On Thu, Oct 22, 2026 at 01:05:38AM +0800, Harshit Mukhedkar wrote:
> write_sstateen_1_3() passes SMSTATEEN_STATEEN (bit 63) as the write
> mask to write_sstateen(). That bit is the SE control bit only in
> mstateenN/hstateenN, where it gates access to sstateenN. The sstateen1-3
> CSRs have no defined bits, and reserved bits must be read-only zero, so
> bit 63 must not be writable on RV64.
>
> Use a write mask of 0 for sstateen1-3 until bits are defined there.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4726
> Fixes: 3bee0e40106d ("target/riscv: Add smstateen support")
> Cc: [email protected]
> Signed-off-by: Harshit Mukhedkar <[email protected]>
Reviewed-by: Chao Liu <[email protected]>
Thanks,
Chao
> ---
> target/riscv/tcg/csr.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
> index 063590f56a..d9731421af 100644
> --- a/target/riscv/tcg/csr.c
> +++ b/target/riscv/tcg/csr.c
> @@ -3941,7 +3941,12 @@ static RISCVException write_sstateen0(CPURISCVState
> *env, int csrno,
> static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
> target_ulong new_val, uintptr_t ra)
> {
> - return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
> + /*
> + * sstateen1-3 have no defined bits yet, so they are read only zero.
> + * Bit 63 is the SE bit only in mstateenN/hstateenN, where it gates
> + * access to sstateenN.
> + */
> + return write_sstateen(env, csrno, 0, new_val);
> }
>
> static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
> --
> 2.56.0
>
