write_sstateen_1_3() passes SMSTATEEN_STATEEN (bit 63) as the write
mask to write_sstateen(). That bit is the SE control bit only in
mstateenN/hstateenN, where it gates access to sstateenN. The sstateen1-3
CSRs have no defined bits, and reserved bits must be read-only zero, so
bit 63 must not be writable on RV64.

Use a write mask of 0 for sstateen1-3 until bits are defined there.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4726
Fixes: 3bee0e40106d ("target/riscv: Add smstateen support")
Cc: qemu-stable@nongnu.org
Signed-off-by: Harshit Mukhedkar <harshit007k@gmail.com>
---
 target/riscv/tcg/csr.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
index 063590f56a..d9731421af 100644
--- a/target/riscv/tcg/csr.c
+++ b/target/riscv/tcg/csr.c
@@ -3941,7 +3941,12 @@ static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
 static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
                                          target_ulong new_val, uintptr_t ra)
 {
-    return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
+    /*
+     * sstateen1-3 have no defined bits yet, so they are read only zero.
+     * Bit 63 is the SE bit only in mstateenN/hstateenN, where it gates
+     * access to sstateenN.
+     */
+    return write_sstateen(env, csrno, 0, new_val);
 }
 
 static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
-- 
2.56.0

On Thu, Oct 22, 2026 at 01:05:38AM +0800, Harshit Mukhedkar wrote:
> write_sstateen_1_3() passes SMSTATEEN_STATEEN (bit 63) as the write
> mask to write_sstateen(). That bit is the SE control bit only in
> mstateenN/hstateenN, where it gates access to sstateenN. The sstateen1-3
> CSRs have no defined bits, and reserved bits must be read-only zero, so
> bit 63 must not be writable on RV64.
> 
> Use a write mask of 0 for sstateen1-3 until bits are defined there.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4726
> Fixes: 3bee0e40106d ("target/riscv: Add smstateen support")
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Harshit Mukhedkar <harshit007k@gmail.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>

Thanks,
Chao

> ---
>  target/riscv/tcg/csr.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
> index 063590f56a..d9731421af 100644
> --- a/target/riscv/tcg/csr.c
> +++ b/target/riscv/tcg/csr.c
> @@ -3941,7 +3941,12 @@ static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
>  static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
>                                           target_ulong new_val, uintptr_t ra)
>  {
> -    return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
> +    /*
> +     * sstateen1-3 have no defined bits yet, so they are read only zero.
> +     * Bit 63 is the SE bit only in mstateenN/hstateenN, where it gates
> +     * access to sstateenN.
> +     */
> +    return write_sstateen(env, csrno, 0, new_val);
>  }
>  
>  static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
> -- 
> 2.56.0
>

On Thu, 2026-10-22 at 01:05 +0530, Harshit Mukhedkar wrote:
> write_sstateen_1_3() passes SMSTATEEN_STATEEN (bit 63) as the write
> mask to write_sstateen(). That bit is the SE control bit only in
> mstateenN/hstateenN, where it gates access to sstateenN. The
> sstateen1-3
> CSRs have no defined bits, and reserved bits must be read-only zero,
> so
> bit 63 must not be writable on RV64.
> 
> Use a write mask of 0 for sstateen1-3 until bits are defined there.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4726
> Fixes: 3bee0e40106d ("target/riscv: Add smstateen support")
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Harshit Mukhedkar <harshit007k@gmail.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  target/riscv/tcg/csr.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
> index 063590f56a..d9731421af 100644
> --- a/target/riscv/tcg/csr.c
> +++ b/target/riscv/tcg/csr.c
> @@ -3941,7 +3941,12 @@ static RISCVException
> write_sstateen0(CPURISCVState *env, int csrno,
>  static RISCVException write_sstateen_1_3(CPURISCVState *env, int
> csrno,
>                                           target_ulong new_val,
> uintptr_t ra)
>  {
> -    return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
> +    /*
> +     * sstateen1-3 have no defined bits yet, so they are read only
> zero.
> +     * Bit 63 is the SE bit only in mstateenN/hstateenN, where it
> gates
> +     * access to sstateenN.
> +     */
> +    return write_sstateen(env, csrno, 0, new_val);
>  }
>  
>  static RISCVException rmw_mip64(CPURISCVState *env, int csrno,