riscv64 cannot use the mret instruction to jump to the address corresponding to s mode

Host environment

• Operating system: Linux
• OS/kernel version: Linux leopard 5.19.0-46-generic #47 (closed)~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Jun 21 15:35:31 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
• Architecture: x86
• QEMU flavor: qemu-system-riscv64
• QEMU version: QEMU emulator version 8.1.90
• QEMU command line: qemu-system-riscv64 -M virt -m 1024M -nographic -bios build/coreboot.rom

Emulated/Virtualized environment

• Operating system: coreboot/bios
• OS/kernel version: latest coreboot
• Architecture: riscv

Description of problem

I use coreboot to boot my linux kernel.The kernel is copied at 0x82200000,I set reg mepc 0x82200000,and set reg mstatus a00000800. and I use "mret" instruction so that qemu can jump to 0x82200000 and enter S mode.But some errors happened. It shows: [DEBUG] Exception: Instruction access fault [DEBUG] Hart ID: 0 [DEBUG] Previous mode: machine [DEBUG] Bad instruction pc: 0x8103f7c0 [DEBUG] Bad address: 0x00000000 [DEBUG] Stored ra: 0x8103f7b8 [DEBUG] Stored sp: 0x82032f08 Bad instruction pc: 0x8103f7c0 in my elf file instruction is "mret". So I can not jump to my kernel's load address. I think when I use -bios option,my qemu should in M mode.How could I can jump to my mepc address?

Steps to reproduce

1.download qemu 2.download coreboot

Additional information

When I enter qemu with -bios option,I find that the reg mstatus is 0xa0000000.