@samitouri / QOSamiQemu / commits / 348a781971

target/riscv: Fix missing CDE check for scountinhibit

According to the RISC-V smcdeleg specification: "When menvcfg.CDE=0, attempts to access scountinhibit raise an illegal-instruction exception." The current implementation of scountinhibit_pred() only checks the hardware extensions (ext_ssccfg, ext_smcdeleg) and virtualization status, but completely misses the runtime environment configuration check (menvcfg.CDE). This allows S-mode to access scountinhibit even when the M-mode has explicitly disabled counter delegation. This issue was discovered by the SpecHunter tool (https://github.com/yizishun/rv-isa-sec/blob/master/output/riscv-isa-manual/pr-2571/qemu.txt). Fixes: 6247dc2ef70b ("target/riscv: Add counter delegation/configuration support") Signed-off-by: Zishun Yi <vulab@iscas.ac.cn> Reviewed-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Message-ID: <20260508174917.371667-1-vulab@iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

Zishun Yi committed May 9, 2026 at 01:49 UTC 348a781971872226721bf9747da7e3b184ad408c

1 file changed +4

target/riscv/csr.c

@@ -398,6 +398,10 @@ static RISCVException scountinhibit_pred(CPURISCVState *env, int csrno)

398 return RISCV_EXCP_ILLEGAL_INST;

399 }

400

401 + if (!get_field(env->menvcfg, MENVCFG_CDE)) {

402 + return RISCV_EXCP_ILLEGAL_INST;

403 + }

404 +

405 if (env->virt_enabled) {

406 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;

407 }