<!--This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/--> ## Host environment - QEMU flavor: ``` qemu-system-riscv64 ``` - QEMU version: ``` qemu-system-riscv64 v10.2.2 ``` - QEMU command line: ``` qemu-system-riscv64 -nographic -semihosting -icount shift=1 -machine virt -cpu max,pmu-mask=0xfffffff8 -bios ``` ## Description of problem With menvcfg.PBMTE=1, accessing a virtual address mapped through a PTE with PTE.PBMT=3 does not raise a page fault while according to the RISCV Priv ISA spec > For leaf PTEs, setting bits 62-61 to the value 3 is reserved for future standard use. Until this value is defined by a standard extension, using this reserved value in a leaf PTE raises a page-fault exception. ## Attachments [sv39_Svpbmt_Smode.elf](/uploads/c985e947936074a5e328a33729163d14/sv39_Svpbmt_Smode.elf) [sv39_Svpbmt_Smode.trace.log](/uploads/22a644b7382bbc58dbac6f0e99147c12/sv39_Svpbmt_Smode.trace.log)