# riscv: XTheadCmo th.dcache.cva/th.dcache.iva retire in U-mode This report was found with assistance from an automated instruction-generation and emulation-differential tool. I triaged the result and independently replayed the fixed witnesses on upstream QEMU 11.1.1. ## Host environment - Operating system: Ubuntu 24.04.4 LTS on an x86_64 Linux host. - OS/kernel version: Linux x86_64 host; the host kernel is not material to the guest behavior. - Architecture: x86_64. - QEMU flavor: qemu-riscv32 and qemu-riscv64. - QEMU version: QEMU 11.1.1 upstream release. - QEMU command line: ```sh qemu-riscv32 -cpu rv32,xtheadcmo=true rv32-cva.elf qemu-riscv32 -cpu rv32,xtheadcmo=true rv32-civa.elf qemu-riscv32 -cpu rv32,xtheadcmo=true rv32-iva.elf qemu-riscv64 -cpu rv64,xtheadcmo=true rv64-cva.elf qemu-riscv64 -cpu rv64,xtheadcmo=true rv64-civa.elf qemu-riscv64 -cpu rv64,xtheadcmo=true rv64-iva.elf ``` ## Emulated/Virtualized environment - Operating system: statically linked Linux ELF with a direct `_start` entry point. - OS/kernel version: not applicable to the direct witness. - Architecture: RISC-V RV32 or RV64. - Source witnesses: minimal RV32 and RV64 assembly files attached to this issue. ## Description of problem With `xtheadcmo=true`, QEMU retires `th.dcache.cva` and `th.dcache.iva` in guest U-mode. The T-Head specification requires both instructions to raise an illegal-instruction exception in U-mode, while the sibling `th.dcache.civa` instruction is allowed at every privilege level. The extension-disabled controls also raise guest SIGILL; together with the legal sibling control and the source-level privilege-macro mismatch, the evidence localizes the issue to the missing privilege check. ## Steps to reproduce 1. Build the attached RV32 and RV64 source witnesses as static ELF files with a RISC-V cross compiler. Each witness executes one raw instruction and then exits through a sentinel value. 2. Run `qemu-riscv32 -cpu rv32,xtheadcmo=true rv32-cva.elf`, `qemu-riscv32 -cpu rv32,xtheadcmo=true rv32-civa.elf`, and `qemu-riscv32 -cpu rv32,xtheadcmo=true rv32-iva.elf`; repeat with the RV64 binaries and `qemu-riscv64`. 3. On the affected baseline, the cva, civa, and iva witnesses exit through sentinels `7`, `11`, and `9` respectively. The expected U-mode results are SIGILL for cva and iva and sentinel `11` for civa. With `xtheadcmo=false`, all witnesses terminate with guest SIGILL. ## Root cause `target/riscv/tcg/insn_trans/trans_xthead.c.inc` defines `REQUIRE_PRIV_MSU` as an empty macro. The `th_dcache_cva` and `th_dcache_iva` translator entries use that macro even though their specification requires a privilege level above U. The neighboring `th_dcache_civa` entry correctly uses the all-level macro, and other U-forbidden XTheadCmo entries use `REQUIRE_PRIV_MS`. ## Suggested fix Use `REQUIRE_PRIV_MS` for `th_dcache_cva` and `th_dcache_iva`, leaving `th_dcache_civa` unchanged. The expected implementation is limited to those two translator entries. ## Validation On QEMU 11.1.1, the baseline produces the incorrect enabled result `7/11/9` for cva/civa/iva. A candidate fix changes this to `132/11/132`, while the extension-disabled controls remain `132/132/132`. ## Additional information - Specification: [XTheadCmo dcache_cva](https://raw.githubusercontent.com/XUANTIE-RV/thead-extension-spec/master/xtheadcmo/dcache_cva.adoc), [XTheadCmo dcache_iva](https://raw.githubusercontent.com/XUANTIE-RV/thead-extension-spec/master/xtheadcmo/dcache_iva.adoc), and [XTheadCmo dcache_civa](https://raw.githubusercontent.com/XUANTIE-RV/thead-extension-spec/master/xtheadcmo/dcache_civa.adoc). - Duplicate search: direct QEMU GitLab searches for `th.dcache.cva`, `th.dcache.iva`, and `xtheadcmo` found no exact matching report on 2026-09-05. ## Reproducer files The minimal source files used for this report are attached below. [rv32-cva.S](/uploads/d587150cd74c72cf1bb0e8e5914fd4d7/rv32-cva.S) [rv32-civa.S](/uploads/30fe458cee2290c16cabff1f9b011478/rv32-civa.S) [rv32-iva.S](/uploads/6232f80394f396603c65e9b4302eb9a8/rv32-iva.S) [rv64-cva.S](/uploads/ef12d4c25aa1bfdeafde6b278551b160/rv64-cva.S) [rv64-civa.S](/uploads/90aae5aafdd5591b6abc7416dff461d0/rv64-civa.S) [rv64-iva.S](/uploads/de3c599ba6a68f161365906691e803f0/rv64-iva.S)