Commit cb82463fa9 for qemu.org

commit cb82463fa9bf46d90e6a1779bb20aff2bf76a1a7
Author: dodochicha <kevincheng60303@gmail.com>
Date:   Mon Oct 5 19:59:16 2026 +0800

    target/riscv: Check Svnapot PTE before updating A/D bits

    Reserved Svnapot PTE encodings must raise a page fault without
    modifying the PTE. Currently the A/D bits may be updated before
    the Svnapot encoding is validated.

    Move the Svnapot validation before the A/D update so reserved
    PTEs fault without changing the PTE.

    Cc: qemu-stable@nongnu.org
    Signed-off-by: dodochicha <kevincheng60303@gmail.com>
    Message-ID: <20261005115916.21196-1-kevincheng60303@gmail.com>
    Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
    Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index b22ecc2eeb..58e98e975c 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -1498,6 +1498,13 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         return sstack_page ? TRANSLATE_PMP_FAIL : TRANSLATE_FAIL;
     }

+    if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
+        napot_bits = ctzl(ppn) + 1;
+        if ((i != (levels - 1)) || (napot_bits != 4)) {
+            return TRANSLATE_FAIL;
+        }
+    }
+
     target_ulong updated_pte = pte;

     /*
@@ -1590,13 +1597,6 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     /* For superpage mappings, make a fake leaf PTE for the TLB's benefit. */
     target_ulong vpn = addr >> PGSHIFT;

-    if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
-        napot_bits = ctzl(ppn) + 1;
-        if ((i != (levels - 1)) || (napot_bits != 4)) {
-            return TRANSLATE_FAIL;
-        }
-    }
-
     napot_mask = (1 << napot_bits) - 1;
     *physical = (((ppn & ~napot_mask) | (vpn & napot_mask) |
                   (vpn & (((target_ulong)1 << ptshift) - 1))