xref: /qemu/target/riscv/csr.c (revision e4a8e093dc74be049f4829831dce76e5edab0003)
1 /*
2  * RISC-V Control and Status Registers.
3  *
4  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
5  * Copyright (c) 2017-2018 SiFive, Inc.
6  *
7  * This program is free software; you can redistribute it and/or modify it
8  * under the terms and conditions of the GNU General Public License,
9  * version 2 or later, as published by the Free Software Foundation.
10  *
11  * This program is distributed in the hope it will be useful, but WITHOUT
12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
14  * more details.
15  *
16  * You should have received a copy of the GNU General Public License along with
17  * this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qemu/log.h"
22 #include "qemu/timer.h"
23 #include "cpu.h"
24 #include "tcg/tcg-cpu.h"
25 #include "pmu.h"
26 #include "time_helper.h"
27 #include "exec/exec-all.h"
28 #include "exec/tb-flush.h"
29 #include "system/cpu-timers.h"
30 #include "qemu/guest-random.h"
31 #include "qapi/error.h"
32 
33 /* CSR function table public API */
34 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
35 {
36     *ops = csr_ops[csrno & (CSR_TABLE_SIZE - 1)];
37 }
38 
39 void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
40 {
41     csr_ops[csrno & (CSR_TABLE_SIZE - 1)] = *ops;
42 }
43 
44 /* Predicates */
45 #if !defined(CONFIG_USER_ONLY)
46 RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit)
47 {
48     bool virt = env->virt_enabled;
49 
50     if (env->priv == PRV_M || !riscv_cpu_cfg(env)->ext_smstateen) {
51         return RISCV_EXCP_NONE;
52     }
53 
54     if (!(env->mstateen[index] & bit)) {
55         return RISCV_EXCP_ILLEGAL_INST;
56     }
57 
58     if (virt) {
59         if (!(env->hstateen[index] & bit)) {
60             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
61         }
62 
63         if (env->priv == PRV_U && !(env->sstateen[index] & bit)) {
64             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
65         }
66     }
67 
68     if (env->priv == PRV_U && riscv_has_ext(env, RVS)) {
69         if (!(env->sstateen[index] & bit)) {
70             return RISCV_EXCP_ILLEGAL_INST;
71         }
72     }
73 
74     return RISCV_EXCP_NONE;
75 }
76 #endif
77 
78 static RISCVException fs(CPURISCVState *env, int csrno)
79 {
80 #if !defined(CONFIG_USER_ONLY)
81     if (!env->debugger && !riscv_cpu_fp_enabled(env) &&
82         !riscv_cpu_cfg(env)->ext_zfinx) {
83         return RISCV_EXCP_ILLEGAL_INST;
84     }
85 
86     if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
87         return smstateen_acc_ok(env, 0, SMSTATEEN0_FCSR);
88     }
89 #endif
90     return RISCV_EXCP_NONE;
91 }
92 
93 static RISCVException vs(CPURISCVState *env, int csrno)
94 {
95     if (riscv_cpu_cfg(env)->ext_zve32x) {
96 #if !defined(CONFIG_USER_ONLY)
97         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
98             return RISCV_EXCP_ILLEGAL_INST;
99         }
100 #endif
101         return RISCV_EXCP_NONE;
102     }
103     return RISCV_EXCP_ILLEGAL_INST;
104 }
105 
106 static RISCVException ctr(CPURISCVState *env, int csrno)
107 {
108 #if !defined(CONFIG_USER_ONLY)
109     RISCVCPU *cpu = env_archcpu(env);
110     int ctr_index;
111     target_ulong ctr_mask;
112     int base_csrno = CSR_CYCLE;
113     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
114 
115     if (rv32 && csrno >= CSR_CYCLEH) {
116         /* Offset for RV32 hpmcounternh counters */
117         base_csrno += 0x80;
118     }
119     ctr_index = csrno - base_csrno;
120     ctr_mask = BIT(ctr_index);
121 
122     if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) ||
123         (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) {
124         if (!riscv_cpu_cfg(env)->ext_zicntr) {
125             return RISCV_EXCP_ILLEGAL_INST;
126         }
127 
128         goto skip_ext_pmu_check;
129     }
130 
131     if (!(cpu->pmu_avail_ctrs & ctr_mask)) {
132         /* No counter is enabled in PMU or the counter is out of range */
133         return RISCV_EXCP_ILLEGAL_INST;
134     }
135 
136 skip_ext_pmu_check:
137 
138     if (env->debugger) {
139         return RISCV_EXCP_NONE;
140     }
141 
142     if (env->priv < PRV_M && !get_field(env->mcounteren, ctr_mask)) {
143         return RISCV_EXCP_ILLEGAL_INST;
144     }
145 
146     if (env->virt_enabled) {
147         if (!get_field(env->hcounteren, ctr_mask) ||
148             (env->priv == PRV_U && !get_field(env->scounteren, ctr_mask))) {
149             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
150         }
151     }
152 
153     if (riscv_has_ext(env, RVS) && env->priv == PRV_U &&
154         !get_field(env->scounteren, ctr_mask)) {
155         return RISCV_EXCP_ILLEGAL_INST;
156     }
157 
158 #endif
159     return RISCV_EXCP_NONE;
160 }
161 
162 static RISCVException ctr32(CPURISCVState *env, int csrno)
163 {
164     if (riscv_cpu_mxl(env) != MXL_RV32) {
165         return RISCV_EXCP_ILLEGAL_INST;
166     }
167 
168     return ctr(env, csrno);
169 }
170 
171 static RISCVException zcmt(CPURISCVState *env, int csrno)
172 {
173     if (!riscv_cpu_cfg(env)->ext_zcmt) {
174         return RISCV_EXCP_ILLEGAL_INST;
175     }
176 
177 #if !defined(CONFIG_USER_ONLY)
178     RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_JVT);
179     if (ret != RISCV_EXCP_NONE) {
180         return ret;
181     }
182 #endif
183 
184     return RISCV_EXCP_NONE;
185 }
186 
187 static RISCVException cfi_ss(CPURISCVState *env, int csrno)
188 {
189     if (!env_archcpu(env)->cfg.ext_zicfiss) {
190         return RISCV_EXCP_ILLEGAL_INST;
191     }
192 
193     /* if bcfi not active for current env, access to csr is illegal */
194     if (!cpu_get_bcfien(env)) {
195 #if !defined(CONFIG_USER_ONLY)
196         if (env->debugger) {
197             return RISCV_EXCP_NONE;
198         }
199 #endif
200         return RISCV_EXCP_ILLEGAL_INST;
201     }
202 
203     return RISCV_EXCP_NONE;
204 }
205 
206 #if !defined(CONFIG_USER_ONLY)
207 static RISCVException mctr(CPURISCVState *env, int csrno)
208 {
209     RISCVCPU *cpu = env_archcpu(env);
210     uint32_t pmu_avail_ctrs = cpu->pmu_avail_ctrs;
211     int ctr_index;
212     int base_csrno = CSR_MHPMCOUNTER3;
213 
214     if ((riscv_cpu_mxl(env) == MXL_RV32) && csrno >= CSR_MCYCLEH) {
215         /* Offset for RV32 mhpmcounternh counters */
216         csrno -= 0x80;
217     }
218 
219     g_assert(csrno >= CSR_MHPMCOUNTER3 && csrno <= CSR_MHPMCOUNTER31);
220 
221     ctr_index = csrno - base_csrno;
222     if ((BIT(ctr_index) & pmu_avail_ctrs >> 3) == 0) {
223         /* The PMU is not enabled or counter is out of range */
224         return RISCV_EXCP_ILLEGAL_INST;
225     }
226 
227     return RISCV_EXCP_NONE;
228 }
229 
230 static RISCVException mctr32(CPURISCVState *env, int csrno)
231 {
232     if (riscv_cpu_mxl(env) != MXL_RV32) {
233         return RISCV_EXCP_ILLEGAL_INST;
234     }
235 
236     return mctr(env, csrno);
237 }
238 
239 static RISCVException sscofpmf(CPURISCVState *env, int csrno)
240 {
241     if (!riscv_cpu_cfg(env)->ext_sscofpmf) {
242         return RISCV_EXCP_ILLEGAL_INST;
243     }
244 
245     return RISCV_EXCP_NONE;
246 }
247 
248 static RISCVException sscofpmf_32(CPURISCVState *env, int csrno)
249 {
250     if (riscv_cpu_mxl(env) != MXL_RV32) {
251         return RISCV_EXCP_ILLEGAL_INST;
252     }
253 
254     return sscofpmf(env, csrno);
255 }
256 
257 static RISCVException smcntrpmf(CPURISCVState *env, int csrno)
258 {
259     if (!riscv_cpu_cfg(env)->ext_smcntrpmf) {
260         return RISCV_EXCP_ILLEGAL_INST;
261     }
262 
263     return RISCV_EXCP_NONE;
264 }
265 
266 static RISCVException smcntrpmf_32(CPURISCVState *env, int csrno)
267 {
268     if (riscv_cpu_mxl(env) != MXL_RV32) {
269         return RISCV_EXCP_ILLEGAL_INST;
270     }
271 
272     return smcntrpmf(env, csrno);
273 }
274 
275 static RISCVException any(CPURISCVState *env, int csrno)
276 {
277     return RISCV_EXCP_NONE;
278 }
279 
280 static RISCVException any32(CPURISCVState *env, int csrno)
281 {
282     if (riscv_cpu_mxl(env) != MXL_RV32) {
283         return RISCV_EXCP_ILLEGAL_INST;
284     }
285 
286     return any(env, csrno);
287 
288 }
289 
290 static RISCVException aia_any(CPURISCVState *env, int csrno)
291 {
292     if (!riscv_cpu_cfg(env)->ext_smaia) {
293         return RISCV_EXCP_ILLEGAL_INST;
294     }
295 
296     return any(env, csrno);
297 }
298 
299 static RISCVException aia_any32(CPURISCVState *env, int csrno)
300 {
301     if (!riscv_cpu_cfg(env)->ext_smaia) {
302         return RISCV_EXCP_ILLEGAL_INST;
303     }
304 
305     return any32(env, csrno);
306 }
307 
308 static RISCVException smode(CPURISCVState *env, int csrno)
309 {
310     if (riscv_has_ext(env, RVS)) {
311         return RISCV_EXCP_NONE;
312     }
313 
314     return RISCV_EXCP_ILLEGAL_INST;
315 }
316 
317 static RISCVException smode32(CPURISCVState *env, int csrno)
318 {
319     if (riscv_cpu_mxl(env) != MXL_RV32) {
320         return RISCV_EXCP_ILLEGAL_INST;
321     }
322 
323     return smode(env, csrno);
324 }
325 
326 static RISCVException aia_smode(CPURISCVState *env, int csrno)
327 {
328     if (!riscv_cpu_cfg(env)->ext_ssaia) {
329         return RISCV_EXCP_ILLEGAL_INST;
330     }
331 
332     return smode(env, csrno);
333 }
334 
335 static RISCVException aia_smode32(CPURISCVState *env, int csrno)
336 {
337     if (!riscv_cpu_cfg(env)->ext_ssaia) {
338         return RISCV_EXCP_ILLEGAL_INST;
339     }
340 
341     return smode32(env, csrno);
342 }
343 
344 static RISCVException hmode(CPURISCVState *env, int csrno)
345 {
346     if (riscv_has_ext(env, RVH)) {
347         return RISCV_EXCP_NONE;
348     }
349 
350     return RISCV_EXCP_ILLEGAL_INST;
351 }
352 
353 static RISCVException hmode32(CPURISCVState *env, int csrno)
354 {
355     if (riscv_cpu_mxl(env) != MXL_RV32) {
356         return RISCV_EXCP_ILLEGAL_INST;
357     }
358 
359     return hmode(env, csrno);
360 
361 }
362 
363 static RISCVException umode(CPURISCVState *env, int csrno)
364 {
365     if (riscv_has_ext(env, RVU)) {
366         return RISCV_EXCP_NONE;
367     }
368 
369     return RISCV_EXCP_ILLEGAL_INST;
370 }
371 
372 static RISCVException umode32(CPURISCVState *env, int csrno)
373 {
374     if (riscv_cpu_mxl(env) != MXL_RV32) {
375         return RISCV_EXCP_ILLEGAL_INST;
376     }
377 
378     return umode(env, csrno);
379 }
380 
381 static RISCVException mstateen(CPURISCVState *env, int csrno)
382 {
383     if (!riscv_cpu_cfg(env)->ext_smstateen) {
384         return RISCV_EXCP_ILLEGAL_INST;
385     }
386 
387     return any(env, csrno);
388 }
389 
390 static RISCVException hstateen_pred(CPURISCVState *env, int csrno, int base)
391 {
392     if (!riscv_cpu_cfg(env)->ext_smstateen) {
393         return RISCV_EXCP_ILLEGAL_INST;
394     }
395 
396     RISCVException ret = hmode(env, csrno);
397     if (ret != RISCV_EXCP_NONE) {
398         return ret;
399     }
400 
401     if (env->debugger) {
402         return RISCV_EXCP_NONE;
403     }
404 
405     if (env->priv < PRV_M) {
406         if (!(env->mstateen[csrno - base] & SMSTATEEN_STATEEN)) {
407             return RISCV_EXCP_ILLEGAL_INST;
408         }
409     }
410 
411     return RISCV_EXCP_NONE;
412 }
413 
414 static RISCVException hstateen(CPURISCVState *env, int csrno)
415 {
416     return hstateen_pred(env, csrno, CSR_HSTATEEN0);
417 }
418 
419 static RISCVException hstateenh(CPURISCVState *env, int csrno)
420 {
421     return hstateen_pred(env, csrno, CSR_HSTATEEN0H);
422 }
423 
424 static RISCVException sstateen(CPURISCVState *env, int csrno)
425 {
426     bool virt = env->virt_enabled;
427     int index = csrno - CSR_SSTATEEN0;
428 
429     if (!riscv_cpu_cfg(env)->ext_smstateen) {
430         return RISCV_EXCP_ILLEGAL_INST;
431     }
432 
433     RISCVException ret = smode(env, csrno);
434     if (ret != RISCV_EXCP_NONE) {
435         return ret;
436     }
437 
438     if (env->debugger) {
439         return RISCV_EXCP_NONE;
440     }
441 
442     if (env->priv < PRV_M) {
443         if (!(env->mstateen[index] & SMSTATEEN_STATEEN)) {
444             return RISCV_EXCP_ILLEGAL_INST;
445         }
446 
447         if (virt) {
448             if (!(env->hstateen[index] & SMSTATEEN_STATEEN)) {
449                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
450             }
451         }
452     }
453 
454     return RISCV_EXCP_NONE;
455 }
456 
457 static RISCVException sstc(CPURISCVState *env, int csrno)
458 {
459     bool hmode_check = false;
460 
461     if (!riscv_cpu_cfg(env)->ext_sstc || !env->rdtime_fn) {
462         return RISCV_EXCP_ILLEGAL_INST;
463     }
464 
465     if ((csrno == CSR_VSTIMECMP) || (csrno == CSR_VSTIMECMPH)) {
466         hmode_check = true;
467     }
468 
469     RISCVException ret = hmode_check ? hmode(env, csrno) : smode(env, csrno);
470     if (ret != RISCV_EXCP_NONE) {
471         return ret;
472     }
473 
474     if (env->debugger) {
475         return RISCV_EXCP_NONE;
476     }
477 
478     if (env->priv == PRV_M) {
479         return RISCV_EXCP_NONE;
480     }
481 
482     /*
483      * No need of separate function for rv32 as menvcfg stores both menvcfg
484      * menvcfgh for RV32.
485      */
486     if (!(get_field(env->mcounteren, COUNTEREN_TM) &&
487           get_field(env->menvcfg, MENVCFG_STCE))) {
488         return RISCV_EXCP_ILLEGAL_INST;
489     }
490 
491     if (env->virt_enabled) {
492         if (!(get_field(env->hcounteren, COUNTEREN_TM) &&
493               get_field(env->henvcfg, HENVCFG_STCE))) {
494             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
495         }
496     }
497 
498     return RISCV_EXCP_NONE;
499 }
500 
501 static RISCVException sstc_32(CPURISCVState *env, int csrno)
502 {
503     if (riscv_cpu_mxl(env) != MXL_RV32) {
504         return RISCV_EXCP_ILLEGAL_INST;
505     }
506 
507     return sstc(env, csrno);
508 }
509 
510 static RISCVException satp(CPURISCVState *env, int csrno)
511 {
512     if (env->priv == PRV_S && !env->virt_enabled &&
513         get_field(env->mstatus, MSTATUS_TVM)) {
514         return RISCV_EXCP_ILLEGAL_INST;
515     }
516     if (env->priv == PRV_S && env->virt_enabled &&
517         get_field(env->hstatus, HSTATUS_VTVM)) {
518         return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
519     }
520 
521     return smode(env, csrno);
522 }
523 
524 static RISCVException hgatp(CPURISCVState *env, int csrno)
525 {
526     if (env->priv == PRV_S && !env->virt_enabled &&
527         get_field(env->mstatus, MSTATUS_TVM)) {
528         return RISCV_EXCP_ILLEGAL_INST;
529     }
530 
531     return hmode(env, csrno);
532 }
533 
534 /* Checks if PointerMasking registers could be accessed */
535 static RISCVException pointer_masking(CPURISCVState *env, int csrno)
536 {
537     /* Check if j-ext is present */
538     if (riscv_has_ext(env, RVJ)) {
539         return RISCV_EXCP_NONE;
540     }
541     return RISCV_EXCP_ILLEGAL_INST;
542 }
543 
544 static RISCVException aia_hmode(CPURISCVState *env, int csrno)
545 {
546     if (!riscv_cpu_cfg(env)->ext_ssaia) {
547         return RISCV_EXCP_ILLEGAL_INST;
548      }
549 
550      return hmode(env, csrno);
551 }
552 
553 static RISCVException aia_hmode32(CPURISCVState *env, int csrno)
554 {
555     if (!riscv_cpu_cfg(env)->ext_ssaia) {
556         return RISCV_EXCP_ILLEGAL_INST;
557     }
558 
559     return hmode32(env, csrno);
560 }
561 
562 static RISCVException pmp(CPURISCVState *env, int csrno)
563 {
564     if (riscv_cpu_cfg(env)->pmp) {
565         if (csrno <= CSR_PMPCFG3) {
566             uint32_t reg_index = csrno - CSR_PMPCFG0;
567 
568             /* TODO: RV128 restriction check */
569             if ((reg_index & 1) && (riscv_cpu_mxl(env) == MXL_RV64)) {
570                 return RISCV_EXCP_ILLEGAL_INST;
571             }
572         }
573 
574         return RISCV_EXCP_NONE;
575     }
576 
577     return RISCV_EXCP_ILLEGAL_INST;
578 }
579 
580 static RISCVException have_mseccfg(CPURISCVState *env, int csrno)
581 {
582     if (riscv_cpu_cfg(env)->ext_smepmp) {
583         return RISCV_EXCP_NONE;
584     }
585     if (riscv_cpu_cfg(env)->ext_zkr) {
586         return RISCV_EXCP_NONE;
587     }
588 
589     return RISCV_EXCP_ILLEGAL_INST;
590 }
591 
592 static RISCVException debug(CPURISCVState *env, int csrno)
593 {
594     if (riscv_cpu_cfg(env)->debug) {
595         return RISCV_EXCP_NONE;
596     }
597 
598     return RISCV_EXCP_ILLEGAL_INST;
599 }
600 #endif
601 
602 static RISCVException seed(CPURISCVState *env, int csrno)
603 {
604     if (!riscv_cpu_cfg(env)->ext_zkr) {
605         return RISCV_EXCP_ILLEGAL_INST;
606     }
607 
608 #if !defined(CONFIG_USER_ONLY)
609     if (env->debugger) {
610         return RISCV_EXCP_NONE;
611     }
612 
613     /*
614      * With a CSR read-write instruction:
615      * 1) The seed CSR is always available in machine mode as normal.
616      * 2) Attempted access to seed from virtual modes VS and VU always raises
617      * an exception(virtual instruction exception only if mseccfg.sseed=1).
618      * 3) Without the corresponding access control bit set to 1, any attempted
619      * access to seed from U, S or HS modes will raise an illegal instruction
620      * exception.
621      */
622     if (env->priv == PRV_M) {
623         return RISCV_EXCP_NONE;
624     } else if (env->virt_enabled) {
625         if (env->mseccfg & MSECCFG_SSEED) {
626             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
627         } else {
628             return RISCV_EXCP_ILLEGAL_INST;
629         }
630     } else {
631         if (env->priv == PRV_S && (env->mseccfg & MSECCFG_SSEED)) {
632             return RISCV_EXCP_NONE;
633         } else if (env->priv == PRV_U && (env->mseccfg & MSECCFG_USEED)) {
634             return RISCV_EXCP_NONE;
635         } else {
636             return RISCV_EXCP_ILLEGAL_INST;
637         }
638     }
639 #else
640     return RISCV_EXCP_NONE;
641 #endif
642 }
643 
644 /* zicfiss CSR_SSP read and write */
645 static int read_ssp(CPURISCVState *env, int csrno, target_ulong *val)
646 {
647     *val = env->ssp;
648     return RISCV_EXCP_NONE;
649 }
650 
651 static int write_ssp(CPURISCVState *env, int csrno, target_ulong val)
652 {
653     env->ssp = val;
654     return RISCV_EXCP_NONE;
655 }
656 
657 /* User Floating-Point CSRs */
658 static RISCVException read_fflags(CPURISCVState *env, int csrno,
659                                   target_ulong *val)
660 {
661     *val = riscv_cpu_get_fflags(env);
662     return RISCV_EXCP_NONE;
663 }
664 
665 static RISCVException write_fflags(CPURISCVState *env, int csrno,
666                                    target_ulong val)
667 {
668 #if !defined(CONFIG_USER_ONLY)
669     if (riscv_has_ext(env, RVF)) {
670         env->mstatus |= MSTATUS_FS;
671     }
672 #endif
673     riscv_cpu_set_fflags(env, val & (FSR_AEXC >> FSR_AEXC_SHIFT));
674     return RISCV_EXCP_NONE;
675 }
676 
677 static RISCVException read_frm(CPURISCVState *env, int csrno,
678                                target_ulong *val)
679 {
680     *val = env->frm;
681     return RISCV_EXCP_NONE;
682 }
683 
684 static RISCVException write_frm(CPURISCVState *env, int csrno,
685                                 target_ulong val)
686 {
687 #if !defined(CONFIG_USER_ONLY)
688     if (riscv_has_ext(env, RVF)) {
689         env->mstatus |= MSTATUS_FS;
690     }
691 #endif
692     env->frm = val & (FSR_RD >> FSR_RD_SHIFT);
693     return RISCV_EXCP_NONE;
694 }
695 
696 static RISCVException read_fcsr(CPURISCVState *env, int csrno,
697                                 target_ulong *val)
698 {
699     *val = (riscv_cpu_get_fflags(env) << FSR_AEXC_SHIFT)
700         | (env->frm << FSR_RD_SHIFT);
701     return RISCV_EXCP_NONE;
702 }
703 
704 static RISCVException write_fcsr(CPURISCVState *env, int csrno,
705                                  target_ulong val)
706 {
707 #if !defined(CONFIG_USER_ONLY)
708     if (riscv_has_ext(env, RVF)) {
709         env->mstatus |= MSTATUS_FS;
710     }
711 #endif
712     env->frm = (val & FSR_RD) >> FSR_RD_SHIFT;
713     riscv_cpu_set_fflags(env, (val & FSR_AEXC) >> FSR_AEXC_SHIFT);
714     return RISCV_EXCP_NONE;
715 }
716 
717 static RISCVException read_vtype(CPURISCVState *env, int csrno,
718                                  target_ulong *val)
719 {
720     uint64_t vill;
721     switch (env->xl) {
722     case MXL_RV32:
723         vill = (uint32_t)env->vill << 31;
724         break;
725     case MXL_RV64:
726         vill = (uint64_t)env->vill << 63;
727         break;
728     default:
729         g_assert_not_reached();
730     }
731     *val = (target_ulong)vill | env->vtype;
732     return RISCV_EXCP_NONE;
733 }
734 
735 static RISCVException read_vl(CPURISCVState *env, int csrno,
736                               target_ulong *val)
737 {
738     *val = env->vl;
739     return RISCV_EXCP_NONE;
740 }
741 
742 static RISCVException read_vlenb(CPURISCVState *env, int csrno,
743                                  target_ulong *val)
744 {
745     *val = riscv_cpu_cfg(env)->vlenb;
746     return RISCV_EXCP_NONE;
747 }
748 
749 static RISCVException read_vxrm(CPURISCVState *env, int csrno,
750                                 target_ulong *val)
751 {
752     *val = env->vxrm;
753     return RISCV_EXCP_NONE;
754 }
755 
756 static RISCVException write_vxrm(CPURISCVState *env, int csrno,
757                                  target_ulong val)
758 {
759 #if !defined(CONFIG_USER_ONLY)
760     env->mstatus |= MSTATUS_VS;
761 #endif
762     env->vxrm = val;
763     return RISCV_EXCP_NONE;
764 }
765 
766 static RISCVException read_vxsat(CPURISCVState *env, int csrno,
767                                  target_ulong *val)
768 {
769     *val = env->vxsat & BIT(0);
770     return RISCV_EXCP_NONE;
771 }
772 
773 static RISCVException write_vxsat(CPURISCVState *env, int csrno,
774                                   target_ulong val)
775 {
776 #if !defined(CONFIG_USER_ONLY)
777     env->mstatus |= MSTATUS_VS;
778 #endif
779     env->vxsat = val & BIT(0);
780     return RISCV_EXCP_NONE;
781 }
782 
783 static RISCVException read_vstart(CPURISCVState *env, int csrno,
784                                   target_ulong *val)
785 {
786     *val = env->vstart;
787     return RISCV_EXCP_NONE;
788 }
789 
790 static RISCVException write_vstart(CPURISCVState *env, int csrno,
791                                    target_ulong val)
792 {
793 #if !defined(CONFIG_USER_ONLY)
794     env->mstatus |= MSTATUS_VS;
795 #endif
796     /*
797      * The vstart CSR is defined to have only enough writable bits
798      * to hold the largest element index, i.e. lg2(VLEN) bits.
799      */
800     env->vstart = val & ~(~0ULL << ctzl(riscv_cpu_cfg(env)->vlenb << 3));
801     return RISCV_EXCP_NONE;
802 }
803 
804 static RISCVException read_vcsr(CPURISCVState *env, int csrno,
805                                 target_ulong *val)
806 {
807     *val = (env->vxrm << VCSR_VXRM_SHIFT) | (env->vxsat << VCSR_VXSAT_SHIFT);
808     return RISCV_EXCP_NONE;
809 }
810 
811 static RISCVException write_vcsr(CPURISCVState *env, int csrno,
812                                  target_ulong val)
813 {
814 #if !defined(CONFIG_USER_ONLY)
815     env->mstatus |= MSTATUS_VS;
816 #endif
817     env->vxrm = (val & VCSR_VXRM) >> VCSR_VXRM_SHIFT;
818     env->vxsat = (val & VCSR_VXSAT) >> VCSR_VXSAT_SHIFT;
819     return RISCV_EXCP_NONE;
820 }
821 
822 #if defined(CONFIG_USER_ONLY)
823 /* User Timers and Counters */
824 static target_ulong get_ticks(bool shift)
825 {
826     int64_t val = cpu_get_host_ticks();
827     target_ulong result = shift ? val >> 32 : val;
828 
829     return result;
830 }
831 
832 static RISCVException read_time(CPURISCVState *env, int csrno,
833                                 target_ulong *val)
834 {
835     *val = cpu_get_host_ticks();
836     return RISCV_EXCP_NONE;
837 }
838 
839 static RISCVException read_timeh(CPURISCVState *env, int csrno,
840                                  target_ulong *val)
841 {
842     *val = cpu_get_host_ticks() >> 32;
843     return RISCV_EXCP_NONE;
844 }
845 
846 static RISCVException read_hpmcounter(CPURISCVState *env, int csrno,
847                                       target_ulong *val)
848 {
849     *val = get_ticks(false);
850     return RISCV_EXCP_NONE;
851 }
852 
853 static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
854                                        target_ulong *val)
855 {
856     *val = get_ticks(true);
857     return RISCV_EXCP_NONE;
858 }
859 
860 #else /* CONFIG_USER_ONLY */
861 
862 static RISCVException read_mcyclecfg(CPURISCVState *env, int csrno,
863                                      target_ulong *val)
864 {
865     *val = env->mcyclecfg;
866     return RISCV_EXCP_NONE;
867 }
868 
869 static RISCVException write_mcyclecfg(CPURISCVState *env, int csrno,
870                                       target_ulong val)
871 {
872     uint64_t inh_avail_mask;
873 
874     if (riscv_cpu_mxl(env) == MXL_RV32) {
875         env->mcyclecfg = val;
876     } else {
877         /* Set xINH fields if priv mode supported */
878         inh_avail_mask = ~MHPMEVENT_FILTER_MASK | MCYCLECFG_BIT_MINH;
879         inh_avail_mask |= riscv_has_ext(env, RVU) ? MCYCLECFG_BIT_UINH : 0;
880         inh_avail_mask |= riscv_has_ext(env, RVS) ? MCYCLECFG_BIT_SINH : 0;
881         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
882                            riscv_has_ext(env, RVU)) ? MCYCLECFG_BIT_VUINH : 0;
883         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
884                            riscv_has_ext(env, RVS)) ? MCYCLECFG_BIT_VSINH : 0;
885         env->mcyclecfg = val & inh_avail_mask;
886     }
887 
888     return RISCV_EXCP_NONE;
889 }
890 
891 static RISCVException read_mcyclecfgh(CPURISCVState *env, int csrno,
892                                       target_ulong *val)
893 {
894     *val = env->mcyclecfgh;
895     return RISCV_EXCP_NONE;
896 }
897 
898 static RISCVException write_mcyclecfgh(CPURISCVState *env, int csrno,
899                                        target_ulong val)
900 {
901     target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
902                                                  MCYCLECFGH_BIT_MINH);
903 
904     /* Set xINH fields if priv mode supported */
905     inh_avail_mask |= riscv_has_ext(env, RVU) ? MCYCLECFGH_BIT_UINH : 0;
906     inh_avail_mask |= riscv_has_ext(env, RVS) ? MCYCLECFGH_BIT_SINH : 0;
907     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
908                        riscv_has_ext(env, RVU)) ? MCYCLECFGH_BIT_VUINH : 0;
909     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
910                        riscv_has_ext(env, RVS)) ? MCYCLECFGH_BIT_VSINH : 0;
911 
912     env->mcyclecfgh = val & inh_avail_mask;
913     return RISCV_EXCP_NONE;
914 }
915 
916 static RISCVException read_minstretcfg(CPURISCVState *env, int csrno,
917                                        target_ulong *val)
918 {
919     *val = env->minstretcfg;
920     return RISCV_EXCP_NONE;
921 }
922 
923 static RISCVException write_minstretcfg(CPURISCVState *env, int csrno,
924                                         target_ulong val)
925 {
926     uint64_t inh_avail_mask;
927 
928     if (riscv_cpu_mxl(env) == MXL_RV32) {
929         env->minstretcfg = val;
930     } else {
931         inh_avail_mask = ~MHPMEVENT_FILTER_MASK | MINSTRETCFG_BIT_MINH;
932         inh_avail_mask |= riscv_has_ext(env, RVU) ? MINSTRETCFG_BIT_UINH : 0;
933         inh_avail_mask |= riscv_has_ext(env, RVS) ? MINSTRETCFG_BIT_SINH : 0;
934         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
935                            riscv_has_ext(env, RVU)) ? MINSTRETCFG_BIT_VUINH : 0;
936         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
937                            riscv_has_ext(env, RVS)) ? MINSTRETCFG_BIT_VSINH : 0;
938         env->minstretcfg = val & inh_avail_mask;
939     }
940     return RISCV_EXCP_NONE;
941 }
942 
943 static RISCVException read_minstretcfgh(CPURISCVState *env, int csrno,
944                                         target_ulong *val)
945 {
946     *val = env->minstretcfgh;
947     return RISCV_EXCP_NONE;
948 }
949 
950 static RISCVException write_minstretcfgh(CPURISCVState *env, int csrno,
951                                          target_ulong val)
952 {
953     target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
954                                                  MINSTRETCFGH_BIT_MINH);
955 
956     inh_avail_mask |= riscv_has_ext(env, RVU) ? MINSTRETCFGH_BIT_UINH : 0;
957     inh_avail_mask |= riscv_has_ext(env, RVS) ? MINSTRETCFGH_BIT_SINH : 0;
958     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
959                        riscv_has_ext(env, RVU)) ? MINSTRETCFGH_BIT_VUINH : 0;
960     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
961                        riscv_has_ext(env, RVS)) ? MINSTRETCFGH_BIT_VSINH : 0;
962 
963     env->minstretcfgh = val & inh_avail_mask;
964     return RISCV_EXCP_NONE;
965 }
966 
967 static RISCVException read_mhpmevent(CPURISCVState *env, int csrno,
968                                      target_ulong *val)
969 {
970     int evt_index = csrno - CSR_MCOUNTINHIBIT;
971 
972     *val = env->mhpmevent_val[evt_index];
973 
974     return RISCV_EXCP_NONE;
975 }
976 
977 static RISCVException write_mhpmevent(CPURISCVState *env, int csrno,
978                                       target_ulong val)
979 {
980     int evt_index = csrno - CSR_MCOUNTINHIBIT;
981     uint64_t mhpmevt_val = val;
982     uint64_t inh_avail_mask;
983 
984     if (riscv_cpu_mxl(env) == MXL_RV32) {
985         env->mhpmevent_val[evt_index] = val;
986         mhpmevt_val = mhpmevt_val |
987                       ((uint64_t)env->mhpmeventh_val[evt_index] << 32);
988     } else {
989         inh_avail_mask = ~MHPMEVENT_FILTER_MASK | MHPMEVENT_BIT_MINH;
990         inh_avail_mask |= riscv_has_ext(env, RVU) ? MHPMEVENT_BIT_UINH : 0;
991         inh_avail_mask |= riscv_has_ext(env, RVS) ? MHPMEVENT_BIT_SINH : 0;
992         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
993                            riscv_has_ext(env, RVU)) ? MHPMEVENT_BIT_VUINH : 0;
994         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
995                            riscv_has_ext(env, RVS)) ? MHPMEVENT_BIT_VSINH : 0;
996         mhpmevt_val = val & inh_avail_mask;
997         env->mhpmevent_val[evt_index] = mhpmevt_val;
998     }
999 
1000     riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
1001 
1002     return RISCV_EXCP_NONE;
1003 }
1004 
1005 static RISCVException read_mhpmeventh(CPURISCVState *env, int csrno,
1006                                       target_ulong *val)
1007 {
1008     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
1009 
1010     *val = env->mhpmeventh_val[evt_index];
1011 
1012     return RISCV_EXCP_NONE;
1013 }
1014 
1015 static RISCVException write_mhpmeventh(CPURISCVState *env, int csrno,
1016                                        target_ulong val)
1017 {
1018     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
1019     uint64_t mhpmevth_val;
1020     uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
1021     target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
1022                                                   MHPMEVENTH_BIT_MINH);
1023 
1024     inh_avail_mask |= riscv_has_ext(env, RVU) ? MHPMEVENTH_BIT_UINH : 0;
1025     inh_avail_mask |= riscv_has_ext(env, RVS) ? MHPMEVENTH_BIT_SINH : 0;
1026     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
1027                        riscv_has_ext(env, RVU)) ? MHPMEVENTH_BIT_VUINH : 0;
1028     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
1029                        riscv_has_ext(env, RVS)) ? MHPMEVENTH_BIT_VSINH : 0;
1030 
1031     mhpmevth_val = val & inh_avail_mask;
1032     mhpmevt_val = mhpmevt_val | (mhpmevth_val << 32);
1033     env->mhpmeventh_val[evt_index] = mhpmevth_val;
1034 
1035     riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
1036 
1037     return RISCV_EXCP_NONE;
1038 }
1039 
1040 static target_ulong riscv_pmu_ctr_get_fixed_counters_val(CPURISCVState *env,
1041                                                          int counter_idx,
1042                                                          bool upper_half)
1043 {
1044     int inst = riscv_pmu_ctr_monitor_instructions(env, counter_idx);
1045     uint64_t *counter_arr_virt = env->pmu_fixed_ctrs[inst].counter_virt;
1046     uint64_t *counter_arr = env->pmu_fixed_ctrs[inst].counter;
1047     target_ulong result = 0;
1048     uint64_t curr_val = 0;
1049     uint64_t cfg_val = 0;
1050 
1051     if (counter_idx == 0) {
1052         cfg_val = upper_half ? ((uint64_t)env->mcyclecfgh << 32) :
1053                   env->mcyclecfg;
1054     } else if (counter_idx == 2) {
1055         cfg_val = upper_half ? ((uint64_t)env->minstretcfgh << 32) :
1056                   env->minstretcfg;
1057     } else {
1058         cfg_val = upper_half ?
1059                   ((uint64_t)env->mhpmeventh_val[counter_idx] << 32) :
1060                   env->mhpmevent_val[counter_idx];
1061         cfg_val &= MHPMEVENT_FILTER_MASK;
1062     }
1063 
1064     if (!cfg_val) {
1065         if (icount_enabled()) {
1066                 curr_val = inst ? icount_get_raw() : icount_get();
1067         } else {
1068             curr_val = cpu_get_host_ticks();
1069         }
1070 
1071         goto done;
1072     }
1073 
1074     /* Update counter before reading. */
1075     riscv_pmu_update_fixed_ctrs(env, env->priv, env->virt_enabled);
1076 
1077     if (!(cfg_val & MCYCLECFG_BIT_MINH)) {
1078         curr_val += counter_arr[PRV_M];
1079     }
1080 
1081     if (!(cfg_val & MCYCLECFG_BIT_SINH)) {
1082         curr_val += counter_arr[PRV_S];
1083     }
1084 
1085     if (!(cfg_val & MCYCLECFG_BIT_UINH)) {
1086         curr_val += counter_arr[PRV_U];
1087     }
1088 
1089     if (!(cfg_val & MCYCLECFG_BIT_VSINH)) {
1090         curr_val += counter_arr_virt[PRV_S];
1091     }
1092 
1093     if (!(cfg_val & MCYCLECFG_BIT_VUINH)) {
1094         curr_val += counter_arr_virt[PRV_U];
1095     }
1096 
1097 done:
1098     if (riscv_cpu_mxl(env) == MXL_RV32) {
1099         result = upper_half ? curr_val >> 32 : curr_val;
1100     } else {
1101         result = curr_val;
1102     }
1103 
1104     return result;
1105 }
1106 
1107 static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
1108                                         target_ulong val)
1109 {
1110     int ctr_idx = csrno - CSR_MCYCLE;
1111     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
1112     uint64_t mhpmctr_val = val;
1113 
1114     counter->mhpmcounter_val = val;
1115     if (!get_field(env->mcountinhibit, BIT(ctr_idx)) &&
1116         (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
1117          riscv_pmu_ctr_monitor_instructions(env, ctr_idx))) {
1118         counter->mhpmcounter_prev = riscv_pmu_ctr_get_fixed_counters_val(env,
1119                                                                 ctr_idx, false);
1120         if (ctr_idx > 2) {
1121             if (riscv_cpu_mxl(env) == MXL_RV32) {
1122                 mhpmctr_val = mhpmctr_val |
1123                               ((uint64_t)counter->mhpmcounterh_val << 32);
1124             }
1125             riscv_pmu_setup_timer(env, mhpmctr_val, ctr_idx);
1126         }
1127      } else {
1128         /* Other counters can keep incrementing from the given value */
1129         counter->mhpmcounter_prev = val;
1130     }
1131 
1132     return RISCV_EXCP_NONE;
1133 }
1134 
1135 static RISCVException write_mhpmcounterh(CPURISCVState *env, int csrno,
1136                                          target_ulong val)
1137 {
1138     int ctr_idx = csrno - CSR_MCYCLEH;
1139     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
1140     uint64_t mhpmctr_val = counter->mhpmcounter_val;
1141     uint64_t mhpmctrh_val = val;
1142 
1143     counter->mhpmcounterh_val = val;
1144     mhpmctr_val = mhpmctr_val | (mhpmctrh_val << 32);
1145     if (!get_field(env->mcountinhibit, BIT(ctr_idx)) &&
1146         (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
1147          riscv_pmu_ctr_monitor_instructions(env, ctr_idx))) {
1148         counter->mhpmcounterh_prev = riscv_pmu_ctr_get_fixed_counters_val(env,
1149                                                                  ctr_idx, true);
1150         if (ctr_idx > 2) {
1151             riscv_pmu_setup_timer(env, mhpmctr_val, ctr_idx);
1152         }
1153     } else {
1154         counter->mhpmcounterh_prev = val;
1155     }
1156 
1157     return RISCV_EXCP_NONE;
1158 }
1159 
1160 RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
1161                                          bool upper_half, uint32_t ctr_idx)
1162 {
1163     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
1164     target_ulong ctr_prev = upper_half ? counter->mhpmcounterh_prev :
1165                                          counter->mhpmcounter_prev;
1166     target_ulong ctr_val = upper_half ? counter->mhpmcounterh_val :
1167                                         counter->mhpmcounter_val;
1168 
1169     if (get_field(env->mcountinhibit, BIT(ctr_idx))) {
1170         /*
1171          * Counter should not increment if inhibit bit is set. Just return the
1172          * current counter value.
1173          */
1174          *val = ctr_val;
1175          return RISCV_EXCP_NONE;
1176     }
1177 
1178     /*
1179      * The kernel computes the perf delta by subtracting the current value from
1180      * the value it initialized previously (ctr_val).
1181      */
1182     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
1183         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
1184         *val = riscv_pmu_ctr_get_fixed_counters_val(env, ctr_idx, upper_half) -
1185                                                     ctr_prev + ctr_val;
1186     } else {
1187         *val = ctr_val;
1188     }
1189 
1190     return RISCV_EXCP_NONE;
1191 }
1192 
1193 static RISCVException read_hpmcounter(CPURISCVState *env, int csrno,
1194                                       target_ulong *val)
1195 {
1196     uint16_t ctr_index;
1197 
1198     if (csrno >= CSR_MCYCLE && csrno <= CSR_MHPMCOUNTER31) {
1199         ctr_index = csrno - CSR_MCYCLE;
1200     } else if (csrno >= CSR_CYCLE && csrno <= CSR_HPMCOUNTER31) {
1201         ctr_index = csrno - CSR_CYCLE;
1202     } else {
1203         return RISCV_EXCP_ILLEGAL_INST;
1204     }
1205 
1206     return riscv_pmu_read_ctr(env, val, false, ctr_index);
1207 }
1208 
1209 static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
1210                                        target_ulong *val)
1211 {
1212     uint16_t ctr_index;
1213 
1214     if (csrno >= CSR_MCYCLEH && csrno <= CSR_MHPMCOUNTER31H) {
1215         ctr_index = csrno - CSR_MCYCLEH;
1216     } else if (csrno >= CSR_CYCLEH && csrno <= CSR_HPMCOUNTER31H) {
1217         ctr_index = csrno - CSR_CYCLEH;
1218     } else {
1219         return RISCV_EXCP_ILLEGAL_INST;
1220     }
1221 
1222     return riscv_pmu_read_ctr(env, val, true, ctr_index);
1223 }
1224 
1225 static RISCVException read_scountovf(CPURISCVState *env, int csrno,
1226                                      target_ulong *val)
1227 {
1228     int mhpmevt_start = CSR_MHPMEVENT3 - CSR_MCOUNTINHIBIT;
1229     int i;
1230     *val = 0;
1231     target_ulong *mhpm_evt_val;
1232     uint64_t of_bit_mask;
1233 
1234     if (riscv_cpu_mxl(env) == MXL_RV32) {
1235         mhpm_evt_val = env->mhpmeventh_val;
1236         of_bit_mask = MHPMEVENTH_BIT_OF;
1237     } else {
1238         mhpm_evt_val = env->mhpmevent_val;
1239         of_bit_mask = MHPMEVENT_BIT_OF;
1240     }
1241 
1242     for (i = mhpmevt_start; i < RV_MAX_MHPMEVENTS; i++) {
1243         if ((get_field(env->mcounteren, BIT(i))) &&
1244             (mhpm_evt_val[i] & of_bit_mask)) {
1245                     *val |= BIT(i);
1246             }
1247     }
1248 
1249     return RISCV_EXCP_NONE;
1250 }
1251 
1252 static RISCVException read_time(CPURISCVState *env, int csrno,
1253                                 target_ulong *val)
1254 {
1255     uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
1256 
1257     if (!env->rdtime_fn) {
1258         return RISCV_EXCP_ILLEGAL_INST;
1259     }
1260 
1261     *val = env->rdtime_fn(env->rdtime_fn_arg) + delta;
1262     return RISCV_EXCP_NONE;
1263 }
1264 
1265 static RISCVException read_timeh(CPURISCVState *env, int csrno,
1266                                  target_ulong *val)
1267 {
1268     uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
1269 
1270     if (!env->rdtime_fn) {
1271         return RISCV_EXCP_ILLEGAL_INST;
1272     }
1273 
1274     *val = (env->rdtime_fn(env->rdtime_fn_arg) + delta) >> 32;
1275     return RISCV_EXCP_NONE;
1276 }
1277 
1278 static RISCVException read_vstimecmp(CPURISCVState *env, int csrno,
1279                                      target_ulong *val)
1280 {
1281     *val = env->vstimecmp;
1282 
1283     return RISCV_EXCP_NONE;
1284 }
1285 
1286 static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
1287                                       target_ulong *val)
1288 {
1289     *val = env->vstimecmp >> 32;
1290 
1291     return RISCV_EXCP_NONE;
1292 }
1293 
1294 static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
1295                                       target_ulong val)
1296 {
1297     if (riscv_cpu_mxl(env) == MXL_RV32) {
1298         env->vstimecmp = deposit64(env->vstimecmp, 0, 32, (uint64_t)val);
1299     } else {
1300         env->vstimecmp = val;
1301     }
1302 
1303     riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
1304                               env->htimedelta, MIP_VSTIP);
1305 
1306     return RISCV_EXCP_NONE;
1307 }
1308 
1309 static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
1310                                        target_ulong val)
1311 {
1312     env->vstimecmp = deposit64(env->vstimecmp, 32, 32, (uint64_t)val);
1313     riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
1314                               env->htimedelta, MIP_VSTIP);
1315 
1316     return RISCV_EXCP_NONE;
1317 }
1318 
1319 static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
1320                                     target_ulong *val)
1321 {
1322     if (env->virt_enabled) {
1323         *val = env->vstimecmp;
1324     } else {
1325         *val = env->stimecmp;
1326     }
1327 
1328     return RISCV_EXCP_NONE;
1329 }
1330 
1331 static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
1332                                      target_ulong *val)
1333 {
1334     if (env->virt_enabled) {
1335         *val = env->vstimecmp >> 32;
1336     } else {
1337         *val = env->stimecmp >> 32;
1338     }
1339 
1340     return RISCV_EXCP_NONE;
1341 }
1342 
1343 static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
1344                                      target_ulong val)
1345 {
1346     if (env->virt_enabled) {
1347         if (env->hvictl & HVICTL_VTI) {
1348             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
1349         }
1350         return write_vstimecmp(env, csrno, val);
1351     }
1352 
1353     if (riscv_cpu_mxl(env) == MXL_RV32) {
1354         env->stimecmp = deposit64(env->stimecmp, 0, 32, (uint64_t)val);
1355     } else {
1356         env->stimecmp = val;
1357     }
1358 
1359     riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
1360 
1361     return RISCV_EXCP_NONE;
1362 }
1363 
1364 static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
1365                                       target_ulong val)
1366 {
1367     if (env->virt_enabled) {
1368         if (env->hvictl & HVICTL_VTI) {
1369             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
1370         }
1371         return write_vstimecmph(env, csrno, val);
1372     }
1373 
1374     env->stimecmp = deposit64(env->stimecmp, 32, 32, (uint64_t)val);
1375     riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
1376 
1377     return RISCV_EXCP_NONE;
1378 }
1379 
1380 #define VSTOPI_NUM_SRCS 5
1381 
1382 /*
1383  * All core local interrupts except the fixed ones 0:12. This macro is for
1384  * virtual interrupts logic so please don't change this to avoid messing up
1385  * the whole support, For reference see AIA spec: `5.3 Interrupt filtering and
1386  * virtual interrupts for supervisor level` and `6.3.2 Virtual interrupts for
1387  * VS level`.
1388  */
1389 #define LOCAL_INTERRUPTS   (~0x1FFFULL)
1390 
1391 static const uint64_t delegable_ints =
1392     S_MODE_INTERRUPTS | VS_MODE_INTERRUPTS | MIP_LCOFIP;
1393 static const uint64_t vs_delegable_ints =
1394     (VS_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & ~MIP_LCOFIP;
1395 static const uint64_t all_ints = M_MODE_INTERRUPTS | S_MODE_INTERRUPTS |
1396                                      HS_MODE_INTERRUPTS | LOCAL_INTERRUPTS;
1397 #define DELEGABLE_EXCPS ((1ULL << (RISCV_EXCP_INST_ADDR_MIS)) | \
1398                          (1ULL << (RISCV_EXCP_INST_ACCESS_FAULT)) | \
1399                          (1ULL << (RISCV_EXCP_ILLEGAL_INST)) | \
1400                          (1ULL << (RISCV_EXCP_BREAKPOINT)) | \
1401                          (1ULL << (RISCV_EXCP_LOAD_ADDR_MIS)) | \
1402                          (1ULL << (RISCV_EXCP_LOAD_ACCESS_FAULT)) | \
1403                          (1ULL << (RISCV_EXCP_STORE_AMO_ADDR_MIS)) | \
1404                          (1ULL << (RISCV_EXCP_STORE_AMO_ACCESS_FAULT)) | \
1405                          (1ULL << (RISCV_EXCP_U_ECALL)) | \
1406                          (1ULL << (RISCV_EXCP_S_ECALL)) | \
1407                          (1ULL << (RISCV_EXCP_VS_ECALL)) | \
1408                          (1ULL << (RISCV_EXCP_M_ECALL)) | \
1409                          (1ULL << (RISCV_EXCP_INST_PAGE_FAULT)) | \
1410                          (1ULL << (RISCV_EXCP_LOAD_PAGE_FAULT)) | \
1411                          (1ULL << (RISCV_EXCP_STORE_PAGE_FAULT)) | \
1412                          (1ULL << (RISCV_EXCP_SW_CHECK)) | \
1413                          (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) | \
1414                          (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) | \
1415                          (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) | \
1416                          (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)))
1417 static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
1418     ~((1ULL << (RISCV_EXCP_S_ECALL)) |
1419       (1ULL << (RISCV_EXCP_VS_ECALL)) |
1420       (1ULL << (RISCV_EXCP_M_ECALL)) |
1421       (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) |
1422       (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) |
1423       (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) |
1424       (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)));
1425 static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
1426     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
1427     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
1428 
1429 /*
1430  * Spec allows for bits 13:63 to be either read-only or writable.
1431  * So far we have interrupt LCOFIP in that region which is writable.
1432  *
1433  * Also, spec allows to inject virtual interrupts in this region even
1434  * without any hardware interrupts for that interrupt number.
1435  *
1436  * For now interrupt in 13:63 region are all kept writable. 13 being
1437  * LCOFIP and 14:63 being virtual only. Change this in future if we
1438  * introduce more interrupts that are not writable.
1439  */
1440 
1441 /* Bit STIP can be an alias of mip.STIP that's why it's writable in mvip. */
1442 static const uint64_t mvip_writable_mask = MIP_SSIP | MIP_STIP | MIP_SEIP |
1443                                     LOCAL_INTERRUPTS;
1444 static const uint64_t mvien_writable_mask = MIP_SSIP | MIP_SEIP |
1445                                     LOCAL_INTERRUPTS;
1446 
1447 static const uint64_t sip_writable_mask = SIP_SSIP | LOCAL_INTERRUPTS;
1448 static const uint64_t hip_writable_mask = MIP_VSSIP;
1449 static const uint64_t hvip_writable_mask = MIP_VSSIP | MIP_VSTIP |
1450                                     MIP_VSEIP | LOCAL_INTERRUPTS;
1451 static const uint64_t hvien_writable_mask = LOCAL_INTERRUPTS;
1452 
1453 static const uint64_t vsip_writable_mask = MIP_VSSIP | LOCAL_INTERRUPTS;
1454 
1455 const bool valid_vm_1_10_32[16] = {
1456     [VM_1_10_MBARE] = true,
1457     [VM_1_10_SV32] = true
1458 };
1459 
1460 const bool valid_vm_1_10_64[16] = {
1461     [VM_1_10_MBARE] = true,
1462     [VM_1_10_SV39] = true,
1463     [VM_1_10_SV48] = true,
1464     [VM_1_10_SV57] = true
1465 };
1466 
1467 /* Machine Information Registers */
1468 static RISCVException read_zero(CPURISCVState *env, int csrno,
1469                                 target_ulong *val)
1470 {
1471     *val = 0;
1472     return RISCV_EXCP_NONE;
1473 }
1474 
1475 static RISCVException write_ignore(CPURISCVState *env, int csrno,
1476                                    target_ulong val)
1477 {
1478     return RISCV_EXCP_NONE;
1479 }
1480 
1481 static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
1482                                      target_ulong *val)
1483 {
1484     *val = riscv_cpu_cfg(env)->mvendorid;
1485     return RISCV_EXCP_NONE;
1486 }
1487 
1488 static RISCVException read_marchid(CPURISCVState *env, int csrno,
1489                                    target_ulong *val)
1490 {
1491     *val = riscv_cpu_cfg(env)->marchid;
1492     return RISCV_EXCP_NONE;
1493 }
1494 
1495 static RISCVException read_mimpid(CPURISCVState *env, int csrno,
1496                                   target_ulong *val)
1497 {
1498     *val = riscv_cpu_cfg(env)->mimpid;
1499     return RISCV_EXCP_NONE;
1500 }
1501 
1502 static RISCVException read_mhartid(CPURISCVState *env, int csrno,
1503                                    target_ulong *val)
1504 {
1505     *val = env->mhartid;
1506     return RISCV_EXCP_NONE;
1507 }
1508 
1509 /* Machine Trap Setup */
1510 
1511 /* We do not store SD explicitly, only compute it on demand. */
1512 static uint64_t add_status_sd(RISCVMXL xl, uint64_t status)
1513 {
1514     if ((status & MSTATUS_FS) == MSTATUS_FS ||
1515         (status & MSTATUS_VS) == MSTATUS_VS ||
1516         (status & MSTATUS_XS) == MSTATUS_XS) {
1517         switch (xl) {
1518         case MXL_RV32:
1519             return status | MSTATUS32_SD;
1520         case MXL_RV64:
1521             return status | MSTATUS64_SD;
1522         case MXL_RV128:
1523             return MSTATUSH128_SD;
1524         default:
1525             g_assert_not_reached();
1526         }
1527     }
1528     return status;
1529 }
1530 
1531 static RISCVException read_mstatus(CPURISCVState *env, int csrno,
1532                                    target_ulong *val)
1533 {
1534     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus);
1535     return RISCV_EXCP_NONE;
1536 }
1537 
1538 static bool validate_vm(CPURISCVState *env, target_ulong vm)
1539 {
1540     uint64_t mode_supported = riscv_cpu_cfg(env)->satp_mode.map;
1541     return get_field(mode_supported, (1 << vm));
1542 }
1543 
1544 static target_ulong legalize_xatp(CPURISCVState *env, target_ulong old_xatp,
1545                                   target_ulong val)
1546 {
1547     target_ulong mask;
1548     bool vm;
1549     if (riscv_cpu_mxl(env) == MXL_RV32) {
1550         vm = validate_vm(env, get_field(val, SATP32_MODE));
1551         mask = (val ^ old_xatp) & (SATP32_MODE | SATP32_ASID | SATP32_PPN);
1552     } else {
1553         vm = validate_vm(env, get_field(val, SATP64_MODE));
1554         mask = (val ^ old_xatp) & (SATP64_MODE | SATP64_ASID | SATP64_PPN);
1555     }
1556 
1557     if (vm && mask) {
1558         /*
1559          * The ISA defines SATP.MODE=Bare as "no translation", but we still
1560          * pass these through QEMU's TLB emulation as it improves
1561          * performance.  Flushing the TLB on SATP writes with paging
1562          * enabled avoids leaking those invalid cached mappings.
1563          */
1564         tlb_flush(env_cpu(env));
1565         return val;
1566     }
1567     return old_xatp;
1568 }
1569 
1570 static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
1571                                  target_ulong val)
1572 {
1573     bool valid = false;
1574     target_ulong new_mpp = get_field(val, MSTATUS_MPP);
1575 
1576     switch (new_mpp) {
1577     case PRV_M:
1578         valid = true;
1579         break;
1580     case PRV_S:
1581         valid = riscv_has_ext(env, RVS);
1582         break;
1583     case PRV_U:
1584         valid = riscv_has_ext(env, RVU);
1585         break;
1586     }
1587 
1588     /* Remain field unchanged if new_mpp value is invalid */
1589     if (!valid) {
1590         val = set_field(val, MSTATUS_MPP, old_mpp);
1591     }
1592 
1593     return val;
1594 }
1595 
1596 static RISCVException write_mstatus(CPURISCVState *env, int csrno,
1597                                     target_ulong val)
1598 {
1599     uint64_t mstatus = env->mstatus;
1600     uint64_t mask = 0;
1601     RISCVMXL xl = riscv_cpu_mxl(env);
1602 
1603     /*
1604      * MPP field have been made WARL since priv version 1.11. However,
1605      * legalization for it will not break any software running on 1.10.
1606      */
1607     val = legalize_mpp(env, get_field(mstatus, MSTATUS_MPP), val);
1608 
1609     /* flush tlb on mstatus fields that affect VM */
1610     if ((val ^ mstatus) & MSTATUS_MXR) {
1611         tlb_flush(env_cpu(env));
1612     }
1613     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
1614         MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
1615         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
1616         MSTATUS_TW;
1617 
1618     if (riscv_has_ext(env, RVF)) {
1619         mask |= MSTATUS_FS;
1620     }
1621     if (riscv_has_ext(env, RVV)) {
1622         mask |= MSTATUS_VS;
1623     }
1624 
1625     if (xl != MXL_RV32 || env->debugger) {
1626         if (riscv_has_ext(env, RVH)) {
1627             mask |= MSTATUS_MPV | MSTATUS_GVA;
1628         }
1629         if ((val & MSTATUS64_UXL) != 0) {
1630             mask |= MSTATUS64_UXL;
1631         }
1632     }
1633 
1634     /* If cfi lp extension is available, then apply cfi lp mask */
1635     if (env_archcpu(env)->cfg.ext_zicfilp) {
1636         mask |= (MSTATUS_MPELP | MSTATUS_SPELP);
1637     }
1638 
1639     mstatus = (mstatus & ~mask) | (val & mask);
1640 
1641     env->mstatus = mstatus;
1642 
1643     /*
1644      * Except in debug mode, UXL/SXL can only be modified by higher
1645      * privilege mode. So xl will not be changed in normal mode.
1646      */
1647     if (env->debugger) {
1648         env->xl = cpu_recompute_xl(env);
1649     }
1650 
1651     riscv_cpu_update_mask(env);
1652     return RISCV_EXCP_NONE;
1653 }
1654 
1655 static RISCVException read_mstatush(CPURISCVState *env, int csrno,
1656                                     target_ulong *val)
1657 {
1658     *val = env->mstatus >> 32;
1659     return RISCV_EXCP_NONE;
1660 }
1661 
1662 static RISCVException write_mstatush(CPURISCVState *env, int csrno,
1663                                      target_ulong val)
1664 {
1665     uint64_t valh = (uint64_t)val << 32;
1666     uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
1667 
1668     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
1669 
1670     return RISCV_EXCP_NONE;
1671 }
1672 
1673 static RISCVException read_mstatus_i128(CPURISCVState *env, int csrno,
1674                                         Int128 *val)
1675 {
1676     *val = int128_make128(env->mstatus, add_status_sd(MXL_RV128,
1677                                                       env->mstatus));
1678     return RISCV_EXCP_NONE;
1679 }
1680 
1681 static RISCVException read_misa_i128(CPURISCVState *env, int csrno,
1682                                      Int128 *val)
1683 {
1684     *val = int128_make128(env->misa_ext, (uint64_t)MXL_RV128 << 62);
1685     return RISCV_EXCP_NONE;
1686 }
1687 
1688 static RISCVException read_misa(CPURISCVState *env, int csrno,
1689                                 target_ulong *val)
1690 {
1691     target_ulong misa;
1692 
1693     switch (env->misa_mxl) {
1694     case MXL_RV32:
1695         misa = (target_ulong)MXL_RV32 << 30;
1696         break;
1697 #ifdef TARGET_RISCV64
1698     case MXL_RV64:
1699         misa = (target_ulong)MXL_RV64 << 62;
1700         break;
1701 #endif
1702     default:
1703         g_assert_not_reached();
1704     }
1705 
1706     *val = misa | env->misa_ext;
1707     return RISCV_EXCP_NONE;
1708 }
1709 
1710 static RISCVException write_misa(CPURISCVState *env, int csrno,
1711                                  target_ulong val)
1712 {
1713     RISCVCPU *cpu = env_archcpu(env);
1714     uint32_t orig_misa_ext = env->misa_ext;
1715     Error *local_err = NULL;
1716 
1717     if (!riscv_cpu_cfg(env)->misa_w) {
1718         /* drop write to misa */
1719         return RISCV_EXCP_NONE;
1720     }
1721 
1722     /* Mask extensions that are not supported by this hart */
1723     val &= env->misa_ext_mask;
1724 
1725     /*
1726      * Suppress 'C' if next instruction is not aligned
1727      * TODO: this should check next_pc
1728      */
1729     if ((val & RVC) && (GETPC() & ~3) != 0) {
1730         val &= ~RVC;
1731     }
1732 
1733     /* Disable RVG if any of its dependencies are disabled */
1734     if (!(val & RVI && val & RVM && val & RVA &&
1735           val & RVF && val & RVD)) {
1736         val &= ~RVG;
1737     }
1738 
1739     /* If nothing changed, do nothing. */
1740     if (val == env->misa_ext) {
1741         return RISCV_EXCP_NONE;
1742     }
1743 
1744     env->misa_ext = val;
1745     riscv_cpu_validate_set_extensions(cpu, &local_err);
1746     if (local_err != NULL) {
1747         /* Rollback on validation error */
1748         qemu_log_mask(LOG_GUEST_ERROR, "Unable to write MISA ext value "
1749                       "0x%x, keeping existing MISA ext 0x%x\n",
1750                       env->misa_ext, orig_misa_ext);
1751 
1752         env->misa_ext = orig_misa_ext;
1753 
1754         return RISCV_EXCP_NONE;
1755     }
1756 
1757     if (!(env->misa_ext & RVF)) {
1758         env->mstatus &= ~MSTATUS_FS;
1759     }
1760 
1761     /* flush translation cache */
1762     tb_flush(env_cpu(env));
1763     env->xl = riscv_cpu_mxl(env);
1764     return RISCV_EXCP_NONE;
1765 }
1766 
1767 static RISCVException read_medeleg(CPURISCVState *env, int csrno,
1768                                    target_ulong *val)
1769 {
1770     *val = env->medeleg;
1771     return RISCV_EXCP_NONE;
1772 }
1773 
1774 static RISCVException write_medeleg(CPURISCVState *env, int csrno,
1775                                     target_ulong val)
1776 {
1777     env->medeleg = (env->medeleg & ~DELEGABLE_EXCPS) | (val & DELEGABLE_EXCPS);
1778     return RISCV_EXCP_NONE;
1779 }
1780 
1781 static RISCVException rmw_mideleg64(CPURISCVState *env, int csrno,
1782                                     uint64_t *ret_val,
1783                                     uint64_t new_val, uint64_t wr_mask)
1784 {
1785     uint64_t mask = wr_mask & delegable_ints;
1786 
1787     if (ret_val) {
1788         *ret_val = env->mideleg;
1789     }
1790 
1791     env->mideleg = (env->mideleg & ~mask) | (new_val & mask);
1792 
1793     if (riscv_has_ext(env, RVH)) {
1794         env->mideleg |= HS_MODE_INTERRUPTS;
1795     }
1796 
1797     return RISCV_EXCP_NONE;
1798 }
1799 
1800 static RISCVException rmw_mideleg(CPURISCVState *env, int csrno,
1801                                   target_ulong *ret_val,
1802                                   target_ulong new_val, target_ulong wr_mask)
1803 {
1804     uint64_t rval;
1805     RISCVException ret;
1806 
1807     ret = rmw_mideleg64(env, csrno, &rval, new_val, wr_mask);
1808     if (ret_val) {
1809         *ret_val = rval;
1810     }
1811 
1812     return ret;
1813 }
1814 
1815 static RISCVException rmw_midelegh(CPURISCVState *env, int csrno,
1816                                    target_ulong *ret_val,
1817                                    target_ulong new_val,
1818                                    target_ulong wr_mask)
1819 {
1820     uint64_t rval;
1821     RISCVException ret;
1822 
1823     ret = rmw_mideleg64(env, csrno, &rval,
1824         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1825     if (ret_val) {
1826         *ret_val = rval >> 32;
1827     }
1828 
1829     return ret;
1830 }
1831 
1832 static RISCVException rmw_mie64(CPURISCVState *env, int csrno,
1833                                 uint64_t *ret_val,
1834                                 uint64_t new_val, uint64_t wr_mask)
1835 {
1836     uint64_t mask = wr_mask & all_ints;
1837 
1838     if (ret_val) {
1839         *ret_val = env->mie;
1840     }
1841 
1842     env->mie = (env->mie & ~mask) | (new_val & mask);
1843 
1844     if (!riscv_has_ext(env, RVH)) {
1845         env->mie &= ~((uint64_t)HS_MODE_INTERRUPTS);
1846     }
1847 
1848     return RISCV_EXCP_NONE;
1849 }
1850 
1851 static RISCVException rmw_mie(CPURISCVState *env, int csrno,
1852                               target_ulong *ret_val,
1853                               target_ulong new_val, target_ulong wr_mask)
1854 {
1855     uint64_t rval;
1856     RISCVException ret;
1857 
1858     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask);
1859     if (ret_val) {
1860         *ret_val = rval;
1861     }
1862 
1863     return ret;
1864 }
1865 
1866 static RISCVException rmw_mieh(CPURISCVState *env, int csrno,
1867                                target_ulong *ret_val,
1868                                target_ulong new_val, target_ulong wr_mask)
1869 {
1870     uint64_t rval;
1871     RISCVException ret;
1872 
1873     ret = rmw_mie64(env, csrno, &rval,
1874         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1875     if (ret_val) {
1876         *ret_val = rval >> 32;
1877     }
1878 
1879     return ret;
1880 }
1881 
1882 static RISCVException rmw_mvien64(CPURISCVState *env, int csrno,
1883                                 uint64_t *ret_val,
1884                                 uint64_t new_val, uint64_t wr_mask)
1885 {
1886     uint64_t mask = wr_mask & mvien_writable_mask;
1887 
1888     if (ret_val) {
1889         *ret_val = env->mvien;
1890     }
1891 
1892     env->mvien = (env->mvien & ~mask) | (new_val & mask);
1893 
1894     return RISCV_EXCP_NONE;
1895 }
1896 
1897 static RISCVException rmw_mvien(CPURISCVState *env, int csrno,
1898                               target_ulong *ret_val,
1899                               target_ulong new_val, target_ulong wr_mask)
1900 {
1901     uint64_t rval;
1902     RISCVException ret;
1903 
1904     ret = rmw_mvien64(env, csrno, &rval, new_val, wr_mask);
1905     if (ret_val) {
1906         *ret_val = rval;
1907     }
1908 
1909     return ret;
1910 }
1911 
1912 static RISCVException rmw_mvienh(CPURISCVState *env, int csrno,
1913                                 target_ulong *ret_val,
1914                                 target_ulong new_val, target_ulong wr_mask)
1915 {
1916     uint64_t rval;
1917     RISCVException ret;
1918 
1919     ret = rmw_mvien64(env, csrno, &rval,
1920         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1921     if (ret_val) {
1922         *ret_val = rval >> 32;
1923     }
1924 
1925     return ret;
1926 }
1927 
1928 static RISCVException read_mtopi(CPURISCVState *env, int csrno,
1929                                  target_ulong *val)
1930 {
1931     int irq;
1932     uint8_t iprio;
1933 
1934     irq = riscv_cpu_mirq_pending(env);
1935     if (irq <= 0 || irq > 63) {
1936         *val = 0;
1937     } else {
1938         iprio = env->miprio[irq];
1939         if (!iprio) {
1940             if (riscv_cpu_default_priority(irq) > IPRIO_DEFAULT_M) {
1941                 iprio = IPRIO_MMAXIPRIO;
1942             }
1943         }
1944         *val = (irq & TOPI_IID_MASK) << TOPI_IID_SHIFT;
1945         *val |= iprio;
1946     }
1947 
1948     return RISCV_EXCP_NONE;
1949 }
1950 
1951 static int aia_xlate_vs_csrno(CPURISCVState *env, int csrno)
1952 {
1953     if (!env->virt_enabled) {
1954         return csrno;
1955     }
1956 
1957     switch (csrno) {
1958     case CSR_SISELECT:
1959         return CSR_VSISELECT;
1960     case CSR_SIREG:
1961         return CSR_VSIREG;
1962     case CSR_STOPEI:
1963         return CSR_VSTOPEI;
1964     default:
1965         return csrno;
1966     };
1967 }
1968 
1969 static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
1970                                    target_ulong *val, target_ulong new_val,
1971                                    target_ulong wr_mask)
1972 {
1973     target_ulong *iselect;
1974 
1975     /* Translate CSR number for VS-mode */
1976     csrno = aia_xlate_vs_csrno(env, csrno);
1977 
1978     /* Find the iselect CSR based on CSR number */
1979     switch (csrno) {
1980     case CSR_MISELECT:
1981         iselect = &env->miselect;
1982         break;
1983     case CSR_SISELECT:
1984         iselect = &env->siselect;
1985         break;
1986     case CSR_VSISELECT:
1987         iselect = &env->vsiselect;
1988         break;
1989     default:
1990          return RISCV_EXCP_ILLEGAL_INST;
1991     };
1992 
1993     if (val) {
1994         *val = *iselect;
1995     }
1996 
1997     wr_mask &= ISELECT_MASK;
1998     if (wr_mask) {
1999         *iselect = (*iselect & ~wr_mask) | (new_val & wr_mask);
2000     }
2001 
2002     return RISCV_EXCP_NONE;
2003 }
2004 
2005 static int rmw_iprio(target_ulong xlen,
2006                      target_ulong iselect, uint8_t *iprio,
2007                      target_ulong *val, target_ulong new_val,
2008                      target_ulong wr_mask, int ext_irq_no)
2009 {
2010     int i, firq, nirqs;
2011     target_ulong old_val;
2012 
2013     if (iselect < ISELECT_IPRIO0 || ISELECT_IPRIO15 < iselect) {
2014         return -EINVAL;
2015     }
2016     if (xlen != 32 && iselect & 0x1) {
2017         return -EINVAL;
2018     }
2019 
2020     nirqs = 4 * (xlen / 32);
2021     firq = ((iselect - ISELECT_IPRIO0) / (xlen / 32)) * (nirqs);
2022 
2023     old_val = 0;
2024     for (i = 0; i < nirqs; i++) {
2025         old_val |= ((target_ulong)iprio[firq + i]) << (IPRIO_IRQ_BITS * i);
2026     }
2027 
2028     if (val) {
2029         *val = old_val;
2030     }
2031 
2032     if (wr_mask) {
2033         new_val = (old_val & ~wr_mask) | (new_val & wr_mask);
2034         for (i = 0; i < nirqs; i++) {
2035             /*
2036              * M-level and S-level external IRQ priority always read-only
2037              * zero. This means default priority order is always preferred
2038              * for M-level and S-level external IRQs.
2039              */
2040             if ((firq + i) == ext_irq_no) {
2041                 continue;
2042             }
2043             iprio[firq + i] = (new_val >> (IPRIO_IRQ_BITS * i)) & 0xff;
2044         }
2045     }
2046 
2047     return 0;
2048 }
2049 
2050 static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
2051                                 target_ulong *val, target_ulong new_val,
2052                                 target_ulong wr_mask)
2053 {
2054     bool virt, isel_reserved;
2055     uint8_t *iprio;
2056     int ret = -EINVAL;
2057     target_ulong priv, isel, vgein;
2058 
2059     /* Translate CSR number for VS-mode */
2060     csrno = aia_xlate_vs_csrno(env, csrno);
2061 
2062     /* Decode register details from CSR number */
2063     virt = false;
2064     isel_reserved = false;
2065     switch (csrno) {
2066     case CSR_MIREG:
2067         iprio = env->miprio;
2068         isel = env->miselect;
2069         priv = PRV_M;
2070         break;
2071     case CSR_SIREG:
2072         if (env->priv == PRV_S && env->mvien & MIP_SEIP &&
2073             env->siselect >= ISELECT_IMSIC_EIDELIVERY &&
2074             env->siselect <= ISELECT_IMSIC_EIE63) {
2075             goto done;
2076         }
2077         iprio = env->siprio;
2078         isel = env->siselect;
2079         priv = PRV_S;
2080         break;
2081     case CSR_VSIREG:
2082         iprio = env->hviprio;
2083         isel = env->vsiselect;
2084         priv = PRV_S;
2085         virt = true;
2086         break;
2087     default:
2088          goto done;
2089     };
2090 
2091     /* Find the selected guest interrupt file */
2092     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
2093 
2094     if (ISELECT_IPRIO0 <= isel && isel <= ISELECT_IPRIO15) {
2095         /* Local interrupt priority registers not available for VS-mode */
2096         if (!virt) {
2097             ret = rmw_iprio(riscv_cpu_mxl_bits(env),
2098                             isel, iprio, val, new_val, wr_mask,
2099                             (priv == PRV_M) ? IRQ_M_EXT : IRQ_S_EXT);
2100         }
2101     } else if (ISELECT_IMSIC_FIRST <= isel && isel <= ISELECT_IMSIC_LAST) {
2102         /* IMSIC registers only available when machine implements it. */
2103         if (env->aia_ireg_rmw_fn[priv]) {
2104             /* Selected guest interrupt file should not be zero */
2105             if (virt && (!vgein || env->geilen < vgein)) {
2106                 goto done;
2107             }
2108             /* Call machine specific IMSIC register emulation */
2109             ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
2110                                     AIA_MAKE_IREG(isel, priv, virt, vgein,
2111                                                   riscv_cpu_mxl_bits(env)),
2112                                     val, new_val, wr_mask);
2113         }
2114     } else {
2115         isel_reserved = true;
2116     }
2117 
2118 done:
2119     if (ret) {
2120         return (env->virt_enabled && virt && !isel_reserved) ?
2121                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
2122     }
2123     return RISCV_EXCP_NONE;
2124 }
2125 
2126 static RISCVException rmw_xtopei(CPURISCVState *env, int csrno,
2127                                  target_ulong *val, target_ulong new_val,
2128                                  target_ulong wr_mask)
2129 {
2130     bool virt;
2131     int ret = -EINVAL;
2132     target_ulong priv, vgein;
2133 
2134     /* Translate CSR number for VS-mode */
2135     csrno = aia_xlate_vs_csrno(env, csrno);
2136 
2137     /* Decode register details from CSR number */
2138     virt = false;
2139     switch (csrno) {
2140     case CSR_MTOPEI:
2141         priv = PRV_M;
2142         break;
2143     case CSR_STOPEI:
2144         if (env->mvien & MIP_SEIP && env->priv == PRV_S) {
2145             goto done;
2146         }
2147         priv = PRV_S;
2148         break;
2149     case CSR_VSTOPEI:
2150         priv = PRV_S;
2151         virt = true;
2152         break;
2153     default:
2154         goto done;
2155     };
2156 
2157     /* IMSIC CSRs only available when machine implements IMSIC. */
2158     if (!env->aia_ireg_rmw_fn[priv]) {
2159         goto done;
2160     }
2161 
2162     /* Find the selected guest interrupt file */
2163     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
2164 
2165     /* Selected guest interrupt file should be valid */
2166     if (virt && (!vgein || env->geilen < vgein)) {
2167         goto done;
2168     }
2169 
2170     /* Call machine specific IMSIC register emulation for TOPEI */
2171     ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
2172                     AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, priv, virt, vgein,
2173                                   riscv_cpu_mxl_bits(env)),
2174                     val, new_val, wr_mask);
2175 
2176 done:
2177     if (ret) {
2178         return (env->virt_enabled && virt) ?
2179                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
2180     }
2181     return RISCV_EXCP_NONE;
2182 }
2183 
2184 static RISCVException read_mtvec(CPURISCVState *env, int csrno,
2185                                  target_ulong *val)
2186 {
2187     *val = env->mtvec;
2188     return RISCV_EXCP_NONE;
2189 }
2190 
2191 static RISCVException write_mtvec(CPURISCVState *env, int csrno,
2192                                   target_ulong val)
2193 {
2194     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
2195     if ((val & 3) < 2) {
2196         env->mtvec = val;
2197     } else {
2198         qemu_log_mask(LOG_UNIMP, "CSR_MTVEC: reserved mode not supported\n");
2199     }
2200     return RISCV_EXCP_NONE;
2201 }
2202 
2203 static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
2204                                          target_ulong *val)
2205 {
2206     *val = env->mcountinhibit;
2207     return RISCV_EXCP_NONE;
2208 }
2209 
2210 static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
2211                                           target_ulong val)
2212 {
2213     int cidx;
2214     PMUCTRState *counter;
2215     RISCVCPU *cpu = env_archcpu(env);
2216     uint32_t present_ctrs = cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR;
2217     target_ulong updated_ctrs = (env->mcountinhibit ^ val) & present_ctrs;
2218     uint64_t mhpmctr_val, prev_count, curr_count;
2219 
2220     /* WARL register - disable unavailable counters; TM bit is always 0 */
2221     env->mcountinhibit = val & present_ctrs;
2222 
2223     /* Check if any other counter is also monitoring cycles/instructions */
2224     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
2225         if (!(updated_ctrs & BIT(cidx)) ||
2226             (!riscv_pmu_ctr_monitor_cycles(env, cidx) &&
2227             !riscv_pmu_ctr_monitor_instructions(env, cidx))) {
2228             continue;
2229         }
2230 
2231         counter = &env->pmu_ctrs[cidx];
2232 
2233         if (!get_field(env->mcountinhibit, BIT(cidx))) {
2234             counter->mhpmcounter_prev =
2235                 riscv_pmu_ctr_get_fixed_counters_val(env, cidx, false);
2236             if (riscv_cpu_mxl(env) == MXL_RV32) {
2237                 counter->mhpmcounterh_prev =
2238                     riscv_pmu_ctr_get_fixed_counters_val(env, cidx, true);
2239             }
2240 
2241             if (cidx > 2) {
2242                 mhpmctr_val = counter->mhpmcounter_val;
2243                 if (riscv_cpu_mxl(env) == MXL_RV32) {
2244                     mhpmctr_val = mhpmctr_val |
2245                             ((uint64_t)counter->mhpmcounterh_val << 32);
2246                 }
2247                 riscv_pmu_setup_timer(env, mhpmctr_val, cidx);
2248             }
2249         } else {
2250             curr_count = riscv_pmu_ctr_get_fixed_counters_val(env, cidx, false);
2251 
2252             mhpmctr_val = counter->mhpmcounter_val;
2253             prev_count = counter->mhpmcounter_prev;
2254             if (riscv_cpu_mxl(env) == MXL_RV32) {
2255                 uint64_t tmp =
2256                     riscv_pmu_ctr_get_fixed_counters_val(env, cidx, true);
2257 
2258                 curr_count = curr_count | (tmp << 32);
2259                 mhpmctr_val = mhpmctr_val |
2260                     ((uint64_t)counter->mhpmcounterh_val << 32);
2261                 prev_count = prev_count |
2262                     ((uint64_t)counter->mhpmcounterh_prev << 32);
2263             }
2264 
2265             /* Adjust the counter for later reads. */
2266             mhpmctr_val = curr_count - prev_count + mhpmctr_val;
2267             counter->mhpmcounter_val = mhpmctr_val;
2268             if (riscv_cpu_mxl(env) == MXL_RV32) {
2269                 counter->mhpmcounterh_val = mhpmctr_val >> 32;
2270             }
2271         }
2272     }
2273 
2274     return RISCV_EXCP_NONE;
2275 }
2276 
2277 static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
2278                                       target_ulong *val)
2279 {
2280     *val = env->mcounteren;
2281     return RISCV_EXCP_NONE;
2282 }
2283 
2284 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
2285                                        target_ulong val)
2286 {
2287     RISCVCPU *cpu = env_archcpu(env);
2288 
2289     /* WARL register - disable unavailable counters */
2290     env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
2291                              COUNTEREN_IR);
2292     return RISCV_EXCP_NONE;
2293 }
2294 
2295 /* Machine Trap Handling */
2296 static RISCVException read_mscratch_i128(CPURISCVState *env, int csrno,
2297                                          Int128 *val)
2298 {
2299     *val = int128_make128(env->mscratch, env->mscratchh);
2300     return RISCV_EXCP_NONE;
2301 }
2302 
2303 static RISCVException write_mscratch_i128(CPURISCVState *env, int csrno,
2304                                           Int128 val)
2305 {
2306     env->mscratch = int128_getlo(val);
2307     env->mscratchh = int128_gethi(val);
2308     return RISCV_EXCP_NONE;
2309 }
2310 
2311 static RISCVException read_mscratch(CPURISCVState *env, int csrno,
2312                                     target_ulong *val)
2313 {
2314     *val = env->mscratch;
2315     return RISCV_EXCP_NONE;
2316 }
2317 
2318 static RISCVException write_mscratch(CPURISCVState *env, int csrno,
2319                                      target_ulong val)
2320 {
2321     env->mscratch = val;
2322     return RISCV_EXCP_NONE;
2323 }
2324 
2325 static RISCVException read_mepc(CPURISCVState *env, int csrno,
2326                                 target_ulong *val)
2327 {
2328     *val = env->mepc;
2329     return RISCV_EXCP_NONE;
2330 }
2331 
2332 static RISCVException write_mepc(CPURISCVState *env, int csrno,
2333                                  target_ulong val)
2334 {
2335     env->mepc = val;
2336     return RISCV_EXCP_NONE;
2337 }
2338 
2339 static RISCVException read_mcause(CPURISCVState *env, int csrno,
2340                                   target_ulong *val)
2341 {
2342     *val = env->mcause;
2343     return RISCV_EXCP_NONE;
2344 }
2345 
2346 static RISCVException write_mcause(CPURISCVState *env, int csrno,
2347                                    target_ulong val)
2348 {
2349     env->mcause = val;
2350     return RISCV_EXCP_NONE;
2351 }
2352 
2353 static RISCVException read_mtval(CPURISCVState *env, int csrno,
2354                                  target_ulong *val)
2355 {
2356     *val = env->mtval;
2357     return RISCV_EXCP_NONE;
2358 }
2359 
2360 static RISCVException write_mtval(CPURISCVState *env, int csrno,
2361                                   target_ulong val)
2362 {
2363     env->mtval = val;
2364     return RISCV_EXCP_NONE;
2365 }
2366 
2367 /* Execution environment configuration setup */
2368 static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
2369                                    target_ulong *val)
2370 {
2371     *val = env->menvcfg;
2372     return RISCV_EXCP_NONE;
2373 }
2374 
2375 static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
2376                                     target_ulong val)
2377 {
2378     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
2379     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE | MENVCFG_CBZE;
2380 
2381     if (riscv_cpu_mxl(env) == MXL_RV64) {
2382         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
2383                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
2384                 (cfg->ext_svadu ? MENVCFG_ADUE : 0);
2385 
2386         if (env_archcpu(env)->cfg.ext_zicfilp) {
2387             mask |= MENVCFG_LPE;
2388         }
2389 
2390         if (env_archcpu(env)->cfg.ext_zicfiss) {
2391             mask |= MENVCFG_SSE;
2392         }
2393     }
2394     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
2395 
2396     return RISCV_EXCP_NONE;
2397 }
2398 
2399 static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
2400                                     target_ulong *val)
2401 {
2402     *val = env->menvcfg >> 32;
2403     return RISCV_EXCP_NONE;
2404 }
2405 
2406 static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
2407                                      target_ulong val)
2408 {
2409     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
2410     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
2411                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
2412                     (cfg->ext_svadu ? MENVCFG_ADUE : 0);
2413     uint64_t valh = (uint64_t)val << 32;
2414 
2415     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
2416 
2417     return RISCV_EXCP_NONE;
2418 }
2419 
2420 static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
2421                                    target_ulong *val)
2422 {
2423     RISCVException ret;
2424 
2425     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2426     if (ret != RISCV_EXCP_NONE) {
2427         return ret;
2428     }
2429 
2430     *val = env->senvcfg;
2431     return RISCV_EXCP_NONE;
2432 }
2433 
2434 static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
2435                                     target_ulong val)
2436 {
2437     uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
2438     RISCVException ret;
2439 
2440     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2441     if (ret != RISCV_EXCP_NONE) {
2442         return ret;
2443     }
2444 
2445     if (env_archcpu(env)->cfg.ext_zicfilp) {
2446         mask |= SENVCFG_LPE;
2447     }
2448 
2449     /* Higher mode SSE must be ON for next-less mode SSE to be ON */
2450     if (env_archcpu(env)->cfg.ext_zicfiss &&
2451         get_field(env->menvcfg, MENVCFG_SSE) &&
2452         (env->virt_enabled ? get_field(env->henvcfg, HENVCFG_SSE) : true)) {
2453         mask |= SENVCFG_SSE;
2454     }
2455 
2456     if (env_archcpu(env)->cfg.ext_svukte) {
2457         mask |= SENVCFG_UKTE;
2458     }
2459 
2460     env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
2461     return RISCV_EXCP_NONE;
2462 }
2463 
2464 static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
2465                                    target_ulong *val)
2466 {
2467     RISCVException ret;
2468 
2469     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2470     if (ret != RISCV_EXCP_NONE) {
2471         return ret;
2472     }
2473 
2474     /*
2475      * henvcfg.pbmte is read_only 0 when menvcfg.pbmte = 0
2476      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
2477      * henvcfg.adue is read_only 0 when menvcfg.adue = 0
2478      */
2479     *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
2480                            env->menvcfg);
2481     return RISCV_EXCP_NONE;
2482 }
2483 
2484 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
2485                                     target_ulong val)
2486 {
2487     uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
2488     RISCVException ret;
2489 
2490     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2491     if (ret != RISCV_EXCP_NONE) {
2492         return ret;
2493     }
2494 
2495     if (riscv_cpu_mxl(env) == MXL_RV64) {
2496         mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
2497 
2498         if (env_archcpu(env)->cfg.ext_zicfilp) {
2499             mask |= HENVCFG_LPE;
2500         }
2501 
2502         /* H can light up SSE for VS only if HS had it from menvcfg */
2503         if (env_archcpu(env)->cfg.ext_zicfiss &&
2504             get_field(env->menvcfg, MENVCFG_SSE)) {
2505             mask |= HENVCFG_SSE;
2506         }
2507     }
2508 
2509     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
2510 
2511     return RISCV_EXCP_NONE;
2512 }
2513 
2514 static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
2515                                     target_ulong *val)
2516 {
2517     RISCVException ret;
2518 
2519     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2520     if (ret != RISCV_EXCP_NONE) {
2521         return ret;
2522     }
2523 
2524     *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
2525                             env->menvcfg)) >> 32;
2526     return RISCV_EXCP_NONE;
2527 }
2528 
2529 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
2530                                      target_ulong val)
2531 {
2532     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
2533                                     HENVCFG_ADUE);
2534     uint64_t valh = (uint64_t)val << 32;
2535     RISCVException ret;
2536 
2537     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2538     if (ret != RISCV_EXCP_NONE) {
2539         return ret;
2540     }
2541 
2542     env->henvcfg = (env->henvcfg & ~mask) | (valh & mask);
2543     return RISCV_EXCP_NONE;
2544 }
2545 
2546 static RISCVException read_mstateen(CPURISCVState *env, int csrno,
2547                                     target_ulong *val)
2548 {
2549     *val = env->mstateen[csrno - CSR_MSTATEEN0];
2550 
2551     return RISCV_EXCP_NONE;
2552 }
2553 
2554 static RISCVException write_mstateen(CPURISCVState *env, int csrno,
2555                                      uint64_t wr_mask, target_ulong new_val)
2556 {
2557     uint64_t *reg;
2558 
2559     reg = &env->mstateen[csrno - CSR_MSTATEEN0];
2560     *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
2561 
2562     return RISCV_EXCP_NONE;
2563 }
2564 
2565 static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
2566                                       target_ulong new_val)
2567 {
2568     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2569     if (!riscv_has_ext(env, RVF)) {
2570         wr_mask |= SMSTATEEN0_FCSR;
2571     }
2572 
2573     if (env->priv_ver >= PRIV_VERSION_1_13_0) {
2574         wr_mask |= SMSTATEEN0_P1P13;
2575     }
2576 
2577     return write_mstateen(env, csrno, wr_mask, new_val);
2578 }
2579 
2580 static RISCVException write_mstateen_1_3(CPURISCVState *env, int csrno,
2581                                          target_ulong new_val)
2582 {
2583     return write_mstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
2584 }
2585 
2586 static RISCVException read_mstateenh(CPURISCVState *env, int csrno,
2587                                      target_ulong *val)
2588 {
2589     *val = env->mstateen[csrno - CSR_MSTATEEN0H] >> 32;
2590 
2591     return RISCV_EXCP_NONE;
2592 }
2593 
2594 static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
2595                                       uint64_t wr_mask, target_ulong new_val)
2596 {
2597     uint64_t *reg, val;
2598 
2599     reg = &env->mstateen[csrno - CSR_MSTATEEN0H];
2600     val = (uint64_t)new_val << 32;
2601     val |= *reg & 0xFFFFFFFF;
2602     *reg = (*reg & ~wr_mask) | (val & wr_mask);
2603 
2604     return RISCV_EXCP_NONE;
2605 }
2606 
2607 static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
2608                                        target_ulong new_val)
2609 {
2610     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2611 
2612     if (env->priv_ver >= PRIV_VERSION_1_13_0) {
2613         wr_mask |= SMSTATEEN0_P1P13;
2614     }
2615 
2616     return write_mstateenh(env, csrno, wr_mask, new_val);
2617 }
2618 
2619 static RISCVException write_mstateenh_1_3(CPURISCVState *env, int csrno,
2620                                           target_ulong new_val)
2621 {
2622     return write_mstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
2623 }
2624 
2625 static RISCVException read_hstateen(CPURISCVState *env, int csrno,
2626                                     target_ulong *val)
2627 {
2628     int index = csrno - CSR_HSTATEEN0;
2629 
2630     *val = env->hstateen[index] & env->mstateen[index];
2631 
2632     return RISCV_EXCP_NONE;
2633 }
2634 
2635 static RISCVException write_hstateen(CPURISCVState *env, int csrno,
2636                                      uint64_t mask, target_ulong new_val)
2637 {
2638     int index = csrno - CSR_HSTATEEN0;
2639     uint64_t *reg, wr_mask;
2640 
2641     reg = &env->hstateen[index];
2642     wr_mask = env->mstateen[index] & mask;
2643     *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
2644 
2645     return RISCV_EXCP_NONE;
2646 }
2647 
2648 static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
2649                                       target_ulong new_val)
2650 {
2651     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2652 
2653     if (!riscv_has_ext(env, RVF)) {
2654         wr_mask |= SMSTATEEN0_FCSR;
2655     }
2656 
2657     return write_hstateen(env, csrno, wr_mask, new_val);
2658 }
2659 
2660 static RISCVException write_hstateen_1_3(CPURISCVState *env, int csrno,
2661                                          target_ulong new_val)
2662 {
2663     return write_hstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
2664 }
2665 
2666 static RISCVException read_hstateenh(CPURISCVState *env, int csrno,
2667                                      target_ulong *val)
2668 {
2669     int index = csrno - CSR_HSTATEEN0H;
2670 
2671     *val = (env->hstateen[index] >> 32) & (env->mstateen[index] >> 32);
2672 
2673     return RISCV_EXCP_NONE;
2674 }
2675 
2676 static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
2677                                       uint64_t mask, target_ulong new_val)
2678 {
2679     int index = csrno - CSR_HSTATEEN0H;
2680     uint64_t *reg, wr_mask, val;
2681 
2682     reg = &env->hstateen[index];
2683     val = (uint64_t)new_val << 32;
2684     val |= *reg & 0xFFFFFFFF;
2685     wr_mask = env->mstateen[index] & mask;
2686     *reg = (*reg & ~wr_mask) | (val & wr_mask);
2687 
2688     return RISCV_EXCP_NONE;
2689 }
2690 
2691 static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
2692                                        target_ulong new_val)
2693 {
2694     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2695 
2696     return write_hstateenh(env, csrno, wr_mask, new_val);
2697 }
2698 
2699 static RISCVException write_hstateenh_1_3(CPURISCVState *env, int csrno,
2700                                           target_ulong new_val)
2701 {
2702     return write_hstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
2703 }
2704 
2705 static RISCVException read_sstateen(CPURISCVState *env, int csrno,
2706                                     target_ulong *val)
2707 {
2708     bool virt = env->virt_enabled;
2709     int index = csrno - CSR_SSTATEEN0;
2710 
2711     *val = env->sstateen[index] & env->mstateen[index];
2712     if (virt) {
2713         *val &= env->hstateen[index];
2714     }
2715 
2716     return RISCV_EXCP_NONE;
2717 }
2718 
2719 static RISCVException write_sstateen(CPURISCVState *env, int csrno,
2720                                      uint64_t mask, target_ulong new_val)
2721 {
2722     bool virt = env->virt_enabled;
2723     int index = csrno - CSR_SSTATEEN0;
2724     uint64_t wr_mask;
2725     uint64_t *reg;
2726 
2727     wr_mask = env->mstateen[index] & mask;
2728     if (virt) {
2729         wr_mask &= env->hstateen[index];
2730     }
2731 
2732     reg = &env->sstateen[index];
2733     *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
2734 
2735     return RISCV_EXCP_NONE;
2736 }
2737 
2738 static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
2739                                       target_ulong new_val)
2740 {
2741     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2742 
2743     if (!riscv_has_ext(env, RVF)) {
2744         wr_mask |= SMSTATEEN0_FCSR;
2745     }
2746 
2747     return write_sstateen(env, csrno, wr_mask, new_val);
2748 }
2749 
2750 static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
2751                                       target_ulong new_val)
2752 {
2753     return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
2754 }
2755 
2756 static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
2757                                 uint64_t *ret_val,
2758                                 uint64_t new_val, uint64_t wr_mask)
2759 {
2760     uint64_t old_mip, mask = wr_mask & delegable_ints;
2761     uint32_t gin;
2762 
2763     if (mask & MIP_SEIP) {
2764         env->software_seip = new_val & MIP_SEIP;
2765         new_val |= env->external_seip * MIP_SEIP;
2766     }
2767 
2768     if (riscv_cpu_cfg(env)->ext_sstc && (env->priv == PRV_M) &&
2769         get_field(env->menvcfg, MENVCFG_STCE)) {
2770         /* sstc extension forbids STIP & VSTIP to be writeable in mip */
2771         mask = mask & ~(MIP_STIP | MIP_VSTIP);
2772     }
2773 
2774     if (mask) {
2775         old_mip = riscv_cpu_update_mip(env, mask, (new_val & mask));
2776     } else {
2777         old_mip = env->mip;
2778     }
2779 
2780     if (csrno != CSR_HVIP) {
2781         gin = get_field(env->hstatus, HSTATUS_VGEIN);
2782         old_mip |= (env->hgeip & ((target_ulong)1 << gin)) ? MIP_VSEIP : 0;
2783         old_mip |= env->vstime_irq ? MIP_VSTIP : 0;
2784     }
2785 
2786     if (ret_val) {
2787         *ret_val = old_mip;
2788     }
2789 
2790     return RISCV_EXCP_NONE;
2791 }
2792 
2793 static RISCVException rmw_mip(CPURISCVState *env, int csrno,
2794                               target_ulong *ret_val,
2795                               target_ulong new_val, target_ulong wr_mask)
2796 {
2797     uint64_t rval;
2798     RISCVException ret;
2799 
2800     ret = rmw_mip64(env, csrno, &rval, new_val, wr_mask);
2801     if (ret_val) {
2802         *ret_val = rval;
2803     }
2804 
2805     return ret;
2806 }
2807 
2808 static RISCVException rmw_miph(CPURISCVState *env, int csrno,
2809                                target_ulong *ret_val,
2810                                target_ulong new_val, target_ulong wr_mask)
2811 {
2812     uint64_t rval;
2813     RISCVException ret;
2814 
2815     ret = rmw_mip64(env, csrno, &rval,
2816         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2817     if (ret_val) {
2818         *ret_val = rval >> 32;
2819     }
2820 
2821     return ret;
2822 }
2823 
2824 /*
2825  * The function is written for two use-cases:
2826  * 1- To access mvip csr as is for m-mode access.
2827  * 2- To access sip as a combination of mip and mvip for s-mode.
2828  *
2829  * Both report bits 1, 5, 9 and 13:63 but with the exception of
2830  * STIP being read-only zero in case of mvip when sstc extension
2831  * is present.
2832  * Also, sip needs to be read-only zero when both mideleg[i] and
2833  * mvien[i] are zero but mvip needs to be an alias of mip.
2834  */
2835 static RISCVException rmw_mvip64(CPURISCVState *env, int csrno,
2836                                 uint64_t *ret_val,
2837                                 uint64_t new_val, uint64_t wr_mask)
2838 {
2839     RISCVCPU *cpu = env_archcpu(env);
2840     target_ulong ret_mip = 0;
2841     RISCVException ret;
2842     uint64_t old_mvip;
2843 
2844     /*
2845      * mideleg[i]  mvien[i]
2846      *   0           0      No delegation. mvip[i] is alias of mip[i].
2847      *   0           1      mvip[i] becomes source of interrupt, mip bypassed.
2848      *   1           X      mip[i] is source of interrupt and mvip[i] aliases
2849      *                      mip[i].
2850      *
2851      *   So alias condition would be for bits:
2852      *      ((S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & (mideleg | ~mvien)) |
2853      *          (!sstc & MIP_STIP)
2854      *
2855      *   Non-alias condition will be for bits:
2856      *      (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & (~mideleg & mvien)
2857      *
2858      *  alias_mask denotes the bits that come from mip nalias_mask denotes bits
2859      *  that come from hvip.
2860      */
2861     uint64_t alias_mask = ((S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) &
2862         (env->mideleg | ~env->mvien)) | MIP_STIP;
2863     uint64_t nalias_mask = (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) &
2864         (~env->mideleg & env->mvien);
2865     uint64_t wr_mask_mvip;
2866     uint64_t wr_mask_mip;
2867 
2868     /*
2869      * mideleg[i]  mvien[i]
2870      *   0           0      sip[i] read-only zero.
2871      *   0           1      sip[i] alias of mvip[i].
2872      *   1           X      sip[i] alias of mip[i].
2873      *
2874      *  Both alias and non-alias mask remain same for sip except for bits
2875      *  which are zero in both mideleg and mvien.
2876      */
2877     if (csrno == CSR_SIP) {
2878         /* Remove bits that are zero in both mideleg and mvien. */
2879         alias_mask &= (env->mideleg | env->mvien);
2880         nalias_mask &= (env->mideleg | env->mvien);
2881     }
2882 
2883     /*
2884      * If sstc is present, mvip.STIP is not an alias of mip.STIP so clear
2885      * that our in mip returned value.
2886      */
2887     if (cpu->cfg.ext_sstc && (env->priv == PRV_M) &&
2888         get_field(env->menvcfg, MENVCFG_STCE)) {
2889         alias_mask &= ~MIP_STIP;
2890     }
2891 
2892     wr_mask_mip = wr_mask & alias_mask & mvip_writable_mask;
2893     wr_mask_mvip = wr_mask & nalias_mask & mvip_writable_mask;
2894 
2895     /*
2896      * For bits set in alias_mask, mvip needs to be alias of mip, so forward
2897      * this to rmw_mip.
2898      */
2899     ret = rmw_mip(env, CSR_MIP, &ret_mip, new_val, wr_mask_mip);
2900     if (ret != RISCV_EXCP_NONE) {
2901         return ret;
2902     }
2903 
2904     old_mvip = env->mvip;
2905 
2906     /*
2907      * Write to mvip. Update only non-alias bits. Alias bits were updated
2908      * in mip in rmw_mip above.
2909      */
2910     if (wr_mask_mvip) {
2911         env->mvip = (env->mvip & ~wr_mask_mvip) | (new_val & wr_mask_mvip);
2912 
2913         /*
2914          * Given mvip is separate source from mip, we need to trigger interrupt
2915          * from here separately. Normally this happen from riscv_cpu_update_mip.
2916          */
2917         riscv_cpu_interrupt(env);
2918     }
2919 
2920     if (ret_val) {
2921         ret_mip &= alias_mask;
2922         old_mvip &= nalias_mask;
2923 
2924         *ret_val = old_mvip | ret_mip;
2925     }
2926 
2927     return RISCV_EXCP_NONE;
2928 }
2929 
2930 static RISCVException rmw_mvip(CPURISCVState *env, int csrno,
2931                               target_ulong *ret_val,
2932                               target_ulong new_val, target_ulong wr_mask)
2933 {
2934     uint64_t rval;
2935     RISCVException ret;
2936 
2937     ret = rmw_mvip64(env, csrno, &rval, new_val, wr_mask);
2938     if (ret_val) {
2939         *ret_val = rval;
2940     }
2941 
2942     return ret;
2943 }
2944 
2945 static RISCVException rmw_mviph(CPURISCVState *env, int csrno,
2946                                target_ulong *ret_val,
2947                                target_ulong new_val, target_ulong wr_mask)
2948 {
2949     uint64_t rval;
2950     RISCVException ret;
2951 
2952     ret = rmw_mvip64(env, csrno, &rval,
2953         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2954     if (ret_val) {
2955         *ret_val = rval >> 32;
2956     }
2957 
2958     return ret;
2959 }
2960 
2961 /* Supervisor Trap Setup */
2962 static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
2963                                         Int128 *val)
2964 {
2965     uint64_t mask = sstatus_v1_10_mask;
2966     uint64_t sstatus = env->mstatus & mask;
2967     if (env->xl != MXL_RV32 || env->debugger) {
2968         mask |= SSTATUS64_UXL;
2969     }
2970 
2971     if (env_archcpu(env)->cfg.ext_zicfilp) {
2972         mask |= SSTATUS_SPELP;
2973     }
2974 
2975     *val = int128_make128(sstatus, add_status_sd(MXL_RV128, sstatus));
2976     return RISCV_EXCP_NONE;
2977 }
2978 
2979 static RISCVException read_sstatus(CPURISCVState *env, int csrno,
2980                                    target_ulong *val)
2981 {
2982     target_ulong mask = (sstatus_v1_10_mask);
2983     if (env->xl != MXL_RV32 || env->debugger) {
2984         mask |= SSTATUS64_UXL;
2985     }
2986 
2987     if (env_archcpu(env)->cfg.ext_zicfilp) {
2988         mask |= SSTATUS_SPELP;
2989     }
2990 
2991     /* TODO: Use SXL not MXL. */
2992     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus & mask);
2993     return RISCV_EXCP_NONE;
2994 }
2995 
2996 static RISCVException write_sstatus(CPURISCVState *env, int csrno,
2997                                     target_ulong val)
2998 {
2999     target_ulong mask = (sstatus_v1_10_mask);
3000 
3001     if (env->xl != MXL_RV32 || env->debugger) {
3002         if ((val & SSTATUS64_UXL) != 0) {
3003             mask |= SSTATUS64_UXL;
3004         }
3005     }
3006 
3007     if (env_archcpu(env)->cfg.ext_zicfilp) {
3008         mask |= SSTATUS_SPELP;
3009     }
3010 
3011     target_ulong newval = (env->mstatus & ~mask) | (val & mask);
3012     return write_mstatus(env, CSR_MSTATUS, newval);
3013 }
3014 
3015 static RISCVException rmw_vsie64(CPURISCVState *env, int csrno,
3016                                  uint64_t *ret_val,
3017                                  uint64_t new_val, uint64_t wr_mask)
3018 {
3019     uint64_t alias_mask = (LOCAL_INTERRUPTS | VS_MODE_INTERRUPTS) &
3020                             env->hideleg;
3021     uint64_t nalias_mask = LOCAL_INTERRUPTS & (~env->hideleg & env->hvien);
3022     uint64_t rval, rval_vs, vsbits;
3023     uint64_t wr_mask_vsie;
3024     uint64_t wr_mask_mie;
3025     RISCVException ret;
3026 
3027     /* Bring VS-level bits to correct position */
3028     vsbits = new_val & (VS_MODE_INTERRUPTS >> 1);
3029     new_val &= ~(VS_MODE_INTERRUPTS >> 1);
3030     new_val |= vsbits << 1;
3031 
3032     vsbits = wr_mask & (VS_MODE_INTERRUPTS >> 1);
3033     wr_mask &= ~(VS_MODE_INTERRUPTS >> 1);
3034     wr_mask |= vsbits << 1;
3035 
3036     wr_mask_mie = wr_mask & alias_mask;
3037     wr_mask_vsie = wr_mask & nalias_mask;
3038 
3039     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask_mie);
3040 
3041     rval_vs = env->vsie & nalias_mask;
3042     env->vsie = (env->vsie & ~wr_mask_vsie) | (new_val & wr_mask_vsie);
3043 
3044     if (ret_val) {
3045         rval &= alias_mask;
3046         vsbits = rval & VS_MODE_INTERRUPTS;
3047         rval &= ~VS_MODE_INTERRUPTS;
3048         *ret_val = rval | (vsbits >> 1) | rval_vs;
3049     }
3050 
3051     return ret;
3052 }
3053 
3054 static RISCVException rmw_vsie(CPURISCVState *env, int csrno,
3055                                target_ulong *ret_val,
3056                                target_ulong new_val, target_ulong wr_mask)
3057 {
3058     uint64_t rval;
3059     RISCVException ret;
3060 
3061     ret = rmw_vsie64(env, csrno, &rval, new_val, wr_mask);
3062     if (ret_val) {
3063         *ret_val = rval;
3064     }
3065 
3066     return ret;
3067 }
3068 
3069 static RISCVException rmw_vsieh(CPURISCVState *env, int csrno,
3070                                 target_ulong *ret_val,
3071                                 target_ulong new_val, target_ulong wr_mask)
3072 {
3073     uint64_t rval;
3074     RISCVException ret;
3075 
3076     ret = rmw_vsie64(env, csrno, &rval,
3077         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3078     if (ret_val) {
3079         *ret_val = rval >> 32;
3080     }
3081 
3082     return ret;
3083 }
3084 
3085 static RISCVException rmw_sie64(CPURISCVState *env, int csrno,
3086                                 uint64_t *ret_val,
3087                                 uint64_t new_val, uint64_t wr_mask)
3088 {
3089     uint64_t nalias_mask = (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) &
3090         (~env->mideleg & env->mvien);
3091     uint64_t alias_mask = (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & env->mideleg;
3092     uint64_t sie_mask = wr_mask & nalias_mask;
3093     RISCVException ret;
3094 
3095     /*
3096      * mideleg[i]  mvien[i]
3097      *   0           0      sie[i] read-only zero.
3098      *   0           1      sie[i] is a separate writable bit.
3099      *   1           X      sie[i] alias of mie[i].
3100      *
3101      *  Both alias and non-alias mask remain same for sip except for bits
3102      *  which are zero in both mideleg and mvien.
3103      */
3104     if (env->virt_enabled) {
3105         if (env->hvictl & HVICTL_VTI) {
3106             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
3107         }
3108         ret = rmw_vsie64(env, CSR_VSIE, ret_val, new_val, wr_mask);
3109         if (ret_val) {
3110             *ret_val &= alias_mask;
3111         }
3112     } else {
3113         ret = rmw_mie64(env, csrno, ret_val, new_val, wr_mask & alias_mask);
3114         if (ret_val) {
3115             *ret_val &= alias_mask;
3116             *ret_val |= env->sie & nalias_mask;
3117         }
3118 
3119         env->sie = (env->sie & ~sie_mask) | (new_val & sie_mask);
3120     }
3121 
3122     return ret;
3123 }
3124 
3125 static RISCVException rmw_sie(CPURISCVState *env, int csrno,
3126                               target_ulong *ret_val,
3127                               target_ulong new_val, target_ulong wr_mask)
3128 {
3129     uint64_t rval;
3130     RISCVException ret;
3131 
3132     ret = rmw_sie64(env, csrno, &rval, new_val, wr_mask);
3133     if (ret == RISCV_EXCP_NONE && ret_val) {
3134         *ret_val = rval;
3135     }
3136 
3137     return ret;
3138 }
3139 
3140 static RISCVException rmw_sieh(CPURISCVState *env, int csrno,
3141                                target_ulong *ret_val,
3142                                target_ulong new_val, target_ulong wr_mask)
3143 {
3144     uint64_t rval;
3145     RISCVException ret;
3146 
3147     ret = rmw_sie64(env, csrno, &rval,
3148         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3149     if (ret_val) {
3150         *ret_val = rval >> 32;
3151     }
3152 
3153     return ret;
3154 }
3155 
3156 static RISCVException read_stvec(CPURISCVState *env, int csrno,
3157                                  target_ulong *val)
3158 {
3159     *val = env->stvec;
3160     return RISCV_EXCP_NONE;
3161 }
3162 
3163 static RISCVException write_stvec(CPURISCVState *env, int csrno,
3164                                   target_ulong val)
3165 {
3166     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
3167     if ((val & 3) < 2) {
3168         env->stvec = val;
3169     } else {
3170         qemu_log_mask(LOG_UNIMP, "CSR_STVEC: reserved mode not supported\n");
3171     }
3172     return RISCV_EXCP_NONE;
3173 }
3174 
3175 static RISCVException read_scounteren(CPURISCVState *env, int csrno,
3176                                       target_ulong *val)
3177 {
3178     *val = env->scounteren;
3179     return RISCV_EXCP_NONE;
3180 }
3181 
3182 static RISCVException write_scounteren(CPURISCVState *env, int csrno,
3183                                        target_ulong val)
3184 {
3185     RISCVCPU *cpu = env_archcpu(env);
3186 
3187     /* WARL register - disable unavailable counters */
3188     env->scounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
3189                              COUNTEREN_IR);
3190     return RISCV_EXCP_NONE;
3191 }
3192 
3193 /* Supervisor Trap Handling */
3194 static RISCVException read_sscratch_i128(CPURISCVState *env, int csrno,
3195                                          Int128 *val)
3196 {
3197     *val = int128_make128(env->sscratch, env->sscratchh);
3198     return RISCV_EXCP_NONE;
3199 }
3200 
3201 static RISCVException write_sscratch_i128(CPURISCVState *env, int csrno,
3202                                           Int128 val)
3203 {
3204     env->sscratch = int128_getlo(val);
3205     env->sscratchh = int128_gethi(val);
3206     return RISCV_EXCP_NONE;
3207 }
3208 
3209 static RISCVException read_sscratch(CPURISCVState *env, int csrno,
3210                                     target_ulong *val)
3211 {
3212     *val = env->sscratch;
3213     return RISCV_EXCP_NONE;
3214 }
3215 
3216 static RISCVException write_sscratch(CPURISCVState *env, int csrno,
3217                                      target_ulong val)
3218 {
3219     env->sscratch = val;
3220     return RISCV_EXCP_NONE;
3221 }
3222 
3223 static RISCVException read_sepc(CPURISCVState *env, int csrno,
3224                                 target_ulong *val)
3225 {
3226     *val = env->sepc;
3227     return RISCV_EXCP_NONE;
3228 }
3229 
3230 static RISCVException write_sepc(CPURISCVState *env, int csrno,
3231                                  target_ulong val)
3232 {
3233     env->sepc = val;
3234     return RISCV_EXCP_NONE;
3235 }
3236 
3237 static RISCVException read_scause(CPURISCVState *env, int csrno,
3238                                   target_ulong *val)
3239 {
3240     *val = env->scause;
3241     return RISCV_EXCP_NONE;
3242 }
3243 
3244 static RISCVException write_scause(CPURISCVState *env, int csrno,
3245                                    target_ulong val)
3246 {
3247     env->scause = val;
3248     return RISCV_EXCP_NONE;
3249 }
3250 
3251 static RISCVException read_stval(CPURISCVState *env, int csrno,
3252                                  target_ulong *val)
3253 {
3254     *val = env->stval;
3255     return RISCV_EXCP_NONE;
3256 }
3257 
3258 static RISCVException write_stval(CPURISCVState *env, int csrno,
3259                                   target_ulong val)
3260 {
3261     env->stval = val;
3262     return RISCV_EXCP_NONE;
3263 }
3264 
3265 static RISCVException rmw_hvip64(CPURISCVState *env, int csrno,
3266                                  uint64_t *ret_val,
3267                                  uint64_t new_val, uint64_t wr_mask);
3268 
3269 static RISCVException rmw_vsip64(CPURISCVState *env, int csrno,
3270                                  uint64_t *ret_val,
3271                                  uint64_t new_val, uint64_t wr_mask)
3272 {
3273     RISCVException ret;
3274     uint64_t rval, mask = env->hideleg & VS_MODE_INTERRUPTS;
3275     uint64_t vsbits;
3276 
3277     /* Add virtualized bits into vsip mask. */
3278     mask |= env->hvien & ~env->hideleg;
3279 
3280     /* Bring VS-level bits to correct position */
3281     vsbits = new_val & (VS_MODE_INTERRUPTS >> 1);
3282     new_val &= ~(VS_MODE_INTERRUPTS >> 1);
3283     new_val |= vsbits << 1;
3284     vsbits = wr_mask & (VS_MODE_INTERRUPTS >> 1);
3285     wr_mask &= ~(VS_MODE_INTERRUPTS >> 1);
3286     wr_mask |= vsbits << 1;
3287 
3288     ret = rmw_hvip64(env, csrno, &rval, new_val,
3289                      wr_mask & mask & vsip_writable_mask);
3290     if (ret_val) {
3291         rval &= mask;
3292         vsbits = rval & VS_MODE_INTERRUPTS;
3293         rval &= ~VS_MODE_INTERRUPTS;
3294         *ret_val = rval | (vsbits >> 1);
3295     }
3296 
3297     return ret;
3298 }
3299 
3300 static RISCVException rmw_vsip(CPURISCVState *env, int csrno,
3301                                target_ulong *ret_val,
3302                                target_ulong new_val, target_ulong wr_mask)
3303 {
3304     uint64_t rval;
3305     RISCVException ret;
3306 
3307     ret = rmw_vsip64(env, csrno, &rval, new_val, wr_mask);
3308     if (ret_val) {
3309         *ret_val = rval;
3310     }
3311 
3312     return ret;
3313 }
3314 
3315 static RISCVException rmw_vsiph(CPURISCVState *env, int csrno,
3316                                 target_ulong *ret_val,
3317                                 target_ulong new_val, target_ulong wr_mask)
3318 {
3319     uint64_t rval;
3320     RISCVException ret;
3321 
3322     ret = rmw_vsip64(env, csrno, &rval,
3323         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3324     if (ret_val) {
3325         *ret_val = rval >> 32;
3326     }
3327 
3328     return ret;
3329 }
3330 
3331 static RISCVException rmw_sip64(CPURISCVState *env, int csrno,
3332                                 uint64_t *ret_val,
3333                                 uint64_t new_val, uint64_t wr_mask)
3334 {
3335     RISCVException ret;
3336     uint64_t mask = (env->mideleg | env->mvien) & sip_writable_mask;
3337 
3338     if (env->virt_enabled) {
3339         if (env->hvictl & HVICTL_VTI) {
3340             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
3341         }
3342         ret = rmw_vsip64(env, CSR_VSIP, ret_val, new_val, wr_mask);
3343     } else {
3344         ret = rmw_mvip64(env, csrno, ret_val, new_val, wr_mask & mask);
3345     }
3346 
3347     if (ret_val) {
3348         *ret_val &= (env->mideleg | env->mvien) &
3349             (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS);
3350     }
3351 
3352     return ret;
3353 }
3354 
3355 static RISCVException rmw_sip(CPURISCVState *env, int csrno,
3356                               target_ulong *ret_val,
3357                               target_ulong new_val, target_ulong wr_mask)
3358 {
3359     uint64_t rval;
3360     RISCVException ret;
3361 
3362     ret = rmw_sip64(env, csrno, &rval, new_val, wr_mask);
3363     if (ret_val) {
3364         *ret_val = rval;
3365     }
3366 
3367     return ret;
3368 }
3369 
3370 static RISCVException rmw_siph(CPURISCVState *env, int csrno,
3371                                target_ulong *ret_val,
3372                                target_ulong new_val, target_ulong wr_mask)
3373 {
3374     uint64_t rval;
3375     RISCVException ret;
3376 
3377     ret = rmw_sip64(env, csrno, &rval,
3378         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3379     if (ret_val) {
3380         *ret_val = rval >> 32;
3381     }
3382 
3383     return ret;
3384 }
3385 
3386 /* Supervisor Protection and Translation */
3387 static RISCVException read_satp(CPURISCVState *env, int csrno,
3388                                 target_ulong *val)
3389 {
3390     if (!riscv_cpu_cfg(env)->mmu) {
3391         *val = 0;
3392         return RISCV_EXCP_NONE;
3393     }
3394     *val = env->satp;
3395     return RISCV_EXCP_NONE;
3396 }
3397 
3398 static RISCVException write_satp(CPURISCVState *env, int csrno,
3399                                  target_ulong val)
3400 {
3401     if (!riscv_cpu_cfg(env)->mmu) {
3402         return RISCV_EXCP_NONE;
3403     }
3404 
3405     env->satp = legalize_xatp(env, env->satp, val);
3406     return RISCV_EXCP_NONE;
3407 }
3408 
3409 static RISCVException read_vstopi(CPURISCVState *env, int csrno,
3410                                   target_ulong *val)
3411 {
3412     int irq, ret;
3413     target_ulong topei;
3414     uint64_t vseip, vsgein;
3415     uint32_t iid, iprio, hviid, hviprio, gein;
3416     uint32_t s, scount = 0, siid[VSTOPI_NUM_SRCS], siprio[VSTOPI_NUM_SRCS];
3417 
3418     gein = get_field(env->hstatus, HSTATUS_VGEIN);
3419     hviid = get_field(env->hvictl, HVICTL_IID);
3420     hviprio = get_field(env->hvictl, HVICTL_IPRIO);
3421 
3422     if (gein) {
3423         vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
3424         vseip = env->mie & (env->mip | vsgein) & MIP_VSEIP;
3425         if (gein <= env->geilen && vseip) {
3426             siid[scount] = IRQ_S_EXT;
3427             siprio[scount] = IPRIO_MMAXIPRIO + 1;
3428             if (env->aia_ireg_rmw_fn[PRV_S]) {
3429                 /*
3430                  * Call machine specific IMSIC register emulation for
3431                  * reading TOPEI.
3432                  */
3433                 ret = env->aia_ireg_rmw_fn[PRV_S](
3434                         env->aia_ireg_rmw_fn_arg[PRV_S],
3435                         AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, PRV_S, true, gein,
3436                                       riscv_cpu_mxl_bits(env)),
3437                         &topei, 0, 0);
3438                 if (!ret && topei) {
3439                     siprio[scount] = topei & IMSIC_TOPEI_IPRIO_MASK;
3440                 }
3441             }
3442             scount++;
3443         }
3444     } else {
3445         if (hviid == IRQ_S_EXT && hviprio) {
3446             siid[scount] = IRQ_S_EXT;
3447             siprio[scount] = hviprio;
3448             scount++;
3449         }
3450     }
3451 
3452     if (env->hvictl & HVICTL_VTI) {
3453         if (hviid != IRQ_S_EXT) {
3454             siid[scount] = hviid;
3455             siprio[scount] = hviprio;
3456             scount++;
3457         }
3458     } else {
3459         irq = riscv_cpu_vsirq_pending(env);
3460         if (irq != IRQ_S_EXT && 0 < irq && irq <= 63) {
3461             siid[scount] = irq;
3462             siprio[scount] = env->hviprio[irq];
3463             scount++;
3464         }
3465     }
3466 
3467     iid = 0;
3468     iprio = UINT_MAX;
3469     for (s = 0; s < scount; s++) {
3470         if (siprio[s] < iprio) {
3471             iid = siid[s];
3472             iprio = siprio[s];
3473         }
3474     }
3475 
3476     if (iid) {
3477         if (env->hvictl & HVICTL_IPRIOM) {
3478             if (iprio > IPRIO_MMAXIPRIO) {
3479                 iprio = IPRIO_MMAXIPRIO;
3480             }
3481             if (!iprio) {
3482                 if (riscv_cpu_default_priority(iid) > IPRIO_DEFAULT_S) {
3483                     iprio = IPRIO_MMAXIPRIO;
3484                 }
3485             }
3486         } else {
3487             iprio = 1;
3488         }
3489     } else {
3490         iprio = 0;
3491     }
3492 
3493     *val = (iid & TOPI_IID_MASK) << TOPI_IID_SHIFT;
3494     *val |= iprio;
3495 
3496     return RISCV_EXCP_NONE;
3497 }
3498 
3499 static RISCVException read_stopi(CPURISCVState *env, int csrno,
3500                                  target_ulong *val)
3501 {
3502     int irq;
3503     uint8_t iprio;
3504 
3505     if (env->virt_enabled) {
3506         return read_vstopi(env, CSR_VSTOPI, val);
3507     }
3508 
3509     irq = riscv_cpu_sirq_pending(env);
3510     if (irq <= 0 || irq > 63) {
3511         *val = 0;
3512     } else {
3513         iprio = env->siprio[irq];
3514         if (!iprio) {
3515             if (riscv_cpu_default_priority(irq) > IPRIO_DEFAULT_S) {
3516                 iprio = IPRIO_MMAXIPRIO;
3517            }
3518         }
3519         *val = (irq & TOPI_IID_MASK) << TOPI_IID_SHIFT;
3520         *val |= iprio;
3521     }
3522 
3523     return RISCV_EXCP_NONE;
3524 }
3525 
3526 /* Hypervisor Extensions */
3527 static RISCVException read_hstatus(CPURISCVState *env, int csrno,
3528                                    target_ulong *val)
3529 {
3530     *val = env->hstatus;
3531     if (riscv_cpu_mxl(env) != MXL_RV32) {
3532         /* We only support 64-bit VSXL */
3533         *val = set_field(*val, HSTATUS_VSXL, 2);
3534     }
3535     /* We only support little endian */
3536     *val = set_field(*val, HSTATUS_VSBE, 0);
3537     return RISCV_EXCP_NONE;
3538 }
3539 
3540 static RISCVException write_hstatus(CPURISCVState *env, int csrno,
3541                                     target_ulong val)
3542 {
3543     if (!env_archcpu(env)->cfg.ext_svukte) {
3544         val = val & (~HSTATUS_HUKTE);
3545     }
3546     env->hstatus = val;
3547     if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
3548         qemu_log_mask(LOG_UNIMP,
3549                       "QEMU does not support mixed HSXLEN options.");
3550     }
3551     if (get_field(val, HSTATUS_VSBE) != 0) {
3552         qemu_log_mask(LOG_UNIMP, "QEMU does not support big endian guests.");
3553     }
3554     return RISCV_EXCP_NONE;
3555 }
3556 
3557 static RISCVException read_hedeleg(CPURISCVState *env, int csrno,
3558                                    target_ulong *val)
3559 {
3560     *val = env->hedeleg;
3561     return RISCV_EXCP_NONE;
3562 }
3563 
3564 static RISCVException write_hedeleg(CPURISCVState *env, int csrno,
3565                                     target_ulong val)
3566 {
3567     env->hedeleg = val & vs_delegable_excps;
3568     return RISCV_EXCP_NONE;
3569 }
3570 
3571 static RISCVException read_hedelegh(CPURISCVState *env, int csrno,
3572                                    target_ulong *val)
3573 {
3574     RISCVException ret;
3575     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_P1P13);
3576     if (ret != RISCV_EXCP_NONE) {
3577         return ret;
3578     }
3579 
3580     /* Reserved, now read zero */
3581     *val = 0;
3582     return RISCV_EXCP_NONE;
3583 }
3584 
3585 static RISCVException write_hedelegh(CPURISCVState *env, int csrno,
3586                                     target_ulong val)
3587 {
3588     RISCVException ret;
3589     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_P1P13);
3590     if (ret != RISCV_EXCP_NONE) {
3591         return ret;
3592     }
3593 
3594     /* Reserved, now write ignore */
3595     return RISCV_EXCP_NONE;
3596 }
3597 
3598 static RISCVException rmw_hvien64(CPURISCVState *env, int csrno,
3599                                     uint64_t *ret_val,
3600                                     uint64_t new_val, uint64_t wr_mask)
3601 {
3602     uint64_t mask = wr_mask & hvien_writable_mask;
3603 
3604     if (ret_val) {
3605         *ret_val = env->hvien;
3606     }
3607 
3608     env->hvien = (env->hvien & ~mask) | (new_val & mask);
3609 
3610     return RISCV_EXCP_NONE;
3611 }
3612 
3613 static RISCVException rmw_hvien(CPURISCVState *env, int csrno,
3614                                target_ulong *ret_val,
3615                                target_ulong new_val, target_ulong wr_mask)
3616 {
3617     uint64_t rval;
3618     RISCVException ret;
3619 
3620     ret = rmw_hvien64(env, csrno, &rval, new_val, wr_mask);
3621     if (ret_val) {
3622         *ret_val = rval;
3623     }
3624 
3625     return ret;
3626 }
3627 
3628 static RISCVException rmw_hvienh(CPURISCVState *env, int csrno,
3629                                    target_ulong *ret_val,
3630                                    target_ulong new_val, target_ulong wr_mask)
3631 {
3632     uint64_t rval;
3633     RISCVException ret;
3634 
3635     ret = rmw_hvien64(env, csrno, &rval,
3636         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3637     if (ret_val) {
3638         *ret_val = rval >> 32;
3639     }
3640 
3641     return ret;
3642 }
3643 
3644 static RISCVException rmw_hideleg64(CPURISCVState *env, int csrno,
3645                                     uint64_t *ret_val,
3646                                     uint64_t new_val, uint64_t wr_mask)
3647 {
3648     uint64_t mask = wr_mask & vs_delegable_ints;
3649 
3650     if (ret_val) {
3651         *ret_val = env->hideleg & vs_delegable_ints;
3652     }
3653 
3654     env->hideleg = (env->hideleg & ~mask) | (new_val & mask);
3655     return RISCV_EXCP_NONE;
3656 }
3657 
3658 static RISCVException rmw_hideleg(CPURISCVState *env, int csrno,
3659                                   target_ulong *ret_val,
3660                                   target_ulong new_val, target_ulong wr_mask)
3661 {
3662     uint64_t rval;
3663     RISCVException ret;
3664 
3665     ret = rmw_hideleg64(env, csrno, &rval, new_val, wr_mask);
3666     if (ret_val) {
3667         *ret_val = rval;
3668     }
3669 
3670     return ret;
3671 }
3672 
3673 static RISCVException rmw_hidelegh(CPURISCVState *env, int csrno,
3674                                    target_ulong *ret_val,
3675                                    target_ulong new_val, target_ulong wr_mask)
3676 {
3677     uint64_t rval;
3678     RISCVException ret;
3679 
3680     ret = rmw_hideleg64(env, csrno, &rval,
3681         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3682     if (ret_val) {
3683         *ret_val = rval >> 32;
3684     }
3685 
3686     return ret;
3687 }
3688 
3689 /*
3690  * The function is written for two use-cases:
3691  * 1- To access hvip csr as is for HS-mode access.
3692  * 2- To access vsip as a combination of hvip, and mip for vs-mode.
3693  *
3694  * Both report bits 2, 6, 10 and 13:63.
3695  * vsip needs to be read-only zero when both hideleg[i] and
3696  * hvien[i] are zero.
3697  */
3698 static RISCVException rmw_hvip64(CPURISCVState *env, int csrno,
3699                                  uint64_t *ret_val,
3700                                  uint64_t new_val, uint64_t wr_mask)
3701 {
3702     RISCVException ret;
3703     uint64_t old_hvip;
3704     uint64_t ret_mip;
3705 
3706     /*
3707      * For bits 10, 6 and 2, vsip[i] is an alias of hip[i]. These bits are
3708      * present in hip, hvip and mip. Where mip[i] is alias of hip[i] and hvip[i]
3709      * is OR'ed in hip[i] to inject virtual interrupts from hypervisor. These
3710      * bits are actually being maintained in mip so we read them from there.
3711      * This way we have a single source of truth and allows for easier
3712      * implementation.
3713      *
3714      * For bits 13:63 we have:
3715      *
3716      * hideleg[i]  hvien[i]
3717      *   0           0      No delegation. vsip[i] readonly zero.
3718      *   0           1      vsip[i] is alias of hvip[i], sip bypassed.
3719      *   1           X      vsip[i] is alias of sip[i], hvip bypassed.
3720      *
3721      *  alias_mask denotes the bits that come from sip (mip here given we
3722      *  maintain all bits there). nalias_mask denotes bits that come from
3723      *  hvip.
3724      */
3725     uint64_t alias_mask = (env->hideleg | ~env->hvien) | VS_MODE_INTERRUPTS;
3726     uint64_t nalias_mask = (~env->hideleg & env->hvien);
3727     uint64_t wr_mask_hvip;
3728     uint64_t wr_mask_mip;
3729 
3730     /*
3731      * Both alias and non-alias mask remain same for vsip except:
3732      *  1- For VS* bits if they are zero in hideleg.
3733      *  2- For 13:63 bits if they are zero in both hideleg and hvien.
3734      */
3735     if (csrno == CSR_VSIP) {
3736         /* zero-out VS* bits that are not delegated to VS mode. */
3737         alias_mask &= (env->hideleg | ~VS_MODE_INTERRUPTS);
3738 
3739         /*
3740          * zero-out 13:63 bits that are zero in both hideleg and hvien.
3741          * nalias_mask mask can not contain any VS* bits so only second
3742          * condition applies on it.
3743          */
3744         nalias_mask &= (env->hideleg | env->hvien);
3745         alias_mask &= (env->hideleg | env->hvien);
3746     }
3747 
3748     wr_mask_hvip = wr_mask & nalias_mask & hvip_writable_mask;
3749     wr_mask_mip = wr_mask & alias_mask & hvip_writable_mask;
3750 
3751     /* Aliased bits, bits 10, 6, 2 need to come from mip. */
3752     ret = rmw_mip64(env, csrno, &ret_mip, new_val, wr_mask_mip);
3753     if (ret != RISCV_EXCP_NONE) {
3754         return ret;
3755     }
3756 
3757     old_hvip = env->hvip;
3758 
3759     if (wr_mask_hvip) {
3760         env->hvip = (env->hvip & ~wr_mask_hvip) | (new_val & wr_mask_hvip);
3761 
3762         /*
3763          * Given hvip is separate source from mip, we need to trigger interrupt
3764          * from here separately. Normally this happen from riscv_cpu_update_mip.
3765          */
3766         riscv_cpu_interrupt(env);
3767     }
3768 
3769     if (ret_val) {
3770         /* Only take VS* bits from mip. */
3771         ret_mip &= alias_mask;
3772 
3773         /* Take in non-delegated 13:63 bits from hvip. */
3774         old_hvip &= nalias_mask;
3775 
3776         *ret_val = ret_mip | old_hvip;
3777     }
3778 
3779     return ret;
3780 }
3781 
3782 static RISCVException rmw_hvip(CPURISCVState *env, int csrno,
3783                                target_ulong *ret_val,
3784                                target_ulong new_val, target_ulong wr_mask)
3785 {
3786     uint64_t rval;
3787     RISCVException ret;
3788 
3789     ret = rmw_hvip64(env, csrno, &rval, new_val, wr_mask);
3790     if (ret_val) {
3791         *ret_val = rval;
3792     }
3793 
3794     return ret;
3795 }
3796 
3797 static RISCVException rmw_hviph(CPURISCVState *env, int csrno,
3798                                 target_ulong *ret_val,
3799                                 target_ulong new_val, target_ulong wr_mask)
3800 {
3801     uint64_t rval;
3802     RISCVException ret;
3803 
3804     ret = rmw_hvip64(env, csrno, &rval,
3805         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3806     if (ret_val) {
3807         *ret_val = rval >> 32;
3808     }
3809 
3810     return ret;
3811 }
3812 
3813 static RISCVException rmw_hip(CPURISCVState *env, int csrno,
3814                               target_ulong *ret_value,
3815                               target_ulong new_value, target_ulong write_mask)
3816 {
3817     int ret = rmw_mip(env, csrno, ret_value, new_value,
3818                       write_mask & hip_writable_mask);
3819 
3820     if (ret_value) {
3821         *ret_value &= HS_MODE_INTERRUPTS;
3822     }
3823     return ret;
3824 }
3825 
3826 static RISCVException rmw_hie(CPURISCVState *env, int csrno,
3827                               target_ulong *ret_val,
3828                               target_ulong new_val, target_ulong wr_mask)
3829 {
3830     uint64_t rval;
3831     RISCVException ret;
3832 
3833     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask & HS_MODE_INTERRUPTS);
3834     if (ret_val) {
3835         *ret_val = rval & HS_MODE_INTERRUPTS;
3836     }
3837 
3838     return ret;
3839 }
3840 
3841 static RISCVException read_hcounteren(CPURISCVState *env, int csrno,
3842                                       target_ulong *val)
3843 {
3844     *val = env->hcounteren;
3845     return RISCV_EXCP_NONE;
3846 }
3847 
3848 static RISCVException write_hcounteren(CPURISCVState *env, int csrno,
3849                                        target_ulong val)
3850 {
3851     RISCVCPU *cpu = env_archcpu(env);
3852 
3853     /* WARL register - disable unavailable counters */
3854     env->hcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
3855                              COUNTEREN_IR);
3856     return RISCV_EXCP_NONE;
3857 }
3858 
3859 static RISCVException read_hgeie(CPURISCVState *env, int csrno,
3860                                  target_ulong *val)
3861 {
3862     if (val) {
3863         *val = env->hgeie;
3864     }
3865     return RISCV_EXCP_NONE;
3866 }
3867 
3868 static RISCVException write_hgeie(CPURISCVState *env, int csrno,
3869                                   target_ulong val)
3870 {
3871     /* Only GEILEN:1 bits implemented and BIT0 is never implemented */
3872     val &= ((((target_ulong)1) << env->geilen) - 1) << 1;
3873     env->hgeie = val;
3874     /* Update mip.SGEIP bit */
3875     riscv_cpu_update_mip(env, MIP_SGEIP,
3876                          BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
3877     return RISCV_EXCP_NONE;
3878 }
3879 
3880 static RISCVException read_htval(CPURISCVState *env, int csrno,
3881                                  target_ulong *val)
3882 {
3883     *val = env->htval;
3884     return RISCV_EXCP_NONE;
3885 }
3886 
3887 static RISCVException write_htval(CPURISCVState *env, int csrno,
3888                                   target_ulong val)
3889 {
3890     env->htval = val;
3891     return RISCV_EXCP_NONE;
3892 }
3893 
3894 static RISCVException read_htinst(CPURISCVState *env, int csrno,
3895                                   target_ulong *val)
3896 {
3897     *val = env->htinst;
3898     return RISCV_EXCP_NONE;
3899 }
3900 
3901 static RISCVException write_htinst(CPURISCVState *env, int csrno,
3902                                    target_ulong val)
3903 {
3904     return RISCV_EXCP_NONE;
3905 }
3906 
3907 static RISCVException read_hgeip(CPURISCVState *env, int csrno,
3908                                  target_ulong *val)
3909 {
3910     if (val) {
3911         *val = env->hgeip;
3912     }
3913     return RISCV_EXCP_NONE;
3914 }
3915 
3916 static RISCVException read_hgatp(CPURISCVState *env, int csrno,
3917                                  target_ulong *val)
3918 {
3919     *val = env->hgatp;
3920     return RISCV_EXCP_NONE;
3921 }
3922 
3923 static RISCVException write_hgatp(CPURISCVState *env, int csrno,
3924                                   target_ulong val)
3925 {
3926     env->hgatp = legalize_xatp(env, env->hgatp, val);
3927     return RISCV_EXCP_NONE;
3928 }
3929 
3930 static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
3931                                       target_ulong *val)
3932 {
3933     if (!env->rdtime_fn) {
3934         return RISCV_EXCP_ILLEGAL_INST;
3935     }
3936 
3937     *val = env->htimedelta;
3938     return RISCV_EXCP_NONE;
3939 }
3940 
3941 static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
3942                                        target_ulong val)
3943 {
3944     if (!env->rdtime_fn) {
3945         return RISCV_EXCP_ILLEGAL_INST;
3946     }
3947 
3948     if (riscv_cpu_mxl(env) == MXL_RV32) {
3949         env->htimedelta = deposit64(env->htimedelta, 0, 32, (uint64_t)val);
3950     } else {
3951         env->htimedelta = val;
3952     }
3953 
3954     if (riscv_cpu_cfg(env)->ext_sstc && env->rdtime_fn) {
3955         riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
3956                                   env->htimedelta, MIP_VSTIP);
3957     }
3958 
3959     return RISCV_EXCP_NONE;
3960 }
3961 
3962 static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
3963                                        target_ulong *val)
3964 {
3965     if (!env->rdtime_fn) {
3966         return RISCV_EXCP_ILLEGAL_INST;
3967     }
3968 
3969     *val = env->htimedelta >> 32;
3970     return RISCV_EXCP_NONE;
3971 }
3972 
3973 static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
3974                                         target_ulong val)
3975 {
3976     if (!env->rdtime_fn) {
3977         return RISCV_EXCP_ILLEGAL_INST;
3978     }
3979 
3980     env->htimedelta = deposit64(env->htimedelta, 32, 32, (uint64_t)val);
3981 
3982     if (riscv_cpu_cfg(env)->ext_sstc && env->rdtime_fn) {
3983         riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
3984                                   env->htimedelta, MIP_VSTIP);
3985     }
3986 
3987     return RISCV_EXCP_NONE;
3988 }
3989 
3990 static RISCVException read_hvictl(CPURISCVState *env, int csrno,
3991                                   target_ulong *val)
3992 {
3993     *val = env->hvictl;
3994     return RISCV_EXCP_NONE;
3995 }
3996 
3997 static RISCVException write_hvictl(CPURISCVState *env, int csrno,
3998                                    target_ulong val)
3999 {
4000     env->hvictl = val & HVICTL_VALID_MASK;
4001     return RISCV_EXCP_NONE;
4002 }
4003 
4004 static RISCVException read_hvipriox(CPURISCVState *env, int first_index,
4005                          uint8_t *iprio, target_ulong *val)
4006 {
4007     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
4008 
4009     /* First index has to be a multiple of number of irqs per register */
4010     if (first_index % num_irqs) {
4011         return (env->virt_enabled) ?
4012                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
4013     }
4014 
4015     /* Fill-up return value */
4016     *val = 0;
4017     for (i = 0; i < num_irqs; i++) {
4018         if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
4019             continue;
4020         }
4021         if (rdzero) {
4022             continue;
4023         }
4024         *val |= ((target_ulong)iprio[irq]) << (i * 8);
4025     }
4026 
4027     return RISCV_EXCP_NONE;
4028 }
4029 
4030 static RISCVException write_hvipriox(CPURISCVState *env, int first_index,
4031                           uint8_t *iprio, target_ulong val)
4032 {
4033     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
4034 
4035     /* First index has to be a multiple of number of irqs per register */
4036     if (first_index % num_irqs) {
4037         return (env->virt_enabled) ?
4038                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
4039     }
4040 
4041     /* Fill-up priority array */
4042     for (i = 0; i < num_irqs; i++) {
4043         if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
4044             continue;
4045         }
4046         if (rdzero) {
4047             iprio[irq] = 0;
4048         } else {
4049             iprio[irq] = (val >> (i * 8)) & 0xff;
4050         }
4051     }
4052 
4053     return RISCV_EXCP_NONE;
4054 }
4055 
4056 static RISCVException read_hviprio1(CPURISCVState *env, int csrno,
4057                                     target_ulong *val)
4058 {
4059     return read_hvipriox(env, 0, env->hviprio, val);
4060 }
4061 
4062 static RISCVException write_hviprio1(CPURISCVState *env, int csrno,
4063                                      target_ulong val)
4064 {
4065     return write_hvipriox(env, 0, env->hviprio, val);
4066 }
4067 
4068 static RISCVException read_hviprio1h(CPURISCVState *env, int csrno,
4069                                      target_ulong *val)
4070 {
4071     return read_hvipriox(env, 4, env->hviprio, val);
4072 }
4073 
4074 static RISCVException write_hviprio1h(CPURISCVState *env, int csrno,
4075                                       target_ulong val)
4076 {
4077     return write_hvipriox(env, 4, env->hviprio, val);
4078 }
4079 
4080 static RISCVException read_hviprio2(CPURISCVState *env, int csrno,
4081                                     target_ulong *val)
4082 {
4083     return read_hvipriox(env, 8, env->hviprio, val);
4084 }
4085 
4086 static RISCVException write_hviprio2(CPURISCVState *env, int csrno,
4087                                      target_ulong val)
4088 {
4089     return write_hvipriox(env, 8, env->hviprio, val);
4090 }
4091 
4092 static RISCVException read_hviprio2h(CPURISCVState *env, int csrno,
4093                                      target_ulong *val)
4094 {
4095     return read_hvipriox(env, 12, env->hviprio, val);
4096 }
4097 
4098 static RISCVException write_hviprio2h(CPURISCVState *env, int csrno,
4099                                       target_ulong val)
4100 {
4101     return write_hvipriox(env, 12, env->hviprio, val);
4102 }
4103 
4104 /* Virtual CSR Registers */
4105 static RISCVException read_vsstatus(CPURISCVState *env, int csrno,
4106                                     target_ulong *val)
4107 {
4108     *val = env->vsstatus;
4109     return RISCV_EXCP_NONE;
4110 }
4111 
4112 static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
4113                                      target_ulong val)
4114 {
4115     uint64_t mask = (target_ulong)-1;
4116     if ((val & VSSTATUS64_UXL) == 0) {
4117         mask &= ~VSSTATUS64_UXL;
4118     }
4119     env->vsstatus = (env->vsstatus & ~mask) | (uint64_t)val;
4120     return RISCV_EXCP_NONE;
4121 }
4122 
4123 static RISCVException read_vstvec(CPURISCVState *env, int csrno,
4124                                   target_ulong *val)
4125 {
4126     *val = env->vstvec;
4127     return RISCV_EXCP_NONE;
4128 }
4129 
4130 static RISCVException write_vstvec(CPURISCVState *env, int csrno,
4131                                    target_ulong val)
4132 {
4133     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
4134     if ((val & 3) < 2) {
4135         env->vstvec = val;
4136     } else {
4137         qemu_log_mask(LOG_UNIMP, "CSR_VSTVEC: reserved mode not supported\n");
4138     }
4139     return RISCV_EXCP_NONE;
4140 }
4141 
4142 static RISCVException read_vsscratch(CPURISCVState *env, int csrno,
4143                                      target_ulong *val)
4144 {
4145     *val = env->vsscratch;
4146     return RISCV_EXCP_NONE;
4147 }
4148 
4149 static RISCVException write_vsscratch(CPURISCVState *env, int csrno,
4150                                       target_ulong val)
4151 {
4152     env->vsscratch = val;
4153     return RISCV_EXCP_NONE;
4154 }
4155 
4156 static RISCVException read_vsepc(CPURISCVState *env, int csrno,
4157                                  target_ulong *val)
4158 {
4159     *val = env->vsepc;
4160     return RISCV_EXCP_NONE;
4161 }
4162 
4163 static RISCVException write_vsepc(CPURISCVState *env, int csrno,
4164                                   target_ulong val)
4165 {
4166     env->vsepc = val;
4167     return RISCV_EXCP_NONE;
4168 }
4169 
4170 static RISCVException read_vscause(CPURISCVState *env, int csrno,
4171                                    target_ulong *val)
4172 {
4173     *val = env->vscause;
4174     return RISCV_EXCP_NONE;
4175 }
4176 
4177 static RISCVException write_vscause(CPURISCVState *env, int csrno,
4178                                     target_ulong val)
4179 {
4180     env->vscause = val;
4181     return RISCV_EXCP_NONE;
4182 }
4183 
4184 static RISCVException read_vstval(CPURISCVState *env, int csrno,
4185                                   target_ulong *val)
4186 {
4187     *val = env->vstval;
4188     return RISCV_EXCP_NONE;
4189 }
4190 
4191 static RISCVException write_vstval(CPURISCVState *env, int csrno,
4192                                    target_ulong val)
4193 {
4194     env->vstval = val;
4195     return RISCV_EXCP_NONE;
4196 }
4197 
4198 static RISCVException read_vsatp(CPURISCVState *env, int csrno,
4199                                  target_ulong *val)
4200 {
4201     *val = env->vsatp;
4202     return RISCV_EXCP_NONE;
4203 }
4204 
4205 static RISCVException write_vsatp(CPURISCVState *env, int csrno,
4206                                   target_ulong val)
4207 {
4208     env->vsatp = legalize_xatp(env, env->vsatp, val);
4209     return RISCV_EXCP_NONE;
4210 }
4211 
4212 static RISCVException read_mtval2(CPURISCVState *env, int csrno,
4213                                   target_ulong *val)
4214 {
4215     *val = env->mtval2;
4216     return RISCV_EXCP_NONE;
4217 }
4218 
4219 static RISCVException write_mtval2(CPURISCVState *env, int csrno,
4220                                    target_ulong val)
4221 {
4222     env->mtval2 = val;
4223     return RISCV_EXCP_NONE;
4224 }
4225 
4226 static RISCVException read_mtinst(CPURISCVState *env, int csrno,
4227                                   target_ulong *val)
4228 {
4229     *val = env->mtinst;
4230     return RISCV_EXCP_NONE;
4231 }
4232 
4233 static RISCVException write_mtinst(CPURISCVState *env, int csrno,
4234                                    target_ulong val)
4235 {
4236     env->mtinst = val;
4237     return RISCV_EXCP_NONE;
4238 }
4239 
4240 /* Physical Memory Protection */
4241 static RISCVException read_mseccfg(CPURISCVState *env, int csrno,
4242                                    target_ulong *val)
4243 {
4244     *val = mseccfg_csr_read(env);
4245     return RISCV_EXCP_NONE;
4246 }
4247 
4248 static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
4249                                     target_ulong val)
4250 {
4251     mseccfg_csr_write(env, val);
4252     return RISCV_EXCP_NONE;
4253 }
4254 
4255 static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
4256                                   target_ulong *val)
4257 {
4258     uint32_t reg_index = csrno - CSR_PMPCFG0;
4259 
4260     *val = pmpcfg_csr_read(env, reg_index);
4261     return RISCV_EXCP_NONE;
4262 }
4263 
4264 static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
4265                                    target_ulong val)
4266 {
4267     uint32_t reg_index = csrno - CSR_PMPCFG0;
4268 
4269     pmpcfg_csr_write(env, reg_index, val);
4270     return RISCV_EXCP_NONE;
4271 }
4272 
4273 static RISCVException read_pmpaddr(CPURISCVState *env, int csrno,
4274                                    target_ulong *val)
4275 {
4276     *val = pmpaddr_csr_read(env, csrno - CSR_PMPADDR0);
4277     return RISCV_EXCP_NONE;
4278 }
4279 
4280 static RISCVException write_pmpaddr(CPURISCVState *env, int csrno,
4281                                     target_ulong val)
4282 {
4283     pmpaddr_csr_write(env, csrno - CSR_PMPADDR0, val);
4284     return RISCV_EXCP_NONE;
4285 }
4286 
4287 static RISCVException read_tselect(CPURISCVState *env, int csrno,
4288                                    target_ulong *val)
4289 {
4290     *val = tselect_csr_read(env);
4291     return RISCV_EXCP_NONE;
4292 }
4293 
4294 static RISCVException write_tselect(CPURISCVState *env, int csrno,
4295                                     target_ulong val)
4296 {
4297     tselect_csr_write(env, val);
4298     return RISCV_EXCP_NONE;
4299 }
4300 
4301 static RISCVException read_tdata(CPURISCVState *env, int csrno,
4302                                  target_ulong *val)
4303 {
4304     /* return 0 in tdata1 to end the trigger enumeration */
4305     if (env->trigger_cur >= RV_MAX_TRIGGERS && csrno == CSR_TDATA1) {
4306         *val = 0;
4307         return RISCV_EXCP_NONE;
4308     }
4309 
4310     if (!tdata_available(env, csrno - CSR_TDATA1)) {
4311         return RISCV_EXCP_ILLEGAL_INST;
4312     }
4313 
4314     *val = tdata_csr_read(env, csrno - CSR_TDATA1);
4315     return RISCV_EXCP_NONE;
4316 }
4317 
4318 static RISCVException write_tdata(CPURISCVState *env, int csrno,
4319                                   target_ulong val)
4320 {
4321     if (!tdata_available(env, csrno - CSR_TDATA1)) {
4322         return RISCV_EXCP_ILLEGAL_INST;
4323     }
4324 
4325     tdata_csr_write(env, csrno - CSR_TDATA1, val);
4326     return RISCV_EXCP_NONE;
4327 }
4328 
4329 static RISCVException read_tinfo(CPURISCVState *env, int csrno,
4330                                  target_ulong *val)
4331 {
4332     *val = tinfo_csr_read(env);
4333     return RISCV_EXCP_NONE;
4334 }
4335 
4336 static RISCVException read_mcontext(CPURISCVState *env, int csrno,
4337                                     target_ulong *val)
4338 {
4339     *val = env->mcontext;
4340     return RISCV_EXCP_NONE;
4341 }
4342 
4343 static RISCVException write_mcontext(CPURISCVState *env, int csrno,
4344                                      target_ulong val)
4345 {
4346     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
4347     int32_t mask;
4348 
4349     if (riscv_has_ext(env, RVH)) {
4350         /* Spec suggest 7-bit for RV32 and 14-bit for RV64 w/ H extension */
4351         mask = rv32 ? MCONTEXT32_HCONTEXT : MCONTEXT64_HCONTEXT;
4352     } else {
4353         /* Spec suggest 6-bit for RV32 and 13-bit for RV64 w/o H extension */
4354         mask = rv32 ? MCONTEXT32 : MCONTEXT64;
4355     }
4356 
4357     env->mcontext = val & mask;
4358     return RISCV_EXCP_NONE;
4359 }
4360 
4361 /*
4362  * Functions to access Pointer Masking feature registers
4363  * We have to check if current priv lvl could modify
4364  * csr in given mode
4365  */
4366 static bool check_pm_current_disabled(CPURISCVState *env, int csrno)
4367 {
4368     int csr_priv = get_field(csrno, 0x300);
4369     int pm_current;
4370 
4371     if (env->debugger) {
4372         return false;
4373     }
4374     /*
4375      * If priv lvls differ that means we're accessing csr from higher priv lvl,
4376      * so allow the access
4377      */
4378     if (env->priv != csr_priv) {
4379         return false;
4380     }
4381     switch (env->priv) {
4382     case PRV_M:
4383         pm_current = get_field(env->mmte, M_PM_CURRENT);
4384         break;
4385     case PRV_S:
4386         pm_current = get_field(env->mmte, S_PM_CURRENT);
4387         break;
4388     case PRV_U:
4389         pm_current = get_field(env->mmte, U_PM_CURRENT);
4390         break;
4391     default:
4392         g_assert_not_reached();
4393     }
4394     /* It's same priv lvl, so we allow to modify csr only if pm.current==1 */
4395     return !pm_current;
4396 }
4397 
4398 static RISCVException read_mmte(CPURISCVState *env, int csrno,
4399                                 target_ulong *val)
4400 {
4401     *val = env->mmte & MMTE_MASK;
4402     return RISCV_EXCP_NONE;
4403 }
4404 
4405 static RISCVException write_mmte(CPURISCVState *env, int csrno,
4406                                  target_ulong val)
4407 {
4408     uint64_t mstatus;
4409     target_ulong wpri_val = val & MMTE_MASK;
4410 
4411     if (val != wpri_val) {
4412         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
4413                       TARGET_FMT_lx "\n", "MMTE: WPRI violation written 0x",
4414                       val, "vs expected 0x", wpri_val);
4415     }
4416     /* for machine mode pm.current is hardwired to 1 */
4417     wpri_val |= MMTE_M_PM_CURRENT;
4418 
4419     /* hardwiring pm.instruction bit to 0, since it's not supported yet */
4420     wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
4421     env->mmte = wpri_val | EXT_STATUS_DIRTY;
4422     riscv_cpu_update_mask(env);
4423 
4424     /* Set XS and SD bits, since PM CSRs are dirty */
4425     mstatus = env->mstatus | MSTATUS_XS;
4426     write_mstatus(env, csrno, mstatus);
4427     return RISCV_EXCP_NONE;
4428 }
4429 
4430 static RISCVException read_smte(CPURISCVState *env, int csrno,
4431                                 target_ulong *val)
4432 {
4433     *val = env->mmte & SMTE_MASK;
4434     return RISCV_EXCP_NONE;
4435 }
4436 
4437 static RISCVException write_smte(CPURISCVState *env, int csrno,
4438                                  target_ulong val)
4439 {
4440     target_ulong wpri_val = val & SMTE_MASK;
4441 
4442     if (val != wpri_val) {
4443         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
4444                       TARGET_FMT_lx "\n", "SMTE: WPRI violation written 0x",
4445                       val, "vs expected 0x", wpri_val);
4446     }
4447 
4448     /* if pm.current==0 we can't modify current PM CSRs */
4449     if (check_pm_current_disabled(env, csrno)) {
4450         return RISCV_EXCP_NONE;
4451     }
4452 
4453     wpri_val |= (env->mmte & ~SMTE_MASK);
4454     write_mmte(env, csrno, wpri_val);
4455     return RISCV_EXCP_NONE;
4456 }
4457 
4458 static RISCVException read_umte(CPURISCVState *env, int csrno,
4459                                 target_ulong *val)
4460 {
4461     *val = env->mmte & UMTE_MASK;
4462     return RISCV_EXCP_NONE;
4463 }
4464 
4465 static RISCVException write_umte(CPURISCVState *env, int csrno,
4466                                  target_ulong val)
4467 {
4468     target_ulong wpri_val = val & UMTE_MASK;
4469 
4470     if (val != wpri_val) {
4471         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
4472                       TARGET_FMT_lx "\n", "UMTE: WPRI violation written 0x",
4473                       val, "vs expected 0x", wpri_val);
4474     }
4475 
4476     if (check_pm_current_disabled(env, csrno)) {
4477         return RISCV_EXCP_NONE;
4478     }
4479 
4480     wpri_val |= (env->mmte & ~UMTE_MASK);
4481     write_mmte(env, csrno, wpri_val);
4482     return RISCV_EXCP_NONE;
4483 }
4484 
4485 static RISCVException read_mpmmask(CPURISCVState *env, int csrno,
4486                                    target_ulong *val)
4487 {
4488     *val = env->mpmmask;
4489     return RISCV_EXCP_NONE;
4490 }
4491 
4492 static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
4493                                     target_ulong val)
4494 {
4495     uint64_t mstatus;
4496 
4497     env->mpmmask = val;
4498     if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
4499         env->cur_pmmask = val;
4500     }
4501     env->mmte |= EXT_STATUS_DIRTY;
4502 
4503     /* Set XS and SD bits, since PM CSRs are dirty */
4504     mstatus = env->mstatus | MSTATUS_XS;
4505     write_mstatus(env, csrno, mstatus);
4506     return RISCV_EXCP_NONE;
4507 }
4508 
4509 static RISCVException read_spmmask(CPURISCVState *env, int csrno,
4510                                    target_ulong *val)
4511 {
4512     *val = env->spmmask;
4513     return RISCV_EXCP_NONE;
4514 }
4515 
4516 static RISCVException write_spmmask(CPURISCVState *env, int csrno,
4517                                     target_ulong val)
4518 {
4519     uint64_t mstatus;
4520 
4521     /* if pm.current==0 we can't modify current PM CSRs */
4522     if (check_pm_current_disabled(env, csrno)) {
4523         return RISCV_EXCP_NONE;
4524     }
4525     env->spmmask = val;
4526     if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
4527         env->cur_pmmask = val;
4528         if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
4529             env->cur_pmmask &= UINT32_MAX;
4530         }
4531     }
4532     env->mmte |= EXT_STATUS_DIRTY;
4533 
4534     /* Set XS and SD bits, since PM CSRs are dirty */
4535     mstatus = env->mstatus | MSTATUS_XS;
4536     write_mstatus(env, csrno, mstatus);
4537     return RISCV_EXCP_NONE;
4538 }
4539 
4540 static RISCVException read_upmmask(CPURISCVState *env, int csrno,
4541                                    target_ulong *val)
4542 {
4543     *val = env->upmmask;
4544     return RISCV_EXCP_NONE;
4545 }
4546 
4547 static RISCVException write_upmmask(CPURISCVState *env, int csrno,
4548                                     target_ulong val)
4549 {
4550     uint64_t mstatus;
4551 
4552     /* if pm.current==0 we can't modify current PM CSRs */
4553     if (check_pm_current_disabled(env, csrno)) {
4554         return RISCV_EXCP_NONE;
4555     }
4556     env->upmmask = val;
4557     if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
4558         env->cur_pmmask = val;
4559         if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
4560             env->cur_pmmask &= UINT32_MAX;
4561         }
4562     }
4563     env->mmte |= EXT_STATUS_DIRTY;
4564 
4565     /* Set XS and SD bits, since PM CSRs are dirty */
4566     mstatus = env->mstatus | MSTATUS_XS;
4567     write_mstatus(env, csrno, mstatus);
4568     return RISCV_EXCP_NONE;
4569 }
4570 
4571 static RISCVException read_mpmbase(CPURISCVState *env, int csrno,
4572                                    target_ulong *val)
4573 {
4574     *val = env->mpmbase;
4575     return RISCV_EXCP_NONE;
4576 }
4577 
4578 static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
4579                                     target_ulong val)
4580 {
4581     uint64_t mstatus;
4582 
4583     env->mpmbase = val;
4584     if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
4585         env->cur_pmbase = val;
4586     }
4587     env->mmte |= EXT_STATUS_DIRTY;
4588 
4589     /* Set XS and SD bits, since PM CSRs are dirty */
4590     mstatus = env->mstatus | MSTATUS_XS;
4591     write_mstatus(env, csrno, mstatus);
4592     return RISCV_EXCP_NONE;
4593 }
4594 
4595 static RISCVException read_spmbase(CPURISCVState *env, int csrno,
4596                                    target_ulong *val)
4597 {
4598     *val = env->spmbase;
4599     return RISCV_EXCP_NONE;
4600 }
4601 
4602 static RISCVException write_spmbase(CPURISCVState *env, int csrno,
4603                                     target_ulong val)
4604 {
4605     uint64_t mstatus;
4606 
4607     /* if pm.current==0 we can't modify current PM CSRs */
4608     if (check_pm_current_disabled(env, csrno)) {
4609         return RISCV_EXCP_NONE;
4610     }
4611     env->spmbase = val;
4612     if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
4613         env->cur_pmbase = val;
4614         if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
4615             env->cur_pmbase &= UINT32_MAX;
4616         }
4617     }
4618     env->mmte |= EXT_STATUS_DIRTY;
4619 
4620     /* Set XS and SD bits, since PM CSRs are dirty */
4621     mstatus = env->mstatus | MSTATUS_XS;
4622     write_mstatus(env, csrno, mstatus);
4623     return RISCV_EXCP_NONE;
4624 }
4625 
4626 static RISCVException read_upmbase(CPURISCVState *env, int csrno,
4627                                    target_ulong *val)
4628 {
4629     *val = env->upmbase;
4630     return RISCV_EXCP_NONE;
4631 }
4632 
4633 static RISCVException write_upmbase(CPURISCVState *env, int csrno,
4634                                     target_ulong val)
4635 {
4636     uint64_t mstatus;
4637 
4638     /* if pm.current==0 we can't modify current PM CSRs */
4639     if (check_pm_current_disabled(env, csrno)) {
4640         return RISCV_EXCP_NONE;
4641     }
4642     env->upmbase = val;
4643     if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
4644         env->cur_pmbase = val;
4645         if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
4646             env->cur_pmbase &= UINT32_MAX;
4647         }
4648     }
4649     env->mmte |= EXT_STATUS_DIRTY;
4650 
4651     /* Set XS and SD bits, since PM CSRs are dirty */
4652     mstatus = env->mstatus | MSTATUS_XS;
4653     write_mstatus(env, csrno, mstatus);
4654     return RISCV_EXCP_NONE;
4655 }
4656 
4657 #endif
4658 
4659 /* Crypto Extension */
4660 target_ulong riscv_new_csr_seed(target_ulong new_value,
4661                                 target_ulong write_mask)
4662 {
4663     uint16_t random_v;
4664     Error *random_e = NULL;
4665     int random_r;
4666     target_ulong rval;
4667 
4668     random_r = qemu_guest_getrandom(&random_v, 2, &random_e);
4669     if (unlikely(random_r < 0)) {
4670         /*
4671          * Failed, for unknown reasons in the crypto subsystem.
4672          * The best we can do is log the reason and return a
4673          * failure indication to the guest.  There is no reason
4674          * we know to expect the failure to be transitory, so
4675          * indicate DEAD to avoid having the guest spin on WAIT.
4676          */
4677         qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
4678                       __func__, error_get_pretty(random_e));
4679         error_free(random_e);
4680         rval = SEED_OPST_DEAD;
4681     } else {
4682         rval = random_v | SEED_OPST_ES16;
4683     }
4684 
4685     return rval;
4686 }
4687 
4688 static RISCVException rmw_seed(CPURISCVState *env, int csrno,
4689                                target_ulong *ret_value,
4690                                target_ulong new_value,
4691                                target_ulong write_mask)
4692 {
4693     target_ulong rval;
4694 
4695     rval = riscv_new_csr_seed(new_value, write_mask);
4696 
4697     if (ret_value) {
4698         *ret_value = rval;
4699     }
4700 
4701     return RISCV_EXCP_NONE;
4702 }
4703 
4704 /*
4705  * riscv_csrrw - read and/or update control and status register
4706  *
4707  * csrr   <->  riscv_csrrw(env, csrno, ret_value, 0, 0);
4708  * csrrw  <->  riscv_csrrw(env, csrno, ret_value, value, -1);
4709  * csrrs  <->  riscv_csrrw(env, csrno, ret_value, -1, value);
4710  * csrrc  <->  riscv_csrrw(env, csrno, ret_value, 0, value);
4711  */
4712 
4713 static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
4714                                                int csrno,
4715                                                bool write)
4716 {
4717     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
4718     bool read_only = get_field(csrno, 0xC00) == 3;
4719     int csr_min_priv = csr_ops[csrno].min_priv_ver;
4720 
4721     /* ensure the CSR extension is enabled */
4722     if (!riscv_cpu_cfg(env)->ext_zicsr) {
4723         return RISCV_EXCP_ILLEGAL_INST;
4724     }
4725 
4726     /* ensure CSR is implemented by checking predicate */
4727     if (!csr_ops[csrno].predicate) {
4728         return RISCV_EXCP_ILLEGAL_INST;
4729     }
4730 
4731     /* privileged spec version check */
4732     if (env->priv_ver < csr_min_priv) {
4733         return RISCV_EXCP_ILLEGAL_INST;
4734     }
4735 
4736     /* read / write check */
4737     if (write && read_only) {
4738         return RISCV_EXCP_ILLEGAL_INST;
4739     }
4740 
4741     /*
4742      * The predicate() not only does existence check but also does some
4743      * access control check which triggers for example virtual instruction
4744      * exception in some cases. When writing read-only CSRs in those cases
4745      * illegal instruction exception should be triggered instead of virtual
4746      * instruction exception. Hence this comes after the read / write check.
4747      */
4748     RISCVException ret = csr_ops[csrno].predicate(env, csrno);
4749     if (ret != RISCV_EXCP_NONE) {
4750         return ret;
4751     }
4752 
4753 #if !defined(CONFIG_USER_ONLY)
4754     int csr_priv, effective_priv = env->priv;
4755 
4756     if (riscv_has_ext(env, RVH) && env->priv == PRV_S &&
4757         !env->virt_enabled) {
4758         /*
4759          * We are in HS mode. Add 1 to the effective privilege level to
4760          * allow us to access the Hypervisor CSRs.
4761          */
4762         effective_priv++;
4763     }
4764 
4765     csr_priv = get_field(csrno, 0x300);
4766     if (!env->debugger && (effective_priv < csr_priv)) {
4767         if (csr_priv == (PRV_S + 1) && env->virt_enabled) {
4768             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
4769         }
4770         return RISCV_EXCP_ILLEGAL_INST;
4771     }
4772 #endif
4773     return RISCV_EXCP_NONE;
4774 }
4775 
4776 static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
4777                                        target_ulong *ret_value,
4778                                        target_ulong new_value,
4779                                        target_ulong write_mask)
4780 {
4781     RISCVException ret;
4782     target_ulong old_value = 0;
4783 
4784     /* execute combined read/write operation if it exists */
4785     if (csr_ops[csrno].op) {
4786         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
4787     }
4788 
4789     /*
4790      * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
4791      * and we can't throw side effects caused by CSR reads.
4792      */
4793     if (ret_value) {
4794         /* if no accessor exists then return failure */
4795         if (!csr_ops[csrno].read) {
4796             return RISCV_EXCP_ILLEGAL_INST;
4797         }
4798         /* read old value */
4799         ret = csr_ops[csrno].read(env, csrno, &old_value);
4800         if (ret != RISCV_EXCP_NONE) {
4801             return ret;
4802         }
4803     }
4804 
4805     /* write value if writable and write mask set, otherwise drop writes */
4806     if (write_mask) {
4807         new_value = (old_value & ~write_mask) | (new_value & write_mask);
4808         if (csr_ops[csrno].write) {
4809             ret = csr_ops[csrno].write(env, csrno, new_value);
4810             if (ret != RISCV_EXCP_NONE) {
4811                 return ret;
4812             }
4813         }
4814     }
4815 
4816     /* return old value */
4817     if (ret_value) {
4818         *ret_value = old_value;
4819     }
4820 
4821     return RISCV_EXCP_NONE;
4822 }
4823 
4824 RISCVException riscv_csrr(CPURISCVState *env, int csrno,
4825                            target_ulong *ret_value)
4826 {
4827     RISCVException ret = riscv_csrrw_check(env, csrno, false);
4828     if (ret != RISCV_EXCP_NONE) {
4829         return ret;
4830     }
4831 
4832     return riscv_csrrw_do64(env, csrno, ret_value, 0, 0);
4833 }
4834 
4835 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
4836                            target_ulong *ret_value,
4837                            target_ulong new_value, target_ulong write_mask)
4838 {
4839     RISCVException ret = riscv_csrrw_check(env, csrno, true);
4840     if (ret != RISCV_EXCP_NONE) {
4841         return ret;
4842     }
4843 
4844     return riscv_csrrw_do64(env, csrno, ret_value, new_value, write_mask);
4845 }
4846 
4847 static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
4848                                         Int128 *ret_value,
4849                                         Int128 new_value,
4850                                         Int128 write_mask)
4851 {
4852     RISCVException ret;
4853     Int128 old_value;
4854 
4855     /* read old value */
4856     ret = csr_ops[csrno].read128(env, csrno, &old_value);
4857     if (ret != RISCV_EXCP_NONE) {
4858         return ret;
4859     }
4860 
4861     /* write value if writable and write mask set, otherwise drop writes */
4862     if (int128_nz(write_mask)) {
4863         new_value = int128_or(int128_and(old_value, int128_not(write_mask)),
4864                               int128_and(new_value, write_mask));
4865         if (csr_ops[csrno].write128) {
4866             ret = csr_ops[csrno].write128(env, csrno, new_value);
4867             if (ret != RISCV_EXCP_NONE) {
4868                 return ret;
4869             }
4870         } else if (csr_ops[csrno].write) {
4871             /* avoids having to write wrappers for all registers */
4872             ret = csr_ops[csrno].write(env, csrno, int128_getlo(new_value));
4873             if (ret != RISCV_EXCP_NONE) {
4874                 return ret;
4875             }
4876         }
4877     }
4878 
4879     /* return old value */
4880     if (ret_value) {
4881         *ret_value = old_value;
4882     }
4883 
4884     return RISCV_EXCP_NONE;
4885 }
4886 
4887 RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
4888                                Int128 *ret_value)
4889 {
4890     RISCVException ret;
4891 
4892     ret = riscv_csrrw_check(env, csrno, false);
4893     if (ret != RISCV_EXCP_NONE) {
4894         return ret;
4895     }
4896 
4897     if (csr_ops[csrno].read128) {
4898         return riscv_csrrw_do128(env, csrno, ret_value,
4899                                  int128_zero(), int128_zero());
4900     }
4901 
4902     /*
4903      * Fall back to 64-bit version for now, if the 128-bit alternative isn't
4904      * at all defined.
4905      * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
4906      * significant), for those, this fallback is correctly handling the
4907      * accesses
4908      */
4909     target_ulong old_value;
4910     ret = riscv_csrrw_do64(env, csrno, &old_value,
4911                            (target_ulong)0,
4912                            (target_ulong)0);
4913     if (ret == RISCV_EXCP_NONE && ret_value) {
4914         *ret_value = int128_make64(old_value);
4915     }
4916     return ret;
4917 }
4918 
4919 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
4920                                 Int128 *ret_value,
4921                                 Int128 new_value, Int128 write_mask)
4922 {
4923     RISCVException ret;
4924 
4925     ret = riscv_csrrw_check(env, csrno, true);
4926     if (ret != RISCV_EXCP_NONE) {
4927         return ret;
4928     }
4929 
4930     if (csr_ops[csrno].read128) {
4931         return riscv_csrrw_do128(env, csrno, ret_value, new_value, write_mask);
4932     }
4933 
4934     /*
4935      * Fall back to 64-bit version for now, if the 128-bit alternative isn't
4936      * at all defined.
4937      * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
4938      * significant), for those, this fallback is correctly handling the
4939      * accesses
4940      */
4941     target_ulong old_value;
4942     ret = riscv_csrrw_do64(env, csrno, &old_value,
4943                            int128_getlo(new_value),
4944                            int128_getlo(write_mask));
4945     if (ret == RISCV_EXCP_NONE && ret_value) {
4946         *ret_value = int128_make64(old_value);
4947     }
4948     return ret;
4949 }
4950 
4951 /*
4952  * Debugger support.  If not in user mode, set env->debugger before the
4953  * riscv_csrrw call and clear it after the call.
4954  */
4955 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
4956                                  target_ulong *ret_value,
4957                                  target_ulong new_value,
4958                                  target_ulong write_mask)
4959 {
4960     RISCVException ret;
4961 #if !defined(CONFIG_USER_ONLY)
4962     env->debugger = true;
4963 #endif
4964     if (!write_mask) {
4965         ret = riscv_csrr(env, csrno, ret_value);
4966     } else {
4967         ret = riscv_csrrw(env, csrno, ret_value, new_value, write_mask);
4968     }
4969 #if !defined(CONFIG_USER_ONLY)
4970     env->debugger = false;
4971 #endif
4972     return ret;
4973 }
4974 
4975 static RISCVException read_jvt(CPURISCVState *env, int csrno,
4976                                target_ulong *val)
4977 {
4978     *val = env->jvt;
4979     return RISCV_EXCP_NONE;
4980 }
4981 
4982 static RISCVException write_jvt(CPURISCVState *env, int csrno,
4983                                 target_ulong val)
4984 {
4985     env->jvt = val;
4986     return RISCV_EXCP_NONE;
4987 }
4988 
4989 /*
4990  * Control and Status Register function table
4991  * riscv_csr_operations::predicate() must be provided for an implemented CSR
4992  */
4993 riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
4994     /* User Floating-Point CSRs */
4995     [CSR_FFLAGS]   = { "fflags",   fs,     read_fflags,  write_fflags },
4996     [CSR_FRM]      = { "frm",      fs,     read_frm,     write_frm    },
4997     [CSR_FCSR]     = { "fcsr",     fs,     read_fcsr,    write_fcsr   },
4998     /* Vector CSRs */
4999     [CSR_VSTART]   = { "vstart",   vs,     read_vstart,  write_vstart },
5000     [CSR_VXSAT]    = { "vxsat",    vs,     read_vxsat,   write_vxsat  },
5001     [CSR_VXRM]     = { "vxrm",     vs,     read_vxrm,    write_vxrm   },
5002     [CSR_VCSR]     = { "vcsr",     vs,     read_vcsr,    write_vcsr   },
5003     [CSR_VL]       = { "vl",       vs,     read_vl                    },
5004     [CSR_VTYPE]    = { "vtype",    vs,     read_vtype                 },
5005     [CSR_VLENB]    = { "vlenb",    vs,     read_vlenb                 },
5006     /* User Timers and Counters */
5007     [CSR_CYCLE]    = { "cycle",    ctr,    read_hpmcounter  },
5008     [CSR_INSTRET]  = { "instret",  ctr,    read_hpmcounter  },
5009     [CSR_CYCLEH]   = { "cycleh",   ctr32,  read_hpmcounterh },
5010     [CSR_INSTRETH] = { "instreth", ctr32,  read_hpmcounterh },
5011 
5012     /*
5013      * In privileged mode, the monitor will have to emulate TIME CSRs only if
5014      * rdtime callback is not provided by machine/platform emulation.
5015      */
5016     [CSR_TIME]  = { "time",  ctr,   read_time  },
5017     [CSR_TIMEH] = { "timeh", ctr32, read_timeh },
5018 
5019     /* Crypto Extension */
5020     [CSR_SEED] = { "seed", seed, NULL, NULL, rmw_seed },
5021 
5022     /* Zcmt Extension */
5023     [CSR_JVT] = {"jvt", zcmt, read_jvt, write_jvt},
5024 
5025     /* zicfiss Extension, shadow stack register */
5026     [CSR_SSP]  = { "ssp", cfi_ss, read_ssp, write_ssp },
5027 
5028 #if !defined(CONFIG_USER_ONLY)
5029     /* Machine Timers and Counters */
5030     [CSR_MCYCLE]    = { "mcycle",    any,   read_hpmcounter,
5031                         write_mhpmcounter                    },
5032     [CSR_MINSTRET]  = { "minstret",  any,   read_hpmcounter,
5033                         write_mhpmcounter                    },
5034     [CSR_MCYCLEH]   = { "mcycleh",   any32, read_hpmcounterh,
5035                         write_mhpmcounterh                   },
5036     [CSR_MINSTRETH] = { "minstreth", any32, read_hpmcounterh,
5037                         write_mhpmcounterh                   },
5038 
5039     /* Machine Information Registers */
5040     [CSR_MVENDORID] = { "mvendorid", any,   read_mvendorid },
5041     [CSR_MARCHID]   = { "marchid",   any,   read_marchid   },
5042     [CSR_MIMPID]    = { "mimpid",    any,   read_mimpid    },
5043     [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid   },
5044 
5045     [CSR_MCONFIGPTR]  = { "mconfigptr", any,   read_zero,
5046                           .min_priv_ver = PRIV_VERSION_1_12_0 },
5047     /* Machine Trap Setup */
5048     [CSR_MSTATUS]     = { "mstatus",    any,   read_mstatus, write_mstatus,
5049                           NULL,                read_mstatus_i128           },
5050     [CSR_MISA]        = { "misa",       any,   read_misa,    write_misa,
5051                           NULL,                read_misa_i128              },
5052     [CSR_MIDELEG]     = { "mideleg",    any,   NULL, NULL,   rmw_mideleg   },
5053     [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg, write_medeleg },
5054     [CSR_MIE]         = { "mie",        any,   NULL, NULL,   rmw_mie       },
5055     [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,   write_mtvec   },
5056     [CSR_MCOUNTEREN]  = { "mcounteren", umode, read_mcounteren,
5057                           write_mcounteren                                 },
5058 
5059     [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,
5060                           write_mstatush                                   },
5061     [CSR_MEDELEGH]    = { "medelegh",   any32, read_zero, write_ignore,
5062                           .min_priv_ver = PRIV_VERSION_1_13_0              },
5063     [CSR_HEDELEGH]    = { "hedelegh",   hmode32, read_hedelegh, write_hedelegh,
5064                           .min_priv_ver = PRIV_VERSION_1_13_0              },
5065 
5066     /* Machine Trap Handling */
5067     [CSR_MSCRATCH] = { "mscratch", any,  read_mscratch, write_mscratch,
5068                        NULL, read_mscratch_i128, write_mscratch_i128   },
5069     [CSR_MEPC]     = { "mepc",     any,  read_mepc,     write_mepc     },
5070     [CSR_MCAUSE]   = { "mcause",   any,  read_mcause,   write_mcause   },
5071     [CSR_MTVAL]    = { "mtval",    any,  read_mtval,    write_mtval    },
5072     [CSR_MIP]      = { "mip",      any,  NULL,    NULL, rmw_mip        },
5073 
5074     /* Machine-Level Window to Indirectly Accessed Registers (AIA) */
5075     [CSR_MISELECT] = { "miselect", aia_any,   NULL, NULL,    rmw_xiselect },
5076     [CSR_MIREG]    = { "mireg",    aia_any,   NULL, NULL,    rmw_xireg },
5077 
5078     /* Machine-Level Interrupts (AIA) */
5079     [CSR_MTOPEI]   = { "mtopei",   aia_any, NULL, NULL, rmw_xtopei },
5080     [CSR_MTOPI]    = { "mtopi",    aia_any, read_mtopi },
5081 
5082     /* Virtual Interrupts for Supervisor Level (AIA) */
5083     [CSR_MVIEN]    = { "mvien",    aia_any, NULL, NULL, rmw_mvien   },
5084     [CSR_MVIP]     = { "mvip",     aia_any, NULL, NULL, rmw_mvip    },
5085 
5086     /* Machine-Level High-Half CSRs (AIA) */
5087     [CSR_MIDELEGH] = { "midelegh", aia_any32, NULL, NULL, rmw_midelegh },
5088     [CSR_MIEH]     = { "mieh",     aia_any32, NULL, NULL, rmw_mieh     },
5089     [CSR_MVIENH]   = { "mvienh",   aia_any32, NULL, NULL, rmw_mvienh   },
5090     [CSR_MVIPH]    = { "mviph",    aia_any32, NULL, NULL, rmw_mviph    },
5091     [CSR_MIPH]     = { "miph",     aia_any32, NULL, NULL, rmw_miph     },
5092 
5093     /* Execution environment configuration */
5094     [CSR_MENVCFG]  = { "menvcfg",  umode, read_menvcfg,  write_menvcfg,
5095                        .min_priv_ver = PRIV_VERSION_1_12_0              },
5096     [CSR_MENVCFGH] = { "menvcfgh", umode32, read_menvcfgh, write_menvcfgh,
5097                        .min_priv_ver = PRIV_VERSION_1_12_0              },
5098     [CSR_SENVCFG]  = { "senvcfg",  smode, read_senvcfg,  write_senvcfg,
5099                        .min_priv_ver = PRIV_VERSION_1_12_0              },
5100     [CSR_HENVCFG]  = { "henvcfg",  hmode, read_henvcfg, write_henvcfg,
5101                        .min_priv_ver = PRIV_VERSION_1_12_0              },
5102     [CSR_HENVCFGH] = { "henvcfgh", hmode32, read_henvcfgh, write_henvcfgh,
5103                        .min_priv_ver = PRIV_VERSION_1_12_0              },
5104 
5105     /* Smstateen extension CSRs */
5106     [CSR_MSTATEEN0] = { "mstateen0", mstateen, read_mstateen, write_mstateen0,
5107                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5108     [CSR_MSTATEEN0H] = { "mstateen0h", mstateen, read_mstateenh,
5109                           write_mstateen0h,
5110                          .min_priv_ver = PRIV_VERSION_1_12_0 },
5111     [CSR_MSTATEEN1] = { "mstateen1", mstateen, read_mstateen,
5112                         write_mstateen_1_3,
5113                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5114     [CSR_MSTATEEN1H] = { "mstateen1h", mstateen, read_mstateenh,
5115                          write_mstateenh_1_3,
5116                          .min_priv_ver = PRIV_VERSION_1_12_0 },
5117     [CSR_MSTATEEN2] = { "mstateen2", mstateen, read_mstateen,
5118                         write_mstateen_1_3,
5119                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5120     [CSR_MSTATEEN2H] = { "mstateen2h", mstateen, read_mstateenh,
5121                          write_mstateenh_1_3,
5122                          .min_priv_ver = PRIV_VERSION_1_12_0 },
5123     [CSR_MSTATEEN3] = { "mstateen3", mstateen, read_mstateen,
5124                         write_mstateen_1_3,
5125                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5126     [CSR_MSTATEEN3H] = { "mstateen3h", mstateen, read_mstateenh,
5127                          write_mstateenh_1_3,
5128                          .min_priv_ver = PRIV_VERSION_1_12_0 },
5129     [CSR_HSTATEEN0] = { "hstateen0", hstateen, read_hstateen, write_hstateen0,
5130                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5131     [CSR_HSTATEEN0H] = { "hstateen0h", hstateenh, read_hstateenh,
5132                          write_hstateen0h,
5133                          .min_priv_ver = PRIV_VERSION_1_12_0 },
5134     [CSR_HSTATEEN1] = { "hstateen1", hstateen, read_hstateen,
5135                         write_hstateen_1_3,
5136                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5137     [CSR_HSTATEEN1H] = { "hstateen1h", hstateenh, read_hstateenh,
5138                          write_hstateenh_1_3,
5139                          .min_priv_ver = PRIV_VERSION_1_12_0 },
5140     [CSR_HSTATEEN2] = { "hstateen2", hstateen, read_hstateen,
5141                         write_hstateen_1_3,
5142                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5143     [CSR_HSTATEEN2H] = { "hstateen2h", hstateenh, read_hstateenh,
5144                          write_hstateenh_1_3,
5145                          .min_priv_ver = PRIV_VERSION_1_12_0 },
5146     [CSR_HSTATEEN3] = { "hstateen3", hstateen, read_hstateen,
5147                         write_hstateen_1_3,
5148                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5149     [CSR_HSTATEEN3H] = { "hstateen3h", hstateenh, read_hstateenh,
5150                          write_hstateenh_1_3,
5151                          .min_priv_ver = PRIV_VERSION_1_12_0 },
5152     [CSR_SSTATEEN0] = { "sstateen0", sstateen, read_sstateen, write_sstateen0,
5153                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5154     [CSR_SSTATEEN1] = { "sstateen1", sstateen, read_sstateen,
5155                         write_sstateen_1_3,
5156                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5157     [CSR_SSTATEEN2] = { "sstateen2", sstateen, read_sstateen,
5158                         write_sstateen_1_3,
5159                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5160     [CSR_SSTATEEN3] = { "sstateen3", sstateen, read_sstateen,
5161                         write_sstateen_1_3,
5162                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5163 
5164     /* Supervisor Trap Setup */
5165     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
5166                          NULL,                read_sstatus_i128              },
5167     [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie       },
5168     [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec   },
5169     [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren,
5170                          write_scounteren                                    },
5171 
5172     /* Supervisor Trap Handling */
5173     [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch,
5174                        NULL, read_sscratch_i128, write_sscratch_i128    },
5175     [CSR_SEPC]     = { "sepc",     smode, read_sepc,     write_sepc     },
5176     [CSR_SCAUSE]   = { "scause",   smode, read_scause,   write_scause   },
5177     [CSR_STVAL]    = { "stval",    smode, read_stval,    write_stval    },
5178     [CSR_SIP]      = { "sip",      smode, NULL,    NULL, rmw_sip        },
5179     [CSR_STIMECMP] = { "stimecmp", sstc, read_stimecmp, write_stimecmp,
5180                        .min_priv_ver = PRIV_VERSION_1_12_0 },
5181     [CSR_STIMECMPH] = { "stimecmph", sstc_32, read_stimecmph, write_stimecmph,
5182                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5183     [CSR_VSTIMECMP] = { "vstimecmp", sstc, read_vstimecmp,
5184                         write_vstimecmp,
5185                         .min_priv_ver = PRIV_VERSION_1_12_0 },
5186     [CSR_VSTIMECMPH] = { "vstimecmph", sstc_32, read_vstimecmph,
5187                          write_vstimecmph,
5188                          .min_priv_ver = PRIV_VERSION_1_12_0 },
5189 
5190     /* Supervisor Protection and Translation */
5191     [CSR_SATP]     = { "satp",     satp, read_satp,     write_satp     },
5192 
5193     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
5194     [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
5195     [CSR_SIREG]      = { "sireg",      aia_smode, NULL, NULL, rmw_xireg },
5196 
5197     /* Supervisor-Level Interrupts (AIA) */
5198     [CSR_STOPEI]     = { "stopei",     aia_smode, NULL, NULL, rmw_xtopei },
5199     [CSR_STOPI]      = { "stopi",      aia_smode, read_stopi },
5200 
5201     /* Supervisor-Level High-Half CSRs (AIA) */
5202     [CSR_SIEH]       = { "sieh",   aia_smode32, NULL, NULL, rmw_sieh },
5203     [CSR_SIPH]       = { "siph",   aia_smode32, NULL, NULL, rmw_siph },
5204 
5205     [CSR_HSTATUS]     = { "hstatus",     hmode,   read_hstatus, write_hstatus,
5206                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5207     [CSR_HEDELEG]     = { "hedeleg",     hmode,   read_hedeleg, write_hedeleg,
5208                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5209     [CSR_HIDELEG]     = { "hideleg",     hmode,   NULL,   NULL, rmw_hideleg,
5210                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5211     [CSR_HVIP]        = { "hvip",        hmode,   NULL,   NULL, rmw_hvip,
5212                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5213     [CSR_HIP]         = { "hip",         hmode,   NULL,   NULL, rmw_hip,
5214                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5215     [CSR_HIE]         = { "hie",         hmode,   NULL,   NULL, rmw_hie,
5216                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5217     [CSR_HCOUNTEREN]  = { "hcounteren",  hmode,   read_hcounteren,
5218                           write_hcounteren,
5219                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5220     [CSR_HGEIE]       = { "hgeie",       hmode,   read_hgeie,   write_hgeie,
5221                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5222     [CSR_HTVAL]       = { "htval",       hmode,   read_htval,   write_htval,
5223                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5224     [CSR_HTINST]      = { "htinst",      hmode,   read_htinst,  write_htinst,
5225                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5226     [CSR_HGEIP]       = { "hgeip",       hmode,   read_hgeip,
5227                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5228     [CSR_HGATP]       = { "hgatp",       hgatp,   read_hgatp,   write_hgatp,
5229                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5230     [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta,
5231                           write_htimedelta,
5232                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5233     [CSR_HTIMEDELTAH] = { "htimedeltah", hmode32, read_htimedeltah,
5234                           write_htimedeltah,
5235                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5236 
5237     [CSR_VSSTATUS]    = { "vsstatus",    hmode,   read_vsstatus,
5238                           write_vsstatus,
5239                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5240     [CSR_VSIP]        = { "vsip",        hmode,   NULL,    NULL, rmw_vsip,
5241                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5242     [CSR_VSIE]        = { "vsie",        hmode,   NULL,    NULL, rmw_vsie ,
5243                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5244     [CSR_VSTVEC]      = { "vstvec",      hmode,   read_vstvec,   write_vstvec,
5245                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5246     [CSR_VSSCRATCH]   = { "vsscratch",   hmode,   read_vsscratch,
5247                           write_vsscratch,
5248                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5249     [CSR_VSEPC]       = { "vsepc",       hmode,   read_vsepc,    write_vsepc,
5250                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5251     [CSR_VSCAUSE]     = { "vscause",     hmode,   read_vscause,  write_vscause,
5252                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5253     [CSR_VSTVAL]      = { "vstval",      hmode,   read_vstval,   write_vstval,
5254                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5255     [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,    write_vsatp,
5256                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5257 
5258     [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,   write_mtval2,
5259                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5260     [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,   write_mtinst,
5261                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5262 
5263     /* Virtual Interrupts and Interrupt Priorities (H-extension with AIA) */
5264     [CSR_HVIEN]       = { "hvien",       aia_hmode, NULL, NULL, rmw_hvien },
5265     [CSR_HVICTL]      = { "hvictl",      aia_hmode, read_hvictl,
5266                           write_hvictl                                      },
5267     [CSR_HVIPRIO1]    = { "hviprio1",    aia_hmode, read_hviprio1,
5268                           write_hviprio1                                    },
5269     [CSR_HVIPRIO2]    = { "hviprio2",    aia_hmode, read_hviprio2,
5270                           write_hviprio2                                    },
5271     /*
5272      * VS-Level Window to Indirectly Accessed Registers (H-extension with AIA)
5273      */
5274     [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,
5275                           rmw_xiselect                                     },
5276     [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL, rmw_xireg  },
5277 
5278     /* VS-Level Interrupts (H-extension with AIA) */
5279     [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
5280     [CSR_VSTOPI]      = { "vstopi",      aia_hmode, read_vstopi },
5281 
5282     /* Hypervisor and VS-Level High-Half CSRs (H-extension with AIA) */
5283     [CSR_HIDELEGH]    = { "hidelegh",    aia_hmode32, NULL, NULL,
5284                           rmw_hidelegh                                      },
5285     [CSR_HVIENH]      = { "hvienh",      aia_hmode32, NULL, NULL, rmw_hvienh },
5286     [CSR_HVIPH]       = { "hviph",       aia_hmode32, NULL, NULL, rmw_hviph },
5287     [CSR_HVIPRIO1H]   = { "hviprio1h",   aia_hmode32, read_hviprio1h,
5288                           write_hviprio1h                                   },
5289     [CSR_HVIPRIO2H]   = { "hviprio2h",   aia_hmode32, read_hviprio2h,
5290                           write_hviprio2h                                   },
5291     [CSR_VSIEH]       = { "vsieh",       aia_hmode32, NULL, NULL, rmw_vsieh },
5292     [CSR_VSIPH]       = { "vsiph",       aia_hmode32, NULL, NULL, rmw_vsiph },
5293 
5294     /* Physical Memory Protection */
5295     [CSR_MSECCFG]    = { "mseccfg",   have_mseccfg, read_mseccfg, write_mseccfg,
5296                          .min_priv_ver = PRIV_VERSION_1_11_0           },
5297     [CSR_PMPCFG0]    = { "pmpcfg0",   pmp, read_pmpcfg,  write_pmpcfg  },
5298     [CSR_PMPCFG1]    = { "pmpcfg1",   pmp, read_pmpcfg,  write_pmpcfg  },
5299     [CSR_PMPCFG2]    = { "pmpcfg2",   pmp, read_pmpcfg,  write_pmpcfg  },
5300     [CSR_PMPCFG3]    = { "pmpcfg3",   pmp, read_pmpcfg,  write_pmpcfg  },
5301     [CSR_PMPADDR0]   = { "pmpaddr0",  pmp, read_pmpaddr, write_pmpaddr },
5302     [CSR_PMPADDR1]   = { "pmpaddr1",  pmp, read_pmpaddr, write_pmpaddr },
5303     [CSR_PMPADDR2]   = { "pmpaddr2",  pmp, read_pmpaddr, write_pmpaddr },
5304     [CSR_PMPADDR3]   = { "pmpaddr3",  pmp, read_pmpaddr, write_pmpaddr },
5305     [CSR_PMPADDR4]   = { "pmpaddr4",  pmp, read_pmpaddr, write_pmpaddr },
5306     [CSR_PMPADDR5]   = { "pmpaddr5",  pmp, read_pmpaddr, write_pmpaddr },
5307     [CSR_PMPADDR6]   = { "pmpaddr6",  pmp, read_pmpaddr, write_pmpaddr },
5308     [CSR_PMPADDR7]   = { "pmpaddr7",  pmp, read_pmpaddr, write_pmpaddr },
5309     [CSR_PMPADDR8]   = { "pmpaddr8",  pmp, read_pmpaddr, write_pmpaddr },
5310     [CSR_PMPADDR9]   = { "pmpaddr9",  pmp, read_pmpaddr, write_pmpaddr },
5311     [CSR_PMPADDR10]  = { "pmpaddr10", pmp, read_pmpaddr, write_pmpaddr },
5312     [CSR_PMPADDR11]  = { "pmpaddr11", pmp, read_pmpaddr, write_pmpaddr },
5313     [CSR_PMPADDR12]  = { "pmpaddr12", pmp, read_pmpaddr, write_pmpaddr },
5314     [CSR_PMPADDR13]  = { "pmpaddr13", pmp, read_pmpaddr, write_pmpaddr },
5315     [CSR_PMPADDR14] =  { "pmpaddr14", pmp, read_pmpaddr, write_pmpaddr },
5316     [CSR_PMPADDR15] =  { "pmpaddr15", pmp, read_pmpaddr, write_pmpaddr },
5317 
5318     /* Debug CSRs */
5319     [CSR_TSELECT]   =  { "tselect",  debug, read_tselect,  write_tselect  },
5320     [CSR_TDATA1]    =  { "tdata1",   debug, read_tdata,    write_tdata    },
5321     [CSR_TDATA2]    =  { "tdata2",   debug, read_tdata,    write_tdata    },
5322     [CSR_TDATA3]    =  { "tdata3",   debug, read_tdata,    write_tdata    },
5323     [CSR_TINFO]     =  { "tinfo",    debug, read_tinfo,    write_ignore   },
5324     [CSR_MCONTEXT]  =  { "mcontext", debug, read_mcontext, write_mcontext },
5325 
5326     /* User Pointer Masking */
5327     [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,  write_umte },
5328     [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask,
5329                          write_upmmask                                      },
5330     [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase,
5331                          write_upmbase                                      },
5332     /* Machine Pointer Masking */
5333     [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,  write_mmte },
5334     [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask,
5335                          write_mpmmask                                      },
5336     [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase,
5337                          write_mpmbase                                      },
5338     /* Supervisor Pointer Masking */
5339     [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,  write_smte },
5340     [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask,
5341                          write_spmmask                                      },
5342     [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase,
5343                          write_spmbase                                      },
5344 
5345     /* Performance Counters */
5346     [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
5347     [CSR_HPMCOUNTER4]    = { "hpmcounter4",    ctr,    read_hpmcounter },
5348     [CSR_HPMCOUNTER5]    = { "hpmcounter5",    ctr,    read_hpmcounter },
5349     [CSR_HPMCOUNTER6]    = { "hpmcounter6",    ctr,    read_hpmcounter },
5350     [CSR_HPMCOUNTER7]    = { "hpmcounter7",    ctr,    read_hpmcounter },
5351     [CSR_HPMCOUNTER8]    = { "hpmcounter8",    ctr,    read_hpmcounter },
5352     [CSR_HPMCOUNTER9]    = { "hpmcounter9",    ctr,    read_hpmcounter },
5353     [CSR_HPMCOUNTER10]   = { "hpmcounter10",   ctr,    read_hpmcounter },
5354     [CSR_HPMCOUNTER11]   = { "hpmcounter11",   ctr,    read_hpmcounter },
5355     [CSR_HPMCOUNTER12]   = { "hpmcounter12",   ctr,    read_hpmcounter },
5356     [CSR_HPMCOUNTER13]   = { "hpmcounter13",   ctr,    read_hpmcounter },
5357     [CSR_HPMCOUNTER14]   = { "hpmcounter14",   ctr,    read_hpmcounter },
5358     [CSR_HPMCOUNTER15]   = { "hpmcounter15",   ctr,    read_hpmcounter },
5359     [CSR_HPMCOUNTER16]   = { "hpmcounter16",   ctr,    read_hpmcounter },
5360     [CSR_HPMCOUNTER17]   = { "hpmcounter17",   ctr,    read_hpmcounter },
5361     [CSR_HPMCOUNTER18]   = { "hpmcounter18",   ctr,    read_hpmcounter },
5362     [CSR_HPMCOUNTER19]   = { "hpmcounter19",   ctr,    read_hpmcounter },
5363     [CSR_HPMCOUNTER20]   = { "hpmcounter20",   ctr,    read_hpmcounter },
5364     [CSR_HPMCOUNTER21]   = { "hpmcounter21",   ctr,    read_hpmcounter },
5365     [CSR_HPMCOUNTER22]   = { "hpmcounter22",   ctr,    read_hpmcounter },
5366     [CSR_HPMCOUNTER23]   = { "hpmcounter23",   ctr,    read_hpmcounter },
5367     [CSR_HPMCOUNTER24]   = { "hpmcounter24",   ctr,    read_hpmcounter },
5368     [CSR_HPMCOUNTER25]   = { "hpmcounter25",   ctr,    read_hpmcounter },
5369     [CSR_HPMCOUNTER26]   = { "hpmcounter26",   ctr,    read_hpmcounter },
5370     [CSR_HPMCOUNTER27]   = { "hpmcounter27",   ctr,    read_hpmcounter },
5371     [CSR_HPMCOUNTER28]   = { "hpmcounter28",   ctr,    read_hpmcounter },
5372     [CSR_HPMCOUNTER29]   = { "hpmcounter29",   ctr,    read_hpmcounter },
5373     [CSR_HPMCOUNTER30]   = { "hpmcounter30",   ctr,    read_hpmcounter },
5374     [CSR_HPMCOUNTER31]   = { "hpmcounter31",   ctr,    read_hpmcounter },
5375 
5376     [CSR_MHPMCOUNTER3]   = { "mhpmcounter3",   mctr,    read_hpmcounter,
5377                              write_mhpmcounter                         },
5378     [CSR_MHPMCOUNTER4]   = { "mhpmcounter4",   mctr,    read_hpmcounter,
5379                              write_mhpmcounter                         },
5380     [CSR_MHPMCOUNTER5]   = { "mhpmcounter5",   mctr,    read_hpmcounter,
5381                              write_mhpmcounter                         },
5382     [CSR_MHPMCOUNTER6]   = { "mhpmcounter6",   mctr,    read_hpmcounter,
5383                              write_mhpmcounter                         },
5384     [CSR_MHPMCOUNTER7]   = { "mhpmcounter7",   mctr,    read_hpmcounter,
5385                              write_mhpmcounter                         },
5386     [CSR_MHPMCOUNTER8]   = { "mhpmcounter8",   mctr,    read_hpmcounter,
5387                              write_mhpmcounter                         },
5388     [CSR_MHPMCOUNTER9]   = { "mhpmcounter9",   mctr,    read_hpmcounter,
5389                              write_mhpmcounter                         },
5390     [CSR_MHPMCOUNTER10]  = { "mhpmcounter10",  mctr,    read_hpmcounter,
5391                              write_mhpmcounter                         },
5392     [CSR_MHPMCOUNTER11]  = { "mhpmcounter11",  mctr,    read_hpmcounter,
5393                              write_mhpmcounter                         },
5394     [CSR_MHPMCOUNTER12]  = { "mhpmcounter12",  mctr,    read_hpmcounter,
5395                              write_mhpmcounter                         },
5396     [CSR_MHPMCOUNTER13]  = { "mhpmcounter13",  mctr,    read_hpmcounter,
5397                              write_mhpmcounter                         },
5398     [CSR_MHPMCOUNTER14]  = { "mhpmcounter14",  mctr,    read_hpmcounter,
5399                              write_mhpmcounter                         },
5400     [CSR_MHPMCOUNTER15]  = { "mhpmcounter15",  mctr,    read_hpmcounter,
5401                              write_mhpmcounter                         },
5402     [CSR_MHPMCOUNTER16]  = { "mhpmcounter16",  mctr,    read_hpmcounter,
5403                              write_mhpmcounter                         },
5404     [CSR_MHPMCOUNTER17]  = { "mhpmcounter17",  mctr,    read_hpmcounter,
5405                              write_mhpmcounter                         },
5406     [CSR_MHPMCOUNTER18]  = { "mhpmcounter18",  mctr,    read_hpmcounter,
5407                              write_mhpmcounter                         },
5408     [CSR_MHPMCOUNTER19]  = { "mhpmcounter19",  mctr,    read_hpmcounter,
5409                              write_mhpmcounter                         },
5410     [CSR_MHPMCOUNTER20]  = { "mhpmcounter20",  mctr,    read_hpmcounter,
5411                              write_mhpmcounter                         },
5412     [CSR_MHPMCOUNTER21]  = { "mhpmcounter21",  mctr,    read_hpmcounter,
5413                              write_mhpmcounter                         },
5414     [CSR_MHPMCOUNTER22]  = { "mhpmcounter22",  mctr,    read_hpmcounter,
5415                              write_mhpmcounter                         },
5416     [CSR_MHPMCOUNTER23]  = { "mhpmcounter23",  mctr,    read_hpmcounter,
5417                              write_mhpmcounter                         },
5418     [CSR_MHPMCOUNTER24]  = { "mhpmcounter24",  mctr,    read_hpmcounter,
5419                              write_mhpmcounter                         },
5420     [CSR_MHPMCOUNTER25]  = { "mhpmcounter25",  mctr,    read_hpmcounter,
5421                              write_mhpmcounter                         },
5422     [CSR_MHPMCOUNTER26]  = { "mhpmcounter26",  mctr,    read_hpmcounter,
5423                              write_mhpmcounter                         },
5424     [CSR_MHPMCOUNTER27]  = { "mhpmcounter27",  mctr,    read_hpmcounter,
5425                              write_mhpmcounter                         },
5426     [CSR_MHPMCOUNTER28]  = { "mhpmcounter28",  mctr,    read_hpmcounter,
5427                              write_mhpmcounter                         },
5428     [CSR_MHPMCOUNTER29]  = { "mhpmcounter29",  mctr,    read_hpmcounter,
5429                              write_mhpmcounter                         },
5430     [CSR_MHPMCOUNTER30]  = { "mhpmcounter30",  mctr,    read_hpmcounter,
5431                              write_mhpmcounter                         },
5432     [CSR_MHPMCOUNTER31]  = { "mhpmcounter31",  mctr,    read_hpmcounter,
5433                              write_mhpmcounter                         },
5434 
5435     [CSR_MCOUNTINHIBIT]  = { "mcountinhibit",  any, read_mcountinhibit,
5436                              write_mcountinhibit,
5437                              .min_priv_ver = PRIV_VERSION_1_11_0       },
5438 
5439     [CSR_MCYCLECFG]      = { "mcyclecfg",   smcntrpmf, read_mcyclecfg,
5440                              write_mcyclecfg,
5441                              .min_priv_ver = PRIV_VERSION_1_12_0       },
5442     [CSR_MINSTRETCFG]    = { "minstretcfg", smcntrpmf, read_minstretcfg,
5443                              write_minstretcfg,
5444                              .min_priv_ver = PRIV_VERSION_1_12_0       },
5445 
5446     [CSR_MHPMEVENT3]     = { "mhpmevent3",     any,    read_mhpmevent,
5447                              write_mhpmevent                           },
5448     [CSR_MHPMEVENT4]     = { "mhpmevent4",     any,    read_mhpmevent,
5449                              write_mhpmevent                           },
5450     [CSR_MHPMEVENT5]     = { "mhpmevent5",     any,    read_mhpmevent,
5451                              write_mhpmevent                           },
5452     [CSR_MHPMEVENT6]     = { "mhpmevent6",     any,    read_mhpmevent,
5453                              write_mhpmevent                           },
5454     [CSR_MHPMEVENT7]     = { "mhpmevent7",     any,    read_mhpmevent,
5455                              write_mhpmevent                           },
5456     [CSR_MHPMEVENT8]     = { "mhpmevent8",     any,    read_mhpmevent,
5457                              write_mhpmevent                           },
5458     [CSR_MHPMEVENT9]     = { "mhpmevent9",     any,    read_mhpmevent,
5459                              write_mhpmevent                           },
5460     [CSR_MHPMEVENT10]    = { "mhpmevent10",    any,    read_mhpmevent,
5461                              write_mhpmevent                           },
5462     [CSR_MHPMEVENT11]    = { "mhpmevent11",    any,    read_mhpmevent,
5463                              write_mhpmevent                           },
5464     [CSR_MHPMEVENT12]    = { "mhpmevent12",    any,    read_mhpmevent,
5465                              write_mhpmevent                           },
5466     [CSR_MHPMEVENT13]    = { "mhpmevent13",    any,    read_mhpmevent,
5467                              write_mhpmevent                           },
5468     [CSR_MHPMEVENT14]    = { "mhpmevent14",    any,    read_mhpmevent,
5469                              write_mhpmevent                           },
5470     [CSR_MHPMEVENT15]    = { "mhpmevent15",    any,    read_mhpmevent,
5471                              write_mhpmevent                           },
5472     [CSR_MHPMEVENT16]    = { "mhpmevent16",    any,    read_mhpmevent,
5473                              write_mhpmevent                           },
5474     [CSR_MHPMEVENT17]    = { "mhpmevent17",    any,    read_mhpmevent,
5475                              write_mhpmevent                           },
5476     [CSR_MHPMEVENT18]    = { "mhpmevent18",    any,    read_mhpmevent,
5477                              write_mhpmevent                           },
5478     [CSR_MHPMEVENT19]    = { "mhpmevent19",    any,    read_mhpmevent,
5479                              write_mhpmevent                           },
5480     [CSR_MHPMEVENT20]    = { "mhpmevent20",    any,    read_mhpmevent,
5481                              write_mhpmevent                           },
5482     [CSR_MHPMEVENT21]    = { "mhpmevent21",    any,    read_mhpmevent,
5483                              write_mhpmevent                           },
5484     [CSR_MHPMEVENT22]    = { "mhpmevent22",    any,    read_mhpmevent,
5485                              write_mhpmevent                           },
5486     [CSR_MHPMEVENT23]    = { "mhpmevent23",    any,    read_mhpmevent,
5487                              write_mhpmevent                           },
5488     [CSR_MHPMEVENT24]    = { "mhpmevent24",    any,    read_mhpmevent,
5489                              write_mhpmevent                           },
5490     [CSR_MHPMEVENT25]    = { "mhpmevent25",    any,    read_mhpmevent,
5491                              write_mhpmevent                           },
5492     [CSR_MHPMEVENT26]    = { "mhpmevent26",    any,    read_mhpmevent,
5493                              write_mhpmevent                           },
5494     [CSR_MHPMEVENT27]    = { "mhpmevent27",    any,    read_mhpmevent,
5495                              write_mhpmevent                           },
5496     [CSR_MHPMEVENT28]    = { "mhpmevent28",    any,    read_mhpmevent,
5497                              write_mhpmevent                           },
5498     [CSR_MHPMEVENT29]    = { "mhpmevent29",    any,    read_mhpmevent,
5499                              write_mhpmevent                           },
5500     [CSR_MHPMEVENT30]    = { "mhpmevent30",    any,    read_mhpmevent,
5501                              write_mhpmevent                           },
5502     [CSR_MHPMEVENT31]    = { "mhpmevent31",    any,    read_mhpmevent,
5503                              write_mhpmevent                           },
5504 
5505     [CSR_MCYCLECFGH]     = { "mcyclecfgh",   smcntrpmf_32, read_mcyclecfgh,
5506                              write_mcyclecfgh,
5507                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5508     [CSR_MINSTRETCFGH]   = { "minstretcfgh", smcntrpmf_32, read_minstretcfgh,
5509                              write_minstretcfgh,
5510                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5511 
5512     [CSR_MHPMEVENT3H]    = { "mhpmevent3h",    sscofpmf_32,  read_mhpmeventh,
5513                              write_mhpmeventh,
5514                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5515     [CSR_MHPMEVENT4H]    = { "mhpmevent4h",    sscofpmf_32,  read_mhpmeventh,
5516                              write_mhpmeventh,
5517                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5518     [CSR_MHPMEVENT5H]    = { "mhpmevent5h",    sscofpmf_32,  read_mhpmeventh,
5519                              write_mhpmeventh,
5520                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5521     [CSR_MHPMEVENT6H]    = { "mhpmevent6h",    sscofpmf_32,  read_mhpmeventh,
5522                              write_mhpmeventh,
5523                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5524     [CSR_MHPMEVENT7H]    = { "mhpmevent7h",    sscofpmf_32,  read_mhpmeventh,
5525                              write_mhpmeventh,
5526                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5527     [CSR_MHPMEVENT8H]    = { "mhpmevent8h",    sscofpmf_32,  read_mhpmeventh,
5528                              write_mhpmeventh,
5529                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5530     [CSR_MHPMEVENT9H]    = { "mhpmevent9h",    sscofpmf_32,  read_mhpmeventh,
5531                              write_mhpmeventh,
5532                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5533     [CSR_MHPMEVENT10H]   = { "mhpmevent10h",    sscofpmf_32,  read_mhpmeventh,
5534                              write_mhpmeventh,
5535                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5536     [CSR_MHPMEVENT11H]   = { "mhpmevent11h",    sscofpmf_32,  read_mhpmeventh,
5537                              write_mhpmeventh,
5538                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5539     [CSR_MHPMEVENT12H]   = { "mhpmevent12h",    sscofpmf_32,  read_mhpmeventh,
5540                              write_mhpmeventh,
5541                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5542     [CSR_MHPMEVENT13H]   = { "mhpmevent13h",    sscofpmf_32,  read_mhpmeventh,
5543                              write_mhpmeventh,
5544                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5545     [CSR_MHPMEVENT14H]   = { "mhpmevent14h",    sscofpmf_32,  read_mhpmeventh,
5546                              write_mhpmeventh,
5547                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5548     [CSR_MHPMEVENT15H]   = { "mhpmevent15h",    sscofpmf_32,  read_mhpmeventh,
5549                              write_mhpmeventh,
5550                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5551     [CSR_MHPMEVENT16H]   = { "mhpmevent16h",    sscofpmf_32,  read_mhpmeventh,
5552                              write_mhpmeventh,
5553                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5554     [CSR_MHPMEVENT17H]   = { "mhpmevent17h",    sscofpmf_32,  read_mhpmeventh,
5555                              write_mhpmeventh,
5556                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5557     [CSR_MHPMEVENT18H]   = { "mhpmevent18h",    sscofpmf_32,  read_mhpmeventh,
5558                              write_mhpmeventh,
5559                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5560     [CSR_MHPMEVENT19H]   = { "mhpmevent19h",    sscofpmf_32,  read_mhpmeventh,
5561                              write_mhpmeventh,
5562                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5563     [CSR_MHPMEVENT20H]   = { "mhpmevent20h",    sscofpmf_32,  read_mhpmeventh,
5564                              write_mhpmeventh,
5565                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5566     [CSR_MHPMEVENT21H]   = { "mhpmevent21h",    sscofpmf_32,  read_mhpmeventh,
5567                              write_mhpmeventh,
5568                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5569     [CSR_MHPMEVENT22H]   = { "mhpmevent22h",    sscofpmf_32,  read_mhpmeventh,
5570                              write_mhpmeventh,
5571                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5572     [CSR_MHPMEVENT23H]   = { "mhpmevent23h",    sscofpmf_32,  read_mhpmeventh,
5573                              write_mhpmeventh,
5574                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5575     [CSR_MHPMEVENT24H]   = { "mhpmevent24h",    sscofpmf_32,  read_mhpmeventh,
5576                              write_mhpmeventh,
5577                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5578     [CSR_MHPMEVENT25H]   = { "mhpmevent25h",    sscofpmf_32,  read_mhpmeventh,
5579                              write_mhpmeventh,
5580                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5581     [CSR_MHPMEVENT26H]   = { "mhpmevent26h",    sscofpmf_32,  read_mhpmeventh,
5582                              write_mhpmeventh,
5583                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5584     [CSR_MHPMEVENT27H]   = { "mhpmevent27h",    sscofpmf_32,  read_mhpmeventh,
5585                              write_mhpmeventh,
5586                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5587     [CSR_MHPMEVENT28H]   = { "mhpmevent28h",    sscofpmf_32,  read_mhpmeventh,
5588                              write_mhpmeventh,
5589                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5590     [CSR_MHPMEVENT29H]   = { "mhpmevent29h",    sscofpmf_32,  read_mhpmeventh,
5591                              write_mhpmeventh,
5592                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5593     [CSR_MHPMEVENT30H]   = { "mhpmevent30h",    sscofpmf_32,  read_mhpmeventh,
5594                              write_mhpmeventh,
5595                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5596     [CSR_MHPMEVENT31H]   = { "mhpmevent31h",    sscofpmf_32,  read_mhpmeventh,
5597                              write_mhpmeventh,
5598                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5599 
5600     [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
5601     [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
5602     [CSR_HPMCOUNTER5H]   = { "hpmcounter5h",   ctr32,  read_hpmcounterh },
5603     [CSR_HPMCOUNTER6H]   = { "hpmcounter6h",   ctr32,  read_hpmcounterh },
5604     [CSR_HPMCOUNTER7H]   = { "hpmcounter7h",   ctr32,  read_hpmcounterh },
5605     [CSR_HPMCOUNTER8H]   = { "hpmcounter8h",   ctr32,  read_hpmcounterh },
5606     [CSR_HPMCOUNTER9H]   = { "hpmcounter9h",   ctr32,  read_hpmcounterh },
5607     [CSR_HPMCOUNTER10H]  = { "hpmcounter10h",  ctr32,  read_hpmcounterh },
5608     [CSR_HPMCOUNTER11H]  = { "hpmcounter11h",  ctr32,  read_hpmcounterh },
5609     [CSR_HPMCOUNTER12H]  = { "hpmcounter12h",  ctr32,  read_hpmcounterh },
5610     [CSR_HPMCOUNTER13H]  = { "hpmcounter13h",  ctr32,  read_hpmcounterh },
5611     [CSR_HPMCOUNTER14H]  = { "hpmcounter14h",  ctr32,  read_hpmcounterh },
5612     [CSR_HPMCOUNTER15H]  = { "hpmcounter15h",  ctr32,  read_hpmcounterh },
5613     [CSR_HPMCOUNTER16H]  = { "hpmcounter16h",  ctr32,  read_hpmcounterh },
5614     [CSR_HPMCOUNTER17H]  = { "hpmcounter17h",  ctr32,  read_hpmcounterh },
5615     [CSR_HPMCOUNTER18H]  = { "hpmcounter18h",  ctr32,  read_hpmcounterh },
5616     [CSR_HPMCOUNTER19H]  = { "hpmcounter19h",  ctr32,  read_hpmcounterh },
5617     [CSR_HPMCOUNTER20H]  = { "hpmcounter20h",  ctr32,  read_hpmcounterh },
5618     [CSR_HPMCOUNTER21H]  = { "hpmcounter21h",  ctr32,  read_hpmcounterh },
5619     [CSR_HPMCOUNTER22H]  = { "hpmcounter22h",  ctr32,  read_hpmcounterh },
5620     [CSR_HPMCOUNTER23H]  = { "hpmcounter23h",  ctr32,  read_hpmcounterh },
5621     [CSR_HPMCOUNTER24H]  = { "hpmcounter24h",  ctr32,  read_hpmcounterh },
5622     [CSR_HPMCOUNTER25H]  = { "hpmcounter25h",  ctr32,  read_hpmcounterh },
5623     [CSR_HPMCOUNTER26H]  = { "hpmcounter26h",  ctr32,  read_hpmcounterh },
5624     [CSR_HPMCOUNTER27H]  = { "hpmcounter27h",  ctr32,  read_hpmcounterh },
5625     [CSR_HPMCOUNTER28H]  = { "hpmcounter28h",  ctr32,  read_hpmcounterh },
5626     [CSR_HPMCOUNTER29H]  = { "hpmcounter29h",  ctr32,  read_hpmcounterh },
5627     [CSR_HPMCOUNTER30H]  = { "hpmcounter30h",  ctr32,  read_hpmcounterh },
5628     [CSR_HPMCOUNTER31H]  = { "hpmcounter31h",  ctr32,  read_hpmcounterh },
5629 
5630     [CSR_MHPMCOUNTER3H]  = { "mhpmcounter3h",  mctr32,  read_hpmcounterh,
5631                              write_mhpmcounterh                         },
5632     [CSR_MHPMCOUNTER4H]  = { "mhpmcounter4h",  mctr32,  read_hpmcounterh,
5633                              write_mhpmcounterh                         },
5634     [CSR_MHPMCOUNTER5H]  = { "mhpmcounter5h",  mctr32,  read_hpmcounterh,
5635                              write_mhpmcounterh                         },
5636     [CSR_MHPMCOUNTER6H]  = { "mhpmcounter6h",  mctr32,  read_hpmcounterh,
5637                              write_mhpmcounterh                         },
5638     [CSR_MHPMCOUNTER7H]  = { "mhpmcounter7h",  mctr32,  read_hpmcounterh,
5639                              write_mhpmcounterh                         },
5640     [CSR_MHPMCOUNTER8H]  = { "mhpmcounter8h",  mctr32,  read_hpmcounterh,
5641                              write_mhpmcounterh                         },
5642     [CSR_MHPMCOUNTER9H]  = { "mhpmcounter9h",  mctr32,  read_hpmcounterh,
5643                              write_mhpmcounterh                         },
5644     [CSR_MHPMCOUNTER10H] = { "mhpmcounter10h", mctr32,  read_hpmcounterh,
5645                              write_mhpmcounterh                         },
5646     [CSR_MHPMCOUNTER11H] = { "mhpmcounter11h", mctr32,  read_hpmcounterh,
5647                              write_mhpmcounterh                         },
5648     [CSR_MHPMCOUNTER12H] = { "mhpmcounter12h", mctr32,  read_hpmcounterh,
5649                              write_mhpmcounterh                         },
5650     [CSR_MHPMCOUNTER13H] = { "mhpmcounter13h", mctr32,  read_hpmcounterh,
5651                              write_mhpmcounterh                         },
5652     [CSR_MHPMCOUNTER14H] = { "mhpmcounter14h", mctr32,  read_hpmcounterh,
5653                              write_mhpmcounterh                         },
5654     [CSR_MHPMCOUNTER15H] = { "mhpmcounter15h", mctr32,  read_hpmcounterh,
5655                              write_mhpmcounterh                         },
5656     [CSR_MHPMCOUNTER16H] = { "mhpmcounter16h", mctr32,  read_hpmcounterh,
5657                              write_mhpmcounterh                         },
5658     [CSR_MHPMCOUNTER17H] = { "mhpmcounter17h", mctr32,  read_hpmcounterh,
5659                              write_mhpmcounterh                         },
5660     [CSR_MHPMCOUNTER18H] = { "mhpmcounter18h", mctr32,  read_hpmcounterh,
5661                              write_mhpmcounterh                         },
5662     [CSR_MHPMCOUNTER19H] = { "mhpmcounter19h", mctr32,  read_hpmcounterh,
5663                              write_mhpmcounterh                         },
5664     [CSR_MHPMCOUNTER20H] = { "mhpmcounter20h", mctr32,  read_hpmcounterh,
5665                              write_mhpmcounterh                         },
5666     [CSR_MHPMCOUNTER21H] = { "mhpmcounter21h", mctr32,  read_hpmcounterh,
5667                              write_mhpmcounterh                         },
5668     [CSR_MHPMCOUNTER22H] = { "mhpmcounter22h", mctr32,  read_hpmcounterh,
5669                              write_mhpmcounterh                         },
5670     [CSR_MHPMCOUNTER23H] = { "mhpmcounter23h", mctr32,  read_hpmcounterh,
5671                              write_mhpmcounterh                         },
5672     [CSR_MHPMCOUNTER24H] = { "mhpmcounter24h", mctr32,  read_hpmcounterh,
5673                              write_mhpmcounterh                         },
5674     [CSR_MHPMCOUNTER25H] = { "mhpmcounter25h", mctr32,  read_hpmcounterh,
5675                              write_mhpmcounterh                         },
5676     [CSR_MHPMCOUNTER26H] = { "mhpmcounter26h", mctr32,  read_hpmcounterh,
5677                              write_mhpmcounterh                         },
5678     [CSR_MHPMCOUNTER27H] = { "mhpmcounter27h", mctr32,  read_hpmcounterh,
5679                              write_mhpmcounterh                         },
5680     [CSR_MHPMCOUNTER28H] = { "mhpmcounter28h", mctr32,  read_hpmcounterh,
5681                              write_mhpmcounterh                         },
5682     [CSR_MHPMCOUNTER29H] = { "mhpmcounter29h", mctr32,  read_hpmcounterh,
5683                              write_mhpmcounterh                         },
5684     [CSR_MHPMCOUNTER30H] = { "mhpmcounter30h", mctr32,  read_hpmcounterh,
5685                              write_mhpmcounterh                         },
5686     [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
5687                              write_mhpmcounterh                         },
5688     [CSR_SCOUNTOVF]      = { "scountovf", sscofpmf,  read_scountovf,
5689                              .min_priv_ver = PRIV_VERSION_1_12_0 },
5690 
5691 #endif /* !CONFIG_USER_ONLY */
5692 };
5693