[PATCH v1 0/3] Minor fixes of RISC-V CFI

[PATCH v1 0/3] Minor fixes of RISC-V CFI

[Jim Shu]

This patch series contains several CFI fixes:
  (1) Fix the mepc in the exception from sspopchk instruction
  (2) Fix the exception type from SSP CSR and ssamoswap instruction

Jim Shu (3):
  target/riscv: Fix the mepc when sspopchk triggers the exception
  target/riscv: Fix SSP CSR error handling in VU/VS mode
  target/riscv: Fix ssamoswap error handling

 target/riscv/csr.c                            |  2 +
 target/riscv/helper.h                         |  5 ++
 target/riscv/insn_trans/trans_rvzicfiss.c.inc |  9 ++++
 target/riscv/op_helper.c                      | 49 +++++++++++++++++++
 4 files changed, 65 insertions(+)

-- 
2.43.0

[PATCH v1 1/3] target/riscv: Fix the mepc when sspopchk triggers the exception

[Jim Shu]

When sspopchk is in the middle of TB and triggers the SW check
exception, it should update PC from gen_update_pc(). If not, RISC-V mepc
CSR will get wrong PC address which is still at the start of TB.

Signed-off-by: Jim Shu <jim.shu@sifive.com>
---
 target/riscv/insn_trans/trans_rvzicfiss.c.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
index b0096adcd0..45686af4d6 100644
--- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
@@ -40,6 +40,7 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
     tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip);
     tcg_gen_st_tl(tcg_constant_tl(RISCV_EXCP_SW_CHECK_BCFI_TVAL),
                   tcg_env, offsetof(CPURISCVState, sw_check_code));
+    gen_update_pc(ctx, 0);
     gen_helper_raise_exception(tcg_env,
                   tcg_constant_i32(RISCV_EXCP_SW_CHECK));
     gen_set_label(skip);
-- 
2.43.0

Re: [PATCH v1 1/3] target/riscv: Fix the mepc when sspopchk triggers the exception

[Alistair Francis]

On Wed, Sep 24, 2025 at 5:50 PM Jim Shu <jim.shu@sifive.com> wrote:
>
> When sspopchk is in the middle of TB and triggers the SW check
> exception, it should update PC from gen_update_pc(). If not, RISC-V mepc
> CSR will get wrong PC address which is still at the start of TB.
>
> Signed-off-by: Jim Shu <jim.shu@sifive.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  target/riscv/insn_trans/trans_rvzicfiss.c.inc | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
> index b0096adcd0..45686af4d6 100644
> --- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
> +++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
> @@ -40,6 +40,7 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
>      tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip);
>      tcg_gen_st_tl(tcg_constant_tl(RISCV_EXCP_SW_CHECK_BCFI_TVAL),
>                    tcg_env, offsetof(CPURISCVState, sw_check_code));
> +    gen_update_pc(ctx, 0);
>      gen_helper_raise_exception(tcg_env,
>                    tcg_constant_i32(RISCV_EXCP_SW_CHECK));
>      gen_set_label(skip);
> --
> 2.43.0
>
>

[PATCH v1 2/3] target/riscv: Fix SSP CSR error handling in VU/VS mode

[Jim Shu]

In VU/VS mode, accessing $ssp CSR will trigger the virtual instruction
exception instead of illegal instruction exception if SSE is disabled
via xenvcfg CSRs.

This is from RISC-V CFI v1.0 spec ch2.2.4. Shadow Stack Pointer

Signed-off-by: Jim Shu <jim.shu@sifive.com>
---
 target/riscv/csr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 8842e07a73..0299a214ef 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -204,6 +204,8 @@ static RISCVException cfi_ss(CPURISCVState *env, int csrno)
 #if !defined(CONFIG_USER_ONLY)
         if (env->debugger) {
             return RISCV_EXCP_NONE;
+        } else if (env->virt_enabled) {
+            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
 #endif
         return RISCV_EXCP_ILLEGAL_INST;
-- 
2.43.0

Re: [PATCH v1 2/3] target/riscv: Fix SSP CSR error handling in VU/VS mode

[Alistair Francis]

On Wed, Sep 24, 2025 at 5:49 PM Jim Shu <jim.shu@sifive.com> wrote:
>
> In VU/VS mode, accessing $ssp CSR will trigger the virtual instruction
> exception instead of illegal instruction exception if SSE is disabled
> via xenvcfg CSRs.
>
> This is from RISC-V CFI v1.0 spec ch2.2.4. Shadow Stack Pointer
>
> Signed-off-by: Jim Shu <jim.shu@sifive.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  target/riscv/csr.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/target/riscv/csr.c b/target/riscv/csr.c
> index 8842e07a73..0299a214ef 100644
> --- a/target/riscv/csr.c
> +++ b/target/riscv/csr.c
> @@ -204,6 +204,8 @@ static RISCVException cfi_ss(CPURISCVState *env, int csrno)
>  #if !defined(CONFIG_USER_ONLY)
>          if (env->debugger) {
>              return RISCV_EXCP_NONE;
> +        } else if (env->virt_enabled) {
> +            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
>          }
>  #endif
>          return RISCV_EXCP_ILLEGAL_INST;
> --
> 2.43.0
>
>

[PATCH v1 3/3] target/riscv: Fix ssamoswap error handling

[Jim Shu]

Follow the RISC-V CFI v1.0 spec [1] to fix the exception type
when ssamoswap is disabled by xSSE.

[1] RISC-V CFI spec v1.0, ch2.7 Atomic Swap from a Shadow Stack Location

Signed-off-by: Jim Shu <jim.shu@sifive.com>
---
 target/riscv/helper.h                         |  5 ++
 target/riscv/insn_trans/trans_rvzicfiss.c.inc |  8 +++
 target/riscv/op_helper.c                      | 49 +++++++++++++++++++
 3 files changed, 62 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index f712b1c368..c82bacdc39 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -1284,3 +1284,8 @@ DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
 DEF_HELPER_5(vsm4k_vi, void, ptr, ptr, i32, env, i32)
 DEF_HELPER_4(vsm4r_vv, void, ptr, ptr, env, i32)
 DEF_HELPER_4(vsm4r_vs, void, ptr, ptr, env, i32)
+
+/* CFI (zicfiss) helpers */
+#ifndef CONFIG_USER_ONLY
+DEF_HELPER_1(ssamoswap_disabled, void, env)
+#endif
diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
index 45686af4d6..f4a1c12ca0 100644
--- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
@@ -91,7 +91,11 @@ static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a)
     }
 
     if (!ctx->bcfi_enabled) {
+#ifndef CONFIG_USER_ONLY
+        gen_helper_ssamoswap_disabled(tcg_env);
+#else
         return false;
+#endif
     }
 
     TCGv dest = dest_gpr(ctx, a->rd);
@@ -116,7 +120,11 @@ static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a)
     }
 
     if (!ctx->bcfi_enabled) {
+#ifndef CONFIG_USER_ONLY
+        gen_helper_ssamoswap_disabled(tcg_env);
+#else
         return false;
+#endif
     }
 
     TCGv dest = dest_gpr(ctx, a->rd);
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 110292e84d..8382aa94cb 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -717,4 +717,53 @@ target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong addr)
     return cpu_ldl_code_mmu(env, addr, oi, ra);
 }
 
+void helper_ssamoswap_disabled(CPURISCVState *env)
+{
+    int exception = RISCV_EXCP_ILLEGAL_INST;
+
+    /*
+     * Here we follow the RISC-V CFI spec [1] to implement the exception type
+     * of ssamoswap* instruction.
+     *
+     * [1] RISC-V CFI spec v1.0, ch2.7 Atomic Swap from a Shadow Stack Location
+     *
+     * Note: We have already checked some conditions in trans_* functions:
+     *   1. The effective priv mode is not M-mode.
+     *   2. The xSSE specific to the effictive priv mode is disabled.
+     */
+    if (!get_field(env->menvcfg, MENVCFG_SSE)) {
+        /*
+         * Disabled M-mode SSE always trigger illegal instruction when
+         * current priv mode is not M-mode.
+         */
+        exception = RISCV_EXCP_ILLEGAL_INST;
+        goto done;
+    }
+
+    if (!riscv_has_ext(env, RVS)) {
+        /* S-mode is not implemented */
+        exception = RISCV_EXCP_ILLEGAL_INST;
+        goto done;
+    } else if (env->virt_enabled) {
+        /*
+         * VU/VS-mode with disabled xSSE will trigger the virtual instruction
+         * exception.
+         */
+        exception = RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+        goto done;
+    } else {
+        /*
+         * U-mode with disabled S-mode SSE will trigger the illegal instruction
+         * exception.
+         *
+         * Note: S-mode is already handled in the disabled M-mode SSE case.
+         */
+        exception = RISCV_EXCP_ILLEGAL_INST;
+        goto done;
+    }
+
+done:
+    riscv_raise_exception(env, exception, GETPC());
+}
+
 #endif /* !CONFIG_USER_ONLY */
-- 
2.43.0

Re: [PATCH v1 3/3] target/riscv: Fix ssamoswap error handling

[Alistair Francis]

On Wed, Sep 24, 2025 at 5:50 PM Jim Shu <jim.shu@sifive.com> wrote:
>
> Follow the RISC-V CFI v1.0 spec [1] to fix the exception type
> when ssamoswap is disabled by xSSE.
>
> [1] RISC-V CFI spec v1.0, ch2.7 Atomic Swap from a Shadow Stack Location
>
> Signed-off-by: Jim Shu <jim.shu@sifive.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  target/riscv/helper.h                         |  5 ++
>  target/riscv/insn_trans/trans_rvzicfiss.c.inc |  8 +++
>  target/riscv/op_helper.c                      | 49 +++++++++++++++++++
>  3 files changed, 62 insertions(+)
>
> diff --git a/target/riscv/helper.h b/target/riscv/helper.h
> index f712b1c368..c82bacdc39 100644
> --- a/target/riscv/helper.h
> +++ b/target/riscv/helper.h
> @@ -1284,3 +1284,8 @@ DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
>  DEF_HELPER_5(vsm4k_vi, void, ptr, ptr, i32, env, i32)
>  DEF_HELPER_4(vsm4r_vv, void, ptr, ptr, env, i32)
>  DEF_HELPER_4(vsm4r_vs, void, ptr, ptr, env, i32)
> +
> +/* CFI (zicfiss) helpers */
> +#ifndef CONFIG_USER_ONLY
> +DEF_HELPER_1(ssamoswap_disabled, void, env)
> +#endif
> diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
> index 45686af4d6..f4a1c12ca0 100644
> --- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
> +++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
> @@ -91,7 +91,11 @@ static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a)
>      }
>
>      if (!ctx->bcfi_enabled) {
> +#ifndef CONFIG_USER_ONLY
> +        gen_helper_ssamoswap_disabled(tcg_env);
> +#else
>          return false;
> +#endif
>      }
>
>      TCGv dest = dest_gpr(ctx, a->rd);
> @@ -116,7 +120,11 @@ static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a)
>      }
>
>      if (!ctx->bcfi_enabled) {
> +#ifndef CONFIG_USER_ONLY
> +        gen_helper_ssamoswap_disabled(tcg_env);
> +#else
>          return false;
> +#endif
>      }
>
>      TCGv dest = dest_gpr(ctx, a->rd);
> diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
> index 110292e84d..8382aa94cb 100644
> --- a/target/riscv/op_helper.c
> +++ b/target/riscv/op_helper.c
> @@ -717,4 +717,53 @@ target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong addr)
>      return cpu_ldl_code_mmu(env, addr, oi, ra);
>  }
>
> +void helper_ssamoswap_disabled(CPURISCVState *env)
> +{
> +    int exception = RISCV_EXCP_ILLEGAL_INST;
> +
> +    /*
> +     * Here we follow the RISC-V CFI spec [1] to implement the exception type
> +     * of ssamoswap* instruction.
> +     *
> +     * [1] RISC-V CFI spec v1.0, ch2.7 Atomic Swap from a Shadow Stack Location
> +     *
> +     * Note: We have already checked some conditions in trans_* functions:
> +     *   1. The effective priv mode is not M-mode.
> +     *   2. The xSSE specific to the effictive priv mode is disabled.
> +     */
> +    if (!get_field(env->menvcfg, MENVCFG_SSE)) {
> +        /*
> +         * Disabled M-mode SSE always trigger illegal instruction when
> +         * current priv mode is not M-mode.
> +         */
> +        exception = RISCV_EXCP_ILLEGAL_INST;
> +        goto done;
> +    }
> +
> +    if (!riscv_has_ext(env, RVS)) {
> +        /* S-mode is not implemented */
> +        exception = RISCV_EXCP_ILLEGAL_INST;
> +        goto done;
> +    } else if (env->virt_enabled) {
> +        /*
> +         * VU/VS-mode with disabled xSSE will trigger the virtual instruction
> +         * exception.
> +         */
> +        exception = RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
> +        goto done;
> +    } else {
> +        /*
> +         * U-mode with disabled S-mode SSE will trigger the illegal instruction
> +         * exception.
> +         *
> +         * Note: S-mode is already handled in the disabled M-mode SSE case.
> +         */
> +        exception = RISCV_EXCP_ILLEGAL_INST;
> +        goto done;
> +    }
> +
> +done:
> +    riscv_raise_exception(env, exception, GETPC());
> +}
> +
>  #endif /* !CONFIG_USER_ONLY */
> --
> 2.43.0
>
>

Re: [PATCH v1 0/3] Minor fixes of RISC-V CFI

[Alistair Francis]

On Wed, Sep 24, 2025 at 5:50 PM Jim Shu <jim.shu@sifive.com> wrote:
>
> This patch series contains several CFI fixes:
>   (1) Fix the mepc in the exception from sspopchk instruction
>   (2) Fix the exception type from SSP CSR and ssamoswap instruction
>
> Jim Shu (3):
>   target/riscv: Fix the mepc when sspopchk triggers the exception
>   target/riscv: Fix SSP CSR error handling in VU/VS mode
>   target/riscv: Fix ssamoswap error handling

Thanks!

Applied to riscv-to-apply.next

Alistair

>
>  target/riscv/csr.c                            |  2 +
>  target/riscv/helper.h                         |  5 ++
>  target/riscv/insn_trans/trans_rvzicfiss.c.inc |  9 ++++
>  target/riscv/op_helper.c                      | 49 +++++++++++++++++++
>  4 files changed, 65 insertions(+)
>
> --
> 2.43.0
>
>

Re: [PATCH v1 0/3] Minor fixes of RISC-V CFI

[Michael Tokarev]

On 9/24/25 10:48, Jim Shu wrote:
> This patch series contains several CFI fixes:
>    (1) Fix the mepc in the exception from sspopchk instruction
>    (2) Fix the exception type from SSP CSR and ssamoswap instruction
> 
> Jim Shu (3):
>    target/riscv: Fix the mepc when sspopchk triggers the exception
>    target/riscv: Fix SSP CSR error handling in VU/VS mode
>    target/riscv: Fix ssamoswap error handling

Hi!

Is there anything in there which should be picked up for
qemu stable series (10.0.x lts and 10.1.x) ?

Thanks,

/mjt

Re: [PATCH v1 0/3] Minor fixes of RISC-V CFI

[Alistair Francis]

On Sat, Oct 4, 2025 at 5:33 PM Michael Tokarev <mjt@tls.msk.ru> wrote:
>
> On 9/24/25 10:48, Jim Shu wrote:
> > This patch series contains several CFI fixes:
> >    (1) Fix the mepc in the exception from sspopchk instruction
> >    (2) Fix the exception type from SSP CSR and ssamoswap instruction
> >
> > Jim Shu (3):
> >    target/riscv: Fix the mepc when sspopchk triggers the exception
> >    target/riscv: Fix SSP CSR error handling in VU/VS mode
> >    target/riscv: Fix ssamoswap error handling
>
> Hi!
>
> Is there anything in there which should be picked up for
> qemu stable series (10.0.x lts and 10.1.x) ?

If it's easy to apply then it can be applied, but it's still a very
new extension so I wouldn't worry too much about back porting the
fixes

Alistair

>
> Thanks,
>
> /mjt
>