From: Deepak Gupta <debug@rivosinc.com>
To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org
Cc: palmer@dabbelt.com, alistair.francis@wdc.com, bmeng.cn@gmail.com,
liwei1518@gmail.com, dbarboza@ventanamicro.com,
zhiwei_liu@linux.alibaba.com, Deepak Gupta <debug@rivosinc.com>,
Ved Shanbhogue <ved@rivosinc.com>
Subject: [PATCH 2/2] target/riscv: fixes a bug against `ssamoswap` behavior in M-mode
Date: Mon, 17 Feb 2025 18:54:46 -0800 [thread overview]
Message-ID: <20250218025446.2452254-2-debug@rivosinc.com> (raw)
In-Reply-To: <20250218025446.2452254-1-debug@rivosinc.com>
Commit f06bfe3dc38c ("target/riscv: implement zicfiss instructions") adds
`ssamoswap` instruction. `ssamoswap` takes the code-point from existing
reserved encoding (and not a zimop like other shadow stack instructions).
If shadow stack is not enabled (via xenvcfg.SSE), then `ssamoswap` must
result in an illegal instruction exception. However there is a slightly
modified behavior for M-mode.
Shadow stack are not available in M-mode and all shadow stack instructions
in M-mode exhibit zimop behavior. However, `ssamoswap` can still succeed
if MPRV=1 and MPP is non-zero (see section 2.7 of zicfiss specification).
This patch corrects that behavior for `ssamoswap`.
Fixes: f06bfe3dc38c ("target/riscv: implement zicfiss instructions")
Reported-by: Ved Shanbhogue <ved@rivosinc.com>
Signed-off-by: Deepak Gupta <debug@rivosinc.com>
---
target/riscv/insn_trans/trans_rvzicfiss.c.inc | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
index e3ebc4977c..ec016cd70f 100644
--- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
@@ -15,6 +15,13 @@
* You should have received a copy of the GNU General Public License along with
* this program. If not, see <http://www.gnu.org/licenses/>.
*/
+
+ #define REQUIRE_ZICFISS(ctx) do { \
+ if (!ctx->cfg_ptr->ext_zicfiss) { \
+ return false; \
+ } \
+} while (0)
+
static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
{
if (!ctx->bcfi_enabled) {
@@ -77,7 +84,8 @@ static bool trans_ssrdp(DisasContext *ctx, arg_ssrdp *a)
static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a)
{
REQUIRE_A_OR_ZAAMO(ctx);
- if (!ctx->bcfi_enabled) {
+ REQUIRE_ZICFISS(ctx);
+ if ((ctx->priv != PRV_M) && !ctx->bcfi_enabled) {
return false;
}
@@ -97,7 +105,8 @@ static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a)
{
REQUIRE_64BIT(ctx);
REQUIRE_A_OR_ZAAMO(ctx);
- if (!ctx->bcfi_enabled) {
+ REQUIRE_ZICFISS(ctx);
+ if ((ctx->priv != PRV_M) && !ctx->bcfi_enabled) {
return false;
}
--
2.34.1
next prev parent reply other threads:[~2025-02-18 2:56 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-18 2:54 [PATCH 1/2] target/riscv: fix access permission checks for CSR_SSP Deepak Gupta
2025-02-18 2:54 ` Deepak Gupta [this message]
2025-03-06 5:29 ` [PATCH 2/2] target/riscv: fixes a bug against `ssamoswap` behavior in M-mode Alistair Francis
2025-03-06 6:13 ` Deepak Gupta
2025-03-06 6:22 ` Alistair Francis
2025-03-06 6:30 ` Deepak Gupta
2025-03-06 5:20 ` [PATCH 1/2] target/riscv: fix access permission checks for CSR_SSP Alistair Francis
2025-03-06 6:12 ` Deepak Gupta
2025-03-06 6:20 ` Alistair Francis
2025-03-06 6:22 ` Deepak Gupta
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250218025446.2452254-2-debug@rivosinc.com \
--to=debug@rivosinc.com \
--cc=alistair.francis@wdc.com \
--cc=bmeng.cn@gmail.com \
--cc=dbarboza@ventanamicro.com \
--cc=liwei1518@gmail.com \
--cc=palmer@dabbelt.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-riscv@nongnu.org \
--cc=ved@rivosinc.com \
--cc=zhiwei_liu@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).