<!--This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/--> ## Host environment - Operating system: Rocky 9 - OS/kernel version: Linux chips.eng.hmc.edu 5.14.0-611.45.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Apr 1 05:56:53 EDT 2026 x86_64 x86_64 x86_64 GNU/Linux - Architecture: x86 - QEMU flavor: `qemu-system-riscv64` - QEMU version: QEMU emulator version 11.0.1 (v11.0.1) - QEMU command line: `qemu-system-riscv64 -d in_asm,int,mmu,unimp,cpu,fpu,vpu,exec,nochain -D Zacas-amocas.d-00.trace.log -nographic -semihosting -icount shift=1 -machine virt -cpu max,pmu-mask=0xfffffff8 -bios Zacas-amocas.d-00.elf` ## Emulated/Virtualized environment - Operating system: <!--Windows 10 21H1, Fedora 37, etc.--> - OS/kernel version: <!--For POSIX guests, use `uname -a`.--> - Architecture: <!--x86, ARM, s390x, etc.--> ## Description of problem amocas with rd = x0 followed by bee involving x0 is not taken when it should be. This happens for amocas.w, d, q, b, h. [Zacas-amocas.d-00.elf.gz](/uploads/c6592d68b3630dec1c199e6c879bef75/Zacas-amocas.d-00.elf.gz) The relevant object dump is `# Testcase cp_rs1_nx0 (Test source rs1 = x10, non-matching (rd_val != mem_val)) RVTEST_TESTDATA_LOAD_INT(x14, x17) # load value in memory: x17 = 0x46cee4b1d71e7d37 80000a0c: 00073883 ld x17,0(x14) 80000a10: 00870713 addi x14,x14,8 RVTEST_TESTDATA_LOAD_INT(x14, x8) # load rs2: x8 = 0xe192161b472afab0 80000a14: 00073403 ld x8,0(x14) 80000a18: 00870713 addi x14,x14,8 80000a1c: 00000013 addi x0,x0,0 LA(x10, scratch) # load base address into rs1 80000a20: 0000f517 auipc x10,0xf 80000a24: 5e050513 addi x10,x10,1504 # 80010000 <scratch> 80000a28: 00000013 addi x0,x0,0 80000a2c: 00000013 addi x0,x0,0 80000a30: 00000013 addi x0,x0,0 80000a34: 00000013 addi x0,x0,0 80000a38: 00000013 addi x0,x0,0 80000a3c: 00000013 addi x0,x0,0 SREG x17, 0(x10) # store value into memory at address in rs1 80000a40: 01153023 sd x17,0(x10) 0000000080000a44 <Zacas_amocas_d_cg_cp_rs1_nx0_b10_not_equal>: Zacas_amocas_d_cg_cp_rs1_nx0_b10_not_equal: amocas.d x0, x8, (x10) # perform operation 80000a44: 2885302f amocas.d x0,x8,(x10) # Check if x0 contains the expected result. x19 is the signature ptr, x13 is the link ptr, x12 is a temp reg. RVTEST_SIGUPD(x19, x13, x12, x0, Zacas_amocas_d_cg_cp_rs1_nx0_b10_not_equal, Zacas_amocas_d_cg_cp_rs1_nx0_b10_not_equal_str) 80000a48: 0009b603 ld x12,0(x19) 80000a4c: 00060c63 beq x12,x0,80000a64 <Zacas_amocas_d_cg_cp_rs1_nx0_b10_not_equal+0x20> 80000a50: 0c10c6ef jal x13,8000d310 <failedtest_x13_x12> 80000a54: 80000a44 .word 0x80000a44 80000a58: 00000000 .word 0x00000000 80000a5c: 8001221f .word 0x8001221f 80000a60: 00000000 .word 0x00000000 80000a64: 00898993 addi x19,x19,8` The QEMU trace is shown below. `IN: 0x80000a08: 00898993 addi s3,s3,8 0x80000a0c: 00073883 ld a7,0(a4) 0x80000a10: 00870713 addi a4,a4,8 0x80000a14: 00073403 ld s0,0(a4) 0x80000a18: 00870713 addi a4,a4,8 0x80000a1c: 00000013 nop 0x80000a20: 0000f517 auipc a0,15 # 0x8000fa20 0x80000a24: 5e050513 addi a0,a0,1504 0x80000a28: 00000013 nop 0x80000a2c: 00000013 nop 0x80000a30: 00000013 nop 0x80000a34: 00000013 nop 0x80000a38: 00000013 nop 0x80000a3c: 00000013 nop 0x80000a40: 01153023 sd a7,0(a0) 0x80000a44: 2885302f amocas.d zero,s0,(a0) 0x80000a48: 0009b603 ld a2,0(s3) 0x80000a4c: 00060c63 beqz a2,24 # 0x80000a64 Trace 0: 0x7fb9b8010f00 [003411ef/0000000080000a08/02c2c07b/ff022200] V = 0 pc 0000000080000a08 x0/zero 0000000000000000 x1/ra e3bdcb3e54ce43e3 x2/sp caf2ba455991f5b5 x3/gp ec336a614d40488a x4/tp 1821cca95dc6c3d6 x5/t0 42064e33c8af5f2b x6/t1 5afd81ab1a8c26e8 x7/t2 1363c9adfe7d4664 x8/s0 bd2b2a023bbb284b x9/s1 029b94c335506719 x10/a0 42064e33c8af5f2b x11/a1 264463d78e1ced88 x12/a2 42064e33c8af5f2b x13/a3 eedbeadfeedbeadf x14/a4 00000000800108f0 x15/a5 1821cca95dc6c3d6 x16/a6 5613235ad98e94ef x17/a7 26592254fb9c91ef x18/s2 e5ff9a47f4549d17 x19/s3 000000008001aef0 x20/s4 3787500dfdce853c x21/s5 97b51eb1b0e32b6a x22/s6 72c205fd6f1271c9 x23/s7 029b94c335506719 x24/s8 0e812955f255240a x25/s9 bf5980d481e0c906 x26/s10 39ae079e48075674 x27/s11 bd7d73ada1578b10 x28/t3 bfddb7d5bfddb7d5 x29/t4 bd7d73ada1578b10 x30/t5 d0b18e7ea82a2b8b x31/t6 42064e33c8af5f2b IN: 0x80000a50: 0c10c6ef jal a3,51392 # 0x8000d310 Trace 0: 0x7fb9b8011340 [003411ef/0000000080000a50/02c2c07b/ff022200] V = 0 pc 0000000080000a50 x0/zero 0000000000000000 x1/ra e3bdcb3e54ce43e3 x2/sp caf2ba455991f5b5 x3/gp ec336a614d40488a x4/tp 1821cca95dc6c3d6 x5/t0 42064e33c8af5f2b x6/t1 5afd81ab1a8c26e8 x7/t2 1363c9adfe7d4664 x8/s0 e192161b472afab0 x9/s1 029b94c335506719 x10/a0 0000000080010000 x11/a1 264463d78e1ced88 x12/a2 0000000000000000 x13/a3 eedbeadfeedbeadf x14/a4 0000000080010900 x15/a5 1821cca95dc6c3d6 x16/a6 5613235ad98e94ef x17/a7 46cee4b1d71e7d37 x18/s2 e5ff9a47f4549d17 x19/s3 000000008001aef8 x20/s4 3787500dfdce853c x21/s5 97b51eb1b0e32b6a x22/s6 72c205fd6f1271c9 x23/s7 029b94c335506719 x24/s8 0e812955f255240a x25/s9 bf5980d481e0c906 x26/s10 39ae079e48075674 x27/s11 bd7d73ada1578b10 x28/t3 bfddb7d5bfddb7d5 x29/t4 bd7d73ada1578b10 x30/t5 d0b18e7ea82a2b8b x31/t6 42064e33c8af5f2b` ## Steps to reproduce 1. - `qemu-system-riscv64 -d in_asm,int,mmu,unimp,cpu,fpu,vpu,exec,nochain -D Zacas-amocas.d-00.trace.log -nographic -semihosting -icount shift=1 -machine virt -cpu max,pmu-mask=0xfffffff8 -bios Zacas-amocas.d-00.elf` 2. Look at `Zacas-amocas.d-00.trace.log` 3. The branch at 80000a4c should be taken because a2 contains 0 but the branch is not taken. ## Additional information <!--Attach logs, stack traces, screenshots, etc. Compress the files if necessary. If using libvirt, libvirt logs and XML domain information may be relevant.--> <!--The line below ensures that proper tags are added to the issue. Please do not remove it.-->