{"id":2221119,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2221119/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260408140635.42546-4-zhiwei_liu@linux.alibaba.com/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/1.1/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260408140635.42546-4-zhiwei_liu@linux.alibaba.com>","date":"2026-04-08T14:06:32","name":"[v5,3/6] target/riscv: Integrate SMMPT checks into MMU and TLB fill","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"5ee8a6d9931660cbc51475d47438823e67257ed4","submitter":{"id":84720,"url":"http://patchwork.ozlabs.org/api/1.1/people/84720/?format=json","name":"LIU Zhiwei","email":"zhiwei_liu@linux.alibaba.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260408140635.42546-4-zhiwei_liu@linux.alibaba.com/mbox/","series":[{"id":499183,"url":"http://patchwork.ozlabs.org/api/1.1/series/499183/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=499183","date":"2026-04-08T14:06:34","name":"target/riscv: Implement Smsdid and Smmpt extension","version":5,"mbox":"http://patchwork.ozlabs.org/series/499183/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2221119/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2221119/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=linux.alibaba.com header.i=@linux.alibaba.com\n header.a=rsa-sha256 header.s=default header.b=fijL2VrY;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4frXv716Hvz1xy1\n\tfor ; Thu, 09 Apr 2026 05:19:47 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wAYJQ-00088m-Gl; Wed, 08 Apr 2026 15:11:40 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wAYGn-0004TG-No; Wed, 08 Apr 2026 15:08:58 -0400","from out30-131.freemail.mail.aliyun.com ([115.124.30.131])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wATbt-0001GO-6C; Wed, 08 Apr 2026 10:10:27 -0400","from localhost.localdomain(mailfrom:zhiwei_liu@linux.alibaba.com\n fp:SMTPD_---0X0f.zbo_1775657295 cluster:ay36) by smtp.aliyun-inc.com;\n Wed, 08 Apr 2026 22:08:16 +0800"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=linux.alibaba.com; s=default;\n t=1775657297; h=From:To:Subject:Date:Message-Id:MIME-Version;\n bh=JKND3Y6ouxyRSoJNyxmyKgMpanX+vT60nZiZuP9QR+s=;\n b=fijL2VrY5sU9384erQgc/tT8hX37D4PFkCsSHFc5EnZqBbI39QHDhkXvLlLO/P0ZUsfUAgs0P2NQMxjyt6Wv6ONPJ/bcHrsJU2MUjFKAjCx65Xs5PEX2lziakJ+/lj0iy1ojQML1BciVLFh/GD2Ys7kCRIF/QL7iCc0rr5/KWjs=","X-Alimail-AntiSpam":"AC=PASS; BC=-1|-1; BR=01201311R101e4; CH=green;\n DM=||false|;\n DS=||; FP=0|-1|-1|-1|0|-1|-1|-1; HT=maildocker-contentspam033045133197;\n MF=zhiwei_liu@linux.alibaba.com; NM=1; PH=DS; RN=11; SR=0;\n TI=SMTPD_---0X0f.zbo_1775657295;","From":"LIU Zhiwei ","To":"qemu-devel@nongnu.org","Cc":"qemu-riscv@nongnu.org, chao.liu.zevorn@gmail.com, palmer@dabbelt.com,\n alistair23@gmail.com, daniel.barboza@oss.qualcomm.com, liwei1518@gmail.com,\n LIU Zhiwei ,\n Huang Tao ,\n TANG Tiancheng ,\n Daniel Henrique Barboza ","Subject":"[PATCH v5 3/6] target/riscv: Integrate SMMPT checks into MMU and TLB\n fill","Date":"Wed, 8 Apr 2026 22:06:32 +0800","Message-Id":"<20260408140635.42546-4-zhiwei_liu@linux.alibaba.com>","X-Mailer":"git-send-email 2.39.3 (Apple Git-146)","In-Reply-To":"<20260408140635.42546-1-zhiwei_liu@linux.alibaba.com>","References":"<20260408140635.42546-1-zhiwei_liu@linux.alibaba.com>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Received-SPF":"pass client-ip=115.124.30.131;\n envelope-from=zhiwei_liu@linux.alibaba.com;\n helo=out30-131.freemail.mail.aliyun.com","X-Spam_score_int":"-174","X-Spam_score":"-17.5","X-Spam_bar":"-----------------","X-Spam_report":"(-17.5 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5,\n RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001,\n RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001,\n UNPARSEABLE_RELAY=0.001, USER_IN_DEF_DKIM_WL=-7.5,\n USER_IN_DEF_SPF_WL=-7.5 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"},"content":"With the core MPT lookup logic in place, this patch integrates the\npermission checks into QEMU's main MMU processing functions.\n\nA new helper, `get_physical_address_mpt`, is introduced to check the\npermissions for a given physical address against the MPT. This helper\nis then called at two critical points:\n\n1. During page table walks (`get_physical_address`): The physical\n address of the Page Table Entry (PTE) itself is checked to ensure\n the supervisor has permission to read it.\n\n2. After successful address translation (`riscv_cpu_tlb_fill`): The final\n guest-physical address is checked against the MPT before the access\n is allowed to proceed.\n\nThis ensures that SMMPT protection is enforced for both the translation\nprocess and the final memory access, as required by the specification.\n\nCo-authored-by: Huang Tao \nCo-authored-by: TANG Tiancheng \nSigned-off-by: LIU Zhiwei \nReviewed-by: Daniel Henrique Barboza \n---\n target/riscv/cpu_helper.c | 76 ++++++++++++++++++++++++++++++++++++++-\n 1 file changed, 75 insertions(+), 1 deletion(-)","diff":"diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c\nindex e3361fadae..2fab00e9b4 100644\n--- a/target/riscv/cpu_helper.c\n+++ b/target/riscv/cpu_helper.c\n@@ -1161,6 +1161,60 @@ static bool check_svukte_addr(CPURISCVState *env, vaddr addr)\n return !high_bit;\n }\n \n+/*\n+ * get_physical_address_mpt - check mpt permission for this physical address\n+ *\n+ * Lookup the Memory Protection Table and check permission for this\n+ * physical address. Returns 0 if the permission checking was successful\n+ *\n+ * @env: CPURISCVState\n+ * @prot: The returned protection attributes\n+ * @addr: The physical address to be checked permission\n+ * @access_type: The type of MMU access\n+ * @mode: Indicates current privilege level.\n+ */\n+static int get_physical_address_mpt(CPURISCVState *env, int *prot, hwaddr addr,\n+ MMUAccessType access_type, int mode)\n+{\n+ mpt_access_t mpt_access;\n+ bool mpt_has_access;\n+\n+ /*\n+ * If the extension is not supported or the mmpt.mode is Bare,\n+ * there is no protection, return success.\n+ */\n+ if (!riscv_cpu_cfg(env)->ext_smmpt || env->mptmode == 0) {\n+ *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;\n+ return TRANSLATE_SUCCESS;\n+ }\n+\n+ /*\n+ * MPT is checked for all accesses to physical memory, unless the\n+ * effective privilege mode is M.\n+ *\n+ * Data accesses in M-mode when the MPRV bit in mstatus is set and\n+ * the MPP field in mstatus contains S or U are subject to MPT checks.\n+ *\n+ * In riscv_env_mmu_index, The MPRV and MPP bits are already checked and\n+ * encoded to mmu_idx, So we do not need to check it here.\n+ */\n+ if (mode == PRV_M) {\n+ *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;\n+ return TRANSLATE_SUCCESS;\n+ }\n+\n+ mpt_has_access = smmpt_check_access(env, addr,\n+ &mpt_access, access_type);\n+ if (!mpt_has_access) {\n+ *prot = 0;\n+ return TRANSLATE_MPT_FAIL;\n+ }\n+\n+ *prot = smmpt_access_to_page_prot(mpt_access);\n+\n+ return TRANSLATE_SUCCESS;\n+}\n+\n /*\n * get_physical_address - get the physical address for this virtual address\n *\n@@ -1355,6 +1409,13 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,\n pte_addr = base + idx * ptesize;\n }\n \n+ int mpt_prot;\n+ int mpt_ret = get_physical_address_mpt(env, &mpt_prot, pte_addr,\n+ MMU_DATA_LOAD, PRV_S);\n+ if (mpt_ret != TRANSLATE_SUCCESS) {\n+ return TRANSLATE_MPT_FAIL;\n+ }\n+\n int pmp_prot;\n int pmp_ret = get_physical_address_pmp(env, &pmp_prot, pte_addr,\n sxlen_bytes,\n@@ -1765,7 +1826,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,\n CPURISCVState *env = &cpu->env;\n vaddr im_address;\n hwaddr pa = 0;\n- int prot, prot2, prot_pmp;\n+ int prot, prot2, prot_pmp, mpt_prot;\n bool pmp_violation = false;\n bool first_stage_error = true;\n bool two_stage_lookup = mmuidx_2stage(mmu_idx);\n@@ -1819,6 +1880,13 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,\n prot &= prot2;\n \n if (ret == TRANSLATE_SUCCESS) {\n+ ret = get_physical_address_mpt(env, &mpt_prot, pa,\n+ access_type, mode);\n+ qemu_log_mask(CPU_LOG_MMU,\n+ \"%s MPT address=\" HWADDR_FMT_plx \" ret %d prot\"\n+ \" %d\\n\",\n+ __func__, pa, ret, mpt_prot);\n+ prot &= mpt_prot;\n ret = get_physical_address_pmp(env, &prot_pmp, pa,\n size, access_type, mode);\n tlb_size = pmp_get_tlb_size(env, pa);\n@@ -1854,6 +1922,12 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,\n __func__, address, ret, pa, prot);\n \n if (ret == TRANSLATE_SUCCESS) {\n+ ret = get_physical_address_mpt(env, &mpt_prot, pa,\n+ access_type, mode);\n+ qemu_log_mask(CPU_LOG_MMU,\n+ \"%s MPT address=\" HWADDR_FMT_plx \" ret %d prot %d\\n\",\n+ __func__, pa, ret, mpt_prot);\n+ prot &= mpt_prot;\n ret = get_physical_address_pmp(env, &prot_pmp, pa,\n size, access_type, mode);\n tlb_size = pmp_get_tlb_size(env, pa);\n","prefixes":["v5","3/6"]}