@samitouri / QOSamiQemu / commits / 23208e398e

target/riscv: Fix page table walk endianness for big-endian harts

The page table walker reads PTEs using address_space_ldl/ldq which use compile-time native endianness (always LE for RISC-V). However, when a big-endian kernel writes PTEs via normal store instructions, they are stored in big-endian byte order. The walker then misinterprets the PTE values, causing page faults and a hang when the kernel enables the MMU. The RISC-V privileged specification states that implicit data memory accesses to supervisor-level memory management data structures follow the hart's endianness setting (MSTATUS SBE/MBE bits). Fix both PTE reads and atomic A/D bit updates to use the explicit _le or _be memory access variants based on the hart's runtime endianness. Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> Message-ID: <20260527201348.29511-7-philmd@linaro.org> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

Djordje Todorovic committed May 27, 2026 at 22:13 UTC 23208e398e487539a326e10cdd1e4a09fc00c183
1 file changed +11 -8
target/riscv/cpu_helper.c
+11 -8
@@ -1370,6 +1370,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
1370 target_ulong pte;
1371 hwaddr pte_addr;
1372 const hwaddr base_root = base;
1373 + const bool be = mo_endian_env(env) == MO_BE;
1374 int i;
1375
1376 restart:
@@ -1418,9 +1419,11 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
1419 }
1420
1421 if (riscv_cpu_mxl(env) == MXL_RV32) {
1421 - pte = address_space_ldl_le(cs->as, pte_addr, attrs, &res);
1422 + pte = be ? address_space_ldl_be(cs->as, pte_addr, attrs, &res)
1423 + : address_space_ldl_le(cs->as, pte_addr, attrs, &res);
1424 } else {
1423 - pte = address_space_ldq_le(cs->as, pte_addr, attrs, &res);
1425 + pte = be ? address_space_ldq_be(cs->as, pte_addr, attrs, &res)
1426 + : address_space_ldq_le(cs->as, pte_addr, attrs, &res);
1427 }
1428
1429 if (res != MEMTX_OK) {
@@ -1679,15 +1682,15 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
1682 uint64_t old_pte;
1683
1684 if (riscv_cpu_sxl(env) == MXL_RV32) {
1682 - uint32_t cmp = cpu_to_le32(pte);
1683 - uint32_t val = cpu_to_le32(updated_pte);
1685 + uint32_t cmp = be ? cpu_to_be32(pte) : cpu_to_le32(pte);
1686 + uint32_t val = be ? cpu_to_be32(updated_pte) : cpu_to_le32(updated_pte);
1687 old_pte = qatomic_cmpxchg((uint32_t *)pte_pa, cmp, val);
1685 - old_pte = le32_to_cpu(old_pte);
1688 + old_pte = be ? be32_to_cpu(old_pte) : le32_to_cpu(old_pte);
1689 } else {
1687 - uint64_t cmp = cpu_to_le64(pte);
1688 - uint64_t val = cpu_to_le64(updated_pte);
1690 + uint64_t cmp = be ? cpu_to_be64(pte) : cpu_to_le64(pte);
1691 + uint64_t val = be ? cpu_to_be64(updated_pte) : cpu_to_le64(updated_pte);
1692 old_pte = qatomic_cmpxchg((uint64_t *)pte_pa, cmp, val);
1690 - old_pte = le64_to_cpu(old_pte);
1693 + old_pte = be ? be64_to_cpu(old_pte) : le64_to_cpu(old_pte);
1694 }
1695 if (old_pte != pte) {
1696 goto restart;