From: A-Shehab <[email protected]>
The Zicfilp landing-pad enable (LPE, bit 2) and Zicfiss shadow-stack
enable (SSE, bit 3) controls live in the low 32 bits of menvcfg and
henvcfg, and the CFI specification defines them for both RV32 and RV64.
QEMU only adds MENVCFG_LPE/MENVCFG_SSE (and the henvcfg equivalents) to
the writable mask inside the "riscv_cpu_mxl(env) == MXL_RV64" block, so
on RV32 these bits are silently dropped and the features cannot be
enabled. This is inconsistent with write_senvcfg(), which already
handles SENVCFG_LPE/SENVCFG_SSE regardless of MXLEN.
Hoist the LPE/SSE mask handling out of the RV64-only block in
write_menvcfg() and write_henvcfg() so the bits become writable on RV32
as well. The upper-half writers (write_menvcfgh/write_henvcfgh) are
unaffected because these bits reside in the low 32 bits.
Reproducible on qemu-system-riscv32 -cpu rv32,zicfilp=true,zicfiss=true:
an M-mode write of menvcfg.{LPE,SSE} reads back as zero, while the same
program on rv64 keeps the bits set.
Fixes: 4923f672e3d7 ("target/riscv: Introduce elp state and enabling controls
for zicfilp")
Fixes: 8205bc127a83 ("target/riscv: introduce ssp and enabling controls for
zicfiss")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4045
Signed-off-by: A-Shehab <[email protected]>
Reviewed-by: Daniel Henrique Barboza <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Alistair Francis <[email protected]>
(cherry picked from commit bd1ee9ab3c39f269d8bea8acf83ea833a69a6e10)
(Mjt: introduce `RISCVCPUConfig *cfg` variable in write_henvcfg()
from v10.0.0-1878-gdff5f515409f
"target/riscv: Enable/Disable S/VS-mode Timer when STCE bit is changed")
Signed-off-by: Michael Tokarev <[email protected]>
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 4015f023d10..9d43dbfab81 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -3196,6 +3196,19 @@ static RISCVException write_menvcfg(CPURISCVState *env,
int csrno,
uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE |
MENVCFG_CBZE | MENVCFG_CDE;
+ /*
+ * menvcfg.LPE (Zicfilp) and menvcfg.SSE (Zicfiss) reside in the low
+ * 32 bits and are defined for both RV32 and RV64, so they must be
+ * writable regardless of MXLEN.
+ */
+ if (cfg->ext_zicfilp) {
+ mask |= MENVCFG_LPE;
+ }
+
+ if (cfg->ext_zicfiss) {
+ mask |= MENVCFG_SSE;
+ }
+
if (riscv_cpu_mxl(env) == MXL_RV64) {
mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
(cfg->ext_sstc ? MENVCFG_STCE : 0) |
@@ -3203,14 +3216,6 @@ static RISCVException write_menvcfg(CPURISCVState *env,
int csrno,
(cfg->ext_svadu ? MENVCFG_ADUE : 0) |
(cfg->ext_ssdbltrp ? MENVCFG_DTE : 0);
- if (env_archcpu(env)->cfg.ext_zicfilp) {
- mask |= MENVCFG_LPE;
- }
-
- if (env_archcpu(env)->cfg.ext_zicfiss) {
- mask |= MENVCFG_SSE;
- }
-
/* Update PMM field only if the value is valid according to Zjpm v1.0
*/
if (env_archcpu(env)->cfg.ext_smnpm &&
get_field(val, MENVCFG_PMM) != PMM_FIELD_RESERVED) {
@@ -3331,6 +3336,7 @@ static RISCVException read_henvcfg(CPURISCVState *env,
int csrno,
static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
target_ulong val)
{
+ const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
RISCVException ret;
@@ -3339,20 +3345,24 @@ static RISCVException write_henvcfg(CPURISCVState *env,
int csrno,
return ret;
}
+ /*
+ * henvcfg.LPE (Zicfilp) and henvcfg.SSE (Zicfiss) reside in the low
+ * 32 bits and are defined for both RV32 and RV64, so they must be
+ * writable regardless of MXLEN.
+ */
+ if (cfg->ext_zicfilp) {
+ mask |= HENVCFG_LPE;
+ }
+
+ /* H can light up SSE for VS only if HS had it from menvcfg */
+ if (cfg->ext_zicfiss && get_field(env->menvcfg, MENVCFG_SSE)) {
+ mask |= HENVCFG_SSE;
+ }
+
if (riscv_cpu_mxl(env) == MXL_RV64) {
mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE |
HENVCFG_DTE);
- if (env_archcpu(env)->cfg.ext_zicfilp) {
- mask |= HENVCFG_LPE;
- }
-
- /* H can light up SSE for VS only if HS had it from menvcfg */
- if (env_archcpu(env)->cfg.ext_zicfiss &&
- get_field(env->menvcfg, MENVCFG_SSE)) {
- mask |= HENVCFG_SSE;
- }
-
/* Update PMM field only if the value is valid according to Zjpm v1.0
*/
if (env_archcpu(env)->cfg.ext_ssnpm &&
get_field(val, HENVCFG_PMM) != PMM_FIELD_RESERVED) {
--
2.47.3
