@samitouri / QOSamiQemu / commits / 18645f1957

target/riscv/csr.c: do not allow mstatus MPV/GVA writes

The priv spec states the following about mstatus.MPV: "The MPV bit (Machine Previous Virtualization Mode) is written by the implementation whenever a trap is taken into M-mode." And, about mstatus.GVA: "Field GVA (Guest Virtual Address) is written by the implementation whenever a trap is taken into M-mode." Both are written during riscv_cpu_do_interrupt(). They're not supposed to be written by userspace. As far as write_mstatus goes these fields are read only. The same applies for mstatush.MPV/mstatush.GVA. Fixes: 03dd405dd5 ("target/riscv: Support MSTATUS.MPV/GVA only when RVH is enabled") Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260514194537.2416243-2-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

Daniel Henrique Barboza committed May 14, 2026 at 16:45 UTC 18645f19578955ec5ff2c40cd2c8753d6bc460c2

1 file changed +1 -4

target/riscv/csr.c

+1 -4

@@ -2044,9 +2044,6 @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,

2044 }

2045

2046 if (xl != MXL_RV32 || env->debugger) {

2047 - if (riscv_has_ext(env, RVH)) {

2048 - mask |= MSTATUS_MPV | MSTATUS_GVA;

2049 - }

2047 if ((val & MSTATUS64_UXL) != 0) {

2048 mask |= MSTATUS64_UXL;

2049 }

@@ -2083,7 +2080,7 @@ static RISCVException write_mstatush(CPURISCVState *env, int csrno,

2080 target_ulong val, uintptr_t ra)

2081 {

2082 uint64_t valh = (uint64_t)val << 32;

2086 - uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;

2083 + uint64_t mask = 0;

2084

2085 if (riscv_cpu_cfg(env)->ext_smdbltrp) {

2086 mask |= MSTATUS_MDT;