Only jvt.mode=0 is implemented by QEMU. write_jvt() currently retains reserved mode bits, so a legal WARL write of base|1 is read back unchanged and causes a subsequent cm.jt to trap. Mask the write with JVT_BASE to normalize the unsupported mode.
Tested with the 4-case RV32 linux-user witness and control matrix on a clean patched QEMU build. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4408 Signed-off-by: wangyang <[email protected]> --- target/riscv/tcg/csr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c index 36f2004bc5..9affee0375 100644 --- a/target/riscv/tcg/csr.c +++ b/target/riscv/tcg/csr.c @@ -5883,7 +5883,7 @@ static RISCVException read_jvt(CPURISCVState *env, int csrno, static RISCVException write_jvt(CPURISCVState *env, int csrno, target_ulong val, uintptr_t ra) { - env->jvt = val; + env->jvt = val & JVT_BASE; return RISCV_EXCP_NONE; } -- 2.55.0.windows.2
