On 10/14/26 20:15, wangyang wrote:
helper_cbo_zero() aligns the address down to the cache-block size before
probe_write(), and accel/tcg/user-exec.c:probe_access_internal() reports
that aligned address to cpu_loop_exit_sigsegv(), so a store fault from a
legal cbo.zero (e.g. on a read-only page) reports the aligned block base
as si_addr instead of the rs1 value supplied by the program. Native
RISC-V Linux reports the exact rs1 address. Keep the original address in
CPUState and use it when the fault is reported.
The saved address must not outlive the instruction that produced it. The
helper alone cannot guarantee that, because a store trigger or
breakpoint on the cbo.zero access leaves through the debug path instead
of one of the four fault consumers, and a later unrelated fault would
then report the stale cbo.zero address. Also drop the pending override
on every trap delivery: at the top of riscv_cpu_do_interrupt() and in
riscv_cpu_debug_excp_handler() for system mode, and right after
cpu_exec() returns in the linux-user cpu loop.
Tested: the read-only-page reproducer reports rs1 for offsets 1, 65 and
129; an mcontrol store-trigger reproducer reports the follow-up load's
own access-fault address instead of the earlier cbo.zero rs1.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4151
Suggested-by: David Harris <[email protected]>
Signed-off-by: wangyang <[email protected]>
---
accel/tcg/user-exec.c | 7 ++++++-
include/hw/core/cpu.h | 2 ++
linux-user/riscv/cpu_loop.c | 3 +++
target/riscv/tcg/cpu_helper.c | 27 ++++++++++++++++++++++++---
target/riscv/tcg/debug.c | 3 +++
target/riscv/tcg/op_helper.c | 5 +++++
6 files changed, 43 insertions(+), 4 deletions(-)
queued up in linux-user-next.
I'm happy to include upcoming R-b or A-b tags.
Helge
