[PATCH v2 0/6] Fix Zjpm implementation

[PATCH v2 0/6] Fix Zjpm implementation

[frank.chang]

From: Frank Chang <frank.chang@sifive.com>

The current Zjpm implementation has the following issues:

1. The address is shifted before obtaining the correct PMLEN value.
2. riscv_pm_get_pmm() does not handle effective privilege mode correctly.
3. mstatus.MPRV does not affect virtual-machine load/store instructions.
4. Sign extension for virtual-machine load/store instructions (HLV.* and
   HSV.*) must be performed when vsatp.MODE != Bare.

This patchset fixes the above issues and also renames
riscv_pm_get_virt_pmm() to riscv_pm_get_vm_ldst_pmm(), as the helper
is only used when checking the PMM configuration for virtual-machine
load/store instructions, rather than for VS/VU modes.

Frank Chang (5):
  target/riscv: Add a helper to return the current effective priv mode
  target/riscv: Fix pointer masking PMM field selection logic
  target/riscv: Fix pointer masking for virtual-machine load/store insns
  target/riscv: Rename riscv_pm_get_virt_pmm() to
    riscv_pm_get_vm_ldst_pmm()
  target/riscv: Fix pointer masking translation mode check bug

Yong-Xuan Wang (1):
  target/riscv: fix address masking

 target/riscv/cpu.h         |   5 +-
 target/riscv/cpu_helper.c  | 164 +++++++++++++++++++++++++++++--------
 target/riscv/internals.h   |   8 +-
 target/riscv/tcg/tcg-cpu.c |   4 +-
 4 files changed, 138 insertions(+), 43 deletions(-)

--
2.43.0

[PATCH v2 1/6] target/riscv: fix address masking

[frank.chang]

From: Yong-Xuan Wang <yongxuan.wang@sifive.com>

The pmlen should get the corresponding value before shifting address.

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
---
 target/riscv/internals.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 172296f12e2..9b3f01144d2 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -203,8 +203,8 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
     if (!is_virt_addr) {
         signext = riscv_cpu_virt_mem_enabled(env);
     }
-    addr = addr << pmlen;
     pmlen = riscv_pm_get_pmlen(pmm);
+    addr = addr << pmlen;
 
     /* sign/zero extend masked address by N-1 bit */
     if (signext) {
-- 
2.43.0

[PATCH v2 2/6] target/riscv: Add a helper to return the current effective priv mode

[frank.chang]

From: Frank Chang <frank.chang@sifive.com>

This helper returns the current effective privilege mode.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
---
 target/riscv/cpu.h        |  1 +
 target/riscv/cpu_helper.c | 55 ++++++++++++++++++++++++++++++++-------
 2 files changed, 46 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 8899bf7667a..ab285d7a6d1 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -607,6 +607,7 @@ target_ulong riscv_cpu_get_geilen(CPURISCVState *env);
 void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen);
 bool riscv_cpu_vector_enabled(CPURISCVState *env);
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
+bool riscv_cpu_eff_priv(CPURISCVState *env, int *priv, bool *virt);
 int riscv_env_mmu_index(CPURISCVState *env, bool ifetch);
 bool cpu_get_fcfien(CPURISCVState *env);
 bool cpu_get_bcfien(CPURISCVState *env);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index dd6c861a90e..fbab8177092 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -38,6 +38,46 @@
 #include "pmp.h"
 #include "qemu/plugin.h"
 
+/*
+ * Returns the current effective privilege mode.
+ *
+ * @env: CPURISCVState
+ * @priv: The returned effective privilege mode.
+ * @virt: The returned effective virtualization mode.
+ *
+ * Returns true if the effective privilege mode is modified.
+ */
+bool riscv_cpu_eff_priv(CPURISCVState *env, int *priv, bool *virt)
+{
+#ifndef CONFIG_USER_ONLY
+    int mode = env->priv;
+    bool virt_enabled = env->virt_enabled;
+    bool mode_modified = false;
+
+#ifndef CONFIG_USER_ONLY
+    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
+        mode = get_field(env->mstatus, MSTATUS_MPP);
+        virt_enabled = get_field(env->mstatus, MSTATUS_MPV) && (mode != PRV_M);
+        mode_modified = true;
+    }
+#endif
+
+    if (priv) {
+        *priv = mode;
+    }
+
+    if (virt) {
+        *virt = virt_enabled;
+    }
+
+    return mode_modified;
+#else
+    *priv = env->priv;
+    *virt = false;
+    return false;
+#endif
+}
+
 int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
 {
 #ifdef CONFIG_USER_ONLY
@@ -45,19 +85,14 @@ int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
 #else
     bool virt = env->virt_enabled;
     int mode = env->priv;
+    bool mode_modified = false;
 
     /* All priv -> mmu_idx mapping are here */
     if (!ifetch) {
-        uint64_t status = env->mstatus;
-
-        if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
-            mode = get_field(env->mstatus, MSTATUS_MPP);
-            virt = get_field(env->mstatus, MSTATUS_MPV) &&
-                   (mode != PRV_M);
-            if (virt) {
-                status = env->vsstatus;
-            }
-        }
+        mode_modified = riscv_cpu_eff_priv(env, &mode, &virt);
+        uint64_t status = (mode_modified && virt) ? env->vsstatus :
+                                                    env->mstatus;
+
         if (mode == PRV_S && get_field(status, MSTATUS_SUM)) {
             mode = MMUIdx_S_SUM;
         }
-- 
2.43.0

[PATCH v2 3/6] target/riscv: Fix pointer masking PMM field selection logic

[frank.chang]

From: Frank Chang <frank.chang@sifive.com>

mstatus.MPV only records the previous virtualization state, and does not
affect pointer masking according to the Zjpm specification.

This patch rewrites riscv_pm_get_pmm() to follow the architectural
definition of Smmpm, Smnpm, and Ssnpm.

The resulting PMM selection logic for each mode is summarized below:

  * mstatus.MXR = 1: pointer masking disabled

  * Smmpm + Smnpm + Ssnpm:
      M-mode:  mseccfg.PMM
      S-mode:  menvcfg.PMM
      U-mode:  senvcfg.PMM
      VS-mode: henvcfg.PMM
      VU-mode: senvcfg.PMM

  * Smmpm + Smnpm (RVS implemented):
      M-mode:  mseccfg.PMM
      S-mode:  menvcfg.PMM
      U/VS/VU: disabled (Ssnpm not present)

  * Smmpm + Smnpm (RVS not implemented):
      M-mode:  mseccfg.PMM
      U-mode:  menvcfg.PMM
      S/VS/VU: disabled (no S-mode)

  * Smmpm only:
      M-mode:  mseccfg.PMM
      Other existing modes: pointer masking disabled

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
---
 target/riscv/cpu_helper.c | 61 ++++++++++++++++++++++++++++++++-------
 1 file changed, 51 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index fbab8177092..acfc6c10607 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -171,16 +171,49 @@ bool riscv_env_smode_dbltrp_enabled(CPURISCVState *env, bool virt)
 #endif
 }
 
+/*
+ * Returns the effective PMM field.
+ *
+ * @env: CPURISCVState
+ *
+ * The PMM field selection logic for each effective privilege mode
+ * is as follows:
+ *
+ * - mstatus.MXR = 1: disabled
+ *
+ * - Smmpm + Smnpm + Ssnpm:
+ *     M-mode:  mseccfg.PMM
+ *     S-mode:  menvcfg.PMM
+ *     U-mode:  senvcfg.PMM
+ *     VS-mode: henvcfg.PMM
+ *     VU-mode: senvcfg.PMM
+ *
+ * - Smmpm + Smnpm (RVS implemented):
+ *     M-mode:  mseccfg.PMM
+ *     S-mode:  menvcfg.PMM
+ *     U/VS/VU: disabled (Ssnpm not present)
+ *
+ * - Smmpm + Smnpm (RVS not implemented):
+ *     M-mode:  mseccfg.PMM
+ *     U-mode:  menvcfg.PMM
+ *     S/VS/VU: disabled (no S-mode)
+ *
+ * - Smmpm only:
+ *     M-mode:  mseccfg.PMM
+ *     Other existing modes: disabled
+ */
 RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
 {
 #ifndef CONFIG_USER_ONLY
-    int priv_mode = cpu_address_mode(env);
+    int priv_mode;
+    bool virt;
 
-    if (get_field(env->mstatus, MSTATUS_MPRV) &&
-        get_field(env->mstatus, MSTATUS_MXR)) {
+    if (get_field(env->mstatus, MSTATUS_MXR)) {
         return PMM_FIELD_DISABLED;
     }
 
+    riscv_cpu_eff_priv(env, &priv_mode, &virt);
+
     /* Get current PMM field */
     switch (priv_mode) {
     case PRV_M:
@@ -189,22 +222,30 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
         }
         break;
     case PRV_S:
-        if (riscv_cpu_cfg(env)->ext_smnpm) {
-            if (get_field(env->mstatus, MSTATUS_MPV)) {
-                return get_field(env->henvcfg, HENVCFG_PMM);
-            } else {
+        if (!virt) {
+            if (riscv_cpu_cfg(env)->ext_smnpm) {
                 return get_field(env->menvcfg, MENVCFG_PMM);
             }
+        } else {
+            if (riscv_cpu_cfg(env)->ext_ssnpm) {
+                return get_field(env->henvcfg, HENVCFG_PMM);
+            }
         }
         break;
     case PRV_U:
-        if (riscv_has_ext(env, RVS)) {
+        if (!virt) {
             if (riscv_cpu_cfg(env)->ext_ssnpm) {
                 return get_field(env->senvcfg, SENVCFG_PMM);
             }
-        } else {
+
             if (riscv_cpu_cfg(env)->ext_smnpm) {
-                return get_field(env->menvcfg, MENVCFG_PMM);
+                if (!riscv_has_ext(env, RVS)) {
+                    return get_field(env->menvcfg, MENVCFG_PMM);
+                }
+            }
+        } else {
+            if (riscv_cpu_cfg(env)->ext_ssnpm) {
+                return get_field(env->senvcfg, SENVCFG_PMM);
             }
         }
         break;
-- 
2.43.0

[PATCH v2 4/6] target/riscv: Fix pointer masking for virtual-machine load/store insns

[frank.chang]

From: Frank Chang <frank.chang@sifive.com>

The effective privilege of explicit memory accesses made by
virtual-machine load/store instructions (HLV.* and HSV.*) is controlled
by hstatus.SPVP. mstatus.MPRV does not affect these virtual-machine
load/store instructions.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
---
 target/riscv/cpu_helper.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index acfc6c10607..bf747834dcc 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -261,16 +261,25 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
 RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env)
 {
 #ifndef CONFIG_USER_ONLY
-    int priv_mode = cpu_address_mode(env);
+    int priv_mode;
 
-    if (priv_mode == PRV_U) {
-        return get_field(env->hstatus, HSTATUS_HUPMM);
-    } else {
-        if (get_field(env->hstatus, HSTATUS_SPVP)) {
-            return get_field(env->henvcfg, HENVCFG_PMM);
-        } else {
-            return get_field(env->senvcfg, SENVCFG_PMM);
-        }
+    if (get_field(env->mstatus, MSTATUS_MXR) ||
+        !riscv_cpu_cfg(env)->ext_ssnpm) {
+        return PMM_FIELD_DISABLED;
+    }
+
+    priv_mode = get_field(env->hstatus, HSTATUS_SPVP);
+
+    switch (priv_mode) {
+    case PRV_S:
+        /* Effective privilege mode: VS */
+        return get_field(env->henvcfg, HENVCFG_PMM);
+    case PRV_U:
+        /* Effective privilege mode: VU */
+        return (env->priv == PRV_U) ? get_field(env->hstatus, HSTATUS_HUPMM) :
+                                      get_field(env->senvcfg, SENVCFG_PMM);
+    default:
+        return PMM_FIELD_DISABLED;
     }
 #else
     return PMM_FIELD_DISABLED;
-- 
2.43.0

[PATCH v2 5/6] target/riscv: Rename riscv_pm_get_virt_pmm() to riscv_pm_get_vm_ldst_pmm()

[frank.chang]

From: Frank Chang <frank.chang@sifive.com>

Rename riscv_pm_get_virt_pmm() to riscv_pm_get_vm_ldst_pmm() to better
reflect its actual usage. This function is used when checking the PMM
field for virtual-machine load/store instructions (HLV.* and HSV.*),
rather than for VS/VU modes.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
---
 target/riscv/cpu.h        | 2 +-
 target/riscv/cpu_helper.c | 2 +-
 target/riscv/internals.h  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index ab285d7a6d1..9ba01b9f90a 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -847,7 +847,7 @@ bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 
 bool riscv_cpu_virt_mem_enabled(CPURISCVState *env);
 RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env);
-RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env);
+RISCVPmPmm riscv_pm_get_vm_ldst_pmm(CPURISCVState *env);
 uint32_t riscv_pm_get_pmlen(RISCVPmPmm pmm);
 
 RISCVException riscv_csrr(CPURISCVState *env, int csrno,
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index bf747834dcc..958b05aaa32 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -258,7 +258,7 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
 #endif
 }
 
-RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env)
+RISCVPmPmm riscv_pm_get_vm_ldst_pmm(CPURISCVState *env)
 {
 #ifndef CONFIG_USER_ONLY
     int priv_mode;
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 9b3f01144d2..b17b661e2a8 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -190,7 +190,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
 
     /* get pmm field depending on whether addr is */
     if (is_virt_addr) {
-        pmm = riscv_pm_get_virt_pmm(env);
+        pmm = riscv_pm_get_vm_ldst_pmm(env);
     } else {
         pmm = riscv_pm_get_pmm(env);
     }
-- 
2.43.0

[PATCH v2 6/6] target/riscv: Fix pointer masking translation mode check bug

[frank.chang]

From: Frank Chang <frank.chang@sifive.com>

When running with virtualization in VS/VU mode, or when executing the
virtual-machine load/store instructions (HLV.* and HSV.*), the type of
address that determines which pointer masking rules apply should be
checked against vsatp rather than satp.

As a result, sign extension also applies to the virtual-machine
load/store instructions.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
---
 target/riscv/cpu.h         |  2 +-
 target/riscv/cpu_helper.c  | 19 +++++++++++++++----
 target/riscv/internals.h   |  4 +---
 target/riscv/tcg/tcg-cpu.c |  4 ++--
 4 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 9ba01b9f90a..c98f95179cc 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -845,7 +845,7 @@ static inline uint32_t vext_get_vlmax(uint32_t vlenb, uint32_t vsew,
 
 bool riscv_cpu_is_32bit(RISCVCPU *cpu);
 
-bool riscv_cpu_virt_mem_enabled(CPURISCVState *env);
+bool riscv_cpu_virt_mem_enabled(CPURISCVState *env, bool is_vm_ldst);
 RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env);
 RISCVPmPmm riscv_pm_get_vm_ldst_pmm(CPURISCVState *env);
 uint32_t riscv_pm_get_pmlen(RISCVPmPmm pmm);
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 958b05aaa32..54ff2881831 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -286,16 +286,27 @@ RISCVPmPmm riscv_pm_get_vm_ldst_pmm(CPURISCVState *env)
 #endif
 }
 
-bool riscv_cpu_virt_mem_enabled(CPURISCVState *env)
+bool riscv_cpu_virt_mem_enabled(CPURISCVState *env, bool is_vm_ldst)
 {
 #ifndef CONFIG_USER_ONLY
     int satp_mode = 0;
-    int priv_mode = cpu_address_mode(env);
+    uint64_t satp;
+    int priv_mode;
+    bool virt = false;
+
+    if (!is_vm_ldst) {
+        riscv_cpu_eff_priv(env, &priv_mode, &virt);
+    } else {
+        priv_mode = get_field(env->hstatus, HSTATUS_SPVP);
+        virt = true;
+    }
+
+    satp = virt ? env->vsatp : env->satp;
 
     if (riscv_cpu_mxl(env) == MXL_RV32) {
-        satp_mode = get_field(env->satp, SATP32_MODE);
+        satp_mode = get_field(satp, SATP32_MODE);
     } else {
-        satp_mode = get_field(env->satp, SATP64_MODE);
+        satp_mode = get_field(satp, SATP64_MODE);
     }
 
     return ((satp_mode != VM_1_10_MBARE) && (priv_mode != PRV_M));
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index b17b661e2a8..38d438fbf93 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -200,9 +200,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
         return addr;
     }
 
-    if (!is_virt_addr) {
-        signext = riscv_cpu_virt_mem_enabled(env);
-    }
+    signext = riscv_cpu_virt_mem_enabled(env, is_virt_addr);
     pmlen = riscv_pm_get_pmlen(pmm);
     addr = addr << pmlen;
 
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 440626ddfad..2b4bcefa0c9 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -104,7 +104,7 @@ static TCGTBCPUState riscv_get_tb_cpu_state(CPUState *cs)
     RISCVCPU *cpu = env_archcpu(env);
     RISCVExtStatus fs, vs;
     uint32_t flags = 0;
-    bool pm_signext = riscv_cpu_virt_mem_enabled(env);
+    bool pm_signext = riscv_cpu_virt_mem_enabled(env, false);
 
     if (cpu->cfg.ext_zve32x) {
         /*
@@ -255,7 +255,7 @@ static vaddr riscv_pointer_wrap(CPUState *cs, int mmu_idx,
         return result;
     }
 
-    pm_signext = riscv_cpu_virt_mem_enabled(env);
+    pm_signext = riscv_cpu_virt_mem_enabled(env, false);
     if (pm_signext) {
         return sextract64(result, 0, 64 - pm_len);
     }
-- 
2.43.0

Re: [PATCH v2 2/6] target/riscv: Add a helper to return the current effective priv mode

[Radim Krčmář]

2025-11-21T13:04:09+08:00, <frank.chang@sifive.com>:
> From: Frank Chang <frank.chang@sifive.com>
>
> This helper returns the current effective privilege mode.
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> ---
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> @@ -38,6 +38,46 @@
> +bool riscv_cpu_eff_priv(CPURISCVState *env, int *priv, bool *virt)

I wonder if this function shouldn't be defined in a header file, so it
can be inlined, because returning values through pointers is quite
inefficient,

> +{
> +#ifndef CONFIG_USER_ONLY
> +    int mode = env->priv;
> +    bool virt_enabled = env->virt_enabled;
> +    bool mode_modified = false;
> +
> +#ifndef CONFIG_USER_ONLY

We know CONFIG_USER_ONLY is not defined at this point.

> +    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
> +        mode = get_field(env->mstatus, MSTATUS_MPP);
> +        virt_enabled = get_field(env->mstatus, MSTATUS_MPV) && (mode != PRV_M);
> +        mode_modified = true;
> +    }
> +#endif
> +
> +    if (priv) {
> +        *priv = mode;
> +    }
> +
> +    if (virt) {
> +        *virt = virt_enabled;
> +    }
> +
> +    return mode_modified;
> +#else
> +    *priv = env->priv;

Since it's #ifdef CONFIG_USER_ONLY, we can just say

       *priv = PRV_U;


> +    *virt = false;
> +    return false;
> +#endif
> +}
> +
>  int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
>  {
>  #ifdef CONFIG_USER_ONLY
> @@ -45,19 +85,14 @@ int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
>  #else
>      bool virt = env->virt_enabled;
>      int mode = env->priv;
> +    bool mode_modified = false;
>  
>      /* All priv -> mmu_idx mapping are here */
>      if (!ifetch) {
> -        uint64_t status = env->mstatus;
> -
> -        if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
> -            mode = get_field(env->mstatus, MSTATUS_MPP);
> -            virt = get_field(env->mstatus, MSTATUS_MPV) &&
> -                   (mode != PRV_M);
> -            if (virt) {
> -                status = env->vsstatus;
> -            }
> -        }
> +        mode_modified = riscv_cpu_eff_priv(env, &mode, &virt);
> +        uint64_t status = (mode_modified && virt) ? env->vsstatus :
> +                                                    env->mstatus;

It is likely a bug that MPRV=1+MPV=1 behaves differently from virt=1,
but your patch preserves the current behavior, as it should.

I had a few nitpicks, but important parts seem fine

Reviewed-by: Radim Krčmář <rkrcmar@ventanamicro.com>

Thanks.

Re: [PATCH v2 3/6] target/riscv: Fix pointer masking PMM field selection logic

[Radim Krčmář]

2025-11-21T13:04:10+08:00, <frank.chang@sifive.com>:
> From: Frank Chang <frank.chang@sifive.com>
>
> mstatus.MPV only records the previous virtualization state, and does not
> affect pointer masking according to the Zjpm specification.
>
> This patch rewrites riscv_pm_get_pmm() to follow the architectural
> definition of Smmpm, Smnpm, and Ssnpm.
>
> The resulting PMM selection logic for each mode is summarized below:
>
>   * mstatus.MXR = 1: pointer masking disabled
>
>   * Smmpm + Smnpm + Ssnpm:
>       M-mode:  mseccfg.PMM
>       S-mode:  menvcfg.PMM
>       U-mode:  senvcfg.PMM
>       VS-mode: henvcfg.PMM
>       VU-mode: senvcfg.PMM
>
>   * Smmpm + Smnpm (RVS implemented):
>       M-mode:  mseccfg.PMM
>       S-mode:  menvcfg.PMM
>       U/VS/VU: disabled (Ssnpm not present)
>
>   * Smmpm + Smnpm (RVS not implemented):
>       M-mode:  mseccfg.PMM
>       U-mode:  menvcfg.PMM
>       S/VS/VU: disabled (no S-mode)
>
>   * Smmpm only:
>       M-mode:  mseccfg.PMM
>       Other existing modes: pointer masking disabled
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
> ---
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
>  RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
>  {
>  #ifndef CONFIG_USER_ONLY
> -    int priv_mode = cpu_address_mode(env);
> +    int priv_mode;
> +    bool virt;
>  
> -    if (get_field(env->mstatus, MSTATUS_MPRV) &&
> -        get_field(env->mstatus, MSTATUS_MXR)) {
> +    if (get_field(env->mstatus, MSTATUS_MXR)) {
>          return PMM_FIELD_DISABLED;
>      }

MSTATUS_MXR doesn't disable Pointer masking in M-mode, and we also need
to consider virt, where vsstatus.MXR is in effect as well.

>  
> +    riscv_cpu_eff_priv(env, &priv_mode, &virt);

I think you could put something like this here:

      if ((mode != PRV_M && get_field(env->mstatus, MSTATUS_MXR)) ||
          (virt && get_field(env->vsstatus, MSTATUS_MXR))) {
          return PMM_FIELD_DISABLED;
      }

>      /* Get current PMM field */
>      switch (priv_mode) {
>      case PRV_M:
> @@ -189,22 +222,30 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
>      case PRV_U:
> -        if (riscv_has_ext(env, RVS)) {
> +        if (!virt) {
>              if (riscv_cpu_cfg(env)->ext_ssnpm) {
>                  return get_field(env->senvcfg, SENVCFG_PMM);
>              }
> -        } else {
> +
>              if (riscv_cpu_cfg(env)->ext_smnpm) {
> -                return get_field(env->menvcfg, MENVCFG_PMM);
> +                if (!riscv_has_ext(env, RVS)) {
> +                    return get_field(env->menvcfg, MENVCFG_PMM);
> +                }
> +            }
> +        } else {
> +            if (riscv_cpu_cfg(env)->ext_ssnpm) {
> +                return get_field(env->senvcfg, SENVCFG_PMM);
>              }
>          }

virt doesn't really matter, the original code was correct.

Thanks.

Re: [PATCH v2 4/6] target/riscv: Fix pointer masking for virtual-machine load/store insns

[Radim Krčmář]

2025-11-21T13:04:11+08:00, <frank.chang@sifive.com>:
> From: Frank Chang <frank.chang@sifive.com>
>
> The effective privilege of explicit memory accesses made by
> virtual-machine load/store instructions (HLV.* and HSV.*) is controlled
> by hstatus.SPVP. mstatus.MPRV does not affect these virtual-machine
> load/store instructions.
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> ---
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> @@ -261,16 +261,25 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
>  RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env)
>  {
>  #ifndef CONFIG_USER_ONLY
> -    int priv_mode = cpu_address_mode(env);
> +    int priv_mode;
>  
> -    if (priv_mode == PRV_U) {
> -        return get_field(env->hstatus, HSTATUS_HUPMM);
> -    } else {
> -        if (get_field(env->hstatus, HSTATUS_SPVP)) {
> -            return get_field(env->henvcfg, HENVCFG_PMM);
> -        } else {
> -            return get_field(env->senvcfg, SENVCFG_PMM);
> -        }
> +    if (get_field(env->mstatus, MSTATUS_MXR) ||
> +        !riscv_cpu_cfg(env)->ext_ssnpm) {
> +        return PMM_FIELD_DISABLED;
> +    }

The condition also needs to consider vsstatus.MXR.

Looks good otherwise, thanks.

Re: [PATCH v2 6/6] target/riscv: Fix pointer masking translation mode check bug

[Radim Krčmář]

2025-11-21T13:04:13+08:00, <frank.chang@sifive.com>:
> From: Frank Chang <frank.chang@sifive.com>
>
> When running with virtualization in VS/VU mode, or when executing the
> virtual-machine load/store instructions (HLV.* and HSV.*), the type of
> address that determines which pointer masking rules apply should be
> checked against vsatp rather than satp.
>
> As a result, sign extension also applies to the virtual-machine
> load/store instructions.
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> ---
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> @@ -286,16 +286,27 @@ RISCVPmPmm riscv_pm_get_vm_ldst_pmm(CPURISCVState *env)
>  #endif
>  }
>  
> -bool riscv_cpu_virt_mem_enabled(CPURISCVState *env)
> +bool riscv_cpu_virt_mem_enabled(CPURISCVState *env, bool is_vm_ldst)
>  {
>  #ifndef CONFIG_USER_ONLY
>      int satp_mode = 0;
> -    int priv_mode = cpu_address_mode(env);
> +    uint64_t satp;
> +    int priv_mode;
> +    bool virt = false;
> +
> +    if (!is_vm_ldst) {
> +        riscv_cpu_eff_priv(env, &priv_mode, &virt);
> +    } else {
> +        priv_mode = get_field(env->hstatus, HSTATUS_SPVP);
> +        virt = true;
> +    }
> +
> +    satp = virt ? env->vsatp : env->satp;
>  
>      if (riscv_cpu_mxl(env) == MXL_RV32) {
> -        satp_mode = get_field(env->satp, SATP32_MODE);
> +        satp_mode = get_field(satp, SATP32_MODE);
>      } else {
> -        satp_mode = get_field(env->satp, SATP64_MODE);
> +        satp_mode = get_field(satp, SATP64_MODE);
>      }
>  
>      return ((satp_mode != VM_1_10_MBARE) && (priv_mode != PRV_M));

riscv_cpu_virt_mem_enabled looked generic, so I got scared at the
beginning, but it's luckily only used for pointer masking.

Reviewed-by: Radim Krčmář <rkrcmar@ventanamicro.com>

Re: [PATCH v2 2/6] target/riscv: Add a helper to return the current effective priv mode

[Frank Chang]

[-- Attachment #1: Type: text/plain, Size: 2976 bytes --]

Hi Radim,

On Tue, Nov 25, 2025 at 10:59 PM Radim Krčmář <rkrcmar@ventanamicro.com>
wrote:

> 2025-11-21T13:04:09+08:00, <frank.chang@sifive.com>:
> > From: Frank Chang <frank.chang@sifive.com>
> >
> > This helper returns the current effective privilege mode.
> >
> > Signed-off-by: Frank Chang <frank.chang@sifive.com>
> > ---
> > diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> > @@ -38,6 +38,46 @@
> > +bool riscv_cpu_eff_priv(CPURISCVState *env, int *priv, bool *virt)
>
> I wonder if this function shouldn't be defined in a header file, so it
>

Are you saying that we "should" define it in a header file?


> can be inlined, because returning values through pointers is quite
> inefficient,


> > +{
> > +#ifndef CONFIG_USER_ONLY
> > +    int mode = env->priv;
> > +    bool virt_enabled = env->virt_enabled;
> > +    bool mode_modified = false;
> > +
> > +#ifndef CONFIG_USER_ONLY
>
> We know CONFIG_USER_ONLY is not defined at this point.
>
> > +    if (mode == PRV_M && get_field(env->mstatus, MSTATUS_MPRV)) {
> > +        mode = get_field(env->mstatus, MSTATUS_MPP);
> > +        virt_enabled = get_field(env->mstatus, MSTATUS_MPV) && (mode !=
> PRV_M);
> > +        mode_modified = true;
> > +    }
> > +#endif
> > +
> > +    if (priv) {
> > +        *priv = mode;
> > +    }
> > +
> > +    if (virt) {
> > +        *virt = virt_enabled;
> > +    }
> > +
> > +    return mode_modified;
> > +#else
> > +    *priv = env->priv;
>
> Since it's #ifdef CONFIG_USER_ONLY, we can just say
>
>        *priv = PRV_U;
>
>
> > +    *virt = false;
> > +    return false;
> > +#endif
> > +}
> > +
> >  int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
> >  {
> >  #ifdef CONFIG_USER_ONLY
> > @@ -45,19 +85,14 @@ int riscv_env_mmu_index(CPURISCVState *env, bool
> ifetch)
> >  #else
> >      bool virt = env->virt_enabled;
> >      int mode = env->priv;
> > +    bool mode_modified = false;
> >
> >      /* All priv -> mmu_idx mapping are here */
> >      if (!ifetch) {
> > -        uint64_t status = env->mstatus;
> > -
> > -        if (mode == PRV_M && get_field(status, MSTATUS_MPRV)) {
> > -            mode = get_field(env->mstatus, MSTATUS_MPP);
> > -            virt = get_field(env->mstatus, MSTATUS_MPV) &&
> > -                   (mode != PRV_M);
> > -            if (virt) {
> > -                status = env->vsstatus;
> > -            }
> > -        }
> > +        mode_modified = riscv_cpu_eff_priv(env, &mode, &virt);
> > +        uint64_t status = (mode_modified && virt) ? env->vsstatus :
> > +                                                    env->mstatus;
>
> It is likely a bug that MPRV=1+MPV=1 behaves differently from virt=1,
> but your patch preserves the current behavior, as it should.
>
> I had a few nitpicks, but important parts seem fine
>
> Reviewed-by: Radim Krčmář <rkrcmar@ventanamicro.com>
>
> Thanks.
>

[-- Attachment #2: Type: text/html, Size: 4484 bytes --]

Re: [PATCH v2 3/6] target/riscv: Fix pointer masking PMM field selection logic

[Frank Chang]

[-- Attachment #1: Type: text/plain, Size: 3453 bytes --]

Hi Radim,

On Tue, Nov 25, 2025 at 11:26 PM Radim Krčmář <rkrcmar@ventanamicro.com>
wrote:

> 2025-11-21T13:04:10+08:00, <frank.chang@sifive.com>:
> > From: Frank Chang <frank.chang@sifive.com>
> >
> > mstatus.MPV only records the previous virtualization state, and does not
> > affect pointer masking according to the Zjpm specification.
> >
> > This patch rewrites riscv_pm_get_pmm() to follow the architectural
> > definition of Smmpm, Smnpm, and Ssnpm.
> >
> > The resulting PMM selection logic for each mode is summarized below:
> >
> >   * mstatus.MXR = 1: pointer masking disabled
> >
> >   * Smmpm + Smnpm + Ssnpm:
> >       M-mode:  mseccfg.PMM
> >       S-mode:  menvcfg.PMM
> >       U-mode:  senvcfg.PMM
> >       VS-mode: henvcfg.PMM
> >       VU-mode: senvcfg.PMM
> >
> >   * Smmpm + Smnpm (RVS implemented):
> >       M-mode:  mseccfg.PMM
> >       S-mode:  menvcfg.PMM
> >       U/VS/VU: disabled (Ssnpm not present)
> >
> >   * Smmpm + Smnpm (RVS not implemented):
> >       M-mode:  mseccfg.PMM
> >       U-mode:  menvcfg.PMM
> >       S/VS/VU: disabled (no S-mode)
> >
> >   * Smmpm only:
> >       M-mode:  mseccfg.PMM
> >       Other existing modes: pointer masking disabled
> >
> > Signed-off-by: Frank Chang <frank.chang@sifive.com>
> > Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
> > ---
> > diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> >  RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
> >  {
> >  #ifndef CONFIG_USER_ONLY
> > -    int priv_mode = cpu_address_mode(env);
> > +    int priv_mode;
> > +    bool virt;
> >
> > -    if (get_field(env->mstatus, MSTATUS_MPRV) &&
> > -        get_field(env->mstatus, MSTATUS_MXR)) {
> > +    if (get_field(env->mstatus, MSTATUS_MXR)) {
> >          return PMM_FIELD_DISABLED;
> >      }
>
> MSTATUS_MXR doesn't disable Pointer masking in M-mode, and we also need
> to consider virt, where vsstatus.MXR is in effect as well.
>
> >
> > +    riscv_cpu_eff_priv(env, &priv_mode, &virt);
>
> I think you could put something like this here:
>
>       if ((mode != PRV_M && get_field(env->mstatus, MSTATUS_MXR)) ||
>           (virt && get_field(env->vsstatus, MSTATUS_MXR))) {
>           return PMM_FIELD_DISABLED;
>       }
>
> >      /* Get current PMM field */
> >      switch (priv_mode) {
> >      case PRV_M:
> > @@ -189,22 +222,30 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
> >      case PRV_U:
> > -        if (riscv_has_ext(env, RVS)) {
> > +        if (!virt) {
> >              if (riscv_cpu_cfg(env)->ext_ssnpm) {
> >                  return get_field(env->senvcfg, SENVCFG_PMM);
> >              }
> > -        } else {
> > +
> >              if (riscv_cpu_cfg(env)->ext_smnpm) {
> > -                return get_field(env->menvcfg, MENVCFG_PMM);
> > +                if (!riscv_has_ext(env, RVS)) {
> > +                    return get_field(env->menvcfg, MENVCFG_PMM);
> > +                }
> > +            }
> > +        } else {
> > +            if (riscv_cpu_cfg(env)->ext_ssnpm) {
> > +                return get_field(env->senvcfg, SENVCFG_PMM);
> >              }
> >          }
>
> virt doesn't really matter, the original code was correct.
>
> Thanks.
>

Thanks for the review, I've sent out the v3 patchset:
https://patchew.org/QEMU/20251211163826.3998266-1-frank.chang@sifive.com/

Regards,
Frank Chang

[-- Attachment #2: Type: text/html, Size: 4922 bytes --]