[PATCH 1/2] riscv: csr: do not drop C bit on misa write

[PATCH 1/2] riscv: csr: do not drop C bit on misa write

[Vladimir Isaev]

According to spec:
> Writing misa may increase IALIGN, e.g., by disabling the "C" extension.
> If an instruction that would write misa increases IALIGN, and the
> subsequent instruction’s address is not IALIGN-bit aligned, the
> write to misa is suppressed, leaving misa unchanged.

So attempt to disable C extension if next instruction is not aligned should not
change the misa.

Signed-off-by: Vladimir Isaev <vvisaev@gmail.com>
---
 target/riscv/tcg/csr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
index 36f2004bc5..58c206c1fa 100644
--- a/target/riscv/tcg/csr.c
+++ b/target/riscv/tcg/csr.c
@@ -2182,9 +2182,10 @@ static RISCVException write_misa(CPURISCVState *env, int csrno,
     /* Mask extensions that are not supported by this hart */
     val &= env->misa_ext_mask;
 
-    /* Suppress 'C' if next instruction is not aligned. */
-    if ((val & RVC) && (get_next_pc(env, ra) & 3) != 0) {
-        val &= ~RVC;
+    /* drop write if RVC is cleared and next instruction is not aligned */
+    if ((env->misa_ext & RVC) && !(val & RVC) &&
+         (get_next_pc(env, ra) & 3) != 0) {
+        return RISCV_EXCP_NONE;
     }
 
     /* Disable RVG if any of its dependencies are disabled */
-- 
2.55.0

[PATCH 2/2] tests/tcg/riscv64: add misa write test

[Vladimir Isaev]

Add test to check that writing misa before compact instruction doesn't
drop any bits.

Signed-off-by: Vladimir Isaev <vvisaev@gmail.com>
---
 tests/tcg/riscv64/Makefile.softmmu-target |  4 ++
 tests/tcg/riscv64/test-misa-w.S           | 46 +++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 tests/tcg/riscv64/test-misa-w.S

diff --git a/tests/tcg/riscv64/Makefile.softmmu-target b/tests/tcg/riscv64/Makefile.softmmu-target
index 82be8a2c91..e7d052909f 100644
--- a/tests/tcg/riscv64/Makefile.softmmu-target
+++ b/tests/tcg/riscv64/Makefile.softmmu-target
@@ -41,5 +41,9 @@ comma:= ,
 run-test-crc32: test-crc32
 	$(call run-test, $<, $(QEMU) -cpu rv64$(comma)xlrbr=true $(QEMU_OPTS)$<)
 
+EXTRA_RUNS += run-test-misa-w
+run-test-misa-w: test-misa-w
+	$(call run-test, $<, $(QEMU) -cpu rv64$(comma)x-misa-w=true$(comma)c=true $(QEMU_OPTS)$<)
+
 # We don't currently support the multiarch system tests
 undefine MULTIARCH_TESTS
diff --git a/tests/tcg/riscv64/test-misa-w.S b/tests/tcg/riscv64/test-misa-w.S
new file mode 100644
index 0000000000..22cba98b8c
--- /dev/null
+++ b/tests/tcg/riscv64/test-misa-w.S
@@ -0,0 +1,46 @@
+#define MISA_C (1<<2)
+
+	.text
+	.globl _start
+	.balign 4
+_start:
+	.option norvc
+	lla t0, trap
+	csrw mtvec, t0
+
+	# Fail if misa after write is not the same as before
+	csrr t0, misa
+	.option rvc
+	c.nop
+	csrw misa, t0
+	c.nop
+	csrr t1, misa
+	bne t0, t1, fail
+
+	li a0, 0
+	j  _exit
+
+
+	.balign 4
+	.option norvc
+trap:
+fail:
+	li	a0, 1
+_exit:
+	lla	a1, semiargs
+	li	t0, 0x20026	# ADP_Stopped_ApplicationExit
+	sd	t0, 0(a1)
+	sd	a0, 8(a1)
+	li	a0, 0x20	# TARGET_SYS_EXIT_EXTENDED
+
+	# Semihosting call sequence
+	.balign	16
+	slli	zero, zero, 0x1f
+	ebreak
+	srai	zero, zero, 0x7
+	j	.
+
+	.data
+	.balign	16
+semiargs:
+	.space	16
-- 
2.55.0

Re: [PATCH 2/2] tests/tcg/riscv64: add misa write test

[Alistair]

On Thu, 2026-08-06 at 16:37 +0300, Vladimir Isaev wrote:
> Add test to check that writing misa before compact instruction
> doesn't
> drop any bits.
> 
> Signed-off-by: Vladimir Isaev <vvisaev@gmail.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  tests/tcg/riscv64/Makefile.softmmu-target |  4 ++
>  tests/tcg/riscv64/test-misa-w.S           | 46
> +++++++++++++++++++++++
>  2 files changed, 50 insertions(+)
>  create mode 100644 tests/tcg/riscv64/test-misa-w.S
> 
> diff --git a/tests/tcg/riscv64/Makefile.softmmu-target
> b/tests/tcg/riscv64/Makefile.softmmu-target
> index 82be8a2c91..e7d052909f 100644
> --- a/tests/tcg/riscv64/Makefile.softmmu-target
> +++ b/tests/tcg/riscv64/Makefile.softmmu-target
> @@ -41,5 +41,9 @@ comma:= ,
>  run-test-crc32: test-crc32
>  	$(call run-test, $<, $(QEMU) -cpu rv64$(comma)xlrbr=true
> $(QEMU_OPTS)$<)
>  
> +EXTRA_RUNS += run-test-misa-w
> +run-test-misa-w: test-misa-w
> +	$(call run-test, $<, $(QEMU) -cpu rv64$(comma)x-misa-
> w=true$(comma)c=true $(QEMU_OPTS)$<)
> +
>  # We don't currently support the multiarch system tests
>  undefine MULTIARCH_TESTS
> diff --git a/tests/tcg/riscv64/test-misa-w.S
> b/tests/tcg/riscv64/test-misa-w.S
> new file mode 100644
> index 0000000000..22cba98b8c
> --- /dev/null
> +++ b/tests/tcg/riscv64/test-misa-w.S
> @@ -0,0 +1,46 @@
> +#define MISA_C (1<<2)
> +
> +	.text
> +	.globl _start
> +	.balign 4
> +_start:
> +	.option norvc
> +	lla t0, trap
> +	csrw mtvec, t0
> +
> +	# Fail if misa after write is not the same as before
> +	csrr t0, misa
> +	.option rvc
> +	c.nop
> +	csrw misa, t0
> +	c.nop
> +	csrr t1, misa
> +	bne t0, t1, fail
> +
> +	li a0, 0
> +	j  _exit
> +
> +
> +	.balign 4
> +	.option norvc
> +trap:
> +fail:
> +	li	a0, 1
> +_exit:
> +	lla	a1, semiargs
> +	li	t0, 0x20026	# ADP_Stopped_ApplicationExit
> +	sd	t0, 0(a1)
> +	sd	a0, 8(a1)
> +	li	a0, 0x20	# TARGET_SYS_EXIT_EXTENDED
> +
> +	# Semihosting call sequence
> +	.balign	16
> +	slli	zero, zero, 0x1f
> +	ebreak
> +	srai	zero, zero, 0x7
> +	j	.
> +
> +	.data
> +	.balign	16
> +semiargs:
> +	.space	16

Re: [PATCH 1/2] riscv: csr: do not drop C bit on misa write

[Alistair]

On Thu, 2026-08-06 at 16:37 +0300, Vladimir Isaev wrote:
> According to spec:
> > Writing misa may increase IALIGN, e.g., by disabling the "C"
> > extension.
> > If an instruction that would write misa increases IALIGN, and the
> > subsequent instruction’s address is not IALIGN-bit aligned, the
> > write to misa is suppressed, leaving misa unchanged.
> 
> So attempt to disable C extension if next instruction is not aligned
> should not
> change the misa.
> 
> Signed-off-by: Vladimir Isaev <vvisaev@gmail.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Thanks for the patches.

Can you please re-send the series with a cover-letter. All multi-patch
series should have a cover letter

Alistair

> ---
>  target/riscv/tcg/csr.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
> index 36f2004bc5..58c206c1fa 100644
> --- a/target/riscv/tcg/csr.c
> +++ b/target/riscv/tcg/csr.c
> @@ -2182,9 +2182,10 @@ static RISCVException write_misa(CPURISCVState
> *env, int csrno,
>      /* Mask extensions that are not supported by this hart */
>      val &= env->misa_ext_mask;
>  
> -    /* Suppress 'C' if next instruction is not aligned. */
> -    if ((val & RVC) && (get_next_pc(env, ra) & 3) != 0) {
> -        val &= ~RVC;
> +    /* drop write if RVC is cleared and next instruction is not
> aligned */
> +    if ((env->misa_ext & RVC) && !(val & RVC) &&
> +         (get_next_pc(env, ra) & 3) != 0) {
> +        return RISCV_EXCP_NONE;
>      }
>  
>      /* Disable RVG if any of its dependencies are disabled */

Re: [PATCH 1/2] riscv: csr: do not drop C bit on misa write

[Joel Stanley]

On Thu, 6 Aug 2026 at 23:07, Vladimir Isaev <vvisaev@gmail.com> wrote:
>
> According to spec:
> > Writing misa may increase IALIGN, e.g., by disabling the "C" extension.
> > If an instruction that would write misa increases IALIGN, and the
> > subsequent instruction’s address is not IALIGN-bit aligned, the
> > write to misa is suppressed, leaving misa unchanged.
>
> So attempt to disable C extension if next instruction is not aligned should not
> change the misa.
>
> Signed-off-by: Vladimir Isaev <vvisaev@gmail.com>
> ---
>  target/riscv/tcg/csr.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
> index 36f2004bc5..58c206c1fa 100644
> --- a/target/riscv/tcg/csr.c
> +++ b/target/riscv/tcg/csr.c
> @@ -2182,9 +2182,10 @@ static RISCVException write_misa(CPURISCVState *env, int csrno,
>      /* Mask extensions that are not supported by this hart */
>      val &= env->misa_ext_mask;
>
> -    /* Suppress 'C' if next instruction is not aligned. */
> -    if ((val & RVC) && (get_next_pc(env, ra) & 3) != 0) {
> -        val &= ~RVC;
> +    /* drop write if RVC is cleared and next instruction is not aligned */
> +    if ((env->misa_ext & RVC) && !(val & RVC) &&
> +         (get_next_pc(env, ra) & 3) != 0) {
> +        return RISCV_EXCP_NONE;
>      }

I thought we'd already fixed this so I went hunting. This is similar
to Nick's patch:

https://lore.kernel.org/qemu-devel/acTSDKzeEb3bbv08@lima-default/

I think the conclusion there was to additionally check ra, and do
a qemu_log_mask(LOG_GUEST_ERROR, ...)

I don't think he got around to sending the next version of that series.

Cheers,

Joel