{"id":2221153,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2221153/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260408140635.42546-3-zhiwei_liu@linux.alibaba.com/","project":{"id":14,"url":"http://patchwork.ozlabs.org/api/1.1/projects/14/?format=json","name":"QEMU Development","link_name":"qemu-devel","list_id":"qemu-devel.nongnu.org","list_email":"qemu-devel@nongnu.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20260408140635.42546-3-zhiwei_liu@linux.alibaba.com>","date":"2026-04-08T14:06:31","name":"[v5,2/6] target/riscv: Implement core SMMPT lookup logic","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"c0e28611589c858df0959bf673d435106479007e","submitter":{"id":84720,"url":"http://patchwork.ozlabs.org/api/1.1/people/84720/?format=json","name":"LIU Zhiwei","email":"zhiwei_liu@linux.alibaba.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/qemu-devel/patch/20260408140635.42546-3-zhiwei_liu@linux.alibaba.com/mbox/","series":[{"id":499183,"url":"http://patchwork.ozlabs.org/api/1.1/series/499183/?format=json","web_url":"http://patchwork.ozlabs.org/project/qemu-devel/list/?series=499183","date":"2026-04-08T14:06:34","name":"target/riscv: Implement Smsdid and Smmpt extension","version":5,"mbox":"http://patchwork.ozlabs.org/series/499183/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2221153/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2221153/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=linux.alibaba.com header.i=@linux.alibaba.com\n header.a=rsa-sha256 header.s=default header.b=RHTTOJua;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4frY6f42Lvz1xy1\n\tfor ; Thu, 09 Apr 2026 05:29:46 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wAYQ7-0004D6-1V; Wed, 08 Apr 2026 15:18:35 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wAXzo-00052P-Vw; Wed, 08 Apr 2026 14:51:25 -0400","from out30-130.freemail.mail.aliyun.com ([115.124.30.130])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wATbM-0001En-N6; Wed, 08 Apr 2026 10:09:55 -0400","from localhost.localdomain(mailfrom:zhiwei_liu@linux.alibaba.com\n fp:SMTPD_---0X0f7VCR_1775657264 cluster:ay36) by smtp.aliyun-inc.com;\n Wed, 08 Apr 2026 22:07:45 +0800"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=linux.alibaba.com; s=default;\n t=1775657266; h=From:To:Subject:Date:Message-Id:MIME-Version;\n bh=DlevkP4drC8rfWY8FsILv2AOFLHqsNxxtxjqJxqY/IQ=;\n b=RHTTOJuaANjG8WxHTEpGr3aRgGg8eTfI4MEqF3vftIQDLyMsuYiOOuZWSrQpeayw9+FftXZdELRHtqlhQtTbVHsOqFd92m/RysF50IbUdnkjzvL63fAlm29IbdKcAgxh8d7qFeWlK7Vggi8JKNbA7JhQDT70U2qKPxByYcPFySE=","X-Alimail-AntiSpam":"AC=PASS; BC=-1|-1; BR=01201311R141e4; CH=green;\n DM=||false|;\n DS=||; FP=0|-1|-1|-1|0|-1|-1|-1; HT=maildocker-contentspam033045133197;\n MF=zhiwei_liu@linux.alibaba.com; NM=1; PH=DS; RN=11; SR=0;\n TI=SMTPD_---0X0f7VCR_1775657264;","From":"LIU Zhiwei ","To":"qemu-devel@nongnu.org","Cc":"qemu-riscv@nongnu.org, chao.liu.zevorn@gmail.com, palmer@dabbelt.com,\n alistair23@gmail.com, daniel.barboza@oss.qualcomm.com, liwei1518@gmail.com,\n LIU Zhiwei ,\n Huang Tao ,\n TANG Tiancheng ,\n Daniel Henrique Barboza ","Subject":"[PATCH v5 2/6] target/riscv: Implement core SMMPT lookup logic","Date":"Wed, 8 Apr 2026 22:06:31 +0800","Message-Id":"<20260408140635.42546-3-zhiwei_liu@linux.alibaba.com>","X-Mailer":"git-send-email 2.39.3 (Apple Git-146)","In-Reply-To":"<20260408140635.42546-1-zhiwei_liu@linux.alibaba.com>","References":"<20260408140635.42546-1-zhiwei_liu@linux.alibaba.com>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Received-SPF":"pass client-ip=115.124.30.130;\n envelope-from=zhiwei_liu@linux.alibaba.com;\n helo=out30-130.freemail.mail.aliyun.com","X-Spam_score_int":"-174","X-Spam_score":"-17.5","X-Spam_bar":"-----------------","X-Spam_report":"(-17.5 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5,\n RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001,\n RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001,\n UNPARSEABLE_RELAY=0.001, USER_IN_DEF_DKIM_WL=-7.5,\n USER_IN_DEF_SPF_WL=-7.5 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"},"content":"This patch introduces the core implementation for the Memory Protection Table\n(MPT) walk, which is the central mechanism of the SMMPT extension.\n\nA new file, `riscv_smmpt.c`, is added to encapsulate the MPT logic. It\nimplements the `smmpt_lookup()` function, which performs a multi-level\npage table-like walk starting from the physical address specified in the\n`mptppn` CSR field. This walk determines the access permissions (read,\nwrite, execute) for a given physical address.\n\nThe implementation supports various SMMPT modes (SMMPT34, SMMPT43, etc.) and\ncorrectly handles leaf and non-leaf entries, including reserved bit\nchecks. Helper functions for parsing MPT entries and converting access\npermissions are also included in the new `riscv_smmpt.h` header.\n\nCo-authored-by: Huang Tao \nCo-authored-by: TANG Tiancheng \nSigned-off-by: LIU Zhiwei \nReviewed-by: Daniel Henrique Barboza \n---\n target/riscv/cpu_helper.c | 5 +-\n target/riscv/meson.build | 1 +\n target/riscv/pmp.h | 3 +\n target/riscv/riscv_smmpt.c | 274 +++++++++++++++++++++++++++++++++++++\n target/riscv/riscv_smmpt.h | 15 ++\n 5 files changed, 295 insertions(+), 3 deletions(-)\n create mode 100644 target/riscv/riscv_smmpt.c","diff":"diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c\nindex dd6c861a90..e3361fadae 100644\n--- a/target/riscv/cpu_helper.c\n+++ b/target/riscv/cpu_helper.c\n@@ -1089,9 +1089,8 @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv, bool virt_en)\n * @access_type: The type of MMU access\n * @mode: Indicates current privilege level.\n */\n-static int get_physical_address_pmp(CPURISCVState *env, int *prot, hwaddr addr,\n- int size, MMUAccessType access_type,\n- int mode)\n+int get_physical_address_pmp(CPURISCVState *env, int *prot, hwaddr addr,\n+ int size, MMUAccessType access_type, int mode)\n {\n pmp_priv_t pmp_priv;\n bool pmp_has_privs;\ndiff --git a/target/riscv/meson.build b/target/riscv/meson.build\nindex 3842c7c1a8..bd1c2e8fad 100644\n--- a/target/riscv/meson.build\n+++ b/target/riscv/meson.build\n@@ -34,6 +34,7 @@ riscv_system_ss = ss.source_set()\n riscv_system_ss.add(files(\n 'arch_dump.c',\n 'pmp.c',\n+ 'riscv_smmpt.c',\n 'debug.c',\n 'monitor.c',\n 'machine.c',\ndiff --git a/target/riscv/pmp.h b/target/riscv/pmp.h\nindex 467fb6b4b1..1ed574227c 100644\n--- a/target/riscv/pmp.h\n+++ b/target/riscv/pmp.h\n@@ -86,6 +86,9 @@ void pmp_update_rule_nums(CPURISCVState *env);\n uint32_t pmp_get_num_rules(CPURISCVState *env);\n int pmp_priv_to_page_prot(pmp_priv_t pmp_priv);\n void pmp_unlock_entries(CPURISCVState *env);\n+int get_physical_address_pmp(CPURISCVState *env, int *prot, hwaddr addr,\n+ int size, MMUAccessType access_type,\n+ int mode);\n \n #define MSECCFG_MML_ISSET(env) get_field(env->mseccfg, MSECCFG_MML)\n #define MSECCFG_MMWP_ISSET(env) get_field(env->mseccfg, MSECCFG_MMWP)\ndiff --git a/target/riscv/riscv_smmpt.c b/target/riscv/riscv_smmpt.c\nnew file mode 100644\nindex 0000000000..b7b47c5ae1\n--- /dev/null\n+++ b/target/riscv/riscv_smmpt.c\n@@ -0,0 +1,274 @@\n+/*\n+ * QEMU RISC-V Smmpt (Memory Protection Table)\n+ *\n+ * Copyright (c) 2024 Alibaba Group. All rights reserved.\n+ *\n+ * SPDX-License-Identifier: GPL-2.0-or-later\n+ */\n+\n+#include \"qemu/osdep.h\"\n+#include \"riscv_smmpt.h\"\n+#include \"pmp.h\"\n+#include \"system/memory.h\"\n+\n+typedef uint64_t load_entry_fn(AddressSpace *, hwaddr,\n+ MemTxAttrs, MemTxResult *);\n+\n+static uint64_t load_entry_32(AddressSpace *as, hwaddr addr,\n+ MemTxAttrs attrs, MemTxResult *result)\n+{\n+ return address_space_ldl(as, addr, attrs, result);\n+}\n+\n+static uint64_t load_entry_64(AddressSpace *as, hwaddr addr,\n+ MemTxAttrs attrs, MemTxResult *result)\n+{\n+ return address_space_ldq(as, addr, attrs, result);\n+}\n+\n+typedef union {\n+ uint64_t raw;\n+ struct {\n+ uint32_t v:1;\n+ uint32_t l:1;\n+ uint32_t rsv1:5;\n+ uint32_t perms:24;\n+ uint32_t n:1;\n+ } leaf32;\n+ struct {\n+ uint32_t v:1;\n+ uint32_t l:1;\n+ uint32_t rsv1:8;\n+ uint32_t ppn:22;\n+ } nonleaf32;\n+ struct {\n+ uint64_t v:1;\n+ uint64_t l:1;\n+ uint64_t rsv1:8;\n+ uint64_t perms:48;\n+ uint64_t rsv2:5;\n+ uint64_t n:1;\n+ } leaf64;\n+ struct {\n+ uint64_t v:1;\n+ uint64_t l:1;\n+ uint64_t rsv1:8;\n+ uint64_t ppn:52;\n+ uint64_t rsv2:1;\n+ uint64_t n:1;\n+ } nonleaf64;\n+} mpte_union_t;\n+\n+static inline bool mpte_is_leaf(uint64_t mpte)\n+{\n+ return mpte & 0x2;\n+}\n+\n+static inline bool mpte_is_valid(uint64_t mpte)\n+{\n+ return mpte & 0x1;\n+}\n+\n+static uint64_t mpte_get_rsv(CPURISCVState *env, uint64_t mpte)\n+{\n+ RISCVMXL mxl = riscv_cpu_mxl(env);\n+ bool leaf = mpte_is_leaf(mpte);\n+ mpte_union_t *u = (mpte_union_t *)&mpte;\n+\n+ if (mxl == MXL_RV32) {\n+ return leaf ? u->leaf32.rsv1 : u->nonleaf32.rsv1;\n+ }\n+ return leaf ? (u->leaf64.rsv1 << 5) | u->leaf64.rsv2\n+ : (u->nonleaf64.rsv1 << 1) | u->nonleaf64.rsv2;\n+}\n+\n+static uint64_t mpte_get_perms(CPURISCVState *env, uint64_t mpte)\n+{\n+ RISCVMXL mxl = riscv_cpu_mxl(env);\n+ mpte_union_t *u = (mpte_union_t *)&mpte;\n+\n+ return (mxl == MXL_RV32) ? u->leaf32.perms : u->leaf64.perms;\n+}\n+\n+static bool mpte_check_nlnapot(CPURISCVState *env, uint64_t mpte, bool *nlnapot)\n+{\n+ RISCVMXL mxl = riscv_cpu_mxl(env);\n+ mpte_union_t *u = (mpte_union_t *)&mpte;\n+ if (mxl == MXL_RV32) {\n+ *nlnapot = false;\n+ return true;\n+ }\n+ *nlnapot = u->nonleaf64.n;\n+ return u->nonleaf64.n ? (u->nonleaf64.ppn & 0x1ff) == 0x100 : true;\n+}\n+\n+static uint64_t mpte_get_ppn(CPURISCVState *env, uint64_t mpte, int pn,\n+ bool nlnapot)\n+{\n+ RISCVMXL mxl = riscv_cpu_mxl(env);\n+ mpte_union_t *u = (mpte_union_t *)&mpte;\n+\n+ if (nlnapot) {\n+ return deposit64(u->nonleaf64.ppn, 0, 9, pn & 0x1ff);\n+ }\n+ return (mxl == MXL_RV32) ? u->nonleaf32.ppn : u->nonleaf64.ppn;\n+}\n+\n+/* Caller should assert i before call this interface */\n+static int mpt_get_pn(hwaddr addr, int i, mpt_mode_t mode)\n+{\n+ if (mode == SMMPT34) {\n+ return i == 0\n+ ? extract64(addr, 15, 10)\n+ : extract64(addr, 25, 9);\n+ } else {\n+ int offset = 16 + i * 9;\n+ if ((mode == SMMPT64) && (i == 4)) {\n+ return extract64(addr, offset, 12);\n+ } else {\n+ return extract64(addr, offset, 9);\n+ }\n+ }\n+}\n+\n+/* Caller should assert i before call this interface */\n+static int mpt_get_pi(hwaddr addr, int i, mpt_mode_t mode)\n+{\n+ if (mode == SMMPT34) {\n+ return i == 0\n+ ? extract64(addr, 12, 3)\n+ : extract64(addr, 22, 3);\n+ } else {\n+ int offset = 16 + i * 9;\n+ return extract64(addr, offset - 4, 4);\n+ }\n+}\n+\n+static bool smmpt_lookup(CPURISCVState *env, hwaddr addr, mpt_mode_t mode,\n+ mpt_access_t *allowed_access,\n+ MMUAccessType access_type)\n+{\n+ MemTxResult res;\n+ MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;\n+ CPUState *cs = env_cpu(env);\n+ hwaddr mpte_addr, base = (hwaddr)env->mptppn << PGSHIFT;\n+ load_entry_fn *load_entry;\n+ uint32_t mptesize, levels, xwr;\n+ int pn, pi, pmp_prot, pmp_ret;\n+ uint64_t mpte, perms;\n+\n+ switch (mode) {\n+ case SMMPT34:\n+ load_entry = &load_entry_32; levels = 2; mptesize = 4; break;\n+ case SMMPT43:\n+ load_entry = &load_entry_64; levels = 3; mptesize = 8; break;\n+ break;\n+ case SMMPT52:\n+ load_entry = &load_entry_64; levels = 4; mptesize = 8; break;\n+ case SMMPT64:\n+ load_entry = &load_entry_64; levels = 5; mptesize = 8; break;\n+ case SMMPTBARE:\n+ *allowed_access = ACCESS_ALLOW_RWX;\n+ return true;\n+ default:\n+ g_assert_not_reached();\n+ break;\n+ }\n+ for (int i = levels - 1; i >= 0 ; i--) {\n+ /* 1. Get pn[i] as the mpt index */\n+ pn = mpt_get_pn(addr, i, mode);\n+ /* 2. Get mpte address and get mpte */\n+ mpte_addr = base + pn * mptesize;\n+ pmp_ret = get_physical_address_pmp(env, &pmp_prot, mpte_addr,\n+ mptesize, MMU_DATA_LOAD, PRV_M);\n+ if (pmp_ret != TRANSLATE_SUCCESS) {\n+ return false;\n+ }\n+ mpte = load_entry(cs->as, mpte_addr, attrs, &res);\n+ /* 3. Check valid bit and reserve bits of mpte */\n+ if (!mpte_is_valid(mpte) || mpte_get_rsv(env, mpte)) {\n+ return false;\n+ }\n+\n+ /* 4. Process non-leaf node */\n+ if (!mpte_is_leaf(mpte)) {\n+ bool nlnapot = false;\n+ if (i == 0) {\n+ return false;\n+ }\n+ if (!mpte_check_nlnapot(env, mpte, &nlnapot)) {\n+ return false;\n+ }\n+ base = mpte_get_ppn(env, mpte, pn, nlnapot) << PGSHIFT;\n+ continue;\n+ }\n+\n+ /* 5. Process leaf node */\n+ pi = mpt_get_pi(addr, i, mode);\n+ perms = mpte_get_perms(env, mpte);\n+ xwr = (perms >> (pi * 3)) & 0x7;\n+ switch (xwr) {\n+ case ACCESS_ALLOW_R:\n+ *allowed_access = ACCESS_ALLOW_R;\n+ return access_type == MMU_DATA_LOAD;\n+ case ACCESS_ALLOW_X:\n+ *allowed_access = ACCESS_ALLOW_X;\n+ return access_type == MMU_INST_FETCH;\n+ case ACCESS_ALLOW_RX:\n+ *allowed_access = ACCESS_ALLOW_R;\n+ return (access_type == MMU_DATA_LOAD ||\n+ access_type == MMU_INST_FETCH);\n+ case ACCESS_ALLOW_RW:\n+ *allowed_access = ACCESS_ALLOW_RW;\n+ return (access_type == MMU_DATA_LOAD ||\n+ access_type == MMU_DATA_STORE);\n+ case ACCESS_ALLOW_RWX:\n+ *allowed_access = ACCESS_ALLOW_RWX;\n+ return true;\n+ default:\n+ return false;\n+ }\n+ }\n+ return false;\n+}\n+\n+bool smmpt_check_access(CPURISCVState *env, hwaddr addr,\n+ mpt_access_t *allowed_access, MMUAccessType access_type)\n+{\n+ bool mpt_has_access;\n+ mpt_mode_t mode = env->mptmode;\n+\n+ mpt_has_access = smmpt_lookup(env, addr, mode,\n+ allowed_access, access_type);\n+ return mpt_has_access;\n+}\n+\n+/*\n+ * Convert MPT access to TLB page privilege.\n+ */\n+int smmpt_access_to_page_prot(mpt_access_t mpt_access)\n+{\n+ int prot;\n+ switch (mpt_access) {\n+ case ACCESS_ALLOW_R:\n+ prot = PAGE_READ;\n+ break;\n+ case ACCESS_ALLOW_X:\n+ prot = PAGE_EXEC;\n+ break;\n+ case ACCESS_ALLOW_RX:\n+ prot = PAGE_READ | PAGE_EXEC;\n+ break;\n+ case ACCESS_ALLOW_RW:\n+ prot = PAGE_READ | PAGE_WRITE;\n+ break;\n+ case ACCESS_ALLOW_RWX:\n+ prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;\n+ break;\n+ default:\n+ prot = 0;\n+ break;\n+ }\n+\n+ return prot;\n+}\ndiff --git a/target/riscv/riscv_smmpt.h b/target/riscv/riscv_smmpt.h\nindex 74dcccf4be..0d0597f8eb 100644\n--- a/target/riscv/riscv_smmpt.h\n+++ b/target/riscv/riscv_smmpt.h\n@@ -9,6 +9,9 @@\n #ifndef RISCV_SMMPT_H\n #define RISCV_SMMPT_H\n \n+#include \"cpu.h\"\n+#include \"exec/mmu-access-type.h\"\n+\n typedef enum {\n SMMPTBARE = 0,\n SMMPT34 = 1,\n@@ -18,4 +21,16 @@ typedef enum {\n SMMPTMAX\n } mpt_mode_t;\n \n+typedef enum {\n+ ACCESS_ALLOW_R = 0b001,\n+ ACCESS_ALLOW_X = 0b100,\n+ ACCESS_ALLOW_RX = 0b101 ,\n+ ACCESS_ALLOW_RW = 0b011,\n+ ACCESS_ALLOW_RWX = 0b111,\n+} mpt_access_t;\n+\n+int smmpt_access_to_page_prot(mpt_access_t mpt_access);\n+bool smmpt_check_access(CPURISCVState *env, hwaddr addr,\n+ mpt_access_t *allowed_access,\n+ MMUAccessType access_type);\n #endif\n","prefixes":["v5","2/6"]}