On Thu, 2026-10-22 at 01:05 +0530, Harshit Mukhedkar wrote: > write_sstateen_1_3() passes SMSTATEEN_STATEEN (bit 63) as the write > mask to write_sstateen(). That bit is the SE control bit only in > mstateenN/hstateenN, where it gates access to sstateenN. The > sstateen1-3 > CSRs have no defined bits, and reserved bits must be read-only zero, > so > bit 63 must not be writable on RV64. > > Use a write mask of 0 for sstateen1-3 until bits are defined there. > > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4726 > Fixes: 3bee0e40106d ("target/riscv: Add smstateen support") > Cc: [email protected] > Signed-off-by: Harshit Mukhedkar <[email protected]>
Reviewed-by: Alistair Francis <[email protected]> Alistair > --- > target/riscv/tcg/csr.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c > index 063590f56a..d9731421af 100644 > --- a/target/riscv/tcg/csr.c > +++ b/target/riscv/tcg/csr.c > @@ -3941,7 +3941,12 @@ static RISCVException > write_sstateen0(CPURISCVState *env, int csrno, > static RISCVException write_sstateen_1_3(CPURISCVState *env, int > csrno, > target_ulong new_val, > uintptr_t ra) > { > - return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val); > + /* > + * sstateen1-3 have no defined bits yet, so they are read only > zero. > + * Bit 63 is the SE bit only in mstateenN/hstateenN, where it > gates > + * access to sstateenN. > + */ > + return write_sstateen(env, csrno, 0, new_val); > } > > static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
