The page table walker reads PTEs using address_space_ldl/ldq which use compile-time native endianness (always LE for RISC-V). However, when a big-endian kernel writes PTEs via normal store instructions, they are stored in big-endian byte order. The walker then misinterprets the PTE values, causing page faults and a hang when the kernel enables the MMU.
The RISC-V privileged specification states that implicit data memory accesses to supervisor-level memory management data structures follow the hart's endianness setting (MSTATUS SBE/MBE bits). Fix both PTE reads and atomic A/D bit updates to use the explicit _le or _be memory access variants based on the hart's runtime endianness. Signed-off-by: Djordje Todorovic <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> --- target/riscv/cpu_helper.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index c28832e0e3..b3d33da13e 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -1365,9 +1365,13 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical, } if (riscv_cpu_mxl(env) == MXL_RV32) { - pte = address_space_ldl_le(cs->as, pte_addr, attrs, &res); + pte = riscv_cpu_data_is_big_endian(env) + ? address_space_ldl_be(cs->as, pte_addr, attrs, &res) + : address_space_ldl_le(cs->as, pte_addr, attrs, &res); } else { - pte = address_space_ldq_le(cs->as, pte_addr, attrs, &res); + pte = riscv_cpu_data_is_big_endian(env) + ? address_space_ldq_be(cs->as, pte_addr, attrs, &res) + : address_space_ldq_le(cs->as, pte_addr, attrs, &res); } if (res != MEMTX_OK) { @@ -1566,12 +1570,24 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical, if (memory_region_is_ram(mr)) { target_ulong *pte_pa = qemu_map_ram_ptr(mr->ram_block, addr1); target_ulong old_pte; + bool be = riscv_cpu_data_is_big_endian(env); if (riscv_cpu_sxl(env) == MXL_RV32) { - old_pte = qatomic_cmpxchg((uint32_t *)pte_pa, cpu_to_le32(pte), cpu_to_le32(updated_pte)); - old_pte = le32_to_cpu(old_pte); + uint32_t cmp = be ? cpu_to_be32(pte) + : cpu_to_le32(pte); + uint32_t val = be ? cpu_to_be32(updated_pte) + : cpu_to_le32(updated_pte); + old_pte = qatomic_cmpxchg((uint32_t *)pte_pa, + cmp, val); + old_pte = be ? be32_to_cpu(old_pte) + : le32_to_cpu(old_pte); } else { - old_pte = qatomic_cmpxchg(pte_pa, cpu_to_le64(pte), cpu_to_le64(updated_pte)); - old_pte = le64_to_cpu(old_pte); + target_ulong cmp = be ? cpu_to_be64(pte) + : cpu_to_le64(pte); + target_ulong val = be ? cpu_to_be64(updated_pte) + : cpu_to_le64(updated_pte); + old_pte = qatomic_cmpxchg(pte_pa, cmp, val); + old_pte = be ? be64_to_cpu(old_pte) + : le64_to_cpu(old_pte); } if (old_pte != pte) { goto restart; -- 2.34.1
