<!-- This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, ensure this ticket is marked 'confidential' before submission. See https://www.qemu.org/contribute/security-process/ for additional guidance --> ## Host environment - Operating system: GNU/Linux - OS/kernel version: Linux 6.17.0 - Architecture: MIPS64EL Release 2 execution ABI - QEMU flavor: `qemu-riscv64` - QEMU version: QEMU 11.0.3, built from the official release tarball - QEMU command line: ```sh timeout --kill-after=2 5 ./qemu-riscv64 ./riscv64-unaligned-lw timeout --kill-after=2 5 ./qemu-riscv64 ./riscv64-unaligned-ld ``` ## Emulated/Virtualized environment - Operating system: None; freestanding statically linked tests - OS/kernel version: None - Architecture: RISC-V 64-bit ## Description of problem Automated testing assisted in identifying this issue. The finding was manually triaged, reduced to the standalone reproducers below, and independently validated against the MIPS64 architecture semantics. On a pre-Release-6 MIPS64 host, an unaligned 32-bit or 64-bit `qemu_ld` may allocate its output register over its dead address input. The backend emits an `LWR/LWL` or `LDR/LDL` pair, but the first load overwrites the base register required by the second load. Both standalone tests fail to terminate: ```text unpatched QEMU 11.0.3 expected riscv64 unaligned lw hard-timeout status 137 status 0 riscv64 unaligned ld hard-timeout status 137 status 0 ``` For the 64-bit case, QEMU emits: ```asm ldr s0,0(s0) ldl s0,7(s0) ``` The first instruction changes `s0`, so the second accesses an address derived from the partial load result instead of the original guest address. The issue cannot be reproduced on current `qemu.git` master because MIPS host support and `tcg/mips64/` were removed in commits `bfa0801e91ca` and `586663f1fa29`. The affected code remains in the supported QEMU 11.0.3 release. ## Steps to reproduce 1. Save the following as `riscv64-unaligned-lw.S`: ```asm .section .text .global _start _start: la a0, data + 1 lw a0, 0(a0) li t0, 0x04030201 bne a0, t0, fail li a0, 0 j exit fail: li a0, 1 exit: li a7, 93 ecall .section .data .balign 8 data: .byte 0, 1, 2, 3, 4, 5, 6 ``` 2. Save the following as `riscv64-unaligned-ld.S`: ```asm .section .text .global _start _start: la a0, data + 1 ld a0, 0(a0) li t0, 0x0807060504030201 bne a0, t0, fail li a0, 0 j exit fail: li a0, 1 exit: li a7, 93 ecall .section .data .balign 8 data: .byte 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 ``` 3. Build both tests: ```sh riscv64-linux-gnu-gcc -nostdlib -static -fno-pie -no-pie \ -Wl,-e,_start -o riscv64-unaligned-lw riscv64-unaligned-lw.S riscv64-linux-gnu-gcc -nostdlib -static -fno-pie -no-pie \ -Wl,-e,_start -o riscv64-unaligned-ld riscv64-unaligned-ld.S ``` 4. Run each test in a pre-Release-6 MIPS64EL Linux environment: ```sh timeout --kill-after=2 5 \ ./qemu-riscv64 ./riscv64-unaligned-lw echo $? timeout --kill-after=2 5 \ ./qemu-riscv64 ./riscv64-unaligned-ld echo $? ``` 5. Observe that each process fails to terminate and is killed with status `137`; the expected status is `0`. ## Additional information The `qemu_ld` output constraint permits the output register to overlap a dead address input. That is valid for a direct load, but both members of the pre-R6 unaligned load pair require the original base. Copying an overlapping base into reserved `TCG_TMP0` before emitting the pair produces: ```asm move at,s0 ldr s0,0(at) ldl s0,7(at) ``` With this change, both reproducers exit with status `0`. A two-patch stable-only RFC is prepared for submission to `qemu-devel`.