemu/plugin.h"
+/*
+ * Returns the current effective privilege mode.
+ *
+ * @env: CPURISCVState
+ * @priv: The returned effective privilege mode.
+ * @virt: The returned effective virtualization mode.
+ *
+ * Returns true if the effective privilege mode is modified.
+ */
+bool riscv_cpu_eff_priv(CPURISCVState *env, int *priv, bool *virt)
+{
+#ifndef CONFIG_USER_ONLY
+ int mode = env->priv;
+ bool virt_enabled = env->virt_enabled;
+ bool mode_modified = false;
+
+#ifndef CONFIG_USER_ONLY
+ if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
+ mode = get_field(env->mstatus, MSTATUS_MPP);
+ virt_enabled = get_field(env->mstatus, MSTATUS_MPV) && (mode != PRV_M);
+ mode_modified = true;
+ }
+#endif
+
+ if (priv) {
+ *priv = mode;
+ }
+
+ if (virt) {
+ *virt = virt_enabled;
+ }
+
+ return mode_modified;
+#else
+ *priv = env->priv;
+ *virt = false;
+ return false;
+#endif
+}
+
int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
{
#ifdef CONFIG_USER_ONLY
@@ -45,19 +85,14 @@ int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
#else
bool virt = env->virt_enabled;
int mode = env->priv;
+ bool mode_modified = false;
/* All priv -> mmu_idx mapping are here */
if (!ifetch) {
- uint64_t status = env->mstatus;
-
- if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
- mode = get_field(env->mstatus, MSTATUS_MPP);
- virt = get_field(env->mstatus, MSTATUS_MPV) &&
- (mode != PRV_M);
- if (virt) {
- status = env->vsstatus;
- }
- }
+ mode_modified = riscv_cpu_eff_priv(env, &mode, &virt);
+ uint64_t status = (mode_modified && virt) ? env->vsstatus :
+ env->mstatus;
+
if (mode == PRV_S && get_field(status, MSTATUS_SUM)) {
mode = MMUIdx_S_SUM;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH v2 2/6] target/riscv: Add a helper to return the current effective priv mode
2025-11-21 5:04 ` [PATCH v2 2/6] target/riscv: Add a helper to return the current effective priv mode frank.chang
@ 2025-11-25 14:59 ` Radim Krčmář
2025-12-11 16:39 ` Frank Chang
0 siblings, 1 reply; 13+ messages in thread
From: Radim Krčmář @ 2025-11-25 14:59 UTC (permalink / raw)
To: frank.chang, qemu-devel
Cc: Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
qemu-riscv-bounces+qemu-riscv=archiver.kernel.org
2025-11-21T13:04:09+08:00, <frank.chang@sifive.com>:
> From: Frank Chang <frank.chang@sifive.com>
>
> This helper returns the current effective privilege mode.
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> ---
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> @@ -38,6 +38,46 @@
> +bool riscv_cpu_eff_priv(CPURISCVState *env, int *priv, bool *virt)
I wonder if this function shouldn't be defined in a header file, so it
can be inlined, because returning values through pointers is quite
inefficient,
> +{
> +#ifndef CONFIG_USER_ONLY
> + int mode = env->priv;
> + bool virt_enabled = env->virt_enabled;
> + bool mode_modified = false;
> +
> +#ifndef CONFIG_USER_ONLY
We know CONFIG_USER_ONLY is not defined at this point.
> + if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
> + mode = get_field(env->mstatus, MSTATUS_MPP);
> + virt_enabled = get_field(env->mstatus, MSTATUS_MPV) && (mode != PRV_M);
> + mode_modified = true;
> + }
> +#endif
> +
> + if (priv) {
> + *priv = mode;
> + }
> +
> + if (virt) {
> + *virt = virt_enabled;
> + }
> +
> + return mode_modified;
> +#else
> + *priv = env->priv;
Since it's #ifdef CONFIG_USER_ONLY, we can just say
*priv = PRV_U;
> + *virt = false;
> + return false;
> +#endif
> +}
> +
> int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
> {
> #ifdef CONFIG_USER_ONLY
> @@ -45,19 +85,14 @@ int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
> #else
> bool virt = env->virt_enabled;
> int mode = env->priv;
> + bool mode_modified = false;
>
> /* All priv -> mmu_idx mapping are here */
> if (!ifetch) {
> - uint64_t status = env->mstatus;
> -
> - if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
> - mode = get_field(env->mstatus, MSTATUS_MPP);
> - virt = get_field(env->mstatus, MSTATUS_MPV) &&
> - (mode != PRV_M);
> - if (virt) {
> - status = env->vsstatus;
> - }
> - }
> + mode_modified = riscv_cpu_eff_priv(env, &mode, &virt);
> + uint64_t status = (mode_modified && virt) ? env->vsstatus :
> + env->mstatus;
It is likely a bug that MPRV=1+MPV=1 behaves differently from virt=1,
but your patch preserves the current behavior, as it should.
I had a few nitpicks, but important parts seem fine
Reviewed-by: Radim Krčmář <rkrcmar@ventanamicro.com>
Thanks.
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH v2 2/6] target/riscv: Add a helper to return the current effective priv mode
2025-11-25 14:59 ` Radim Krčmář
@ 2025-12-11 16:39 ` Frank Chang
0 siblings, 0 replies; 13+ messages in thread
From: Frank Chang @ 2025-12-11 16:39 UTC (permalink / raw)
To: Radim Krčmář
Cc: qemu-devel, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
qemu-riscv-bounces+qemu-riscv=archiver.kernel.org
[-- Attachment #1: Type: text/plain, Size: 2976 bytes --]
Hi Radim,
On Tue, Nov 25, 2025 at 10:59 PM Radim Krčmář <rkrcmar@ventanamicro.com>
wrote:
> 2025-11-21T13:04:09+08:00, <frank.chang@sifive.com>:
> > From: Frank Chang <frank.chang@sifive.com>
> >
> > This helper returns the current effective privilege mode.
> >
> > Signed-off-by: Frank Chang <frank.chang@sifive.com>
> > ---
> > diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> > @@ -38,6 +38,46 @@
> > +bool riscv_cpu_eff_priv(CPURISCVState *env, int *priv, bool *virt)
>
> I wonder if this function shouldn't be defined in a header file, so it
>
Are you saying that we "should" define it in a header file?
> can be inlined, because returning values through pointers is quite
> inefficient,
> > +{
> > +#ifndef CONFIG_USER_ONLY
> > + int mode = env->priv;
> > + bool virt_enabled = env->virt_enabled;
> > + bool mode_modified = false;
> > +
> > +#ifndef CONFIG_USER_ONLY
>
> We know CONFIG_USER_ONLY is not defined at this point.
>
> > + if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
> > + mode = get_field(env->mstatus, MSTATUS_MPP);
> > + virt_enabled = get_field(env->mstatus, MSTATUS_MPV) && (mode !=
> PRV_M);
> > + mode_modified = true;
> > + }
> > +#endif
> > +
> > + if (priv) {
> > + *priv = mode;
> > + }
> > +
> > + if (virt) {
> > + *virt = virt_enabled;
> > + }
> > +
> > + return mode_modified;
> > +#else
> > + *priv = env->priv;
>
> Since it's #ifdef CONFIG_USER_ONLY, we can just say
>
> *priv = PRV_U;
>
>
> > + *virt = false;
> > + return false;
> > +#endif
> > +}
> > +
> > int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
> > {
> > #ifdef CONFIG_USER_ONLY
> > @@ -45,19 +85,14 @@ int riscv_env_mmu_index(CPURISCVState *env, bool
> ifetch)
> > #else
> > bool virt = env->virt_enabled;
> > int mode = env->priv;
> > + bool mode_modified = false;
> >
> > /* All priv -> mmu_idx mapping are here */
> > if (!ifetch) {
> > - uint64_t status = env->mstatus;
> > -
> > - if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
> > - mode = get_field(env->mstatus, MSTATUS_MPP);
> > - virt = get_field(env->mstatus, MSTATUS_MPV) &&
> > - (mode != PRV_M);
> > - if (virt) {
> > - status = env->vsstatus;
> > - }
> > - }
> > + mode_modified = riscv_cpu_eff_priv(env, &mode, &virt);
> > + uint64_t status = (mode_modified && virt) ? env->vsstatus :
> > + env->mstatus;
>
> It is likely a bug that MPRV=1+MPV=1 behaves differently from virt=1,
> but your patch preserves the current behavior, as it should.
>
> I had a few nitpicks, but important parts seem fine
>
> Reviewed-by: Radim Krčmář <rkrcmar@ventanamicro.com>
>
> Thanks.
>
[-- Attachment #2: Type: text/html, Size: 4484 bytes --]
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v2 3/6] target/riscv: Fix pointer masking PMM field selection logic
2025-11-21 5:04 [PATCH v2 0/6] Fix Zjpm implementation frank.chang
2025-11-21 5:04 ` [PATCH v2 1/6] target/riscv: fix address masking frank.chang
2025-11-21 5:04 ` [PATCH v2 2/6] target/riscv: Add a helper to return the current effective priv mode frank.chang
@ 2025-11-21 5:04 ` frank.chang
2025-11-25 15:25 ` Radim Krčmář
2025-11-21 5:04 ` [PATCH v2 4/6] target/riscv: Fix pointer masking for virtual-machine load/store insns frank.chang
` (2 subsequent siblings)
5 siblings, 1 reply; 13+ messages in thread
From: frank.chang @ 2025-11-21 5:04 UTC (permalink / raw)
To: qemu-devel
Cc: Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
Frank Chang
From: Frank Chang <frank.chang@sifive.com>
mstatus.MPV only records the previous virtualization state, and does not
affect pointer masking according to the Zjpm specification.
This patch rewrites riscv_pm_get_pmm() to follow the architectural
definition of Smmpm, Smnpm, and Ssnpm.
The resulting PMM selection logic for each mode is summarized below:
* mstatus.MXR = 1: pointer masking disabled
* Smmpm + Smnpm + Ssnpm:
M-mode: mseccfg.PMM
S-mode: menvcfg.PMM
U-mode: senvcfg.PMM
VS-mode: henvcfg.PMM
VU-mode: senvcfg.PMM
* Smmpm + Smnpm (RVS implemented):
M-mode: mseccfg.PMM
S-mode: menvcfg.PMM
U/VS/VU: disabled (Ssnpm not present)
* Smmpm + Smnpm (RVS not implemented):
M-mode: mseccfg.PMM
U-mode: menvcfg.PMM
S/VS/VU: disabled (no S-mode)
* Smmpm only:
M-mode: mseccfg.PMM
Other existing modes: pointer masking disabled
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
---
target/riscv/cpu_helper.c | 61 ++++++++++++++++++++++++++++++++-------
1 file changed, 51 insertions(+), 10 deletions(-)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index fbab8177092..acfc6c10607 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -171,16 +171,49 @@ bool riscv_env_smode_dbltrp_enabled(CPURISCVState *env, bool virt)
#endif
}
+/*
+ * Returns the effective PMM field.
+ *
+ * @env: CPURISCVState
+ *
+ * The PMM field selection logic for each effective privilege mode
+ * is as follows:
+ *
+ * - mstatus.MXR = 1: disabled
+ *
+ * - Smmpm + Smnpm + Ssnpm:
+ * M-mode: mseccfg.PMM
+ * S-mode: menvcfg.PMM
+ * U-mode: senvcfg.PMM
+ * VS-mode: henvcfg.PMM
+ * VU-mode: senvcfg.PMM
+ *
+ * - Smmpm + Smnpm (RVS implemented):
+ * M-mode: mseccfg.PMM
+ * S-mode: menvcfg.PMM
+ * U/VS/VU: disabled (Ssnpm not present)
+ *
+ * - Smmpm + Smnpm (RVS not implemented):
+ * M-mode: mseccfg.PMM
+ * U-mode: menvcfg.PMM
+ * S/VS/VU: disabled (no S-mode)
+ *
+ * - Smmpm only:
+ * M-mode: mseccfg.PMM
+ * Other existing modes: disabled
+ */
RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
{
#ifndef CONFIG_USER_ONLY
- int priv_mode = cpu_address_mode(env);
+ int priv_mode;
+ bool virt;
- if (get_field(env->mstatus, MSTATUS_MPRV) &&
- get_field(env->mstatus, MSTATUS_MXR)) {
+ if (get_field(env->mstatus, MSTATUS_MXR)) {
return PMM_FIELD_DISABLED;
}
+ riscv_cpu_eff_priv(env, &priv_mode, &virt);
+
/* Get current PMM field */
switch (priv_mode) {
case PRV_M:
@@ -189,22 +222,30 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
}
break;
case PRV_S:
- if (riscv_cpu_cfg(env)->ext_smnpm) {
- if (get_field(env->mstatus, MSTATUS_MPV)) {
- return get_field(env->henvcfg, HENVCFG_PMM);
- } else {
+ if (!virt) {
+ if (riscv_cpu_cfg(env)->ext_smnpm) {
return get_field(env->menvcfg, MENVCFG_PMM);
}
+ } else {
+ if (riscv_cpu_cfg(env)->ext_ssnpm) {
+ return get_field(env->henvcfg, HENVCFG_PMM);
+ }
}
break;
case PRV_U:
- if (riscv_has_ext(env, RVS)) {
+ if (!virt) {
if (riscv_cpu_cfg(env)->ext_ssnpm) {
return get_field(env->senvcfg, SENVCFG_PMM);
}
- } else {
+
if (riscv_cpu_cfg(env)->ext_smnpm) {
- return get_field(env->menvcfg, MENVCFG_PMM);
+ if (!riscv_has_ext(env, RVS)) {
+ return get_field(env->menvcfg, MENVCFG_PMM);
+ }
+ }
+ } else {
+ if (riscv_cpu_cfg(env)->ext_ssnpm) {
+ return get_field(env->senvcfg, SENVCFG_PMM);
}
}
break;
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH v2 3/6] target/riscv: Fix pointer masking PMM field selection logic
2025-11-21 5:04 ` [PATCH v2 3/6] target/riscv: Fix pointer masking PMM field selection logic frank.chang
@ 2025-11-25 15:25 ` Radim Krčmář
2025-12-11 16:41 ` Frank Chang
0 siblings, 1 reply; 13+ messages in thread
From: Radim Krčmář @ 2025-11-25 15:25 UTC (permalink / raw)
To: frank.chang, qemu-devel
Cc: Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
qemu-riscv-bounces+qemu-riscv=archiver.kernel.org
2025-11-21T13:04:10+08:00, <frank.chang@sifive.com>:
> From: Frank Chang <frank.chang@sifive.com>
>
> mstatus.MPV only records the previous virtualization state, and does not
> affect pointer masking according to the Zjpm specification.
>
> This patch rewrites riscv_pm_get_pmm() to follow the architectural
> definition of Smmpm, Smnpm, and Ssnpm.
>
> The resulting PMM selection logic for each mode is summarized below:
>
> * mstatus.MXR = 1: pointer masking disabled
>
> * Smmpm + Smnpm + Ssnpm:
> M-mode: mseccfg.PMM
> S-mode: menvcfg.PMM
> U-mode: senvcfg.PMM
> VS-mode: henvcfg.PMM
> VU-mode: senvcfg.PMM
>
> * Smmpm + Smnpm (RVS implemented):
> M-mode: mseccfg.PMM
> S-mode: menvcfg.PMM
> U/VS/VU: disabled (Ssnpm not present)
>
> * Smmpm + Smnpm (RVS not implemented):
> M-mode: mseccfg.PMM
> U-mode: menvcfg.PMM
> S/VS/VU: disabled (no S-mode)
>
> * Smmpm only:
> M-mode: mseccfg.PMM
> Other existing modes: pointer masking disabled
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
> ---
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
> {
> #ifndef CONFIG_USER_ONLY
> - int priv_mode = cpu_address_mode(env);
> + int priv_mode;
> + bool virt;
>
> - if (get_field(env->mstatus, MSTATUS_MPRV) &&
> - get_field(env->mstatus, MSTATUS_MXR)) {
> + if (get_field(env->mstatus, MSTATUS_MXR)) {
> return PMM_FIELD_DISABLED;
> }
MSTATUS_MXR doesn't disable Pointer masking in M-mode, and we also need
to consider virt, where vsstatus.MXR is in effect as well.
>
> + riscv_cpu_eff_priv(env, &priv_mode, &virt);
I think you could put something like this here:
if ((mode != PRV_M && get_field(env->mstatus, MSTATUS_MXR)) ||
(virt && get_field(env->vsstatus, MSTATUS_MXR))) {
return PMM_FIELD_DISABLED;
}
> /* Get current PMM field */
> switch (priv_mode) {
> case PRV_M:
> @@ -189,22 +222,30 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
> case PRV_U:
> - if (riscv_has_ext(env, RVS)) {
> + if (!virt) {
> if (riscv_cpu_cfg(env)->ext_ssnpm) {
> return get_field(env->senvcfg, SENVCFG_PMM);
> }
> - } else {
> +
> if (riscv_cpu_cfg(env)->ext_smnpm) {
> - return get_field(env->menvcfg, MENVCFG_PMM);
> + if (!riscv_has_ext(env, RVS)) {
> + return get_field(env->menvcfg, MENVCFG_PMM);
> + }
> + }
> + } else {
> + if (riscv_cpu_cfg(env)->ext_ssnpm) {
> + return get_field(env->senvcfg, SENVCFG_PMM);
> }
> }
virt doesn't really matter, the original code was correct.
Thanks.
^ permalink raw reply [flat|nested] 13+ messages in thread* Re: [PATCH v2 3/6] target/riscv: Fix pointer masking PMM field selection logic
2025-11-25 15:25 ` Radim Krčmář
@ 2025-12-11 16:41 ` Frank Chang
0 siblings, 0 replies; 13+ messages in thread
From: Frank Chang @ 2025-12-11 16:41 UTC (permalink / raw)
To: Radim Krčmář
Cc: qemu-devel, Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
qemu-riscv-bounces+qemu-riscv=archiver.kernel.org
[-- Attachment #1: Type: text/plain, Size: 3453 bytes --]
Hi Radim,
On Tue, Nov 25, 2025 at 11:26 PM Radim Krčmář <rkrcmar@ventanamicro.com>
wrote:
> 2025-11-21T13:04:10+08:00, <frank.chang@sifive.com>:
> > From: Frank Chang <frank.chang@sifive.com>
> >
> > mstatus.MPV only records the previous virtualization state, and does not
> > affect pointer masking according to the Zjpm specification.
> >
> > This patch rewrites riscv_pm_get_pmm() to follow the architectural
> > definition of Smmpm, Smnpm, and Ssnpm.
> >
> > The resulting PMM selection logic for each mode is summarized below:
> >
> > * mstatus.MXR = 1: pointer masking disabled
> >
> > * Smmpm + Smnpm + Ssnpm:
> > M-mode: mseccfg.PMM
> > S-mode: menvcfg.PMM
> > U-mode: senvcfg.PMM
> > VS-mode: henvcfg.PMM
> > VU-mode: senvcfg.PMM
> >
> > * Smmpm + Smnpm (RVS implemented):
> > M-mode: mseccfg.PMM
> > S-mode: menvcfg.PMM
> > U/VS/VU: disabled (Ssnpm not present)
> >
> > * Smmpm + Smnpm (RVS not implemented):
> > M-mode: mseccfg.PMM
> > U-mode: menvcfg.PMM
> > S/VS/VU: disabled (no S-mode)
> >
> > * Smmpm only:
> > M-mode: mseccfg.PMM
> > Other existing modes: pointer masking disabled
> >
> > Signed-off-by: Frank Chang <frank.chang@sifive.com>
> > Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
> > ---
> > diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> > RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
> > {
> > #ifndef CONFIG_USER_ONLY
> > - int priv_mode = cpu_address_mode(env);
> > + int priv_mode;
> > + bool virt;
> >
> > - if (get_field(env->mstatus, MSTATUS_MPRV) &&
> > - get_field(env->mstatus, MSTATUS_MXR)) {
> > + if (get_field(env->mstatus, MSTATUS_MXR)) {
> > return PMM_FIELD_DISABLED;
> > }
>
> MSTATUS_MXR doesn't disable Pointer masking in M-mode, and we also need
> to consider virt, where vsstatus.MXR is in effect as well.
>
> >
> > + riscv_cpu_eff_priv(env, &priv_mode, &virt);
>
> I think you could put something like this here:
>
> if ((mode != PRV_M && get_field(env->mstatus, MSTATUS_MXR)) ||
> (virt && get_field(env->vsstatus, MSTATUS_MXR))) {
> return PMM_FIELD_DISABLED;
> }
>
> > /* Get current PMM field */
> > switch (priv_mode) {
> > case PRV_M:
> > @@ -189,22 +222,30 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
> > case PRV_U:
> > - if (riscv_has_ext(env, RVS)) {
> > + if (!virt) {
> > if (riscv_cpu_cfg(env)->ext_ssnpm) {
> > return get_field(env->senvcfg, SENVCFG_PMM);
> > }
> > - } else {
> > +
> > if (riscv_cpu_cfg(env)->ext_smnpm) {
> > - return get_field(env->menvcfg, MENVCFG_PMM);
> > + if (!riscv_has_ext(env, RVS)) {
> > + return get_field(env->menvcfg, MENVCFG_PMM);
> > + }
> > + }
> > + } else {
> > + if (riscv_cpu_cfg(env)->ext_ssnpm) {
> > + return get_field(env->senvcfg, SENVCFG_PMM);
> > }
> > }
>
> virt doesn't really matter, the original code was correct.
>
> Thanks.
>
Thanks for the review, I've sent out the v3 patchset:
https://patchew.org/QEMU/20251211163826.3998266-1-frank.chang@sifive.com/
Regards,
Frank Chang
[-- Attachment #2: Type: text/html, Size: 4922 bytes --]
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v2 4/6] target/riscv: Fix pointer masking for virtual-machine load/store insns
2025-11-21 5:04 [PATCH v2 0/6] Fix Zjpm implementation frank.chang
` (2 preceding siblings ...)
2025-11-21 5:04 ` [PATCH v2 3/6] target/riscv: Fix pointer masking PMM field selection logic frank.chang
@ 2025-11-21 5:04 ` frank.chang
2025-11-25 15:28 ` Radim Krčmář
2025-11-21 5:04 ` [PATCH v2 5/6] target/riscv: Rename riscv_pm_get_virt_pmm() to riscv_pm_get_vm_ldst_pmm() frank.chang
2025-11-21 5:04 ` [PATCH v2 6/6] target/riscv: Fix pointer masking translation mode check bug frank.chang
5 siblings, 1 reply; 13+ messages in thread
From: frank.chang @ 2025-11-21 5:04 UTC (permalink / raw)
To: qemu-devel
Cc: Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
Frank Chang
From: Frank Chang <frank.chang@sifive.com>
The effective privilege of explicit memory accesses made by
virtual-machine load/store instructions (HLV.* and HSV.*) is controlled
by hstatus.SPVP. mstatus.MPRV does not affect these virtual-machine
load/store instructions.
Signed-off-by: Frank Chang <frank.chang@sifive.com>
---
target/riscv/cpu_helper.c | 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index acfc6c10607..bf747834dcc 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -261,16 +261,25 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env)
{
#ifndef CONFIG_USER_ONLY
- int priv_mode = cpu_address_mode(env);
+ int priv_mode;
- if (priv_mode == PRV_U) {
- return get_field(env->hstatus, HSTATUS_HUPMM);
- } else {
- if (get_field(env->hstatus, HSTATUS_SPVP)) {
- return get_field(env->henvcfg, HENVCFG_PMM);
- } else {
- return get_field(env->senvcfg, SENVCFG_PMM);
- }
+ if (get_field(env->mstatus, MSTATUS_MXR) ||
+ !riscv_cpu_cfg(env)->ext_ssnpm) {
+ return PMM_FIELD_DISABLED;
+ }
+
+ priv_mode = get_field(env->hstatus, HSTATUS_SPVP);
+
+ switch (priv_mode) {
+ case PRV_S:
+ /* Effective privilege mode: VS */
+ return get_field(env->henvcfg, HENVCFG_PMM);
+ case PRV_U:
+ /* Effective privilege mode: VU */
+ return (env->priv == PRV_U) ? get_field(env->hstatus, HSTATUS_HUPMM) :
+ get_field(env->senvcfg, SENVCFG_PMM);
+ default:
+ return PMM_FIELD_DISABLED;
}
#else
return PMM_FIELD_DISABLED;
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH v2 4/6] target/riscv: Fix pointer masking for virtual-machine load/store insns
2025-11-21 5:04 ` [PATCH v2 4/6] target/riscv: Fix pointer masking for virtual-machine load/store insns frank.chang
@ 2025-11-25 15:28 ` Radim Krčmář
0 siblings, 0 replies; 13+ messages in thread
From: Radim Krčmář @ 2025-11-25 15:28 UTC (permalink / raw)
To: frank.chang, qemu-devel
Cc: Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
qemu-riscv-bounces+qemu-riscv=archiver.kernel.org
2025-11-21T13:04:11+08:00, <frank.chang@sifive.com>:
> From: Frank Chang <frank.chang@sifive.com>
>
> The effective privilege of explicit memory accesses made by
> virtual-machine load/store instructions (HLV.* and HSV.*) is controlled
> by hstatus.SPVP. mstatus.MPRV does not affect these virtual-machine
> load/store instructions.
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> ---
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> @@ -261,16 +261,25 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
> RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env)
> {
> #ifndef CONFIG_USER_ONLY
> - int priv_mode = cpu_address_mode(env);
> + int priv_mode;
>
> - if (priv_mode == PRV_U) {
> - return get_field(env->hstatus, HSTATUS_HUPMM);
> - } else {
> - if (get_field(env->hstatus, HSTATUS_SPVP)) {
> - return get_field(env->henvcfg, HENVCFG_PMM);
> - } else {
> - return get_field(env->senvcfg, SENVCFG_PMM);
> - }
> + if (get_field(env->mstatus, MSTATUS_MXR) ||
> + !riscv_cpu_cfg(env)->ext_ssnpm) {
> + return PMM_FIELD_DISABLED;
> + }
The condition also needs to consider vsstatus.MXR.
Looks good otherwise, thanks.
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH v2 5/6] target/riscv: Rename riscv_pm_get_virt_pmm() to riscv_pm_get_vm_ldst_pmm()
2025-11-21 5:04 [PATCH v2 0/6] Fix Zjpm implementation frank.chang
` (3 preceding siblings ...)
2025-11-21 5:04 ` [PATCH v2 4/6] target/riscv: Fix pointer masking for virtual-machine load/store insns frank.chang
@ 2025-11-21 5:04 ` frank.chang
2025-11-21 5:04 ` [PATCH v2 6/6] target/riscv: Fix pointer masking translation mode check bug frank.chang
5 siblings, 0 replies; 13+ messages in thread
From: frank.chang @ 2025-11-21 5:04 UTC (permalink / raw)
To: qemu-devel
Cc: Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
Frank Chang
From: Frank Chang <frank.chang@sifive.com>
Rename riscv_pm_get_virt_pmm() to riscv_pm_get_vm_ldst_pmm() to better
reflect its actual usage. This function is used when checking the PMM
field for virtual-machine load/store instructions (HLV.* and HSV.*),
rather than for VS/VU modes.
Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
---
target/riscv/cpu.h | 2 +-
target/riscv/cpu_helper.c | 2 +-
target/riscv/internals.h | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index ab285d7a6d1..9ba01b9f90a 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -847,7 +847,7 @@ bool riscv_cpu_is_32bit(RISCVCPU *cpu);
bool riscv_cpu_virt_mem_enabled(CPURISCVState *env);
RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env);
-RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env);
+RISCVPmPmm riscv_pm_get_vm_ldst_pmm(CPURISCVState *env);
uint32_t riscv_pm_get_pmlen(RISCVPmPmm pmm);
RISCVException riscv_csrr(CPURISCVState *env, int csrno,
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index bf747834dcc..958b05aaa32 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -258,7 +258,7 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
#endif
}
-RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env)
+RISCVPmPmm riscv_pm_get_vm_ldst_pmm(CPURISCVState *env)
{
#ifndef CONFIG_USER_ONLY
int priv_mode;
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 9b3f01144d2..b17b661e2a8 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -190,7 +190,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
/* get pmm field depending on whether addr is */
if (is_virt_addr) {
- pmm = riscv_pm_get_virt_pmm(env);
+ pmm = riscv_pm_get_vm_ldst_pmm(env);
} else {
pmm = riscv_pm_get_pmm(env);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* [PATCH v2 6/6] target/riscv: Fix pointer masking translation mode check bug
2025-11-21 5:04 [PATCH v2 0/6] Fix Zjpm implementation frank.chang
` (4 preceding siblings ...)
2025-11-21 5:04 ` [PATCH v2 5/6] target/riscv: Rename riscv_pm_get_virt_pmm() to riscv_pm_get_vm_ldst_pmm() frank.chang
@ 2025-11-21 5:04 ` frank.chang
2025-11-25 15:41 ` Radim Krčmář
5 siblings, 1 reply; 13+ messages in thread
From: frank.chang @ 2025-11-21 5:04 UTC (permalink / raw)
To: qemu-devel
Cc: Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
Frank Chang
From: Frank Chang <frank.chang@sifive.com>
When running with virtualization in VS/VU mode, or when executing the
virtual-machine load/store instructions (HLV.* and HSV.*), the type of
address that determines which pointer masking rules apply should be
checked against vsatp rather than satp.
As a result, sign extension also applies to the virtual-machine
load/store instructions.
Signed-off-by: Frank Chang <frank.chang@sifive.com>
---
target/riscv/cpu.h | 2 +-
target/riscv/cpu_helper.c | 19 +++++++++++++++----
target/riscv/internals.h | 4 +---
target/riscv/tcg/tcg-cpu.c | 4 ++--
4 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 9ba01b9f90a..c98f95179cc 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -845,7 +845,7 @@ static inline uint32_t vext_get_vlmax(uint32_t vlenb, uint32_t vsew,
bool riscv_cpu_is_32bit(RISCVCPU *cpu);
-bool riscv_cpu_virt_mem_enabled(CPURISCVState *env);
+bool riscv_cpu_virt_mem_enabled(CPURISCVState *env, bool is_vm_ldst);
RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env);
RISCVPmPmm riscv_pm_get_vm_ldst_pmm(CPURISCVState *env);
uint32_t riscv_pm_get_pmlen(RISCVPmPmm pmm);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 958b05aaa32..54ff2881831 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -286,16 +286,27 @@ RISCVPmPmm riscv_pm_get_vm_ldst_pmm(CPURISCVState *env)
#endif
}
-bool riscv_cpu_virt_mem_enabled(CPURISCVState *env)
+bool riscv_cpu_virt_mem_enabled(CPURISCVState *env, bool is_vm_ldst)
{
#ifndef CONFIG_USER_ONLY
int satp_mode = 0;
- int priv_mode = cpu_address_mode(env);
+ uint64_t satp;
+ int priv_mode;
+ bool virt = false;
+
+ if (!is_vm_ldst) {
+ riscv_cpu_eff_priv(env, &priv_mode, &virt);
+ } else {
+ priv_mode = get_field(env->hstatus, HSTATUS_SPVP);
+ virt = true;
+ }
+
+ satp = virt ? env->vsatp : env->satp;
if (riscv_cpu_mxl(env) == MXL_RV32) {
- satp_mode = get_field(env->satp, SATP32_MODE);
+ satp_mode = get_field(satp, SATP32_MODE);
} else {
- satp_mode = get_field(env->satp, SATP64_MODE);
+ satp_mode = get_field(satp, SATP64_MODE);
}
return ((satp_mode != VM_1_10_MBARE) && (priv_mode != PRV_M));
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index b17b661e2a8..38d438fbf93 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -200,9 +200,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
return addr;
}
- if (!is_virt_addr) {
- signext = riscv_cpu_virt_mem_enabled(env);
- }
+ signext = riscv_cpu_virt_mem_enabled(env, is_virt_addr);
pmlen = riscv_pm_get_pmlen(pmm);
addr = addr << pmlen;
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 440626ddfad..2b4bcefa0c9 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -104,7 +104,7 @@ static TCGTBCPUState riscv_get_tb_cpu_state(CPUState *cs)
RISCVCPU *cpu = env_archcpu(env);
RISCVExtStatus fs, vs;
uint32_t flags = 0;
- bool pm_signext = riscv_cpu_virt_mem_enabled(env);
+ bool pm_signext = riscv_cpu_virt_mem_enabled(env, false);
if (cpu->cfg.ext_zve32x) {
/*
@@ -255,7 +255,7 @@ static vaddr riscv_pointer_wrap(CPUState *cs, int mmu_idx,
return result;
}
- pm_signext = riscv_cpu_virt_mem_enabled(env);
+ pm_signext = riscv_cpu_virt_mem_enabled(env, false);
if (pm_signext) {
return sextract64(result, 0, 64 - pm_len);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 13+ messages in thread* Re: [PATCH v2 6/6] target/riscv: Fix pointer masking translation mode check bug
2025-11-21 5:04 ` [PATCH v2 6/6] target/riscv: Fix pointer masking translation mode check bug frank.chang
@ 2025-11-25 15:41 ` Radim Krčmář
0 siblings, 0 replies; 13+ messages in thread
From: Radim Krčmář @ 2025-11-25 15:41 UTC (permalink / raw)
To: frank.chang, qemu-devel
Cc: Palmer Dabbelt, Alistair Francis, Weiwei Li,
Daniel Henrique Barboza, Liu Zhiwei, open list:RISC-V TCG CPUs,
qemu-riscv-bounces+qemu-riscv=archiver.kernel.org
2025-11-21T13:04:13+08:00, <frank.chang@sifive.com>:
> From: Frank Chang <frank.chang@sifive.com>
>
> When running with virtualization in VS/VU mode, or when executing the
> virtual-machine load/store instructions (HLV.* and HSV.*), the type of
> address that determines which pointer masking rules apply should be
> checked against vsatp rather than satp.
>
> As a result, sign extension also applies to the virtual-machine
> load/store instructions.
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> ---
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> @@ -286,16 +286,27 @@ RISCVPmPmm riscv_pm_get_vm_ldst_pmm(CPURISCVState *env)
> #endif
> }
>
> -bool riscv_cpu_virt_mem_enabled(CPURISCVState *env)
> +bool riscv_cpu_virt_mem_enabled(CPURISCVState *env, bool is_vm_ldst)
> {
> #ifndef CONFIG_USER_ONLY
> int satp_mode = 0;
> - int priv_mode = cpu_address_mode(env);
> + uint64_t satp;
> + int priv_mode;
> + bool virt = false;
> +
> + if (!is_vm_ldst) {
> + riscv_cpu_eff_priv(env, &priv_mode, &virt);
> + } else {
> + priv_mode = get_field(env->hstatus, HSTATUS_SPVP);
> + virt = true;
> + }
> +
> + satp = virt ? env->vsatp : env->satp;
>
> if (riscv_cpu_mxl(env) == MXL_RV32) {
> - satp_mode = get_field(env->satp, SATP32_MODE);
> + satp_mode = get_field(satp, SATP32_MODE);
> } else {
> - satp_mode = get_field(env->satp, SATP64_MODE);
> + satp_mode = get_field(satp, SATP64_MODE);
> }
>
> return ((satp_mode != VM_1_10_MBARE) && (priv_mode != PRV_M));
riscv_cpu_virt_mem_enabled looked generic, so I got scared at the
beginning, but it's luckily only used for pointer masking.
Reviewed-by: Radim Krčmář <rkrcmar@ventanamicro.com>
^ permalink raw reply [flat|nested] 13+ messages in thread