As per the specification, in 64-bit, if any of the pte reserved bits 60-54 is set, an exception should be triggered (see 4.4.1, "Addressing and Memory Protection"), so implement this behaviour in the address translation process.
Reported-by: Andrea Parri <and...@rivosinc.com> Signed-off-by: Alexandre Ghiti <alexgh...@rivosinc.com> --- target/riscv/cpu_bits.h | 1 + target/riscv/cpu_helper.c | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h index fca7ef0cef..8d9ba2ce11 100644 --- a/target/riscv/cpu_bits.h +++ b/target/riscv/cpu_bits.h @@ -640,6 +640,7 @@ typedef enum { #define PTE_SOFT 0x300 /* Reserved for Software */ #define PTE_PBMT 0x6000000000000000ULL /* Page-based memory types */ #define PTE_N 0x8000000000000000ULL /* NAPOT translation */ +#define PTE_RESERVED 0x1FC0000000000000ULL /* Reserved bits */ #define PTE_ATTR (PTE_N | PTE_PBMT) /* All attributes bits */ /* Page table PPN shift amount */ diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index f88c503cf4..39c323a865 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -936,6 +936,11 @@ restart: return TRANSLATE_FAIL; } + /* PTE reserved bits must be cleared otherwise an exception is raised */ + if (riscv_cpu_mxl(env) == MXL_RV64 && (pte & PTE_RESERVED)) { + return TRANSLATE_FAIL; + } + bool pbmte = env->menvcfg & MENVCFG_PBMTE; bool hade = env->menvcfg & MENVCFG_HADE; -- 2.37.2