Hi Alistair, Thank you for the feedback, and sorry that the commit message was unclear.
This patch fixes the Smrnmi and Zicfilp case where an M-mode exception occurs with mnstatus.NMIE=0. QEMU currently saves ELP in mnstatus.MNPELP when redirecting to the RNMI exception vector, but this path returns with MRET, which restores ELP from mstatus.MPELP. As a result, ELP is lost and a subsequent indirect branch requiring a landing pad may avoid the expected software-check exception. The patch saves ELP in mstatus.MPELP for this path; the true RNMI interrupt path using MNPELP and MNRET is unchanged. I also found that Zephyr Li has submitted an equivalent fix, including a TCG regression test: https://www.mail-archive.com/[email protected]/msg1222084.html. Since that patch fixes the same issue, I will not submit a duplicate revision. Please let me know if any further clarification is needed. Best regards, Wang Yang
