On Mon, Apr 27, 2026 at 10:50 PM Abhigyan Kumar <[email protected]> wrote: > > RISC-V Privileged Specification 3.1.8 (Machine Trap Delegation Registers > (medeleg and mideleg)) mentions: > > "For exceptions that cannot occur in less privileged modes, the > corresponding medeleg bits should be read-only zero. In particular, > medeleg[11] is read-only zero." > > QEMU incorrectly included RISCV_EXCP_M_ECALL in DELEGABLE_EXCPS. It > allowed the 11th bit to be written and read as set. Fixed by removing it > from the DELEGABLE_EXCPS mask, adhering to the specification. > > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3438 > Signed-off-by: Abhigyan Kumar <[email protected]>
Reviewed-by: Alistair Francis <[email protected]> Alistair > --- > target/riscv/csr.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/target/riscv/csr.c b/target/riscv/csr.c > index a75281539..c9bf73dd7 100644 > --- a/target/riscv/csr.c > +++ b/target/riscv/csr.c > @@ -1775,6 +1775,10 @@ static const uint64_t vs_delegable_ints = > (VS_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & ~MIP_LCOFIP; > static const uint64_t all_ints = M_MODE_INTERRUPTS | S_MODE_INTERRUPTS | > HS_MODE_INTERRUPTS | LOCAL_INTERRUPTS; > +/* > + * As per RSIC-V Privileged Spec Section 3.1.8, M-mode ecall should be a > + * read-only zero. Therefore, medeleg[11] is set to zero below. > + */ > #define DELEGABLE_EXCPS ((1ULL << (RISCV_EXCP_INST_ADDR_MIS)) | \ > (1ULL << (RISCV_EXCP_INST_ACCESS_FAULT)) | \ > (1ULL << (RISCV_EXCP_ILLEGAL_INST)) | \ > @@ -1786,7 +1790,6 @@ static const uint64_t all_ints = M_MODE_INTERRUPTS | > S_MODE_INTERRUPTS | > (1ULL << (RISCV_EXCP_U_ECALL)) | \ > (1ULL << (RISCV_EXCP_S_ECALL)) | \ > (1ULL << (RISCV_EXCP_VS_ECALL)) | \ > - (1ULL << (RISCV_EXCP_M_ECALL)) | \ > (1ULL << (RISCV_EXCP_INST_PAGE_FAULT)) | \ > (1ULL << (RISCV_EXCP_LOAD_PAGE_FAULT)) | \ > (1ULL << (RISCV_EXCP_STORE_PAGE_FAULT)) | \ > -- > 2.54.0 > >
