write_sstateen_1_3() passes SMSTATEEN_STATEEN (bit 63) as the write mask to write_sstateen(). That bit is the SE control bit only in mstateenN/hstateenN, where it gates access to sstateenN. The sstateen1-3 CSRs have no defined bits, and reserved bits must be read-only zero, so bit 63 must not be writable on RV64.
Use a write mask of 0 for sstateen1-3 until bits are defined there. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4726 Fixes: 3bee0e40106d ("target/riscv: Add smstateen support") Cc: [email protected] Signed-off-by: Harshit Mukhedkar <[email protected]> --- target/riscv/tcg/csr.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c index 063590f56a..d9731421af 100644 --- a/target/riscv/tcg/csr.c +++ b/target/riscv/tcg/csr.c @@ -3941,7 +3941,12 @@ static RISCVException write_sstateen0(CPURISCVState *env, int csrno, static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno, target_ulong new_val, uintptr_t ra) { - return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val); + /* + * sstateen1-3 have no defined bits yet, so they are read only zero. + * Bit 63 is the SE bit only in mstateenN/hstateenN, where it gates + * access to sstateenN. + */ + return write_sstateen(env, csrno, 0, new_val); } static RISCVException rmw_mip64(CPURISCVState *env, int csrno, -- 2.56.0
