blob: d1603567425f8c173c36260ceacb5303cda31f66 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
id = 1060
title = "RISC-V: mtval/stval is not correctly set to the instruction itself on illegal instructions"
state = "closed"
created_at = "2022-06-03T19:27:05.176Z"
closed_at = "2022-07-03T04:38:37.975Z"
labels = ["Closed::Fixed", "accel: TCG", "target: riscv"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/1060"
host-os = "NixOS unstable, git commit 692517bf851f2d8d999f0ad50f53fa1d2dd5c8f9"
host-arch = "x86-64"
qemu-version = "7.0.0"
guest-os = "n/a"
guest-arch = "n/a"
description = """QEMU 7.0 claims to support `stval`/`mtval` for illegal instructions, but `mtval`/`stval` is actually set to `0`"""
reproduce = """1. Assemble and link `mtval-illegal.elf`. The code simply sets up a trap handler and generates an illegal instruction exception
2. Start QEMU with:
```
qemu-system-riscv64 -cpu rv64,h=off -bios mtval-illegal.elf -nographic -icount shift=0 -s -S
```
3. Attach with GDB:
```
gdb mtval-illegal.elf
# Within GDB
target extended-remote :1234
break trap
disp $mtval
# Keep single stepping until breakpoint
stepi
```
4. When control flow reaches `trap`, `mtval` is written with `0` instead of the encoding of `csrw time, x0` (`0xc0101073`)"""
additional = """Writing `0` to `mtval` on a illegal instruction trap is allowed by the specs, but since the [changelog of QEMU 7.0][changelog] says it should be supported, I would consider it a bug.
[changelog]: https://wiki.qemu.org/ChangeLog/7.0#RISC-V
I encountered this when trying to figure out why my program worked with QEMU 6 but breaks with QEMU 7. It's more complicated, but in that case I managed to get `mtval` written with neither `0` nor the actual illegal instruction, but a different illegal instruction. I will try gathering up all the dependencies and write down the steps to reproduce if needed and if I find the time."""
|