@samitouri / QOSamiQemu / commits / 2494836232

target/riscv: Allow mseccfg access based on ext_zicfilp

The Zicfilp extension adds the MLPE field to the mseccfg CSR. According to the RISC-V Privileged Specification, mseccfg exists if any extension that adds a field to it is implemented. Currently, the `have_mseccfg()` predicate function checks for Smepmp, Zkr, and Smmpm, but misses Zicfilp. As a result, if a CPU is configured with `zicfilp=true` but without the other extensions, accessing the mseccfg CSR will incorrectly raise an illegal instruction exception. This patch adds the missing check for `ext_zicfilp` to ensure the CSR is properly accessible when the Zicfilp extension is enabled. This issue was discovered and reported by SpecHunter, an AI-driven architecture specification analysis tool. Link: https://github.com/yizishun/rv-isa-sec/blob/master/output/riscv-isa-manual/pr-2561/qemu.txt Signed-off-by: Zishun Yi <vulab@iscas.ac.cn> Reviewed-by: Chao Liu <chao.liu.zevorn@gmail.com> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260511072705.3015986-1-vulab@iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

Zishun Yi committed May 11, 2026 at 15:27 UTC 249483623242c1b9ad4a1600083bea534620917a

1 file changed +3

target/riscv/csr.c

@@ -783,6 +783,9 @@ static RISCVException have_mseccfg(CPURISCVState *env, int csrno)

783 if (riscv_cpu_cfg(env)->ext_smmpm) {

784 return RISCV_EXCP_NONE;

785 }

786 + if (riscv_cpu_cfg(env)->ext_zicfilp) {

787 + return RISCV_EXCP_NONE;

788 + }

789

790 return RISCV_EXCP_ILLEGAL_INST;

791 }