risc-v: 0.932 register: 0.893 architecture: 0.803 mistranslation: 0.790 semantic: 0.781 device: 0.768 performance: 0.721 network: 0.629 graphic: 0.625 ppc: 0.623 permissions: 0.623 socket: 0.600 kernel: 0.595 peripherals: 0.570 files: 0.512 vnc: 0.479 hypervisor: 0.470 debug: 0.421 TCG: 0.387 boot: 0.380 arm: 0.372 KVM: 0.350 user-level: 0.350 PID: 0.342 virtual: 0.333 i386: 0.322 VMM: 0.309 x86: 0.308 assembly: 0.269 -------------------- risc-v: 0.917 register: 0.846 architecture: 0.094 files: 0.079 TCG: 0.068 debug: 0.065 user-level: 0.059 hypervisor: 0.036 semantic: 0.021 assembly: 0.021 virtual: 0.018 PID: 0.012 kernel: 0.008 device: 0.006 performance: 0.004 VMM: 0.003 network: 0.003 boot: 0.003 peripherals: 0.002 permissions: 0.002 KVM: 0.001 socket: 0.001 mistranslation: 0.001 graphic: 0.001 vnc: 0.001 arm: 0.000 ppc: 0.000 i386: 0.000 x86: 0.000 RISC-V mstatus TSR bit not correctly implemented Hi, since qemu 4.1.0 the TSR bit in mstatus register is supported. But it does not allow for executing sret in m-mode. From the RISC-V specifications: "When TSR=1, attempts to execute SRET while executing in S-mode will raise an illegal instruction exception. When TSR=0, this operation is permitted in S-mode." This means an exception should only be raised when executing in S-mode, but not in M-mode, hence you should change the condition in helper_sret (target/riscv/op_helper.c) from: if (env->priv_ver >= PRIV_VERSION_1_10_0 && get_field(env->mstatus, MSTATUS_TSR)) to: if (env->priv_ver >= PRIV_VERSION_1_10_0 && get_field(env->mstatus, MSTATUS_TSR) && !(env->priv >= PRV_M)) Fixed here: https://git.qemu.org/?p=qemu.git;a=commitdiff;h=ed5abf46b3c4