Re: [PATCH v2 26/39] xen/riscv: add guest store emulation for trapped MMIO accesses

[Jan Beulich <jbeulich@xxxxxxxx>]

On 27.08.2026 17:21, Oleksii Kurochko wrote:
> --- a/xen/arch/riscv/emulate.c
> +++ b/xen/arch/riscv/emulate.c
> @@ -453,9 +453,28 @@ static int emulate_load(const struct guest_fault *gf)
>      return 0;
>  }
>  
> -static int emulate_store(struct guest_fault *gf)
> +static int emulate_store(const struct guest_fault *gf)
>  {
> -    return -EOPNOTSUPP;
> +    struct cpu_user_regs *regs = gf->regs;
> +    mmio_info_t info = { .is_write = true };
> +    struct decoded_insn di;
> +    int rc;
> +
> +    if ( insn_fetch_faulted(gf, &di) )
> +        return 0;
> +
> +    if ( !decode_ldst_insn(&di, guest_xlen(regs)) || !di.is_write )
> +        return -EOPNOTSUPP;
> +
> +    info.data = *guest_gpr(regs, di.reg);

This came to mind only here, but applies to the earlier patch as well:
There's no checking of di.len, not even by an assertion. The above is
fragile as to extensions like Zilsd. Zilsd itself may still be okay as
the overrun of the register field will hit the correct one, but the
general concern remains (plus of course that moving across fields is
UB).

Jan