xref: /openbmc/qemu/target/riscv/csr.c (revision 0c98ccef) 
1 /*
2  * RISC-V Control and Status Registers.
3  *
4  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
5  * Copyright (c) 2017-2018 SiFive, Inc.
6  *
7  * This program is free software; you can redistribute it and/or modify it
8  * under the terms and conditions of the GNU General Public License,
9  * version 2 or later, as published by the Free Software Foundation.
10  *
11  * This program is distributed in the hope it will be useful, but WITHOUT
12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
14  * more details.
15  *
16  * You should have received a copy of the GNU General Public License along with
17  * this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qemu/log.h"
22 #include "qemu/timer.h"
23 #include "cpu.h"
24 #include "pmu.h"
25 #include "time_helper.h"
26 #include "qemu/main-loop.h"
27 #include "exec/exec-all.h"
28 #include "exec/tb-flush.h"
29 #include "sysemu/cpu-timers.h"
30 #include "qemu/guest-random.h"
31 #include "qapi/error.h"
32 
33 /* CSR function table public API */
34 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
35 {
36     *ops = csr_ops[csrno & (CSR_TABLE_SIZE - 1)];
37 }
38 
39 void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
40 {
41     csr_ops[csrno & (CSR_TABLE_SIZE - 1)] = *ops;
42 }
43 
44 /* Predicates */
45 #if !defined(CONFIG_USER_ONLY)
46 RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit)
47 {
48     bool virt = env->virt_enabled;
49 
50     if (env->priv == PRV_M || !riscv_cpu_cfg(env)->ext_smstateen) {
51         return RISCV_EXCP_NONE;
52     }
53 
54     if (!(env->mstateen[index] & bit)) {
55         return RISCV_EXCP_ILLEGAL_INST;
56     }
57 
58     if (virt) {
59         if (!(env->hstateen[index] & bit)) {
60             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
61         }
62 
63         if (env->priv == PRV_U && !(env->sstateen[index] & bit)) {
64             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
65         }
66     }
67 
68     if (env->priv == PRV_U && riscv_has_ext(env, RVS)) {
69         if (!(env->sstateen[index] & bit)) {
70             return RISCV_EXCP_ILLEGAL_INST;
71         }
72     }
73 
74     return RISCV_EXCP_NONE;
75 }
76 #endif
77 
78 static RISCVException fs(CPURISCVState *env, int csrno)
79 {
80 #if !defined(CONFIG_USER_ONLY)
81     if (!env->debugger && !riscv_cpu_fp_enabled(env) &&
82         !riscv_cpu_cfg(env)->ext_zfinx) {
83         return RISCV_EXCP_ILLEGAL_INST;
84     }
85 #endif
86     return RISCV_EXCP_NONE;
87 }
88 
89 static RISCVException vs(CPURISCVState *env, int csrno)
90 {
91     if (riscv_cpu_cfg(env)->ext_zve32f) {
92 #if !defined(CONFIG_USER_ONLY)
93         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
94             return RISCV_EXCP_ILLEGAL_INST;
95         }
96 #endif
97         return RISCV_EXCP_NONE;
98     }
99     return RISCV_EXCP_ILLEGAL_INST;
100 }
101 
102 static RISCVException ctr(CPURISCVState *env, int csrno)
103 {
104 #if !defined(CONFIG_USER_ONLY)
105     RISCVCPU *cpu = env_archcpu(env);
106     int ctr_index;
107     target_ulong ctr_mask;
108     int base_csrno = CSR_CYCLE;
109     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
110 
111     if (rv32 && csrno >= CSR_CYCLEH) {
112         /* Offset for RV32 hpmcounternh counters */
113         base_csrno += 0x80;
114     }
115     ctr_index = csrno - base_csrno;
116     ctr_mask = BIT(ctr_index);
117 
118     if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) ||
119         (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) {
120         goto skip_ext_pmu_check;
121     }
122 
123     if (!(cpu->pmu_avail_ctrs & ctr_mask)) {
124         /* No counter is enabled in PMU or the counter is out of range */
125         return RISCV_EXCP_ILLEGAL_INST;
126     }
127 
128 skip_ext_pmu_check:
129 
130     if (env->debugger) {
131         return RISCV_EXCP_NONE;
132     }
133 
134     if (env->priv < PRV_M && !get_field(env->mcounteren, ctr_mask)) {
135         return RISCV_EXCP_ILLEGAL_INST;
136     }
137 
138     if (env->virt_enabled) {
139         if (!get_field(env->hcounteren, ctr_mask) ||
140             (env->priv == PRV_U && !get_field(env->scounteren, ctr_mask))) {
141             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
142         }
143     }
144 
145     if (riscv_has_ext(env, RVS) && env->priv == PRV_U &&
146         !get_field(env->scounteren, ctr_mask)) {
147         return RISCV_EXCP_ILLEGAL_INST;
148     }
149 
150 #endif
151     return RISCV_EXCP_NONE;
152 }
153 
154 static RISCVException ctr32(CPURISCVState *env, int csrno)
155 {
156     if (riscv_cpu_mxl(env) != MXL_RV32) {
157         return RISCV_EXCP_ILLEGAL_INST;
158     }
159 
160     return ctr(env, csrno);
161 }
162 
163 static RISCVException zcmt(CPURISCVState *env, int csrno)
164 {
165     if (!riscv_cpu_cfg(env)->ext_zcmt) {
166         return RISCV_EXCP_ILLEGAL_INST;
167     }
168 
169 #if !defined(CONFIG_USER_ONLY)
170     RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_JVT);
171     if (ret != RISCV_EXCP_NONE) {
172         return ret;
173     }
174 #endif
175 
176     return RISCV_EXCP_NONE;
177 }
178 
179 #if !defined(CONFIG_USER_ONLY)
180 static RISCVException mctr(CPURISCVState *env, int csrno)
181 {
182     int pmu_num = riscv_cpu_cfg(env)->pmu_num;
183     int ctr_index;
184     int base_csrno = CSR_MHPMCOUNTER3;
185 
186     if ((riscv_cpu_mxl(env) == MXL_RV32) && csrno >= CSR_MCYCLEH) {
187         /* Offset for RV32 mhpmcounternh counters */
188         base_csrno += 0x80;
189     }
190     ctr_index = csrno - base_csrno;
191     if (!pmu_num || ctr_index >= pmu_num) {
192         /* The PMU is not enabled or counter is out of range */
193         return RISCV_EXCP_ILLEGAL_INST;
194     }
195 
196     return RISCV_EXCP_NONE;
197 }
198 
199 static RISCVException mctr32(CPURISCVState *env, int csrno)
200 {
201     if (riscv_cpu_mxl(env) != MXL_RV32) {
202         return RISCV_EXCP_ILLEGAL_INST;
203     }
204 
205     return mctr(env, csrno);
206 }
207 
208 static RISCVException sscofpmf(CPURISCVState *env, int csrno)
209 {
210     if (!riscv_cpu_cfg(env)->ext_sscofpmf) {
211         return RISCV_EXCP_ILLEGAL_INST;
212     }
213 
214     return RISCV_EXCP_NONE;
215 }
216 
217 static RISCVException any(CPURISCVState *env, int csrno)
218 {
219     return RISCV_EXCP_NONE;
220 }
221 
222 static RISCVException any32(CPURISCVState *env, int csrno)
223 {
224     if (riscv_cpu_mxl(env) != MXL_RV32) {
225         return RISCV_EXCP_ILLEGAL_INST;
226     }
227 
228     return any(env, csrno);
229 
230 }
231 
232 static int aia_any(CPURISCVState *env, int csrno)
233 {
234     if (!riscv_cpu_cfg(env)->ext_smaia) {
235         return RISCV_EXCP_ILLEGAL_INST;
236     }
237 
238     return any(env, csrno);
239 }
240 
241 static int aia_any32(CPURISCVState *env, int csrno)
242 {
243     if (!riscv_cpu_cfg(env)->ext_smaia) {
244         return RISCV_EXCP_ILLEGAL_INST;
245     }
246 
247     return any32(env, csrno);
248 }
249 
250 static RISCVException smode(CPURISCVState *env, int csrno)
251 {
252     if (riscv_has_ext(env, RVS)) {
253         return RISCV_EXCP_NONE;
254     }
255 
256     return RISCV_EXCP_ILLEGAL_INST;
257 }
258 
259 static int smode32(CPURISCVState *env, int csrno)
260 {
261     if (riscv_cpu_mxl(env) != MXL_RV32) {
262         return RISCV_EXCP_ILLEGAL_INST;
263     }
264 
265     return smode(env, csrno);
266 }
267 
268 static int aia_smode(CPURISCVState *env, int csrno)
269 {
270     if (!riscv_cpu_cfg(env)->ext_ssaia) {
271         return RISCV_EXCP_ILLEGAL_INST;
272     }
273 
274     return smode(env, csrno);
275 }
276 
277 static int aia_smode32(CPURISCVState *env, int csrno)
278 {
279     if (!riscv_cpu_cfg(env)->ext_ssaia) {
280         return RISCV_EXCP_ILLEGAL_INST;
281     }
282 
283     return smode32(env, csrno);
284 }
285 
286 static RISCVException hmode(CPURISCVState *env, int csrno)
287 {
288     if (riscv_has_ext(env, RVH)) {
289         return RISCV_EXCP_NONE;
290     }
291 
292     return RISCV_EXCP_ILLEGAL_INST;
293 }
294 
295 static RISCVException hmode32(CPURISCVState *env, int csrno)
296 {
297     if (riscv_cpu_mxl(env) != MXL_RV32) {
298         return RISCV_EXCP_ILLEGAL_INST;
299     }
300 
301     return hmode(env, csrno);
302 
303 }
304 
305 static RISCVException umode(CPURISCVState *env, int csrno)
306 {
307     if (riscv_has_ext(env, RVU)) {
308         return RISCV_EXCP_NONE;
309     }
310 
311     return RISCV_EXCP_ILLEGAL_INST;
312 }
313 
314 static RISCVException umode32(CPURISCVState *env, int csrno)
315 {
316     if (riscv_cpu_mxl(env) != MXL_RV32) {
317         return RISCV_EXCP_ILLEGAL_INST;
318     }
319 
320     return umode(env, csrno);
321 }
322 
323 static RISCVException mstateen(CPURISCVState *env, int csrno)
324 {
325     if (!riscv_cpu_cfg(env)->ext_smstateen) {
326         return RISCV_EXCP_ILLEGAL_INST;
327     }
328 
329     return any(env, csrno);
330 }
331 
332 static RISCVException hstateen_pred(CPURISCVState *env, int csrno, int base)
333 {
334     if (!riscv_cpu_cfg(env)->ext_smstateen) {
335         return RISCV_EXCP_ILLEGAL_INST;
336     }
337 
338     RISCVException ret = hmode(env, csrno);
339     if (ret != RISCV_EXCP_NONE) {
340         return ret;
341     }
342 
343     if (env->debugger) {
344         return RISCV_EXCP_NONE;
345     }
346 
347     if (env->priv < PRV_M) {
348         if (!(env->mstateen[csrno - base] & SMSTATEEN_STATEEN)) {
349             return RISCV_EXCP_ILLEGAL_INST;
350         }
351     }
352 
353     return RISCV_EXCP_NONE;
354 }
355 
356 static RISCVException hstateen(CPURISCVState *env, int csrno)
357 {
358     return hstateen_pred(env, csrno, CSR_HSTATEEN0);
359 }
360 
361 static RISCVException hstateenh(CPURISCVState *env, int csrno)
362 {
363     return hstateen_pred(env, csrno, CSR_HSTATEEN0H);
364 }
365 
366 static RISCVException sstateen(CPURISCVState *env, int csrno)
367 {
368     bool virt = env->virt_enabled;
369     int index = csrno - CSR_SSTATEEN0;
370 
371     if (!riscv_cpu_cfg(env)->ext_smstateen) {
372         return RISCV_EXCP_ILLEGAL_INST;
373     }
374 
375     RISCVException ret = smode(env, csrno);
376     if (ret != RISCV_EXCP_NONE) {
377         return ret;
378     }
379 
380     if (env->debugger) {
381         return RISCV_EXCP_NONE;
382     }
383 
384     if (env->priv < PRV_M) {
385         if (!(env->mstateen[index] & SMSTATEEN_STATEEN)) {
386             return RISCV_EXCP_ILLEGAL_INST;
387         }
388 
389         if (virt) {
390             if (!(env->hstateen[index] & SMSTATEEN_STATEEN)) {
391                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
392             }
393         }
394     }
395 
396     return RISCV_EXCP_NONE;
397 }
398 
399 static RISCVException sstc(CPURISCVState *env, int csrno)
400 {
401     bool hmode_check = false;
402 
403     if (!riscv_cpu_cfg(env)->ext_sstc || !env->rdtime_fn) {
404         return RISCV_EXCP_ILLEGAL_INST;
405     }
406 
407     if ((csrno == CSR_VSTIMECMP) || (csrno == CSR_VSTIMECMPH)) {
408         hmode_check = true;
409     }
410 
411     RISCVException ret = hmode_check ? hmode(env, csrno) : smode(env, csrno);
412     if (ret != RISCV_EXCP_NONE) {
413         return ret;
414     }
415 
416     if (env->debugger) {
417         return RISCV_EXCP_NONE;
418     }
419 
420     if (env->priv == PRV_M) {
421         return RISCV_EXCP_NONE;
422     }
423 
424     /*
425      * No need of separate function for rv32 as menvcfg stores both menvcfg
426      * menvcfgh for RV32.
427      */
428     if (!(get_field(env->mcounteren, COUNTEREN_TM) &&
429           get_field(env->menvcfg, MENVCFG_STCE))) {
430         return RISCV_EXCP_ILLEGAL_INST;
431     }
432 
433     if (env->virt_enabled) {
434         if (!(get_field(env->hcounteren, COUNTEREN_TM) &&
435               get_field(env->henvcfg, HENVCFG_STCE))) {
436             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
437         }
438     }
439 
440     return RISCV_EXCP_NONE;
441 }
442 
443 static RISCVException sstc_32(CPURISCVState *env, int csrno)
444 {
445     if (riscv_cpu_mxl(env) != MXL_RV32) {
446         return RISCV_EXCP_ILLEGAL_INST;
447     }
448 
449     return sstc(env, csrno);
450 }
451 
452 /* Checks if PointerMasking registers could be accessed */
453 static RISCVException pointer_masking(CPURISCVState *env, int csrno)
454 {
455     /* Check if j-ext is present */
456     if (riscv_has_ext(env, RVJ)) {
457         return RISCV_EXCP_NONE;
458     }
459     return RISCV_EXCP_ILLEGAL_INST;
460 }
461 
462 static int aia_hmode(CPURISCVState *env, int csrno)
463 {
464     if (!riscv_cpu_cfg(env)->ext_ssaia) {
465         return RISCV_EXCP_ILLEGAL_INST;
466      }
467 
468      return hmode(env, csrno);
469 }
470 
471 static int aia_hmode32(CPURISCVState *env, int csrno)
472 {
473     if (!riscv_cpu_cfg(env)->ext_ssaia) {
474         return RISCV_EXCP_ILLEGAL_INST;
475     }
476 
477     return hmode32(env, csrno);
478 }
479 
480 static RISCVException pmp(CPURISCVState *env, int csrno)
481 {
482     if (riscv_cpu_cfg(env)->pmp) {
483         if (csrno <= CSR_PMPCFG3) {
484             uint32_t reg_index = csrno - CSR_PMPCFG0;
485 
486             /* TODO: RV128 restriction check */
487             if ((reg_index & 1) && (riscv_cpu_mxl(env) == MXL_RV64)) {
488                 return RISCV_EXCP_ILLEGAL_INST;
489             }
490         }
491 
492         return RISCV_EXCP_NONE;
493     }
494 
495     return RISCV_EXCP_ILLEGAL_INST;
496 }
497 
498 static RISCVException epmp(CPURISCVState *env, int csrno)
499 {
500     if (riscv_cpu_cfg(env)->epmp) {
501         return RISCV_EXCP_NONE;
502     }
503 
504     return RISCV_EXCP_ILLEGAL_INST;
505 }
506 
507 static RISCVException debug(CPURISCVState *env, int csrno)
508 {
509     if (riscv_cpu_cfg(env)->debug) {
510         return RISCV_EXCP_NONE;
511     }
512 
513     return RISCV_EXCP_ILLEGAL_INST;
514 }
515 #endif
516 
517 static RISCVException seed(CPURISCVState *env, int csrno)
518 {
519     if (!riscv_cpu_cfg(env)->ext_zkr) {
520         return RISCV_EXCP_ILLEGAL_INST;
521     }
522 
523 #if !defined(CONFIG_USER_ONLY)
524     if (env->debugger) {
525         return RISCV_EXCP_NONE;
526     }
527 
528     /*
529      * With a CSR read-write instruction:
530      * 1) The seed CSR is always available in machine mode as normal.
531      * 2) Attempted access to seed from virtual modes VS and VU always raises
532      * an exception(virtual instruction exception only if mseccfg.sseed=1).
533      * 3) Without the corresponding access control bit set to 1, any attempted
534      * access to seed from U, S or HS modes will raise an illegal instruction
535      * exception.
536      */
537     if (env->priv == PRV_M) {
538         return RISCV_EXCP_NONE;
539     } else if (env->virt_enabled) {
540         if (env->mseccfg & MSECCFG_SSEED) {
541             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
542         } else {
543             return RISCV_EXCP_ILLEGAL_INST;
544         }
545     } else {
546         if (env->priv == PRV_S && (env->mseccfg & MSECCFG_SSEED)) {
547             return RISCV_EXCP_NONE;
548         } else if (env->priv == PRV_U && (env->mseccfg & MSECCFG_USEED)) {
549             return RISCV_EXCP_NONE;
550         } else {
551             return RISCV_EXCP_ILLEGAL_INST;
552         }
553     }
554 #else
555     return RISCV_EXCP_NONE;
556 #endif
557 }
558 
559 /* User Floating-Point CSRs */
560 static RISCVException read_fflags(CPURISCVState *env, int csrno,
561                                   target_ulong *val)
562 {
563     *val = riscv_cpu_get_fflags(env);
564     return RISCV_EXCP_NONE;
565 }
566 
567 static RISCVException write_fflags(CPURISCVState *env, int csrno,
568                                    target_ulong val)
569 {
570 #if !defined(CONFIG_USER_ONLY)
571     if (riscv_has_ext(env, RVF)) {
572         env->mstatus |= MSTATUS_FS;
573     }
574 #endif
575     riscv_cpu_set_fflags(env, val & (FSR_AEXC >> FSR_AEXC_SHIFT));
576     return RISCV_EXCP_NONE;
577 }
578 
579 static RISCVException read_frm(CPURISCVState *env, int csrno,
580                                target_ulong *val)
581 {
582     *val = env->frm;
583     return RISCV_EXCP_NONE;
584 }
585 
586 static RISCVException write_frm(CPURISCVState *env, int csrno,
587                                 target_ulong val)
588 {
589 #if !defined(CONFIG_USER_ONLY)
590     if (riscv_has_ext(env, RVF)) {
591         env->mstatus |= MSTATUS_FS;
592     }
593 #endif
594     env->frm = val & (FSR_RD >> FSR_RD_SHIFT);
595     return RISCV_EXCP_NONE;
596 }
597 
598 static RISCVException read_fcsr(CPURISCVState *env, int csrno,
599                                 target_ulong *val)
600 {
601     *val = (riscv_cpu_get_fflags(env) << FSR_AEXC_SHIFT)
602         | (env->frm << FSR_RD_SHIFT);
603     return RISCV_EXCP_NONE;
604 }
605 
606 static RISCVException write_fcsr(CPURISCVState *env, int csrno,
607                                  target_ulong val)
608 {
609 #if !defined(CONFIG_USER_ONLY)
610     if (riscv_has_ext(env, RVF)) {
611         env->mstatus |= MSTATUS_FS;
612     }
613 #endif
614     env->frm = (val & FSR_RD) >> FSR_RD_SHIFT;
615     riscv_cpu_set_fflags(env, (val & FSR_AEXC) >> FSR_AEXC_SHIFT);
616     return RISCV_EXCP_NONE;
617 }
618 
619 static RISCVException read_vtype(CPURISCVState *env, int csrno,
620                                  target_ulong *val)
621 {
622     uint64_t vill;
623     switch (env->xl) {
624     case MXL_RV32:
625         vill = (uint32_t)env->vill << 31;
626         break;
627     case MXL_RV64:
628         vill = (uint64_t)env->vill << 63;
629         break;
630     default:
631         g_assert_not_reached();
632     }
633     *val = (target_ulong)vill | env->vtype;
634     return RISCV_EXCP_NONE;
635 }
636 
637 static RISCVException read_vl(CPURISCVState *env, int csrno,
638                               target_ulong *val)
639 {
640     *val = env->vl;
641     return RISCV_EXCP_NONE;
642 }
643 
644 static int read_vlenb(CPURISCVState *env, int csrno, target_ulong *val)
645 {
646     *val = riscv_cpu_cfg(env)->vlen >> 3;
647     return RISCV_EXCP_NONE;
648 }
649 
650 static RISCVException read_vxrm(CPURISCVState *env, int csrno,
651                                 target_ulong *val)
652 {
653     *val = env->vxrm;
654     return RISCV_EXCP_NONE;
655 }
656 
657 static RISCVException write_vxrm(CPURISCVState *env, int csrno,
658                                  target_ulong val)
659 {
660 #if !defined(CONFIG_USER_ONLY)
661     env->mstatus |= MSTATUS_VS;
662 #endif
663     env->vxrm = val;
664     return RISCV_EXCP_NONE;
665 }
666 
667 static RISCVException read_vxsat(CPURISCVState *env, int csrno,
668                                  target_ulong *val)
669 {
670     *val = env->vxsat;
671     return RISCV_EXCP_NONE;
672 }
673 
674 static RISCVException write_vxsat(CPURISCVState *env, int csrno,
675                                   target_ulong val)
676 {
677 #if !defined(CONFIG_USER_ONLY)
678     env->mstatus |= MSTATUS_VS;
679 #endif
680     env->vxsat = val;
681     return RISCV_EXCP_NONE;
682 }
683 
684 static RISCVException read_vstart(CPURISCVState *env, int csrno,
685                                   target_ulong *val)
686 {
687     *val = env->vstart;
688     return RISCV_EXCP_NONE;
689 }
690 
691 static RISCVException write_vstart(CPURISCVState *env, int csrno,
692                                    target_ulong val)
693 {
694 #if !defined(CONFIG_USER_ONLY)
695     env->mstatus |= MSTATUS_VS;
696 #endif
697     /*
698      * The vstart CSR is defined to have only enough writable bits
699      * to hold the largest element index, i.e. lg2(VLEN) bits.
700      */
701     env->vstart = val & ~(~0ULL << ctzl(riscv_cpu_cfg(env)->vlen));
702     return RISCV_EXCP_NONE;
703 }
704 
705 static int read_vcsr(CPURISCVState *env, int csrno, target_ulong *val)
706 {
707     *val = (env->vxrm << VCSR_VXRM_SHIFT) | (env->vxsat << VCSR_VXSAT_SHIFT);
708     return RISCV_EXCP_NONE;
709 }
710 
711 static int write_vcsr(CPURISCVState *env, int csrno, target_ulong val)
712 {
713 #if !defined(CONFIG_USER_ONLY)
714     env->mstatus |= MSTATUS_VS;
715 #endif
716     env->vxrm = (val & VCSR_VXRM) >> VCSR_VXRM_SHIFT;
717     env->vxsat = (val & VCSR_VXSAT) >> VCSR_VXSAT_SHIFT;
718     return RISCV_EXCP_NONE;
719 }
720 
721 /* User Timers and Counters */
722 static target_ulong get_ticks(bool shift)
723 {
724     int64_t val;
725     target_ulong result;
726 
727 #if !defined(CONFIG_USER_ONLY)
728     if (icount_enabled()) {
729         val = icount_get();
730     } else {
731         val = cpu_get_host_ticks();
732     }
733 #else
734     val = cpu_get_host_ticks();
735 #endif
736 
737     if (shift) {
738         result = val >> 32;
739     } else {
740         result = val;
741     }
742 
743     return result;
744 }
745 
746 #if defined(CONFIG_USER_ONLY)
747 static RISCVException read_time(CPURISCVState *env, int csrno,
748                                 target_ulong *val)
749 {
750     *val = cpu_get_host_ticks();
751     return RISCV_EXCP_NONE;
752 }
753 
754 static RISCVException read_timeh(CPURISCVState *env, int csrno,
755                                  target_ulong *val)
756 {
757     *val = cpu_get_host_ticks() >> 32;
758     return RISCV_EXCP_NONE;
759 }
760 
761 static int read_hpmcounter(CPURISCVState *env, int csrno, target_ulong *val)
762 {
763     *val = get_ticks(false);
764     return RISCV_EXCP_NONE;
765 }
766 
767 static int read_hpmcounterh(CPURISCVState *env, int csrno, target_ulong *val)
768 {
769     *val = get_ticks(true);
770     return RISCV_EXCP_NONE;
771 }
772 
773 #else /* CONFIG_USER_ONLY */
774 
775 static int read_mhpmevent(CPURISCVState *env, int csrno, target_ulong *val)
776 {
777     int evt_index = csrno - CSR_MCOUNTINHIBIT;
778 
779     *val = env->mhpmevent_val[evt_index];
780 
781     return RISCV_EXCP_NONE;
782 }
783 
784 static int write_mhpmevent(CPURISCVState *env, int csrno, target_ulong val)
785 {
786     int evt_index = csrno - CSR_MCOUNTINHIBIT;
787     uint64_t mhpmevt_val = val;
788 
789     env->mhpmevent_val[evt_index] = val;
790 
791     if (riscv_cpu_mxl(env) == MXL_RV32) {
792         mhpmevt_val = mhpmevt_val |
793                       ((uint64_t)env->mhpmeventh_val[evt_index] << 32);
794     }
795     riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
796 
797     return RISCV_EXCP_NONE;
798 }
799 
800 static int read_mhpmeventh(CPURISCVState *env, int csrno, target_ulong *val)
801 {
802     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
803 
804     *val = env->mhpmeventh_val[evt_index];
805 
806     return RISCV_EXCP_NONE;
807 }
808 
809 static int write_mhpmeventh(CPURISCVState *env, int csrno, target_ulong val)
810 {
811     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
812     uint64_t mhpmevth_val = val;
813     uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
814 
815     mhpmevt_val = mhpmevt_val | (mhpmevth_val << 32);
816     env->mhpmeventh_val[evt_index] = val;
817 
818     riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
819 
820     return RISCV_EXCP_NONE;
821 }
822 
823 static int write_mhpmcounter(CPURISCVState *env, int csrno, target_ulong val)
824 {
825     int ctr_idx = csrno - CSR_MCYCLE;
826     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
827     uint64_t mhpmctr_val = val;
828 
829     counter->mhpmcounter_val = val;
830     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
831         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
832         counter->mhpmcounter_prev = get_ticks(false);
833         if (ctr_idx > 2) {
834             if (riscv_cpu_mxl(env) == MXL_RV32) {
835                 mhpmctr_val = mhpmctr_val |
836                               ((uint64_t)counter->mhpmcounterh_val << 32);
837             }
838             riscv_pmu_setup_timer(env, mhpmctr_val, ctr_idx);
839         }
840      } else {
841         /* Other counters can keep incrementing from the given value */
842         counter->mhpmcounter_prev = val;
843     }
844 
845     return RISCV_EXCP_NONE;
846 }
847 
848 static int write_mhpmcounterh(CPURISCVState *env, int csrno, target_ulong val)
849 {
850     int ctr_idx = csrno - CSR_MCYCLEH;
851     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
852     uint64_t mhpmctr_val = counter->mhpmcounter_val;
853     uint64_t mhpmctrh_val = val;
854 
855     counter->mhpmcounterh_val = val;
856     mhpmctr_val = mhpmctr_val | (mhpmctrh_val << 32);
857     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
858         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
859         counter->mhpmcounterh_prev = get_ticks(true);
860         if (ctr_idx > 2) {
861             riscv_pmu_setup_timer(env, mhpmctr_val, ctr_idx);
862         }
863     } else {
864         counter->mhpmcounterh_prev = val;
865     }
866 
867     return RISCV_EXCP_NONE;
868 }
869 
870 static RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
871                                          bool upper_half, uint32_t ctr_idx)
872 {
873     PMUCTRState counter = env->pmu_ctrs[ctr_idx];
874     target_ulong ctr_prev = upper_half ? counter.mhpmcounterh_prev :
875                                          counter.mhpmcounter_prev;
876     target_ulong ctr_val = upper_half ? counter.mhpmcounterh_val :
877                                         counter.mhpmcounter_val;
878 
879     if (get_field(env->mcountinhibit, BIT(ctr_idx))) {
880         /*
881          * Counter should not increment if inhibit bit is set. We can't really
882          * stop the icount counting. Just return the counter value written by
883          * the supervisor to indicate that counter was not incremented.
884          */
885         if (!counter.started) {
886             *val = ctr_val;
887             return RISCV_EXCP_NONE;
888         } else {
889             /* Mark that the counter has been stopped */
890             counter.started = false;
891         }
892     }
893 
894     /*
895      * The kernel computes the perf delta by subtracting the current value from
896      * the value it initialized previously (ctr_val).
897      */
898     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
899         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
900         *val = get_ticks(upper_half) - ctr_prev + ctr_val;
901     } else {
902         *val = ctr_val;
903     }
904 
905     return RISCV_EXCP_NONE;
906 }
907 
908 static int read_hpmcounter(CPURISCVState *env, int csrno, target_ulong *val)
909 {
910     uint16_t ctr_index;
911 
912     if (csrno >= CSR_MCYCLE && csrno <= CSR_MHPMCOUNTER31) {
913         ctr_index = csrno - CSR_MCYCLE;
914     } else if (csrno >= CSR_CYCLE && csrno <= CSR_HPMCOUNTER31) {
915         ctr_index = csrno - CSR_CYCLE;
916     } else {
917         return RISCV_EXCP_ILLEGAL_INST;
918     }
919 
920     return riscv_pmu_read_ctr(env, val, false, ctr_index);
921 }
922 
923 static int read_hpmcounterh(CPURISCVState *env, int csrno, target_ulong *val)
924 {
925     uint16_t ctr_index;
926 
927     if (csrno >= CSR_MCYCLEH && csrno <= CSR_MHPMCOUNTER31H) {
928         ctr_index = csrno - CSR_MCYCLEH;
929     } else if (csrno >= CSR_CYCLEH && csrno <= CSR_HPMCOUNTER31H) {
930         ctr_index = csrno - CSR_CYCLEH;
931     } else {
932         return RISCV_EXCP_ILLEGAL_INST;
933     }
934 
935     return riscv_pmu_read_ctr(env, val, true, ctr_index);
936 }
937 
938 static int read_scountovf(CPURISCVState *env, int csrno, target_ulong *val)
939 {
940     int mhpmevt_start = CSR_MHPMEVENT3 - CSR_MCOUNTINHIBIT;
941     int i;
942     *val = 0;
943     target_ulong *mhpm_evt_val;
944     uint64_t of_bit_mask;
945 
946     if (riscv_cpu_mxl(env) == MXL_RV32) {
947         mhpm_evt_val = env->mhpmeventh_val;
948         of_bit_mask = MHPMEVENTH_BIT_OF;
949     } else {
950         mhpm_evt_val = env->mhpmevent_val;
951         of_bit_mask = MHPMEVENT_BIT_OF;
952     }
953 
954     for (i = mhpmevt_start; i < RV_MAX_MHPMEVENTS; i++) {
955         if ((get_field(env->mcounteren, BIT(i))) &&
956             (mhpm_evt_val[i] & of_bit_mask)) {
957                     *val |= BIT(i);
958             }
959     }
960 
961     return RISCV_EXCP_NONE;
962 }
963 
964 static RISCVException read_time(CPURISCVState *env, int csrno,
965                                 target_ulong *val)
966 {
967     uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
968 
969     if (!env->rdtime_fn) {
970         return RISCV_EXCP_ILLEGAL_INST;
971     }
972 
973     *val = env->rdtime_fn(env->rdtime_fn_arg) + delta;
974     return RISCV_EXCP_NONE;
975 }
976 
977 static RISCVException read_timeh(CPURISCVState *env, int csrno,
978                                  target_ulong *val)
979 {
980     uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
981 
982     if (!env->rdtime_fn) {
983         return RISCV_EXCP_ILLEGAL_INST;
984     }
985 
986     *val = (env->rdtime_fn(env->rdtime_fn_arg) + delta) >> 32;
987     return RISCV_EXCP_NONE;
988 }
989 
990 static RISCVException read_vstimecmp(CPURISCVState *env, int csrno,
991                                      target_ulong *val)
992 {
993     *val = env->vstimecmp;
994 
995     return RISCV_EXCP_NONE;
996 }
997 
998 static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
999                                       target_ulong *val)
1000 {
1001     *val = env->vstimecmp >> 32;
1002 
1003     return RISCV_EXCP_NONE;
1004 }
1005 
1006 static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
1007                                       target_ulong val)
1008 {
1009     if (riscv_cpu_mxl(env) == MXL_RV32) {
1010         env->vstimecmp = deposit64(env->vstimecmp, 0, 32, (uint64_t)val);
1011     } else {
1012         env->vstimecmp = val;
1013     }
1014 
1015     riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
1016                               env->htimedelta, MIP_VSTIP);
1017 
1018     return RISCV_EXCP_NONE;
1019 }
1020 
1021 static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
1022                                        target_ulong val)
1023 {
1024     env->vstimecmp = deposit64(env->vstimecmp, 32, 32, (uint64_t)val);
1025     riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
1026                               env->htimedelta, MIP_VSTIP);
1027 
1028     return RISCV_EXCP_NONE;
1029 }
1030 
1031 static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
1032                                     target_ulong *val)
1033 {
1034     if (env->virt_enabled) {
1035         *val = env->vstimecmp;
1036     } else {
1037         *val = env->stimecmp;
1038     }
1039 
1040     return RISCV_EXCP_NONE;
1041 }
1042 
1043 static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
1044                                      target_ulong *val)
1045 {
1046     if (env->virt_enabled) {
1047         *val = env->vstimecmp >> 32;
1048     } else {
1049         *val = env->stimecmp >> 32;
1050     }
1051 
1052     return RISCV_EXCP_NONE;
1053 }
1054 
1055 static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
1056                                      target_ulong val)
1057 {
1058     if (env->virt_enabled) {
1059         if (env->hvictl & HVICTL_VTI) {
1060             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
1061         }
1062         return write_vstimecmp(env, csrno, val);
1063     }
1064 
1065     if (riscv_cpu_mxl(env) == MXL_RV32) {
1066         env->stimecmp = deposit64(env->stimecmp, 0, 32, (uint64_t)val);
1067     } else {
1068         env->stimecmp = val;
1069     }
1070 
1071     riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
1072 
1073     return RISCV_EXCP_NONE;
1074 }
1075 
1076 static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
1077                                       target_ulong val)
1078 {
1079     if (env->virt_enabled) {
1080         if (env->hvictl & HVICTL_VTI) {
1081             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
1082         }
1083         return write_vstimecmph(env, csrno, val);
1084     }
1085 
1086     env->stimecmp = deposit64(env->stimecmp, 32, 32, (uint64_t)val);
1087     riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
1088 
1089     return RISCV_EXCP_NONE;
1090 }
1091 
1092 /* Machine constants */
1093 
1094 #define M_MODE_INTERRUPTS  ((uint64_t)(MIP_MSIP | MIP_MTIP | MIP_MEIP))
1095 #define S_MODE_INTERRUPTS  ((uint64_t)(MIP_SSIP | MIP_STIP | MIP_SEIP | \
1096                                       MIP_LCOFIP))
1097 #define VS_MODE_INTERRUPTS ((uint64_t)(MIP_VSSIP | MIP_VSTIP | MIP_VSEIP))
1098 #define HS_MODE_INTERRUPTS ((uint64_t)(MIP_SGEIP | VS_MODE_INTERRUPTS))
1099 
1100 #define VSTOPI_NUM_SRCS 5
1101 
1102 static const uint64_t delegable_ints = S_MODE_INTERRUPTS |
1103                                            VS_MODE_INTERRUPTS;
1104 static const uint64_t vs_delegable_ints = VS_MODE_INTERRUPTS;
1105 static const uint64_t all_ints = M_MODE_INTERRUPTS | S_MODE_INTERRUPTS |
1106                                      HS_MODE_INTERRUPTS;
1107 #define DELEGABLE_EXCPS ((1ULL << (RISCV_EXCP_INST_ADDR_MIS)) | \
1108                          (1ULL << (RISCV_EXCP_INST_ACCESS_FAULT)) | \
1109                          (1ULL << (RISCV_EXCP_ILLEGAL_INST)) | \
1110                          (1ULL << (RISCV_EXCP_BREAKPOINT)) | \
1111                          (1ULL << (RISCV_EXCP_LOAD_ADDR_MIS)) | \
1112                          (1ULL << (RISCV_EXCP_LOAD_ACCESS_FAULT)) | \
1113                          (1ULL << (RISCV_EXCP_STORE_AMO_ADDR_MIS)) | \
1114                          (1ULL << (RISCV_EXCP_STORE_AMO_ACCESS_FAULT)) | \
1115                          (1ULL << (RISCV_EXCP_U_ECALL)) | \
1116                          (1ULL << (RISCV_EXCP_S_ECALL)) | \
1117                          (1ULL << (RISCV_EXCP_VS_ECALL)) | \
1118                          (1ULL << (RISCV_EXCP_M_ECALL)) | \
1119                          (1ULL << (RISCV_EXCP_INST_PAGE_FAULT)) | \
1120                          (1ULL << (RISCV_EXCP_LOAD_PAGE_FAULT)) | \
1121                          (1ULL << (RISCV_EXCP_STORE_PAGE_FAULT)) | \
1122                          (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) | \
1123                          (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) | \
1124                          (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) | \
1125                          (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)))
1126 static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
1127     ~((1ULL << (RISCV_EXCP_S_ECALL)) |
1128       (1ULL << (RISCV_EXCP_VS_ECALL)) |
1129       (1ULL << (RISCV_EXCP_M_ECALL)) |
1130       (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) |
1131       (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) |
1132       (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) |
1133       (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)));
1134 static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
1135     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
1136     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
1137 static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP |
1138                                               SIP_LCOFIP;
1139 static const target_ulong hip_writable_mask = MIP_VSSIP;
1140 static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP |
1141                                                MIP_VSEIP;
1142 static const target_ulong vsip_writable_mask = MIP_VSSIP;
1143 
1144 const bool valid_vm_1_10_32[16] = {
1145     [VM_1_10_MBARE] = true,
1146     [VM_1_10_SV32] = true
1147 };
1148 
1149 const bool valid_vm_1_10_64[16] = {
1150     [VM_1_10_MBARE] = true,
1151     [VM_1_10_SV39] = true,
1152     [VM_1_10_SV48] = true,
1153     [VM_1_10_SV57] = true
1154 };
1155 
1156 /* Machine Information Registers */
1157 static RISCVException read_zero(CPURISCVState *env, int csrno,
1158                                 target_ulong *val)
1159 {
1160     *val = 0;
1161     return RISCV_EXCP_NONE;
1162 }
1163 
1164 static RISCVException write_ignore(CPURISCVState *env, int csrno,
1165                                    target_ulong val)
1166 {
1167     return RISCV_EXCP_NONE;
1168 }
1169 
1170 static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
1171                                      target_ulong *val)
1172 {
1173     *val = riscv_cpu_cfg(env)->mvendorid;
1174     return RISCV_EXCP_NONE;
1175 }
1176 
1177 static RISCVException read_marchid(CPURISCVState *env, int csrno,
1178                                    target_ulong *val)
1179 {
1180     *val = riscv_cpu_cfg(env)->marchid;
1181     return RISCV_EXCP_NONE;
1182 }
1183 
1184 static RISCVException read_mimpid(CPURISCVState *env, int csrno,
1185                                   target_ulong *val)
1186 {
1187     *val = riscv_cpu_cfg(env)->mimpid;
1188     return RISCV_EXCP_NONE;
1189 }
1190 
1191 static RISCVException read_mhartid(CPURISCVState *env, int csrno,
1192                                    target_ulong *val)
1193 {
1194     *val = env->mhartid;
1195     return RISCV_EXCP_NONE;
1196 }
1197 
1198 /* Machine Trap Setup */
1199 
1200 /* We do not store SD explicitly, only compute it on demand. */
1201 static uint64_t add_status_sd(RISCVMXL xl, uint64_t status)
1202 {
1203     if ((status & MSTATUS_FS) == MSTATUS_FS ||
1204         (status & MSTATUS_VS) == MSTATUS_VS ||
1205         (status & MSTATUS_XS) == MSTATUS_XS) {
1206         switch (xl) {
1207         case MXL_RV32:
1208             return status | MSTATUS32_SD;
1209         case MXL_RV64:
1210             return status | MSTATUS64_SD;
1211         case MXL_RV128:
1212             return MSTATUSH128_SD;
1213         default:
1214             g_assert_not_reached();
1215         }
1216     }
1217     return status;
1218 }
1219 
1220 static RISCVException read_mstatus(CPURISCVState *env, int csrno,
1221                                    target_ulong *val)
1222 {
1223     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus);
1224     return RISCV_EXCP_NONE;
1225 }
1226 
1227 static bool validate_vm(CPURISCVState *env, target_ulong vm)
1228 {
1229     return (vm & 0xf) <=
1230            satp_mode_max_from_map(riscv_cpu_cfg(env)->satp_mode.map);
1231 }
1232 
1233 static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
1234                                  target_ulong val)
1235 {
1236     bool valid = false;
1237     target_ulong new_mpp = get_field(val, MSTATUS_MPP);
1238 
1239     switch (new_mpp) {
1240     case PRV_M:
1241         valid = true;
1242         break;
1243     case PRV_S:
1244         valid = riscv_has_ext(env, RVS);
1245         break;
1246     case PRV_U:
1247         valid = riscv_has_ext(env, RVU);
1248         break;
1249     }
1250 
1251     /* Remain field unchanged if new_mpp value is invalid */
1252     if (!valid) {
1253         val = set_field(val, MSTATUS_MPP, old_mpp);
1254     }
1255 
1256     return val;
1257 }
1258 
1259 static RISCVException write_mstatus(CPURISCVState *env, int csrno,
1260                                     target_ulong val)
1261 {
1262     uint64_t mstatus = env->mstatus;
1263     uint64_t mask = 0;
1264     RISCVMXL xl = riscv_cpu_mxl(env);
1265 
1266     /*
1267      * MPP field have been made WARL since priv version 1.11. However,
1268      * legalization for it will not break any software running on 1.10.
1269      */
1270     val = legalize_mpp(env, get_field(mstatus, MSTATUS_MPP), val);
1271 
1272     /* flush tlb on mstatus fields that affect VM */
1273     if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPP | MSTATUS_MPV |
1274             MSTATUS_MPRV | MSTATUS_SUM)) {
1275         tlb_flush(env_cpu(env));
1276     }
1277     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
1278         MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
1279         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
1280         MSTATUS_TW | MSTATUS_VS;
1281 
1282     if (riscv_has_ext(env, RVF)) {
1283         mask |= MSTATUS_FS;
1284     }
1285 
1286     if (xl != MXL_RV32 || env->debugger) {
1287         /*
1288          * RV32: MPV and GVA are not in mstatus. The current plan is to
1289          * add them to mstatush. For now, we just don't support it.
1290          */
1291         mask |= MSTATUS_MPV | MSTATUS_GVA;
1292         if ((val & MSTATUS64_UXL) != 0) {
1293             mask |= MSTATUS64_UXL;
1294         }
1295     }
1296 
1297     mstatus = (mstatus & ~mask) | (val & mask);
1298 
1299     if (xl > MXL_RV32) {
1300         /* SXL field is for now read only */
1301         mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
1302     }
1303     env->mstatus = mstatus;
1304     env->xl = cpu_recompute_xl(env);
1305 
1306     return RISCV_EXCP_NONE;
1307 }
1308 
1309 static RISCVException read_mstatush(CPURISCVState *env, int csrno,
1310                                     target_ulong *val)
1311 {
1312     *val = env->mstatus >> 32;
1313     return RISCV_EXCP_NONE;
1314 }
1315 
1316 static RISCVException write_mstatush(CPURISCVState *env, int csrno,
1317                                      target_ulong val)
1318 {
1319     uint64_t valh = (uint64_t)val << 32;
1320     uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
1321 
1322     if ((valh ^ env->mstatus) & (MSTATUS_MPV)) {
1323         tlb_flush(env_cpu(env));
1324     }
1325 
1326     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
1327 
1328     return RISCV_EXCP_NONE;
1329 }
1330 
1331 static RISCVException read_mstatus_i128(CPURISCVState *env, int csrno,
1332                                         Int128 *val)
1333 {
1334     *val = int128_make128(env->mstatus, add_status_sd(MXL_RV128,
1335                                                       env->mstatus));
1336     return RISCV_EXCP_NONE;
1337 }
1338 
1339 static RISCVException read_misa_i128(CPURISCVState *env, int csrno,
1340                                      Int128 *val)
1341 {
1342     *val = int128_make128(env->misa_ext, (uint64_t)MXL_RV128 << 62);
1343     return RISCV_EXCP_NONE;
1344 }
1345 
1346 static RISCVException read_misa(CPURISCVState *env, int csrno,
1347                                 target_ulong *val)
1348 {
1349     target_ulong misa;
1350 
1351     switch (env->misa_mxl) {
1352     case MXL_RV32:
1353         misa = (target_ulong)MXL_RV32 << 30;
1354         break;
1355 #ifdef TARGET_RISCV64
1356     case MXL_RV64:
1357         misa = (target_ulong)MXL_RV64 << 62;
1358         break;
1359 #endif
1360     default:
1361         g_assert_not_reached();
1362     }
1363 
1364     *val = misa | env->misa_ext;
1365     return RISCV_EXCP_NONE;
1366 }
1367 
1368 static RISCVException write_misa(CPURISCVState *env, int csrno,
1369                                  target_ulong val)
1370 {
1371     if (!riscv_cpu_cfg(env)->misa_w) {
1372         /* drop write to misa */
1373         return RISCV_EXCP_NONE;
1374     }
1375 
1376     /* 'I' or 'E' must be present */
1377     if (!(val & (RVI | RVE))) {
1378         /* It is not, drop write to misa */
1379         return RISCV_EXCP_NONE;
1380     }
1381 
1382     /* 'E' excludes all other extensions */
1383     if (val & RVE) {
1384         /*
1385          * when we support 'E' we can do "val = RVE;" however
1386          * for now we just drop writes if 'E' is present.
1387          */
1388         return RISCV_EXCP_NONE;
1389     }
1390 
1391     /*
1392      * misa.MXL writes are not supported by QEMU.
1393      * Drop writes to those bits.
1394      */
1395 
1396     /* Mask extensions that are not supported by this hart */
1397     val &= env->misa_ext_mask;
1398 
1399     /* 'D' depends on 'F', so clear 'D' if 'F' is not present */
1400     if ((val & RVD) && !(val & RVF)) {
1401         val &= ~RVD;
1402     }
1403 
1404     /*
1405      * Suppress 'C' if next instruction is not aligned
1406      * TODO: this should check next_pc
1407      */
1408     if ((val & RVC) && (GETPC() & ~3) != 0) {
1409         val &= ~RVC;
1410     }
1411 
1412     /* If nothing changed, do nothing. */
1413     if (val == env->misa_ext) {
1414         return RISCV_EXCP_NONE;
1415     }
1416 
1417     if (!(val & RVF)) {
1418         env->mstatus &= ~MSTATUS_FS;
1419     }
1420 
1421     /* flush translation cache */
1422     tb_flush(env_cpu(env));
1423     env->misa_ext = val;
1424     env->xl = riscv_cpu_mxl(env);
1425     return RISCV_EXCP_NONE;
1426 }
1427 
1428 static RISCVException read_medeleg(CPURISCVState *env, int csrno,
1429                                    target_ulong *val)
1430 {
1431     *val = env->medeleg;
1432     return RISCV_EXCP_NONE;
1433 }
1434 
1435 static RISCVException write_medeleg(CPURISCVState *env, int csrno,
1436                                     target_ulong val)
1437 {
1438     env->medeleg = (env->medeleg & ~DELEGABLE_EXCPS) | (val & DELEGABLE_EXCPS);
1439     return RISCV_EXCP_NONE;
1440 }
1441 
1442 static RISCVException rmw_mideleg64(CPURISCVState *env, int csrno,
1443                                     uint64_t *ret_val,
1444                                     uint64_t new_val, uint64_t wr_mask)
1445 {
1446     uint64_t mask = wr_mask & delegable_ints;
1447 
1448     if (ret_val) {
1449         *ret_val = env->mideleg;
1450     }
1451 
1452     env->mideleg = (env->mideleg & ~mask) | (new_val & mask);
1453 
1454     if (riscv_has_ext(env, RVH)) {
1455         env->mideleg |= HS_MODE_INTERRUPTS;
1456     }
1457 
1458     return RISCV_EXCP_NONE;
1459 }
1460 
1461 static RISCVException rmw_mideleg(CPURISCVState *env, int csrno,
1462                                   target_ulong *ret_val,
1463                                   target_ulong new_val, target_ulong wr_mask)
1464 {
1465     uint64_t rval;
1466     RISCVException ret;
1467 
1468     ret = rmw_mideleg64(env, csrno, &rval, new_val, wr_mask);
1469     if (ret_val) {
1470         *ret_val = rval;
1471     }
1472 
1473     return ret;
1474 }
1475 
1476 static RISCVException rmw_midelegh(CPURISCVState *env, int csrno,
1477                                    target_ulong *ret_val,
1478                                    target_ulong new_val,
1479                                    target_ulong wr_mask)
1480 {
1481     uint64_t rval;
1482     RISCVException ret;
1483 
1484     ret = rmw_mideleg64(env, csrno, &rval,
1485         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1486     if (ret_val) {
1487         *ret_val = rval >> 32;
1488     }
1489 
1490     return ret;
1491 }
1492 
1493 static RISCVException rmw_mie64(CPURISCVState *env, int csrno,
1494                                 uint64_t *ret_val,
1495                                 uint64_t new_val, uint64_t wr_mask)
1496 {
1497     uint64_t mask = wr_mask & all_ints;
1498 
1499     if (ret_val) {
1500         *ret_val = env->mie;
1501     }
1502 
1503     env->mie = (env->mie & ~mask) | (new_val & mask);
1504 
1505     if (!riscv_has_ext(env, RVH)) {
1506         env->mie &= ~((uint64_t)MIP_SGEIP);
1507     }
1508 
1509     return RISCV_EXCP_NONE;
1510 }
1511 
1512 static RISCVException rmw_mie(CPURISCVState *env, int csrno,
1513                               target_ulong *ret_val,
1514                               target_ulong new_val, target_ulong wr_mask)
1515 {
1516     uint64_t rval;
1517     RISCVException ret;
1518 
1519     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask);
1520     if (ret_val) {
1521         *ret_val = rval;
1522     }
1523 
1524     return ret;
1525 }
1526 
1527 static RISCVException rmw_mieh(CPURISCVState *env, int csrno,
1528                                target_ulong *ret_val,
1529                                target_ulong new_val, target_ulong wr_mask)
1530 {
1531     uint64_t rval;
1532     RISCVException ret;
1533 
1534     ret = rmw_mie64(env, csrno, &rval,
1535         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1536     if (ret_val) {
1537         *ret_val = rval >> 32;
1538     }
1539 
1540     return ret;
1541 }
1542 
1543 static int read_mtopi(CPURISCVState *env, int csrno, target_ulong *val)
1544 {
1545     int irq;
1546     uint8_t iprio;
1547 
1548     irq = riscv_cpu_mirq_pending(env);
1549     if (irq <= 0 || irq > 63) {
1550         *val = 0;
1551     } else {
1552         iprio = env->miprio[irq];
1553         if (!iprio) {
1554             if (riscv_cpu_default_priority(irq) > IPRIO_DEFAULT_M) {
1555                 iprio = IPRIO_MMAXIPRIO;
1556             }
1557         }
1558         *val = (irq & TOPI_IID_MASK) << TOPI_IID_SHIFT;
1559         *val |= iprio;
1560     }
1561 
1562     return RISCV_EXCP_NONE;
1563 }
1564 
1565 static int aia_xlate_vs_csrno(CPURISCVState *env, int csrno)
1566 {
1567     if (!env->virt_enabled) {
1568         return csrno;
1569     }
1570 
1571     switch (csrno) {
1572     case CSR_SISELECT:
1573         return CSR_VSISELECT;
1574     case CSR_SIREG:
1575         return CSR_VSIREG;
1576     case CSR_STOPEI:
1577         return CSR_VSTOPEI;
1578     default:
1579         return csrno;
1580     };
1581 }
1582 
1583 static int rmw_xiselect(CPURISCVState *env, int csrno, target_ulong *val,
1584                         target_ulong new_val, target_ulong wr_mask)
1585 {
1586     target_ulong *iselect;
1587 
1588     /* Translate CSR number for VS-mode */
1589     csrno = aia_xlate_vs_csrno(env, csrno);
1590 
1591     /* Find the iselect CSR based on CSR number */
1592     switch (csrno) {
1593     case CSR_MISELECT:
1594         iselect = &env->miselect;
1595         break;
1596     case CSR_SISELECT:
1597         iselect = &env->siselect;
1598         break;
1599     case CSR_VSISELECT:
1600         iselect = &env->vsiselect;
1601         break;
1602     default:
1603          return RISCV_EXCP_ILLEGAL_INST;
1604     };
1605 
1606     if (val) {
1607         *val = *iselect;
1608     }
1609 
1610     wr_mask &= ISELECT_MASK;
1611     if (wr_mask) {
1612         *iselect = (*iselect & ~wr_mask) | (new_val & wr_mask);
1613     }
1614 
1615     return RISCV_EXCP_NONE;
1616 }
1617 
1618 static int rmw_iprio(target_ulong xlen,
1619                      target_ulong iselect, uint8_t *iprio,
1620                      target_ulong *val, target_ulong new_val,
1621                      target_ulong wr_mask, int ext_irq_no)
1622 {
1623     int i, firq, nirqs;
1624     target_ulong old_val;
1625 
1626     if (iselect < ISELECT_IPRIO0 || ISELECT_IPRIO15 < iselect) {
1627         return -EINVAL;
1628     }
1629     if (xlen != 32 && iselect & 0x1) {
1630         return -EINVAL;
1631     }
1632 
1633     nirqs = 4 * (xlen / 32);
1634     firq = ((iselect - ISELECT_IPRIO0) / (xlen / 32)) * (nirqs);
1635 
1636     old_val = 0;
1637     for (i = 0; i < nirqs; i++) {
1638         old_val |= ((target_ulong)iprio[firq + i]) << (IPRIO_IRQ_BITS * i);
1639     }
1640 
1641     if (val) {
1642         *val = old_val;
1643     }
1644 
1645     if (wr_mask) {
1646         new_val = (old_val & ~wr_mask) | (new_val & wr_mask);
1647         for (i = 0; i < nirqs; i++) {
1648             /*
1649              * M-level and S-level external IRQ priority always read-only
1650              * zero. This means default priority order is always preferred
1651              * for M-level and S-level external IRQs.
1652              */
1653             if ((firq + i) == ext_irq_no) {
1654                 continue;
1655             }
1656             iprio[firq + i] = (new_val >> (IPRIO_IRQ_BITS * i)) & 0xff;
1657         }
1658     }
1659 
1660     return 0;
1661 }
1662 
1663 static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
1664                      target_ulong new_val, target_ulong wr_mask)
1665 {
1666     bool virt;
1667     uint8_t *iprio;
1668     int ret = -EINVAL;
1669     target_ulong priv, isel, vgein;
1670 
1671     /* Translate CSR number for VS-mode */
1672     csrno = aia_xlate_vs_csrno(env, csrno);
1673 
1674     /* Decode register details from CSR number */
1675     virt = false;
1676     switch (csrno) {
1677     case CSR_MIREG:
1678         iprio = env->miprio;
1679         isel = env->miselect;
1680         priv = PRV_M;
1681         break;
1682     case CSR_SIREG:
1683         iprio = env->siprio;
1684         isel = env->siselect;
1685         priv = PRV_S;
1686         break;
1687     case CSR_VSIREG:
1688         iprio = env->hviprio;
1689         isel = env->vsiselect;
1690         priv = PRV_S;
1691         virt = true;
1692         break;
1693     default:
1694          goto done;
1695     };
1696 
1697     /* Find the selected guest interrupt file */
1698     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
1699 
1700     if (ISELECT_IPRIO0 <= isel && isel <= ISELECT_IPRIO15) {
1701         /* Local interrupt priority registers not available for VS-mode */
1702         if (!virt) {
1703             ret = rmw_iprio(riscv_cpu_mxl_bits(env),
1704                             isel, iprio, val, new_val, wr_mask,
1705                             (priv == PRV_M) ? IRQ_M_EXT : IRQ_S_EXT);
1706         }
1707     } else if (ISELECT_IMSIC_FIRST <= isel && isel <= ISELECT_IMSIC_LAST) {
1708         /* IMSIC registers only available when machine implements it. */
1709         if (env->aia_ireg_rmw_fn[priv]) {
1710             /* Selected guest interrupt file should not be zero */
1711             if (virt && (!vgein || env->geilen < vgein)) {
1712                 goto done;
1713             }
1714             /* Call machine specific IMSIC register emulation */
1715             ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
1716                                     AIA_MAKE_IREG(isel, priv, virt, vgein,
1717                                                   riscv_cpu_mxl_bits(env)),
1718                                     val, new_val, wr_mask);
1719         }
1720     }
1721 
1722 done:
1723     if (ret) {
1724         return (env->virt_enabled && virt) ?
1725                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
1726     }
1727     return RISCV_EXCP_NONE;
1728 }
1729 
1730 static int rmw_xtopei(CPURISCVState *env, int csrno, target_ulong *val,
1731                       target_ulong new_val, target_ulong wr_mask)
1732 {
1733     bool virt;
1734     int ret = -EINVAL;
1735     target_ulong priv, vgein;
1736 
1737     /* Translate CSR number for VS-mode */
1738     csrno = aia_xlate_vs_csrno(env, csrno);
1739 
1740     /* Decode register details from CSR number */
1741     virt = false;
1742     switch (csrno) {
1743     case CSR_MTOPEI:
1744         priv = PRV_M;
1745         break;
1746     case CSR_STOPEI:
1747         priv = PRV_S;
1748         break;
1749     case CSR_VSTOPEI:
1750         priv = PRV_S;
1751         virt = true;
1752         break;
1753     default:
1754         goto done;
1755     };
1756 
1757     /* IMSIC CSRs only available when machine implements IMSIC. */
1758     if (!env->aia_ireg_rmw_fn[priv]) {
1759         goto done;
1760     }
1761 
1762     /* Find the selected guest interrupt file */
1763     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
1764 
1765     /* Selected guest interrupt file should be valid */
1766     if (virt && (!vgein || env->geilen < vgein)) {
1767         goto done;
1768     }
1769 
1770     /* Call machine specific IMSIC register emulation for TOPEI */
1771     ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
1772                     AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, priv, virt, vgein,
1773                                   riscv_cpu_mxl_bits(env)),
1774                     val, new_val, wr_mask);
1775 
1776 done:
1777     if (ret) {
1778         return (env->virt_enabled && virt) ?
1779                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
1780     }
1781     return RISCV_EXCP_NONE;
1782 }
1783 
1784 static RISCVException read_mtvec(CPURISCVState *env, int csrno,
1785                                  target_ulong *val)
1786 {
1787     *val = env->mtvec;
1788     return RISCV_EXCP_NONE;
1789 }
1790 
1791 static RISCVException write_mtvec(CPURISCVState *env, int csrno,
1792                                   target_ulong val)
1793 {
1794     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
1795     if ((val & 3) < 2) {
1796         env->mtvec = val;
1797     } else {
1798         qemu_log_mask(LOG_UNIMP, "CSR_MTVEC: reserved mode not supported\n");
1799     }
1800     return RISCV_EXCP_NONE;
1801 }
1802 
1803 static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
1804                                          target_ulong *val)
1805 {
1806     *val = env->mcountinhibit;
1807     return RISCV_EXCP_NONE;
1808 }
1809 
1810 static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
1811                                           target_ulong val)
1812 {
1813     int cidx;
1814     PMUCTRState *counter;
1815 
1816     env->mcountinhibit = val;
1817 
1818     /* Check if any other counter is also monitoring cycles/instructions */
1819     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
1820         if (!get_field(env->mcountinhibit, BIT(cidx))) {
1821             counter = &env->pmu_ctrs[cidx];
1822             counter->started = true;
1823         }
1824     }
1825 
1826     return RISCV_EXCP_NONE;
1827 }
1828 
1829 static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
1830                                       target_ulong *val)
1831 {
1832     *val = env->mcounteren;
1833     return RISCV_EXCP_NONE;
1834 }
1835 
1836 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
1837                                        target_ulong val)
1838 {
1839     env->mcounteren = val;
1840     return RISCV_EXCP_NONE;
1841 }
1842 
1843 /* Machine Trap Handling */
1844 static RISCVException read_mscratch_i128(CPURISCVState *env, int csrno,
1845                                          Int128 *val)
1846 {
1847     *val = int128_make128(env->mscratch, env->mscratchh);
1848     return RISCV_EXCP_NONE;
1849 }
1850 
1851 static RISCVException write_mscratch_i128(CPURISCVState *env, int csrno,
1852                                           Int128 val)
1853 {
1854     env->mscratch = int128_getlo(val);
1855     env->mscratchh = int128_gethi(val);
1856     return RISCV_EXCP_NONE;
1857 }
1858 
1859 static RISCVException read_mscratch(CPURISCVState *env, int csrno,
1860                                     target_ulong *val)
1861 {
1862     *val = env->mscratch;
1863     return RISCV_EXCP_NONE;
1864 }
1865 
1866 static RISCVException write_mscratch(CPURISCVState *env, int csrno,
1867                                      target_ulong val)
1868 {
1869     env->mscratch = val;
1870     return RISCV_EXCP_NONE;
1871 }
1872 
1873 static RISCVException read_mepc(CPURISCVState *env, int csrno,
1874                                 target_ulong *val)
1875 {
1876     *val = env->mepc;
1877     return RISCV_EXCP_NONE;
1878 }
1879 
1880 static RISCVException write_mepc(CPURISCVState *env, int csrno,
1881                                  target_ulong val)
1882 {
1883     env->mepc = val;
1884     return RISCV_EXCP_NONE;
1885 }
1886 
1887 static RISCVException read_mcause(CPURISCVState *env, int csrno,
1888                                   target_ulong *val)
1889 {
1890     *val = env->mcause;
1891     return RISCV_EXCP_NONE;
1892 }
1893 
1894 static RISCVException write_mcause(CPURISCVState *env, int csrno,
1895                                    target_ulong val)
1896 {
1897     env->mcause = val;
1898     return RISCV_EXCP_NONE;
1899 }
1900 
1901 static RISCVException read_mtval(CPURISCVState *env, int csrno,
1902                                  target_ulong *val)
1903 {
1904     *val = env->mtval;
1905     return RISCV_EXCP_NONE;
1906 }
1907 
1908 static RISCVException write_mtval(CPURISCVState *env, int csrno,
1909                                   target_ulong val)
1910 {
1911     env->mtval = val;
1912     return RISCV_EXCP_NONE;
1913 }
1914 
1915 /* Execution environment configuration setup */
1916 static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
1917                                    target_ulong *val)
1918 {
1919     *val = env->menvcfg;
1920     return RISCV_EXCP_NONE;
1921 }
1922 
1923 static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
1924                                     target_ulong val)
1925 {
1926     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
1927     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE | MENVCFG_CBZE;
1928 
1929     if (riscv_cpu_mxl(env) == MXL_RV64) {
1930         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
1931                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
1932                 (cfg->ext_svadu ? MENVCFG_HADE : 0);
1933     }
1934     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
1935 
1936     return RISCV_EXCP_NONE;
1937 }
1938 
1939 static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
1940                                     target_ulong *val)
1941 {
1942     *val = env->menvcfg >> 32;
1943     return RISCV_EXCP_NONE;
1944 }
1945 
1946 static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
1947                                      target_ulong val)
1948 {
1949     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
1950     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
1951                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
1952                     (cfg->ext_svadu ? MENVCFG_HADE : 0);
1953     uint64_t valh = (uint64_t)val << 32;
1954 
1955     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
1956 
1957     return RISCV_EXCP_NONE;
1958 }
1959 
1960 static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
1961                                    target_ulong *val)
1962 {
1963     RISCVException ret;
1964 
1965     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
1966     if (ret != RISCV_EXCP_NONE) {
1967         return ret;
1968     }
1969 
1970     *val = env->senvcfg;
1971     return RISCV_EXCP_NONE;
1972 }
1973 
1974 static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
1975                                     target_ulong val)
1976 {
1977     uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
1978     RISCVException ret;
1979 
1980     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
1981     if (ret != RISCV_EXCP_NONE) {
1982         return ret;
1983     }
1984 
1985     env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
1986     return RISCV_EXCP_NONE;
1987 }
1988 
1989 static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
1990                                    target_ulong *val)
1991 {
1992     RISCVException ret;
1993 
1994     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
1995     if (ret != RISCV_EXCP_NONE) {
1996         return ret;
1997     }
1998 
1999     /*
2000      * henvcfg.pbmte is read_only 0 when menvcfg.pbmte = 0
2001      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
2002      * henvcfg.hade is read_only 0 when menvcfg.hade = 0
2003      */
2004     *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
2005                            env->menvcfg);
2006     return RISCV_EXCP_NONE;
2007 }
2008 
2009 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
2010                                     target_ulong val)
2011 {
2012     uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
2013     RISCVException ret;
2014 
2015     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2016     if (ret != RISCV_EXCP_NONE) {
2017         return ret;
2018     }
2019 
2020     if (riscv_cpu_mxl(env) == MXL_RV64) {
2021         mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE);
2022     }
2023 
2024     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
2025 
2026     return RISCV_EXCP_NONE;
2027 }
2028 
2029 static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
2030                                     target_ulong *val)
2031 {
2032     RISCVException ret;
2033 
2034     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2035     if (ret != RISCV_EXCP_NONE) {
2036         return ret;
2037     }
2038 
2039     *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_HADE) |
2040                             env->menvcfg)) >> 32;
2041     return RISCV_EXCP_NONE;
2042 }
2043 
2044 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
2045                                      target_ulong val)
2046 {
2047     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
2048                                     HENVCFG_HADE);
2049     uint64_t valh = (uint64_t)val << 32;
2050     RISCVException ret;
2051 
2052     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2053     if (ret != RISCV_EXCP_NONE) {
2054         return ret;
2055     }
2056 
2057     env->henvcfg = (env->henvcfg & ~mask) | (valh & mask);
2058     return RISCV_EXCP_NONE;
2059 }
2060 
2061 static RISCVException read_mstateen(CPURISCVState *env, int csrno,
2062                                     target_ulong *val)
2063 {
2064     *val = env->mstateen[csrno - CSR_MSTATEEN0];
2065 
2066     return RISCV_EXCP_NONE;
2067 }
2068 
2069 static RISCVException write_mstateen(CPURISCVState *env, int csrno,
2070                                      uint64_t wr_mask, target_ulong new_val)
2071 {
2072     uint64_t *reg;
2073 
2074     reg = &env->mstateen[csrno - CSR_MSTATEEN0];
2075     *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
2076 
2077     return RISCV_EXCP_NONE;
2078 }
2079 
2080 static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
2081                                       target_ulong new_val)
2082 {
2083     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2084 
2085     return write_mstateen(env, csrno, wr_mask, new_val);
2086 }
2087 
2088 static RISCVException write_mstateen_1_3(CPURISCVState *env, int csrno,
2089                                          target_ulong new_val)
2090 {
2091     return write_mstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
2092 }
2093 
2094 static RISCVException read_mstateenh(CPURISCVState *env, int csrno,
2095                                      target_ulong *val)
2096 {
2097     *val = env->mstateen[csrno - CSR_MSTATEEN0H] >> 32;
2098 
2099     return RISCV_EXCP_NONE;
2100 }
2101 
2102 static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
2103                                       uint64_t wr_mask, target_ulong new_val)
2104 {
2105     uint64_t *reg, val;
2106 
2107     reg = &env->mstateen[csrno - CSR_MSTATEEN0H];
2108     val = (uint64_t)new_val << 32;
2109     val |= *reg & 0xFFFFFFFF;
2110     *reg = (*reg & ~wr_mask) | (val & wr_mask);
2111 
2112     return RISCV_EXCP_NONE;
2113 }
2114 
2115 static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
2116                                        target_ulong new_val)
2117 {
2118     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2119 
2120     return write_mstateenh(env, csrno, wr_mask, new_val);
2121 }
2122 
2123 static RISCVException write_mstateenh_1_3(CPURISCVState *env, int csrno,
2124                                           target_ulong new_val)
2125 {
2126     return write_mstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
2127 }
2128 
2129 static RISCVException read_hstateen(CPURISCVState *env, int csrno,
2130                                     target_ulong *val)
2131 {
2132     int index = csrno - CSR_HSTATEEN0;
2133 
2134     *val = env->hstateen[index] & env->mstateen[index];
2135 
2136     return RISCV_EXCP_NONE;
2137 }
2138 
2139 static RISCVException write_hstateen(CPURISCVState *env, int csrno,
2140                                      uint64_t mask, target_ulong new_val)
2141 {
2142     int index = csrno - CSR_HSTATEEN0;
2143     uint64_t *reg, wr_mask;
2144 
2145     reg = &env->hstateen[index];
2146     wr_mask = env->mstateen[index] & mask;
2147     *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
2148 
2149     return RISCV_EXCP_NONE;
2150 }
2151 
2152 static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
2153                                       target_ulong new_val)
2154 {
2155     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2156 
2157     return write_hstateen(env, csrno, wr_mask, new_val);
2158 }
2159 
2160 static RISCVException write_hstateen_1_3(CPURISCVState *env, int csrno,
2161                                          target_ulong new_val)
2162 {
2163     return write_hstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
2164 }
2165 
2166 static RISCVException read_hstateenh(CPURISCVState *env, int csrno,
2167                                      target_ulong *val)
2168 {
2169     int index = csrno - CSR_HSTATEEN0H;
2170 
2171     *val = (env->hstateen[index] >> 32) & (env->mstateen[index] >> 32);
2172 
2173     return RISCV_EXCP_NONE;
2174 }
2175 
2176 static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
2177                                       uint64_t mask, target_ulong new_val)
2178 {
2179     int index = csrno - CSR_HSTATEEN0H;
2180     uint64_t *reg, wr_mask, val;
2181 
2182     reg = &env->hstateen[index];
2183     val = (uint64_t)new_val << 32;
2184     val |= *reg & 0xFFFFFFFF;
2185     wr_mask = env->mstateen[index] & mask;
2186     *reg = (*reg & ~wr_mask) | (val & wr_mask);
2187 
2188     return RISCV_EXCP_NONE;
2189 }
2190 
2191 static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
2192                                        target_ulong new_val)
2193 {
2194     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2195 
2196     return write_hstateenh(env, csrno, wr_mask, new_val);
2197 }
2198 
2199 static RISCVException write_hstateenh_1_3(CPURISCVState *env, int csrno,
2200                                           target_ulong new_val)
2201 {
2202     return write_hstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
2203 }
2204 
2205 static RISCVException read_sstateen(CPURISCVState *env, int csrno,
2206                                     target_ulong *val)
2207 {
2208     bool virt = env->virt_enabled;
2209     int index = csrno - CSR_SSTATEEN0;
2210 
2211     *val = env->sstateen[index] & env->mstateen[index];
2212     if (virt) {
2213         *val &= env->hstateen[index];
2214     }
2215 
2216     return RISCV_EXCP_NONE;
2217 }
2218 
2219 static RISCVException write_sstateen(CPURISCVState *env, int csrno,
2220                                      uint64_t mask, target_ulong new_val)
2221 {
2222     bool virt = env->virt_enabled;
2223     int index = csrno - CSR_SSTATEEN0;
2224     uint64_t wr_mask;
2225     uint64_t *reg;
2226 
2227     wr_mask = env->mstateen[index] & mask;
2228     if (virt) {
2229         wr_mask &= env->hstateen[index];
2230     }
2231 
2232     reg = &env->sstateen[index];
2233     *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
2234 
2235     return RISCV_EXCP_NONE;
2236 }
2237 
2238 static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
2239                                       target_ulong new_val)
2240 {
2241     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2242 
2243     return write_sstateen(env, csrno, wr_mask, new_val);
2244 }
2245 
2246 static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
2247                                       target_ulong new_val)
2248 {
2249     return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
2250 }
2251 
2252 static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
2253                                 uint64_t *ret_val,
2254                                 uint64_t new_val, uint64_t wr_mask)
2255 {
2256     uint64_t old_mip, mask = wr_mask & delegable_ints;
2257     uint32_t gin;
2258 
2259     if (mask & MIP_SEIP) {
2260         env->software_seip = new_val & MIP_SEIP;
2261         new_val |= env->external_seip * MIP_SEIP;
2262     }
2263 
2264     if (riscv_cpu_cfg(env)->ext_sstc && (env->priv == PRV_M) &&
2265         get_field(env->menvcfg, MENVCFG_STCE)) {
2266         /* sstc extension forbids STIP & VSTIP to be writeable in mip */
2267         mask = mask & ~(MIP_STIP | MIP_VSTIP);
2268     }
2269 
2270     if (mask) {
2271         old_mip = riscv_cpu_update_mip(env, mask, (new_val & mask));
2272     } else {
2273         old_mip = env->mip;
2274     }
2275 
2276     if (csrno != CSR_HVIP) {
2277         gin = get_field(env->hstatus, HSTATUS_VGEIN);
2278         old_mip |= (env->hgeip & ((target_ulong)1 << gin)) ? MIP_VSEIP : 0;
2279         old_mip |= env->vstime_irq ? MIP_VSTIP : 0;
2280     }
2281 
2282     if (ret_val) {
2283         *ret_val = old_mip;
2284     }
2285 
2286     return RISCV_EXCP_NONE;
2287 }
2288 
2289 static RISCVException rmw_mip(CPURISCVState *env, int csrno,
2290                               target_ulong *ret_val,
2291                               target_ulong new_val, target_ulong wr_mask)
2292 {
2293     uint64_t rval;
2294     RISCVException ret;
2295 
2296     ret = rmw_mip64(env, csrno, &rval, new_val, wr_mask);
2297     if (ret_val) {
2298         *ret_val = rval;
2299     }
2300 
2301     return ret;
2302 }
2303 
2304 static RISCVException rmw_miph(CPURISCVState *env, int csrno,
2305                                target_ulong *ret_val,
2306                                target_ulong new_val, target_ulong wr_mask)
2307 {
2308     uint64_t rval;
2309     RISCVException ret;
2310 
2311     ret = rmw_mip64(env, csrno, &rval,
2312         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2313     if (ret_val) {
2314         *ret_val = rval >> 32;
2315     }
2316 
2317     return ret;
2318 }
2319 
2320 /* Supervisor Trap Setup */
2321 static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
2322                                         Int128 *val)
2323 {
2324     uint64_t mask = sstatus_v1_10_mask;
2325     uint64_t sstatus = env->mstatus & mask;
2326     if (env->xl != MXL_RV32 || env->debugger) {
2327         mask |= SSTATUS64_UXL;
2328     }
2329 
2330     *val = int128_make128(sstatus, add_status_sd(MXL_RV128, sstatus));
2331     return RISCV_EXCP_NONE;
2332 }
2333 
2334 static RISCVException read_sstatus(CPURISCVState *env, int csrno,
2335                                    target_ulong *val)
2336 {
2337     target_ulong mask = (sstatus_v1_10_mask);
2338     if (env->xl != MXL_RV32 || env->debugger) {
2339         mask |= SSTATUS64_UXL;
2340     }
2341     /* TODO: Use SXL not MXL. */
2342     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus & mask);
2343     return RISCV_EXCP_NONE;
2344 }
2345 
2346 static RISCVException write_sstatus(CPURISCVState *env, int csrno,
2347                                     target_ulong val)
2348 {
2349     target_ulong mask = (sstatus_v1_10_mask);
2350 
2351     if (env->xl != MXL_RV32 || env->debugger) {
2352         if ((val & SSTATUS64_UXL) != 0) {
2353             mask |= SSTATUS64_UXL;
2354         }
2355     }
2356     target_ulong newval = (env->mstatus & ~mask) | (val & mask);
2357     return write_mstatus(env, CSR_MSTATUS, newval);
2358 }
2359 
2360 static RISCVException rmw_vsie64(CPURISCVState *env, int csrno,
2361                                  uint64_t *ret_val,
2362                                  uint64_t new_val, uint64_t wr_mask)
2363 {
2364     RISCVException ret;
2365     uint64_t rval, mask = env->hideleg & VS_MODE_INTERRUPTS;
2366 
2367     /* Bring VS-level bits to correct position */
2368     new_val = (new_val & (VS_MODE_INTERRUPTS >> 1)) << 1;
2369     wr_mask = (wr_mask & (VS_MODE_INTERRUPTS >> 1)) << 1;
2370 
2371     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask & mask);
2372     if (ret_val) {
2373         *ret_val = (rval & mask) >> 1;
2374     }
2375 
2376     return ret;
2377 }
2378 
2379 static RISCVException rmw_vsie(CPURISCVState *env, int csrno,
2380                                target_ulong *ret_val,
2381                                target_ulong new_val, target_ulong wr_mask)
2382 {
2383     uint64_t rval;
2384     RISCVException ret;
2385 
2386     ret = rmw_vsie64(env, csrno, &rval, new_val, wr_mask);
2387     if (ret_val) {
2388         *ret_val = rval;
2389     }
2390 
2391     return ret;
2392 }
2393 
2394 static RISCVException rmw_vsieh(CPURISCVState *env, int csrno,
2395                                 target_ulong *ret_val,
2396                                 target_ulong new_val, target_ulong wr_mask)
2397 {
2398     uint64_t rval;
2399     RISCVException ret;
2400 
2401     ret = rmw_vsie64(env, csrno, &rval,
2402         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2403     if (ret_val) {
2404         *ret_val = rval >> 32;
2405     }
2406 
2407     return ret;
2408 }
2409 
2410 static RISCVException rmw_sie64(CPURISCVState *env, int csrno,
2411                                 uint64_t *ret_val,
2412                                 uint64_t new_val, uint64_t wr_mask)
2413 {
2414     RISCVException ret;
2415     uint64_t mask = env->mideleg & S_MODE_INTERRUPTS;
2416 
2417     if (env->virt_enabled) {
2418         if (env->hvictl & HVICTL_VTI) {
2419             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
2420         }
2421         ret = rmw_vsie64(env, CSR_VSIE, ret_val, new_val, wr_mask);
2422     } else {
2423         ret = rmw_mie64(env, csrno, ret_val, new_val, wr_mask & mask);
2424     }
2425 
2426     if (ret_val) {
2427         *ret_val &= mask;
2428     }
2429 
2430     return ret;
2431 }
2432 
2433 static RISCVException rmw_sie(CPURISCVState *env, int csrno,
2434                               target_ulong *ret_val,
2435                               target_ulong new_val, target_ulong wr_mask)
2436 {
2437     uint64_t rval;
2438     RISCVException ret;
2439 
2440     ret = rmw_sie64(env, csrno, &rval, new_val, wr_mask);
2441     if (ret == RISCV_EXCP_NONE && ret_val) {
2442         *ret_val = rval;
2443     }
2444 
2445     return ret;
2446 }
2447 
2448 static RISCVException rmw_sieh(CPURISCVState *env, int csrno,
2449                                target_ulong *ret_val,
2450                                target_ulong new_val, target_ulong wr_mask)
2451 {
2452     uint64_t rval;
2453     RISCVException ret;
2454 
2455     ret = rmw_sie64(env, csrno, &rval,
2456         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2457     if (ret_val) {
2458         *ret_val = rval >> 32;
2459     }
2460 
2461     return ret;
2462 }
2463 
2464 static RISCVException read_stvec(CPURISCVState *env, int csrno,
2465                                  target_ulong *val)
2466 {
2467     *val = env->stvec;
2468     return RISCV_EXCP_NONE;
2469 }
2470 
2471 static RISCVException write_stvec(CPURISCVState *env, int csrno,
2472                                   target_ulong val)
2473 {
2474     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
2475     if ((val & 3) < 2) {
2476         env->stvec = val;
2477     } else {
2478         qemu_log_mask(LOG_UNIMP, "CSR_STVEC: reserved mode not supported\n");
2479     }
2480     return RISCV_EXCP_NONE;
2481 }
2482 
2483 static RISCVException read_scounteren(CPURISCVState *env, int csrno,
2484                                       target_ulong *val)
2485 {
2486     *val = env->scounteren;
2487     return RISCV_EXCP_NONE;
2488 }
2489 
2490 static RISCVException write_scounteren(CPURISCVState *env, int csrno,
2491                                        target_ulong val)
2492 {
2493     env->scounteren = val;
2494     return RISCV_EXCP_NONE;
2495 }
2496 
2497 /* Supervisor Trap Handling */
2498 static RISCVException read_sscratch_i128(CPURISCVState *env, int csrno,
2499                                          Int128 *val)
2500 {
2501     *val = int128_make128(env->sscratch, env->sscratchh);
2502     return RISCV_EXCP_NONE;
2503 }
2504 
2505 static RISCVException write_sscratch_i128(CPURISCVState *env, int csrno,
2506                                           Int128 val)
2507 {
2508     env->sscratch = int128_getlo(val);
2509     env->sscratchh = int128_gethi(val);
2510     return RISCV_EXCP_NONE;
2511 }
2512 
2513 static RISCVException read_sscratch(CPURISCVState *env, int csrno,
2514                                     target_ulong *val)
2515 {
2516     *val = env->sscratch;
2517     return RISCV_EXCP_NONE;
2518 }
2519 
2520 static RISCVException write_sscratch(CPURISCVState *env, int csrno,
2521                                      target_ulong val)
2522 {
2523     env->sscratch = val;
2524     return RISCV_EXCP_NONE;
2525 }
2526 
2527 static RISCVException read_sepc(CPURISCVState *env, int csrno,
2528                                 target_ulong *val)
2529 {
2530     *val = env->sepc;
2531     return RISCV_EXCP_NONE;
2532 }
2533 
2534 static RISCVException write_sepc(CPURISCVState *env, int csrno,
2535                                  target_ulong val)
2536 {
2537     env->sepc = val;
2538     return RISCV_EXCP_NONE;
2539 }
2540 
2541 static RISCVException read_scause(CPURISCVState *env, int csrno,
2542                                   target_ulong *val)
2543 {
2544     *val = env->scause;
2545     return RISCV_EXCP_NONE;
2546 }
2547 
2548 static RISCVException write_scause(CPURISCVState *env, int csrno,
2549                                    target_ulong val)
2550 {
2551     env->scause = val;
2552     return RISCV_EXCP_NONE;
2553 }
2554 
2555 static RISCVException read_stval(CPURISCVState *env, int csrno,
2556                                  target_ulong *val)
2557 {
2558     *val = env->stval;
2559     return RISCV_EXCP_NONE;
2560 }
2561 
2562 static RISCVException write_stval(CPURISCVState *env, int csrno,
2563                                   target_ulong val)
2564 {
2565     env->stval = val;
2566     return RISCV_EXCP_NONE;
2567 }
2568 
2569 static RISCVException rmw_vsip64(CPURISCVState *env, int csrno,
2570                                  uint64_t *ret_val,
2571                                  uint64_t new_val, uint64_t wr_mask)
2572 {
2573     RISCVException ret;
2574     uint64_t rval, mask = env->hideleg & VS_MODE_INTERRUPTS;
2575 
2576     /* Bring VS-level bits to correct position */
2577     new_val = (new_val & (VS_MODE_INTERRUPTS >> 1)) << 1;
2578     wr_mask = (wr_mask & (VS_MODE_INTERRUPTS >> 1)) << 1;
2579 
2580     ret = rmw_mip64(env, csrno, &rval, new_val,
2581                     wr_mask & mask & vsip_writable_mask);
2582     if (ret_val) {
2583         *ret_val = (rval & mask) >> 1;
2584     }
2585 
2586     return ret;
2587 }
2588 
2589 static RISCVException rmw_vsip(CPURISCVState *env, int csrno,
2590                                target_ulong *ret_val,
2591                                target_ulong new_val, target_ulong wr_mask)
2592 {
2593     uint64_t rval;
2594     RISCVException ret;
2595 
2596     ret = rmw_vsip64(env, csrno, &rval, new_val, wr_mask);
2597     if (ret_val) {
2598         *ret_val = rval;
2599     }
2600 
2601     return ret;
2602 }
2603 
2604 static RISCVException rmw_vsiph(CPURISCVState *env, int csrno,
2605                                 target_ulong *ret_val,
2606                                 target_ulong new_val, target_ulong wr_mask)
2607 {
2608     uint64_t rval;
2609     RISCVException ret;
2610 
2611     ret = rmw_vsip64(env, csrno, &rval,
2612         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2613     if (ret_val) {
2614         *ret_val = rval >> 32;
2615     }
2616 
2617     return ret;
2618 }
2619 
2620 static RISCVException rmw_sip64(CPURISCVState *env, int csrno,
2621                                 uint64_t *ret_val,
2622                                 uint64_t new_val, uint64_t wr_mask)
2623 {
2624     RISCVException ret;
2625     uint64_t mask = env->mideleg & sip_writable_mask;
2626 
2627     if (env->virt_enabled) {
2628         if (env->hvictl & HVICTL_VTI) {
2629             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
2630         }
2631         ret = rmw_vsip64(env, CSR_VSIP, ret_val, new_val, wr_mask);
2632     } else {
2633         ret = rmw_mip64(env, csrno, ret_val, new_val, wr_mask & mask);
2634     }
2635 
2636     if (ret_val) {
2637         *ret_val &= env->mideleg & S_MODE_INTERRUPTS;
2638     }
2639 
2640     return ret;
2641 }
2642 
2643 static RISCVException rmw_sip(CPURISCVState *env, int csrno,
2644                               target_ulong *ret_val,
2645                               target_ulong new_val, target_ulong wr_mask)
2646 {
2647     uint64_t rval;
2648     RISCVException ret;
2649 
2650     ret = rmw_sip64(env, csrno, &rval, new_val, wr_mask);
2651     if (ret_val) {
2652         *ret_val = rval;
2653     }
2654 
2655     return ret;
2656 }
2657 
2658 static RISCVException rmw_siph(CPURISCVState *env, int csrno,
2659                                target_ulong *ret_val,
2660                                target_ulong new_val, target_ulong wr_mask)
2661 {
2662     uint64_t rval;
2663     RISCVException ret;
2664 
2665     ret = rmw_sip64(env, csrno, &rval,
2666         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2667     if (ret_val) {
2668         *ret_val = rval >> 32;
2669     }
2670 
2671     return ret;
2672 }
2673 
2674 /* Supervisor Protection and Translation */
2675 static RISCVException read_satp(CPURISCVState *env, int csrno,
2676                                 target_ulong *val)
2677 {
2678     if (!riscv_cpu_cfg(env)->mmu) {
2679         *val = 0;
2680         return RISCV_EXCP_NONE;
2681     }
2682 
2683     if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
2684         return RISCV_EXCP_ILLEGAL_INST;
2685     } else {
2686         *val = env->satp;
2687     }
2688 
2689     return RISCV_EXCP_NONE;
2690 }
2691 
2692 static RISCVException write_satp(CPURISCVState *env, int csrno,
2693                                  target_ulong val)
2694 {
2695     target_ulong mask;
2696     bool vm;
2697 
2698     if (!riscv_cpu_cfg(env)->mmu) {
2699         return RISCV_EXCP_NONE;
2700     }
2701 
2702     if (riscv_cpu_mxl(env) == MXL_RV32) {
2703         vm = validate_vm(env, get_field(val, SATP32_MODE));
2704         mask = (val ^ env->satp) & (SATP32_MODE | SATP32_ASID | SATP32_PPN);
2705     } else {
2706         vm = validate_vm(env, get_field(val, SATP64_MODE));
2707         mask = (val ^ env->satp) & (SATP64_MODE | SATP64_ASID | SATP64_PPN);
2708     }
2709 
2710     if (vm && mask) {
2711         if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
2712             return RISCV_EXCP_ILLEGAL_INST;
2713         } else {
2714             /*
2715              * The ISA defines SATP.MODE=Bare as "no translation", but we still
2716              * pass these through QEMU's TLB emulation as it improves
2717              * performance.  Flushing the TLB on SATP writes with paging
2718              * enabled avoids leaking those invalid cached mappings.
2719              */
2720             tlb_flush(env_cpu(env));
2721             env->satp = val;
2722         }
2723     }
2724     return RISCV_EXCP_NONE;
2725 }
2726 
2727 static int read_vstopi(CPURISCVState *env, int csrno, target_ulong *val)
2728 {
2729     int irq, ret;
2730     target_ulong topei;
2731     uint64_t vseip, vsgein;
2732     uint32_t iid, iprio, hviid, hviprio, gein;
2733     uint32_t s, scount = 0, siid[VSTOPI_NUM_SRCS], siprio[VSTOPI_NUM_SRCS];
2734 
2735     gein = get_field(env->hstatus, HSTATUS_VGEIN);
2736     hviid = get_field(env->hvictl, HVICTL_IID);
2737     hviprio = get_field(env->hvictl, HVICTL_IPRIO);
2738 
2739     if (gein) {
2740         vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
2741         vseip = env->mie & (env->mip | vsgein) & MIP_VSEIP;
2742         if (gein <= env->geilen && vseip) {
2743             siid[scount] = IRQ_S_EXT;
2744             siprio[scount] = IPRIO_MMAXIPRIO + 1;
2745             if (env->aia_ireg_rmw_fn[PRV_S]) {
2746                 /*
2747                  * Call machine specific IMSIC register emulation for
2748                  * reading TOPEI.
2749                  */
2750                 ret = env->aia_ireg_rmw_fn[PRV_S](
2751                         env->aia_ireg_rmw_fn_arg[PRV_S],
2752                         AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, PRV_S, true, gein,
2753                                       riscv_cpu_mxl_bits(env)),
2754                         &topei, 0, 0);
2755                 if (!ret && topei) {
2756                     siprio[scount] = topei & IMSIC_TOPEI_IPRIO_MASK;
2757                 }
2758             }
2759             scount++;
2760         }
2761     } else {
2762         if (hviid == IRQ_S_EXT && hviprio) {
2763             siid[scount] = IRQ_S_EXT;
2764             siprio[scount] = hviprio;
2765             scount++;
2766         }
2767     }
2768 
2769     if (env->hvictl & HVICTL_VTI) {
2770         if (hviid != IRQ_S_EXT) {
2771             siid[scount] = hviid;
2772             siprio[scount] = hviprio;
2773             scount++;
2774         }
2775     } else {
2776         irq = riscv_cpu_vsirq_pending(env);
2777         if (irq != IRQ_S_EXT && 0 < irq && irq <= 63) {
2778             siid[scount] = irq;
2779             siprio[scount] = env->hviprio[irq];
2780             scount++;
2781         }
2782     }
2783 
2784     iid = 0;
2785     iprio = UINT_MAX;
2786     for (s = 0; s < scount; s++) {
2787         if (siprio[s] < iprio) {
2788             iid = siid[s];
2789             iprio = siprio[s];
2790         }
2791     }
2792 
2793     if (iid) {
2794         if (env->hvictl & HVICTL_IPRIOM) {
2795             if (iprio > IPRIO_MMAXIPRIO) {
2796                 iprio = IPRIO_MMAXIPRIO;
2797             }
2798             if (!iprio) {
2799                 if (riscv_cpu_default_priority(iid) > IPRIO_DEFAULT_S) {
2800                     iprio = IPRIO_MMAXIPRIO;
2801                 }
2802             }
2803         } else {
2804             iprio = 1;
2805         }
2806     } else {
2807         iprio = 0;
2808     }
2809 
2810     *val = (iid & TOPI_IID_MASK) << TOPI_IID_SHIFT;
2811     *val |= iprio;
2812     return RISCV_EXCP_NONE;
2813 }
2814 
2815 static int read_stopi(CPURISCVState *env, int csrno, target_ulong *val)
2816 {
2817     int irq;
2818     uint8_t iprio;
2819 
2820     if (env->virt_enabled) {
2821         return read_vstopi(env, CSR_VSTOPI, val);
2822     }
2823 
2824     irq = riscv_cpu_sirq_pending(env);
2825     if (irq <= 0 || irq > 63) {
2826         *val = 0;
2827     } else {
2828         iprio = env->siprio[irq];
2829         if (!iprio) {
2830             if (riscv_cpu_default_priority(irq) > IPRIO_DEFAULT_S) {
2831                 iprio = IPRIO_MMAXIPRIO;
2832            }
2833         }
2834         *val = (irq & TOPI_IID_MASK) << TOPI_IID_SHIFT;
2835         *val |= iprio;
2836     }
2837 
2838     return RISCV_EXCP_NONE;
2839 }
2840 
2841 /* Hypervisor Extensions */
2842 static RISCVException read_hstatus(CPURISCVState *env, int csrno,
2843                                    target_ulong *val)
2844 {
2845     *val = env->hstatus;
2846     if (riscv_cpu_mxl(env) != MXL_RV32) {
2847         /* We only support 64-bit VSXL */
2848         *val = set_field(*val, HSTATUS_VSXL, 2);
2849     }
2850     /* We only support little endian */
2851     *val = set_field(*val, HSTATUS_VSBE, 0);
2852     return RISCV_EXCP_NONE;
2853 }
2854 
2855 static RISCVException write_hstatus(CPURISCVState *env, int csrno,
2856                                     target_ulong val)
2857 {
2858     env->hstatus = val;
2859     if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
2860         qemu_log_mask(LOG_UNIMP,
2861                       "QEMU does not support mixed HSXLEN options.");
2862     }
2863     if (get_field(val, HSTATUS_VSBE) != 0) {
2864         qemu_log_mask(LOG_UNIMP, "QEMU does not support big endian guests.");
2865     }
2866     return RISCV_EXCP_NONE;
2867 }
2868 
2869 static RISCVException read_hedeleg(CPURISCVState *env, int csrno,
2870                                    target_ulong *val)
2871 {
2872     *val = env->hedeleg;
2873     return RISCV_EXCP_NONE;
2874 }
2875 
2876 static RISCVException write_hedeleg(CPURISCVState *env, int csrno,
2877                                     target_ulong val)
2878 {
2879     env->hedeleg = val & vs_delegable_excps;
2880     return RISCV_EXCP_NONE;
2881 }
2882 
2883 static RISCVException rmw_hideleg64(CPURISCVState *env, int csrno,
2884                                     uint64_t *ret_val,
2885                                     uint64_t new_val, uint64_t wr_mask)
2886 {
2887     uint64_t mask = wr_mask & vs_delegable_ints;
2888 
2889     if (ret_val) {
2890         *ret_val = env->hideleg & vs_delegable_ints;
2891     }
2892 
2893     env->hideleg = (env->hideleg & ~mask) | (new_val & mask);
2894     return RISCV_EXCP_NONE;
2895 }
2896 
2897 static RISCVException rmw_hideleg(CPURISCVState *env, int csrno,
2898                                   target_ulong *ret_val,
2899                                   target_ulong new_val, target_ulong wr_mask)
2900 {
2901     uint64_t rval;
2902     RISCVException ret;
2903 
2904     ret = rmw_hideleg64(env, csrno, &rval, new_val, wr_mask);
2905     if (ret_val) {
2906         *ret_val = rval;
2907     }
2908 
2909     return ret;
2910 }
2911 
2912 static RISCVException rmw_hidelegh(CPURISCVState *env, int csrno,
2913                                    target_ulong *ret_val,
2914                                    target_ulong new_val, target_ulong wr_mask)
2915 {
2916     uint64_t rval;
2917     RISCVException ret;
2918 
2919     ret = rmw_hideleg64(env, csrno, &rval,
2920         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2921     if (ret_val) {
2922         *ret_val = rval >> 32;
2923     }
2924 
2925     return ret;
2926 }
2927 
2928 static RISCVException rmw_hvip64(CPURISCVState *env, int csrno,
2929                                  uint64_t *ret_val,
2930                                  uint64_t new_val, uint64_t wr_mask)
2931 {
2932     RISCVException ret;
2933 
2934     ret = rmw_mip64(env, csrno, ret_val, new_val,
2935                     wr_mask & hvip_writable_mask);
2936     if (ret_val) {
2937         *ret_val &= VS_MODE_INTERRUPTS;
2938     }
2939 
2940     return ret;
2941 }
2942 
2943 static RISCVException rmw_hvip(CPURISCVState *env, int csrno,
2944                                target_ulong *ret_val,
2945                                target_ulong new_val, target_ulong wr_mask)
2946 {
2947     uint64_t rval;
2948     RISCVException ret;
2949 
2950     ret = rmw_hvip64(env, csrno, &rval, new_val, wr_mask);
2951     if (ret_val) {
2952         *ret_val = rval;
2953     }
2954 
2955     return ret;
2956 }
2957 
2958 static RISCVException rmw_hviph(CPURISCVState *env, int csrno,
2959                                 target_ulong *ret_val,
2960                                 target_ulong new_val, target_ulong wr_mask)
2961 {
2962     uint64_t rval;
2963     RISCVException ret;
2964 
2965     ret = rmw_hvip64(env, csrno, &rval,
2966         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2967     if (ret_val) {
2968         *ret_val = rval >> 32;
2969     }
2970 
2971     return ret;
2972 }
2973 
2974 static RISCVException rmw_hip(CPURISCVState *env, int csrno,
2975                               target_ulong *ret_value,
2976                               target_ulong new_value, target_ulong write_mask)
2977 {
2978     int ret = rmw_mip(env, csrno, ret_value, new_value,
2979                       write_mask & hip_writable_mask);
2980 
2981     if (ret_value) {
2982         *ret_value &= HS_MODE_INTERRUPTS;
2983     }
2984     return ret;
2985 }
2986 
2987 static RISCVException rmw_hie(CPURISCVState *env, int csrno,
2988                               target_ulong *ret_val,
2989                               target_ulong new_val, target_ulong wr_mask)
2990 {
2991     uint64_t rval;
2992     RISCVException ret;
2993 
2994     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask & HS_MODE_INTERRUPTS);
2995     if (ret_val) {
2996         *ret_val = rval & HS_MODE_INTERRUPTS;
2997     }
2998 
2999     return ret;
3000 }
3001 
3002 static RISCVException read_hcounteren(CPURISCVState *env, int csrno,
3003                                       target_ulong *val)
3004 {
3005     *val = env->hcounteren;
3006     return RISCV_EXCP_NONE;
3007 }
3008 
3009 static RISCVException write_hcounteren(CPURISCVState *env, int csrno,
3010                                        target_ulong val)
3011 {
3012     env->hcounteren = val;
3013     return RISCV_EXCP_NONE;
3014 }
3015 
3016 static RISCVException read_hgeie(CPURISCVState *env, int csrno,
3017                                  target_ulong *val)
3018 {
3019     if (val) {
3020         *val = env->hgeie;
3021     }
3022     return RISCV_EXCP_NONE;
3023 }
3024 
3025 static RISCVException write_hgeie(CPURISCVState *env, int csrno,
3026                                   target_ulong val)
3027 {
3028     /* Only GEILEN:1 bits implemented and BIT0 is never implemented */
3029     val &= ((((target_ulong)1) << env->geilen) - 1) << 1;
3030     env->hgeie = val;
3031     /* Update mip.SGEIP bit */
3032     riscv_cpu_update_mip(env, MIP_SGEIP,
3033                          BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
3034     return RISCV_EXCP_NONE;
3035 }
3036 
3037 static RISCVException read_htval(CPURISCVState *env, int csrno,
3038                                  target_ulong *val)
3039 {
3040     *val = env->htval;
3041     return RISCV_EXCP_NONE;
3042 }
3043 
3044 static RISCVException write_htval(CPURISCVState *env, int csrno,
3045                                   target_ulong val)
3046 {
3047     env->htval = val;
3048     return RISCV_EXCP_NONE;
3049 }
3050 
3051 static RISCVException read_htinst(CPURISCVState *env, int csrno,
3052                                   target_ulong *val)
3053 {
3054     *val = env->htinst;
3055     return RISCV_EXCP_NONE;
3056 }
3057 
3058 static RISCVException write_htinst(CPURISCVState *env, int csrno,
3059                                    target_ulong val)
3060 {
3061     return RISCV_EXCP_NONE;
3062 }
3063 
3064 static RISCVException read_hgeip(CPURISCVState *env, int csrno,
3065                                  target_ulong *val)
3066 {
3067     if (val) {
3068         *val = env->hgeip;
3069     }
3070     return RISCV_EXCP_NONE;
3071 }
3072 
3073 static RISCVException read_hgatp(CPURISCVState *env, int csrno,
3074                                  target_ulong *val)
3075 {
3076     *val = env->hgatp;
3077     return RISCV_EXCP_NONE;
3078 }
3079 
3080 static RISCVException write_hgatp(CPURISCVState *env, int csrno,
3081                                   target_ulong val)
3082 {
3083     env->hgatp = val;
3084     return RISCV_EXCP_NONE;
3085 }
3086 
3087 static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
3088                                       target_ulong *val)
3089 {
3090     if (!env->rdtime_fn) {
3091         return RISCV_EXCP_ILLEGAL_INST;
3092     }
3093 
3094     *val = env->htimedelta;
3095     return RISCV_EXCP_NONE;
3096 }
3097 
3098 static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
3099                                        target_ulong val)
3100 {
3101     if (!env->rdtime_fn) {
3102         return RISCV_EXCP_ILLEGAL_INST;
3103     }
3104 
3105     if (riscv_cpu_mxl(env) == MXL_RV32) {
3106         env->htimedelta = deposit64(env->htimedelta, 0, 32, (uint64_t)val);
3107     } else {
3108         env->htimedelta = val;
3109     }
3110 
3111     if (riscv_cpu_cfg(env)->ext_sstc && env->rdtime_fn) {
3112         riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
3113                                   env->htimedelta, MIP_VSTIP);
3114     }
3115 
3116     return RISCV_EXCP_NONE;
3117 }
3118 
3119 static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
3120                                        target_ulong *val)
3121 {
3122     if (!env->rdtime_fn) {
3123         return RISCV_EXCP_ILLEGAL_INST;
3124     }
3125 
3126     *val = env->htimedelta >> 32;
3127     return RISCV_EXCP_NONE;
3128 }
3129 
3130 static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
3131                                         target_ulong val)
3132 {
3133     if (!env->rdtime_fn) {
3134         return RISCV_EXCP_ILLEGAL_INST;
3135     }
3136 
3137     env->htimedelta = deposit64(env->htimedelta, 32, 32, (uint64_t)val);
3138 
3139     if (riscv_cpu_cfg(env)->ext_sstc && env->rdtime_fn) {
3140         riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
3141                                   env->htimedelta, MIP_VSTIP);
3142     }
3143 
3144     return RISCV_EXCP_NONE;
3145 }
3146 
3147 static int read_hvictl(CPURISCVState *env, int csrno, target_ulong *val)
3148 {
3149     *val = env->hvictl;
3150     return RISCV_EXCP_NONE;
3151 }
3152 
3153 static int write_hvictl(CPURISCVState *env, int csrno, target_ulong val)
3154 {
3155     env->hvictl = val & HVICTL_VALID_MASK;
3156     return RISCV_EXCP_NONE;
3157 }
3158 
3159 static int read_hvipriox(CPURISCVState *env, int first_index,
3160                          uint8_t *iprio, target_ulong *val)
3161 {
3162     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
3163 
3164     /* First index has to be a multiple of number of irqs per register */
3165     if (first_index % num_irqs) {
3166         return (env->virt_enabled) ?
3167                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
3168     }
3169 
3170     /* Fill-up return value */
3171     *val = 0;
3172     for (i = 0; i < num_irqs; i++) {
3173         if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
3174             continue;
3175         }
3176         if (rdzero) {
3177             continue;
3178         }
3179         *val |= ((target_ulong)iprio[irq]) << (i * 8);
3180     }
3181 
3182     return RISCV_EXCP_NONE;
3183 }
3184 
3185 static int write_hvipriox(CPURISCVState *env, int first_index,
3186                           uint8_t *iprio, target_ulong val)
3187 {
3188     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
3189 
3190     /* First index has to be a multiple of number of irqs per register */
3191     if (first_index % num_irqs) {
3192         return (env->virt_enabled) ?
3193                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
3194     }
3195 
3196     /* Fill-up priority arrary */
3197     for (i = 0; i < num_irqs; i++) {
3198         if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
3199             continue;
3200         }
3201         if (rdzero) {
3202             iprio[irq] = 0;
3203         } else {
3204             iprio[irq] = (val >> (i * 8)) & 0xff;
3205         }
3206     }
3207 
3208     return RISCV_EXCP_NONE;
3209 }
3210 
3211 static int read_hviprio1(CPURISCVState *env, int csrno, target_ulong *val)
3212 {
3213     return read_hvipriox(env, 0, env->hviprio, val);
3214 }
3215 
3216 static int write_hviprio1(CPURISCVState *env, int csrno, target_ulong val)
3217 {
3218     return write_hvipriox(env, 0, env->hviprio, val);
3219 }
3220 
3221 static int read_hviprio1h(CPURISCVState *env, int csrno, target_ulong *val)
3222 {
3223     return read_hvipriox(env, 4, env->hviprio, val);
3224 }
3225 
3226 static int write_hviprio1h(CPURISCVState *env, int csrno, target_ulong val)
3227 {
3228     return write_hvipriox(env, 4, env->hviprio, val);
3229 }
3230 
3231 static int read_hviprio2(CPURISCVState *env, int csrno, target_ulong *val)
3232 {
3233     return read_hvipriox(env, 8, env->hviprio, val);
3234 }
3235 
3236 static int write_hviprio2(CPURISCVState *env, int csrno, target_ulong val)
3237 {
3238     return write_hvipriox(env, 8, env->hviprio, val);
3239 }
3240 
3241 static int read_hviprio2h(CPURISCVState *env, int csrno, target_ulong *val)
3242 {
3243     return read_hvipriox(env, 12, env->hviprio, val);
3244 }
3245 
3246 static int write_hviprio2h(CPURISCVState *env, int csrno, target_ulong val)
3247 {
3248     return write_hvipriox(env, 12, env->hviprio, val);
3249 }
3250 
3251 /* Virtual CSR Registers */
3252 static RISCVException read_vsstatus(CPURISCVState *env, int csrno,
3253                                     target_ulong *val)
3254 {
3255     *val = env->vsstatus;
3256     return RISCV_EXCP_NONE;
3257 }
3258 
3259 static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
3260                                      target_ulong val)
3261 {
3262     uint64_t mask = (target_ulong)-1;
3263     if ((val & VSSTATUS64_UXL) == 0) {
3264         mask &= ~VSSTATUS64_UXL;
3265     }
3266     env->vsstatus = (env->vsstatus & ~mask) | (uint64_t)val;
3267     return RISCV_EXCP_NONE;
3268 }
3269 
3270 static int read_vstvec(CPURISCVState *env, int csrno, target_ulong *val)
3271 {
3272     *val = env->vstvec;
3273     return RISCV_EXCP_NONE;
3274 }
3275 
3276 static RISCVException write_vstvec(CPURISCVState *env, int csrno,
3277                                    target_ulong val)
3278 {
3279     env->vstvec = val;
3280     return RISCV_EXCP_NONE;
3281 }
3282 
3283 static RISCVException read_vsscratch(CPURISCVState *env, int csrno,
3284                                      target_ulong *val)
3285 {
3286     *val = env->vsscratch;
3287     return RISCV_EXCP_NONE;
3288 }
3289 
3290 static RISCVException write_vsscratch(CPURISCVState *env, int csrno,
3291                                       target_ulong val)
3292 {
3293     env->vsscratch = val;
3294     return RISCV_EXCP_NONE;
3295 }
3296 
3297 static RISCVException read_vsepc(CPURISCVState *env, int csrno,
3298                                  target_ulong *val)
3299 {
3300     *val = env->vsepc;
3301     return RISCV_EXCP_NONE;
3302 }
3303 
3304 static RISCVException write_vsepc(CPURISCVState *env, int csrno,
3305                                   target_ulong val)
3306 {
3307     env->vsepc = val;
3308     return RISCV_EXCP_NONE;
3309 }
3310 
3311 static RISCVException read_vscause(CPURISCVState *env, int csrno,
3312                                    target_ulong *val)
3313 {
3314     *val = env->vscause;
3315     return RISCV_EXCP_NONE;
3316 }
3317 
3318 static RISCVException write_vscause(CPURISCVState *env, int csrno,
3319                                     target_ulong val)
3320 {
3321     env->vscause = val;
3322     return RISCV_EXCP_NONE;
3323 }
3324 
3325 static RISCVException read_vstval(CPURISCVState *env, int csrno,
3326                                   target_ulong *val)
3327 {
3328     *val = env->vstval;
3329     return RISCV_EXCP_NONE;
3330 }
3331 
3332 static RISCVException write_vstval(CPURISCVState *env, int csrno,
3333                                    target_ulong val)
3334 {
3335     env->vstval = val;
3336     return RISCV_EXCP_NONE;
3337 }
3338 
3339 static RISCVException read_vsatp(CPURISCVState *env, int csrno,
3340                                  target_ulong *val)
3341 {
3342     *val = env->vsatp;
3343     return RISCV_EXCP_NONE;
3344 }
3345 
3346 static RISCVException write_vsatp(CPURISCVState *env, int csrno,
3347                                   target_ulong val)
3348 {
3349     env->vsatp = val;
3350     return RISCV_EXCP_NONE;
3351 }
3352 
3353 static RISCVException read_mtval2(CPURISCVState *env, int csrno,
3354                                   target_ulong *val)
3355 {
3356     *val = env->mtval2;
3357     return RISCV_EXCP_NONE;
3358 }
3359 
3360 static RISCVException write_mtval2(CPURISCVState *env, int csrno,
3361                                    target_ulong val)
3362 {
3363     env->mtval2 = val;
3364     return RISCV_EXCP_NONE;
3365 }
3366 
3367 static RISCVException read_mtinst(CPURISCVState *env, int csrno,
3368                                   target_ulong *val)
3369 {
3370     *val = env->mtinst;
3371     return RISCV_EXCP_NONE;
3372 }
3373 
3374 static RISCVException write_mtinst(CPURISCVState *env, int csrno,
3375                                    target_ulong val)
3376 {
3377     env->mtinst = val;
3378     return RISCV_EXCP_NONE;
3379 }
3380 
3381 /* Physical Memory Protection */
3382 static RISCVException read_mseccfg(CPURISCVState *env, int csrno,
3383                                    target_ulong *val)
3384 {
3385     *val = mseccfg_csr_read(env);
3386     return RISCV_EXCP_NONE;
3387 }
3388 
3389 static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
3390                                     target_ulong val)
3391 {
3392     mseccfg_csr_write(env, val);
3393     return RISCV_EXCP_NONE;
3394 }
3395 
3396 static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
3397                                   target_ulong *val)
3398 {
3399     uint32_t reg_index = csrno - CSR_PMPCFG0;
3400 
3401     *val = pmpcfg_csr_read(env, reg_index);
3402     return RISCV_EXCP_NONE;
3403 }
3404 
3405 static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
3406                                    target_ulong val)
3407 {
3408     uint32_t reg_index = csrno - CSR_PMPCFG0;
3409 
3410     pmpcfg_csr_write(env, reg_index, val);
3411     return RISCV_EXCP_NONE;
3412 }
3413 
3414 static RISCVException read_pmpaddr(CPURISCVState *env, int csrno,
3415                                    target_ulong *val)
3416 {
3417     *val = pmpaddr_csr_read(env, csrno - CSR_PMPADDR0);
3418     return RISCV_EXCP_NONE;
3419 }
3420 
3421 static RISCVException write_pmpaddr(CPURISCVState *env, int csrno,
3422                                     target_ulong val)
3423 {
3424     pmpaddr_csr_write(env, csrno - CSR_PMPADDR0, val);
3425     return RISCV_EXCP_NONE;
3426 }
3427 
3428 static RISCVException read_tselect(CPURISCVState *env, int csrno,
3429                                    target_ulong *val)
3430 {
3431     *val = tselect_csr_read(env);
3432     return RISCV_EXCP_NONE;
3433 }
3434 
3435 static RISCVException write_tselect(CPURISCVState *env, int csrno,
3436                                     target_ulong val)
3437 {
3438     tselect_csr_write(env, val);
3439     return RISCV_EXCP_NONE;
3440 }
3441 
3442 static RISCVException read_tdata(CPURISCVState *env, int csrno,
3443                                  target_ulong *val)
3444 {
3445     /* return 0 in tdata1 to end the trigger enumeration */
3446     if (env->trigger_cur >= RV_MAX_TRIGGERS && csrno == CSR_TDATA1) {
3447         *val = 0;
3448         return RISCV_EXCP_NONE;
3449     }
3450 
3451     if (!tdata_available(env, csrno - CSR_TDATA1)) {
3452         return RISCV_EXCP_ILLEGAL_INST;
3453     }
3454 
3455     *val = tdata_csr_read(env, csrno - CSR_TDATA1);
3456     return RISCV_EXCP_NONE;
3457 }
3458 
3459 static RISCVException write_tdata(CPURISCVState *env, int csrno,
3460                                   target_ulong val)
3461 {
3462     if (!tdata_available(env, csrno - CSR_TDATA1)) {
3463         return RISCV_EXCP_ILLEGAL_INST;
3464     }
3465 
3466     tdata_csr_write(env, csrno - CSR_TDATA1, val);
3467     return RISCV_EXCP_NONE;
3468 }
3469 
3470 static RISCVException read_tinfo(CPURISCVState *env, int csrno,
3471                                  target_ulong *val)
3472 {
3473     *val = tinfo_csr_read(env);
3474     return RISCV_EXCP_NONE;
3475 }
3476 
3477 /*
3478  * Functions to access Pointer Masking feature registers
3479  * We have to check if current priv lvl could modify
3480  * csr in given mode
3481  */
3482 static bool check_pm_current_disabled(CPURISCVState *env, int csrno)
3483 {
3484     int csr_priv = get_field(csrno, 0x300);
3485     int pm_current;
3486 
3487     if (env->debugger) {
3488         return false;
3489     }
3490     /*
3491      * If priv lvls differ that means we're accessing csr from higher priv lvl,
3492      * so allow the access
3493      */
3494     if (env->priv != csr_priv) {
3495         return false;
3496     }
3497     switch (env->priv) {
3498     case PRV_M:
3499         pm_current = get_field(env->mmte, M_PM_CURRENT);
3500         break;
3501     case PRV_S:
3502         pm_current = get_field(env->mmte, S_PM_CURRENT);
3503         break;
3504     case PRV_U:
3505         pm_current = get_field(env->mmte, U_PM_CURRENT);
3506         break;
3507     default:
3508         g_assert_not_reached();
3509     }
3510     /* It's same priv lvl, so we allow to modify csr only if pm.current==1 */
3511     return !pm_current;
3512 }
3513 
3514 static RISCVException read_mmte(CPURISCVState *env, int csrno,
3515                                 target_ulong *val)
3516 {
3517     *val = env->mmte & MMTE_MASK;
3518     return RISCV_EXCP_NONE;
3519 }
3520 
3521 static RISCVException write_mmte(CPURISCVState *env, int csrno,
3522                                  target_ulong val)
3523 {
3524     uint64_t mstatus;
3525     target_ulong wpri_val = val & MMTE_MASK;
3526 
3527     if (val != wpri_val) {
3528         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
3529                       TARGET_FMT_lx "\n", "MMTE: WPRI violation written 0x",
3530                       val, "vs expected 0x", wpri_val);
3531     }
3532     /* for machine mode pm.current is hardwired to 1 */
3533     wpri_val |= MMTE_M_PM_CURRENT;
3534 
3535     /* hardwiring pm.instruction bit to 0, since it's not supported yet */
3536     wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
3537     env->mmte = wpri_val | PM_EXT_DIRTY;
3538     riscv_cpu_update_mask(env);
3539 
3540     /* Set XS and SD bits, since PM CSRs are dirty */
3541     mstatus = env->mstatus | MSTATUS_XS;
3542     write_mstatus(env, csrno, mstatus);
3543     return RISCV_EXCP_NONE;
3544 }
3545 
3546 static RISCVException read_smte(CPURISCVState *env, int csrno,
3547                                 target_ulong *val)
3548 {
3549     *val = env->mmte & SMTE_MASK;
3550     return RISCV_EXCP_NONE;
3551 }
3552 
3553 static RISCVException write_smte(CPURISCVState *env, int csrno,
3554                                  target_ulong val)
3555 {
3556     target_ulong wpri_val = val & SMTE_MASK;
3557 
3558     if (val != wpri_val) {
3559         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
3560                       TARGET_FMT_lx "\n", "SMTE: WPRI violation written 0x",
3561                       val, "vs expected 0x", wpri_val);
3562     }
3563 
3564     /* if pm.current==0 we can't modify current PM CSRs */
3565     if (check_pm_current_disabled(env, csrno)) {
3566         return RISCV_EXCP_NONE;
3567     }
3568 
3569     wpri_val |= (env->mmte & ~SMTE_MASK);
3570     write_mmte(env, csrno, wpri_val);
3571     return RISCV_EXCP_NONE;
3572 }
3573 
3574 static RISCVException read_umte(CPURISCVState *env, int csrno,
3575                                 target_ulong *val)
3576 {
3577     *val = env->mmte & UMTE_MASK;
3578     return RISCV_EXCP_NONE;
3579 }
3580 
3581 static RISCVException write_umte(CPURISCVState *env, int csrno,
3582                                  target_ulong val)
3583 {
3584     target_ulong wpri_val = val & UMTE_MASK;
3585 
3586     if (val != wpri_val) {
3587         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
3588                       TARGET_FMT_lx "\n", "UMTE: WPRI violation written 0x",
3589                       val, "vs expected 0x", wpri_val);
3590     }
3591 
3592     if (check_pm_current_disabled(env, csrno)) {
3593         return RISCV_EXCP_NONE;
3594     }
3595 
3596     wpri_val |= (env->mmte & ~UMTE_MASK);
3597     write_mmte(env, csrno, wpri_val);
3598     return RISCV_EXCP_NONE;
3599 }
3600 
3601 static RISCVException read_mpmmask(CPURISCVState *env, int csrno,
3602                                    target_ulong *val)
3603 {
3604     *val = env->mpmmask;
3605     return RISCV_EXCP_NONE;
3606 }
3607 
3608 static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
3609                                     target_ulong val)
3610 {
3611     uint64_t mstatus;
3612 
3613     env->mpmmask = val;
3614     if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
3615         env->cur_pmmask = val;
3616     }
3617     env->mmte |= PM_EXT_DIRTY;
3618 
3619     /* Set XS and SD bits, since PM CSRs are dirty */
3620     mstatus = env->mstatus | MSTATUS_XS;
3621     write_mstatus(env, csrno, mstatus);
3622     return RISCV_EXCP_NONE;
3623 }
3624 
3625 static RISCVException read_spmmask(CPURISCVState *env, int csrno,
3626                                    target_ulong *val)
3627 {
3628     *val = env->spmmask;
3629     return RISCV_EXCP_NONE;
3630 }
3631 
3632 static RISCVException write_spmmask(CPURISCVState *env, int csrno,
3633                                     target_ulong val)
3634 {
3635     uint64_t mstatus;
3636 
3637     /* if pm.current==0 we can't modify current PM CSRs */
3638     if (check_pm_current_disabled(env, csrno)) {
3639         return RISCV_EXCP_NONE;
3640     }
3641     env->spmmask = val;
3642     if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
3643         env->cur_pmmask = val;
3644     }
3645     env->mmte |= PM_EXT_DIRTY;
3646 
3647     /* Set XS and SD bits, since PM CSRs are dirty */
3648     mstatus = env->mstatus | MSTATUS_XS;
3649     write_mstatus(env, csrno, mstatus);
3650     return RISCV_EXCP_NONE;
3651 }
3652 
3653 static RISCVException read_upmmask(CPURISCVState *env, int csrno,
3654                                    target_ulong *val)
3655 {
3656     *val = env->upmmask;
3657     return RISCV_EXCP_NONE;
3658 }
3659 
3660 static RISCVException write_upmmask(CPURISCVState *env, int csrno,
3661                                     target_ulong val)
3662 {
3663     uint64_t mstatus;
3664 
3665     /* if pm.current==0 we can't modify current PM CSRs */
3666     if (check_pm_current_disabled(env, csrno)) {
3667         return RISCV_EXCP_NONE;
3668     }
3669     env->upmmask = val;
3670     if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
3671         env->cur_pmmask = val;
3672     }
3673     env->mmte |= PM_EXT_DIRTY;
3674 
3675     /* Set XS and SD bits, since PM CSRs are dirty */
3676     mstatus = env->mstatus | MSTATUS_XS;
3677     write_mstatus(env, csrno, mstatus);
3678     return RISCV_EXCP_NONE;
3679 }
3680 
3681 static RISCVException read_mpmbase(CPURISCVState *env, int csrno,
3682                                    target_ulong *val)
3683 {
3684     *val = env->mpmbase;
3685     return RISCV_EXCP_NONE;
3686 }
3687 
3688 static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
3689                                     target_ulong val)
3690 {
3691     uint64_t mstatus;
3692 
3693     env->mpmbase = val;
3694     if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
3695         env->cur_pmbase = val;
3696     }
3697     env->mmte |= PM_EXT_DIRTY;
3698 
3699     /* Set XS and SD bits, since PM CSRs are dirty */
3700     mstatus = env->mstatus | MSTATUS_XS;
3701     write_mstatus(env, csrno, mstatus);
3702     return RISCV_EXCP_NONE;
3703 }
3704 
3705 static RISCVException read_spmbase(CPURISCVState *env, int csrno,
3706                                    target_ulong *val)
3707 {
3708     *val = env->spmbase;
3709     return RISCV_EXCP_NONE;
3710 }
3711 
3712 static RISCVException write_spmbase(CPURISCVState *env, int csrno,
3713                                     target_ulong val)
3714 {
3715     uint64_t mstatus;
3716 
3717     /* if pm.current==0 we can't modify current PM CSRs */
3718     if (check_pm_current_disabled(env, csrno)) {
3719         return RISCV_EXCP_NONE;
3720     }
3721     env->spmbase = val;
3722     if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
3723         env->cur_pmbase = val;
3724     }
3725     env->mmte |= PM_EXT_DIRTY;
3726 
3727     /* Set XS and SD bits, since PM CSRs are dirty */
3728     mstatus = env->mstatus | MSTATUS_XS;
3729     write_mstatus(env, csrno, mstatus);
3730     return RISCV_EXCP_NONE;
3731 }
3732 
3733 static RISCVException read_upmbase(CPURISCVState *env, int csrno,
3734                                    target_ulong *val)
3735 {
3736     *val = env->upmbase;
3737     return RISCV_EXCP_NONE;
3738 }
3739 
3740 static RISCVException write_upmbase(CPURISCVState *env, int csrno,
3741                                     target_ulong val)
3742 {
3743     uint64_t mstatus;
3744 
3745     /* if pm.current==0 we can't modify current PM CSRs */
3746     if (check_pm_current_disabled(env, csrno)) {
3747         return RISCV_EXCP_NONE;
3748     }
3749     env->upmbase = val;
3750     if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
3751         env->cur_pmbase = val;
3752     }
3753     env->mmte |= PM_EXT_DIRTY;
3754 
3755     /* Set XS and SD bits, since PM CSRs are dirty */
3756     mstatus = env->mstatus | MSTATUS_XS;
3757     write_mstatus(env, csrno, mstatus);
3758     return RISCV_EXCP_NONE;
3759 }
3760 
3761 #endif
3762 
3763 /* Crypto Extension */
3764 static RISCVException rmw_seed(CPURISCVState *env, int csrno,
3765                                target_ulong *ret_value,
3766                                target_ulong new_value,
3767                                target_ulong write_mask)
3768 {
3769     uint16_t random_v;
3770     Error *random_e = NULL;
3771     int random_r;
3772     target_ulong rval;
3773 
3774     random_r = qemu_guest_getrandom(&random_v, 2, &random_e);
3775     if (unlikely(random_r < 0)) {
3776         /*
3777          * Failed, for unknown reasons in the crypto subsystem.
3778          * The best we can do is log the reason and return a
3779          * failure indication to the guest.  There is no reason
3780          * we know to expect the failure to be transitory, so
3781          * indicate DEAD to avoid having the guest spin on WAIT.
3782          */
3783         qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
3784                       __func__, error_get_pretty(random_e));
3785         error_free(random_e);
3786         rval = SEED_OPST_DEAD;
3787     } else {
3788         rval = random_v | SEED_OPST_ES16;
3789     }
3790 
3791     if (ret_value) {
3792         *ret_value = rval;
3793     }
3794 
3795     return RISCV_EXCP_NONE;
3796 }
3797 
3798 /*
3799  * riscv_csrrw - read and/or update control and status register
3800  *
3801  * csrr   <->  riscv_csrrw(env, csrno, ret_value, 0, 0);
3802  * csrrw  <->  riscv_csrrw(env, csrno, ret_value, value, -1);
3803  * csrrs  <->  riscv_csrrw(env, csrno, ret_value, -1, value);
3804  * csrrc  <->  riscv_csrrw(env, csrno, ret_value, 0, value);
3805  */
3806 
3807 static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
3808                                                int csrno,
3809                                                bool write_mask)
3810 {
3811     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
3812     bool read_only = get_field(csrno, 0xC00) == 3;
3813     int csr_min_priv = csr_ops[csrno].min_priv_ver;
3814 
3815     /* ensure the CSR extension is enabled */
3816     if (!riscv_cpu_cfg(env)->ext_icsr) {
3817         return RISCV_EXCP_ILLEGAL_INST;
3818     }
3819 
3820     /* privileged spec version check */
3821     if (env->priv_ver < csr_min_priv) {
3822         return RISCV_EXCP_ILLEGAL_INST;
3823     }
3824 
3825     /* read / write check */
3826     if (write_mask && read_only) {
3827         return RISCV_EXCP_ILLEGAL_INST;
3828     }
3829 
3830     /*
3831      * The predicate() not only does existence check but also does some
3832      * access control check which triggers for example virtual instruction
3833      * exception in some cases. When writing read-only CSRs in those cases
3834      * illegal instruction exception should be triggered instead of virtual
3835      * instruction exception. Hence this comes after the read / write check.
3836      */
3837     g_assert(csr_ops[csrno].predicate != NULL);
3838     RISCVException ret = csr_ops[csrno].predicate(env, csrno);
3839     if (ret != RISCV_EXCP_NONE) {
3840         return ret;
3841     }
3842 
3843 #if !defined(CONFIG_USER_ONLY)
3844     int csr_priv, effective_priv = env->priv;
3845 
3846     if (riscv_has_ext(env, RVH) && env->priv == PRV_S &&
3847         !env->virt_enabled) {
3848         /*
3849          * We are in HS mode. Add 1 to the effective privledge level to
3850          * allow us to access the Hypervisor CSRs.
3851          */
3852         effective_priv++;
3853     }
3854 
3855     csr_priv = get_field(csrno, 0x300);
3856     if (!env->debugger && (effective_priv < csr_priv)) {
3857         if (csr_priv == (PRV_S + 1) && env->virt_enabled) {
3858             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
3859         }
3860         return RISCV_EXCP_ILLEGAL_INST;
3861     }
3862 #endif
3863     return RISCV_EXCP_NONE;
3864 }
3865 
3866 static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
3867                                        target_ulong *ret_value,
3868                                        target_ulong new_value,
3869                                        target_ulong write_mask)
3870 {
3871     RISCVException ret;
3872     target_ulong old_value;
3873 
3874     /* execute combined read/write operation if it exists */
3875     if (csr_ops[csrno].op) {
3876         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
3877     }
3878 
3879     /* if no accessor exists then return failure */
3880     if (!csr_ops[csrno].read) {
3881         return RISCV_EXCP_ILLEGAL_INST;
3882     }
3883     /* read old value */
3884     ret = csr_ops[csrno].read(env, csrno, &old_value);
3885     if (ret != RISCV_EXCP_NONE) {
3886         return ret;
3887     }
3888 
3889     /* write value if writable and write mask set, otherwise drop writes */
3890     if (write_mask) {
3891         new_value = (old_value & ~write_mask) | (new_value & write_mask);
3892         if (csr_ops[csrno].write) {
3893             ret = csr_ops[csrno].write(env, csrno, new_value);
3894             if (ret != RISCV_EXCP_NONE) {
3895                 return ret;
3896             }
3897         }
3898     }
3899 
3900     /* return old value */
3901     if (ret_value) {
3902         *ret_value = old_value;
3903     }
3904 
3905     return RISCV_EXCP_NONE;
3906 }
3907 
3908 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
3909                            target_ulong *ret_value,
3910                            target_ulong new_value, target_ulong write_mask)
3911 {
3912     RISCVException ret = riscv_csrrw_check(env, csrno, write_mask);
3913     if (ret != RISCV_EXCP_NONE) {
3914         return ret;
3915     }
3916 
3917     return riscv_csrrw_do64(env, csrno, ret_value, new_value, write_mask);
3918 }
3919 
3920 static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
3921                                         Int128 *ret_value,
3922                                         Int128 new_value,
3923                                         Int128 write_mask)
3924 {
3925     RISCVException ret;
3926     Int128 old_value;
3927 
3928     /* read old value */
3929     ret = csr_ops[csrno].read128(env, csrno, &old_value);
3930     if (ret != RISCV_EXCP_NONE) {
3931         return ret;
3932     }
3933 
3934     /* write value if writable and write mask set, otherwise drop writes */
3935     if (int128_nz(write_mask)) {
3936         new_value = int128_or(int128_and(old_value, int128_not(write_mask)),
3937                               int128_and(new_value, write_mask));
3938         if (csr_ops[csrno].write128) {
3939             ret = csr_ops[csrno].write128(env, csrno, new_value);
3940             if (ret != RISCV_EXCP_NONE) {
3941                 return ret;
3942             }
3943         } else if (csr_ops[csrno].write) {
3944             /* avoids having to write wrappers for all registers */
3945             ret = csr_ops[csrno].write(env, csrno, int128_getlo(new_value));
3946             if (ret != RISCV_EXCP_NONE) {
3947                 return ret;
3948             }
3949         }
3950     }
3951 
3952     /* return old value */
3953     if (ret_value) {
3954         *ret_value = old_value;
3955     }
3956 
3957     return RISCV_EXCP_NONE;
3958 }
3959 
3960 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
3961                                 Int128 *ret_value,
3962                                 Int128 new_value, Int128 write_mask)
3963 {
3964     RISCVException ret;
3965 
3966     ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask));
3967     if (ret != RISCV_EXCP_NONE) {
3968         return ret;
3969     }
3970 
3971     if (csr_ops[csrno].read128) {
3972         return riscv_csrrw_do128(env, csrno, ret_value, new_value, write_mask);
3973     }
3974 
3975     /*
3976      * Fall back to 64-bit version for now, if the 128-bit alternative isn't
3977      * at all defined.
3978      * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
3979      * significant), for those, this fallback is correctly handling the
3980      * accesses
3981      */
3982     target_ulong old_value;
3983     ret = riscv_csrrw_do64(env, csrno, &old_value,
3984                            int128_getlo(new_value),
3985                            int128_getlo(write_mask));
3986     if (ret == RISCV_EXCP_NONE && ret_value) {
3987         *ret_value = int128_make64(old_value);
3988     }
3989     return ret;
3990 }
3991 
3992 /*
3993  * Debugger support.  If not in user mode, set env->debugger before the
3994  * riscv_csrrw call and clear it after the call.
3995  */
3996 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
3997                                  target_ulong *ret_value,
3998                                  target_ulong new_value,
3999                                  target_ulong write_mask)
4000 {
4001     RISCVException ret;
4002 #if !defined(CONFIG_USER_ONLY)
4003     env->debugger = true;
4004 #endif
4005     ret = riscv_csrrw(env, csrno, ret_value, new_value, write_mask);
4006 #if !defined(CONFIG_USER_ONLY)
4007     env->debugger = false;
4008 #endif
4009     return ret;
4010 }
4011 
4012 static RISCVException read_jvt(CPURISCVState *env, int csrno,
4013                                target_ulong *val)
4014 {
4015     *val = env->jvt;
4016     return RISCV_EXCP_NONE;
4017 }
4018 
4019 static RISCVException write_jvt(CPURISCVState *env, int csrno,
4020                                 target_ulong val)
4021 {
4022     env->jvt = val;
4023     return RISCV_EXCP_NONE;
4024 }
4025 
4026 /* Control and Status Register function table */
4027 riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
4028     /* User Floating-Point CSRs */
4029     [CSR_FFLAGS]   = { "fflags",   fs,     read_fflags,  write_fflags },
4030     [CSR_FRM]      = { "frm",      fs,     read_frm,     write_frm    },
4031     [CSR_FCSR]     = { "fcsr",     fs,     read_fcsr,    write_fcsr   },
4032     /* Vector CSRs */
4033     [CSR_VSTART]   = { "vstart",   vs,     read_vstart,  write_vstart },
4034     [CSR_VXSAT]    = { "vxsat",    vs,     read_vxsat,   write_vxsat  },
4035     [CSR_VXRM]     = { "vxrm",     vs,     read_vxrm,    write_vxrm   },
4036     [CSR_VCSR]     = { "vcsr",     vs,     read_vcsr,    write_vcsr   },
4037     [CSR_VL]       = { "vl",       vs,     read_vl                    },
4038     [CSR_VTYPE]    = { "vtype",    vs,     read_vtype                 },
4039     [CSR_VLENB]    = { "vlenb",    vs,     read_vlenb                 },
4040     /* User Timers and Counters */
4041     [CSR_CYCLE]    = { "cycle",    ctr,    read_hpmcounter  },
4042     [CSR_INSTRET]  = { "instret",  ctr,    read_hpmcounter  },
4043     [CSR_CYCLEH]   = { "cycleh",   ctr32,  read_hpmcounterh },
4044     [CSR_INSTRETH] = { "instreth", ctr32,  read_hpmcounterh },
4045 
4046     /*
4047      * In privileged mode, the monitor will have to emulate TIME CSRs only if
4048      * rdtime callback is not provided by machine/platform emulation.
4049      */
4050     [CSR_TIME]  = { "time",  ctr,   read_time  },
4051     [CSR_TIMEH] = { "timeh", ctr32, read_timeh },
4052 
4053     /* Crypto Extension */
4054     [CSR_SEED] = { "seed", seed, NULL, NULL, rmw_seed },
4055 
4056     /* Zcmt Extension */
4057     [CSR_JVT] = {"jvt", zcmt, read_jvt, write_jvt},
4058 
4059 #if !defined(CONFIG_USER_ONLY)
4060     /* Machine Timers and Counters */
4061     [CSR_MCYCLE]    = { "mcycle",    any,   read_hpmcounter,
4062                         write_mhpmcounter                    },
4063     [CSR_MINSTRET]  = { "minstret",  any,   read_hpmcounter,
4064                         write_mhpmcounter                    },
4065     [CSR_MCYCLEH]   = { "mcycleh",   any32, read_hpmcounterh,
4066                         write_mhpmcounterh                   },
4067     [CSR_MINSTRETH] = { "minstreth", any32, read_hpmcounterh,
4068                         write_mhpmcounterh                   },
4069 
4070     /* Machine Information Registers */
4071     [CSR_MVENDORID] = { "mvendorid", any,   read_mvendorid },
4072     [CSR_MARCHID]   = { "marchid",   any,   read_marchid   },
4073     [CSR_MIMPID]    = { "mimpid",    any,   read_mimpid    },
4074     [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid   },
4075 
4076     [CSR_MCONFIGPTR]  = { "mconfigptr", any,   read_zero,
4077                           .min_priv_ver = PRIV_VERSION_1_12_0 },
4078     /* Machine Trap Setup */
4079     [CSR_MSTATUS]     = { "mstatus",    any,   read_mstatus, write_mstatus,
4080                           NULL,                read_mstatus_i128           },
4081     [CSR_MISA]        = { "misa",       any,   read_misa,    write_misa,
4082                           NULL,                read_misa_i128              },
4083     [CSR_MIDELEG]     = { "mideleg",    any,   NULL, NULL,   rmw_mideleg   },
4084     [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg, write_medeleg },
4085     [CSR_MIE]         = { "mie",        any,   NULL, NULL,   rmw_mie       },
4086     [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,   write_mtvec   },
4087     [CSR_MCOUNTEREN]  = { "mcounteren", umode, read_mcounteren,
4088                           write_mcounteren                                 },
4089 
4090     [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,
4091                           write_mstatush                                   },
4092 
4093     /* Machine Trap Handling */
4094     [CSR_MSCRATCH] = { "mscratch", any,  read_mscratch, write_mscratch,
4095                        NULL, read_mscratch_i128, write_mscratch_i128   },
4096     [CSR_MEPC]     = { "mepc",     any,  read_mepc,     write_mepc     },
4097     [CSR_MCAUSE]   = { "mcause",   any,  read_mcause,   write_mcause   },
4098     [CSR_MTVAL]    = { "mtval",    any,  read_mtval,    write_mtval    },
4099     [CSR_MIP]      = { "mip",      any,  NULL,    NULL, rmw_mip        },
4100 
4101     /* Machine-Level Window to Indirectly Accessed Registers (AIA) */
4102     [CSR_MISELECT] = { "miselect", aia_any,   NULL, NULL,    rmw_xiselect },
4103     [CSR_MIREG]    = { "mireg",    aia_any,   NULL, NULL,    rmw_xireg },
4104 
4105     /* Machine-Level Interrupts (AIA) */
4106     [CSR_MTOPEI]   = { "mtopei",   aia_any, NULL, NULL, rmw_xtopei },
4107     [CSR_MTOPI]    = { "mtopi",    aia_any, read_mtopi },
4108 
4109     /* Virtual Interrupts for Supervisor Level (AIA) */
4110     [CSR_MVIEN]    = { "mvien",    aia_any, read_zero, write_ignore },
4111     [CSR_MVIP]     = { "mvip",     aia_any, read_zero, write_ignore },
4112 
4113     /* Machine-Level High-Half CSRs (AIA) */
4114     [CSR_MIDELEGH] = { "midelegh", aia_any32, NULL, NULL, rmw_midelegh },
4115     [CSR_MIEH]     = { "mieh",     aia_any32, NULL, NULL, rmw_mieh     },
4116     [CSR_MVIENH]   = { "mvienh",   aia_any32, read_zero,  write_ignore },
4117     [CSR_MVIPH]    = { "mviph",    aia_any32, read_zero,  write_ignore },
4118     [CSR_MIPH]     = { "miph",     aia_any32, NULL, NULL, rmw_miph     },
4119 
4120     /* Execution environment configuration */
4121     [CSR_MENVCFG]  = { "menvcfg",  umode, read_menvcfg,  write_menvcfg,
4122                        .min_priv_ver = PRIV_VERSION_1_12_0              },
4123     [CSR_MENVCFGH] = { "menvcfgh", umode32, read_menvcfgh, write_menvcfgh,
4124                        .min_priv_ver = PRIV_VERSION_1_12_0              },
4125     [CSR_SENVCFG]  = { "senvcfg",  smode, read_senvcfg,  write_senvcfg,
4126                        .min_priv_ver = PRIV_VERSION_1_12_0              },
4127     [CSR_HENVCFG]  = { "henvcfg",  hmode, read_henvcfg, write_henvcfg,
4128                        .min_priv_ver = PRIV_VERSION_1_12_0              },
4129     [CSR_HENVCFGH] = { "henvcfgh", hmode32, read_henvcfgh, write_henvcfgh,
4130                        .min_priv_ver = PRIV_VERSION_1_12_0              },
4131 
4132     /* Smstateen extension CSRs */
4133     [CSR_MSTATEEN0] = { "mstateen0", mstateen, read_mstateen, write_mstateen0,
4134                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4135     [CSR_MSTATEEN0H] = { "mstateen0h", mstateen, read_mstateenh,
4136                           write_mstateen0h,
4137                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4138     [CSR_MSTATEEN1] = { "mstateen1", mstateen, read_mstateen,
4139                         write_mstateen_1_3,
4140                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4141     [CSR_MSTATEEN1H] = { "mstateen1h", mstateen, read_mstateenh,
4142                          write_mstateenh_1_3,
4143                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4144     [CSR_MSTATEEN2] = { "mstateen2", mstateen, read_mstateen,
4145                         write_mstateen_1_3,
4146                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4147     [CSR_MSTATEEN2H] = { "mstateen2h", mstateen, read_mstateenh,
4148                          write_mstateenh_1_3,
4149                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4150     [CSR_MSTATEEN3] = { "mstateen3", mstateen, read_mstateen,
4151                         write_mstateen_1_3,
4152                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4153     [CSR_MSTATEEN3H] = { "mstateen3h", mstateen, read_mstateenh,
4154                          write_mstateenh_1_3,
4155                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4156     [CSR_HSTATEEN0] = { "hstateen0", hstateen, read_hstateen, write_hstateen0,
4157                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4158     [CSR_HSTATEEN0H] = { "hstateen0h", hstateenh, read_hstateenh,
4159                          write_hstateen0h,
4160                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4161     [CSR_HSTATEEN1] = { "hstateen1", hstateen, read_hstateen,
4162                         write_hstateen_1_3,
4163                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4164     [CSR_HSTATEEN1H] = { "hstateen1h", hstateenh, read_hstateenh,
4165                          write_hstateenh_1_3,
4166                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4167     [CSR_HSTATEEN2] = { "hstateen2", hstateen, read_hstateen,
4168                         write_hstateen_1_3,
4169                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4170     [CSR_HSTATEEN2H] = { "hstateen2h", hstateenh, read_hstateenh,
4171                          write_hstateenh_1_3,
4172                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4173     [CSR_HSTATEEN3] = { "hstateen3", hstateen, read_hstateen,
4174                         write_hstateen_1_3,
4175                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4176     [CSR_HSTATEEN3H] = { "hstateen3h", hstateenh, read_hstateenh,
4177                          write_hstateenh_1_3,
4178                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4179     [CSR_SSTATEEN0] = { "sstateen0", sstateen, read_sstateen, write_sstateen0,
4180                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4181     [CSR_SSTATEEN1] = { "sstateen1", sstateen, read_sstateen,
4182                         write_sstateen_1_3,
4183                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4184     [CSR_SSTATEEN2] = { "sstateen2", sstateen, read_sstateen,
4185                         write_sstateen_1_3,
4186                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4187     [CSR_SSTATEEN3] = { "sstateen3", sstateen, read_sstateen,
4188                         write_sstateen_1_3,
4189                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4190 
4191     /* Supervisor Trap Setup */
4192     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
4193                          NULL,                read_sstatus_i128              },
4194     [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie       },
4195     [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec   },
4196     [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren,
4197                          write_scounteren                                    },
4198 
4199     /* Supervisor Trap Handling */
4200     [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch,
4201                        NULL, read_sscratch_i128, write_sscratch_i128    },
4202     [CSR_SEPC]     = { "sepc",     smode, read_sepc,     write_sepc     },
4203     [CSR_SCAUSE]   = { "scause",   smode, read_scause,   write_scause   },
4204     [CSR_STVAL]    = { "stval",    smode, read_stval,    write_stval    },
4205     [CSR_SIP]      = { "sip",      smode, NULL,    NULL, rmw_sip        },
4206     [CSR_STIMECMP] = { "stimecmp", sstc, read_stimecmp, write_stimecmp,
4207                        .min_priv_ver = PRIV_VERSION_1_12_0 },
4208     [CSR_STIMECMPH] = { "stimecmph", sstc_32, read_stimecmph, write_stimecmph,
4209                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4210     [CSR_VSTIMECMP] = { "vstimecmp", sstc, read_vstimecmp,
4211                         write_vstimecmp,
4212                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4213     [CSR_VSTIMECMPH] = { "vstimecmph", sstc_32, read_vstimecmph,
4214                          write_vstimecmph,
4215                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4216 
4217     /* Supervisor Protection and Translation */
4218     [CSR_SATP]     = { "satp",     smode, read_satp,     write_satp     },
4219 
4220     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
4221     [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
4222     [CSR_SIREG]      = { "sireg",      aia_smode, NULL, NULL, rmw_xireg },
4223 
4224     /* Supervisor-Level Interrupts (AIA) */
4225     [CSR_STOPEI]     = { "stopei",     aia_smode, NULL, NULL, rmw_xtopei },
4226     [CSR_STOPI]      = { "stopi",      aia_smode, read_stopi },
4227 
4228     /* Supervisor-Level High-Half CSRs (AIA) */
4229     [CSR_SIEH]       = { "sieh",   aia_smode32, NULL, NULL, rmw_sieh },
4230     [CSR_SIPH]       = { "siph",   aia_smode32, NULL, NULL, rmw_siph },
4231 
4232     [CSR_HSTATUS]     = { "hstatus",     hmode,   read_hstatus, write_hstatus,
4233                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4234     [CSR_HEDELEG]     = { "hedeleg",     hmode,   read_hedeleg, write_hedeleg,
4235                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4236     [CSR_HIDELEG]     = { "hideleg",     hmode,   NULL,   NULL, rmw_hideleg,
4237                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4238     [CSR_HVIP]        = { "hvip",        hmode,   NULL,   NULL, rmw_hvip,
4239                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4240     [CSR_HIP]         = { "hip",         hmode,   NULL,   NULL, rmw_hip,
4241                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4242     [CSR_HIE]         = { "hie",         hmode,   NULL,   NULL, rmw_hie,
4243                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4244     [CSR_HCOUNTEREN]  = { "hcounteren",  hmode,   read_hcounteren,
4245                           write_hcounteren,
4246                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4247     [CSR_HGEIE]       = { "hgeie",       hmode,   read_hgeie,   write_hgeie,
4248                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4249     [CSR_HTVAL]       = { "htval",       hmode,   read_htval,   write_htval,
4250                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4251     [CSR_HTINST]      = { "htinst",      hmode,   read_htinst,  write_htinst,
4252                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4253     [CSR_HGEIP]       = { "hgeip",       hmode,   read_hgeip,
4254                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4255     [CSR_HGATP]       = { "hgatp",       hmode,   read_hgatp,   write_hgatp,
4256                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4257     [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta,
4258                           write_htimedelta,
4259                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4260     [CSR_HTIMEDELTAH] = { "htimedeltah", hmode32, read_htimedeltah,
4261                           write_htimedeltah,
4262                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4263 
4264     [CSR_VSSTATUS]    = { "vsstatus",    hmode,   read_vsstatus,
4265                           write_vsstatus,
4266                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4267     [CSR_VSIP]        = { "vsip",        hmode,   NULL,    NULL, rmw_vsip,
4268                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4269     [CSR_VSIE]        = { "vsie",        hmode,   NULL,    NULL, rmw_vsie ,
4270                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4271     [CSR_VSTVEC]      = { "vstvec",      hmode,   read_vstvec,   write_vstvec,
4272                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4273     [CSR_VSSCRATCH]   = { "vsscratch",   hmode,   read_vsscratch,
4274                           write_vsscratch,
4275                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4276     [CSR_VSEPC]       = { "vsepc",       hmode,   read_vsepc,    write_vsepc,
4277                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4278     [CSR_VSCAUSE]     = { "vscause",     hmode,   read_vscause,  write_vscause,
4279                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4280     [CSR_VSTVAL]      = { "vstval",      hmode,   read_vstval,   write_vstval,
4281                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4282     [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,    write_vsatp,
4283                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4284 
4285     [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,   write_mtval2,
4286                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4287     [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,   write_mtinst,
4288                           .min_priv_ver = PRIV_VERSION_1_12_0                },
4289 
4290     /* Virtual Interrupts and Interrupt Priorities (H-extension with AIA) */
4291     [CSR_HVIEN]       = { "hvien",       aia_hmode, read_zero, write_ignore },
4292     [CSR_HVICTL]      = { "hvictl",      aia_hmode, read_hvictl,
4293                           write_hvictl                                      },
4294     [CSR_HVIPRIO1]    = { "hviprio1",    aia_hmode, read_hviprio1,
4295                           write_hviprio1                                    },
4296     [CSR_HVIPRIO2]    = { "hviprio2",    aia_hmode, read_hviprio2,
4297                           write_hviprio2                                    },
4298 
4299     /*
4300      * VS-Level Window to Indirectly Accessed Registers (H-extension with AIA)
4301      */
4302     [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,
4303                           rmw_xiselect                                     },
4304     [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL, rmw_xireg  },
4305 
4306     /* VS-Level Interrupts (H-extension with AIA) */
4307     [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
4308     [CSR_VSTOPI]      = { "vstopi",      aia_hmode, read_vstopi },
4309 
4310     /* Hypervisor and VS-Level High-Half CSRs (H-extension with AIA) */
4311     [CSR_HIDELEGH]    = { "hidelegh",    aia_hmode32, NULL, NULL,
4312                           rmw_hidelegh                                      },
4313     [CSR_HVIENH]      = { "hvienh",      aia_hmode32, read_zero,
4314                           write_ignore                                      },
4315     [CSR_HVIPH]       = { "hviph",       aia_hmode32, NULL, NULL, rmw_hviph },
4316     [CSR_HVIPRIO1H]   = { "hviprio1h",   aia_hmode32, read_hviprio1h,
4317                           write_hviprio1h                                   },
4318     [CSR_HVIPRIO2H]   = { "hviprio2h",   aia_hmode32, read_hviprio2h,
4319                           write_hviprio2h                                   },
4320     [CSR_VSIEH]       = { "vsieh",       aia_hmode32, NULL, NULL, rmw_vsieh },
4321     [CSR_VSIPH]       = { "vsiph",       aia_hmode32, NULL, NULL, rmw_vsiph },
4322 
4323     /* Physical Memory Protection */
4324     [CSR_MSECCFG]    = { "mseccfg",  epmp, read_mseccfg, write_mseccfg,
4325                          .min_priv_ver = PRIV_VERSION_1_11_0           },
4326     [CSR_PMPCFG0]    = { "pmpcfg0",   pmp, read_pmpcfg,  write_pmpcfg  },
4327     [CSR_PMPCFG1]    = { "pmpcfg1",   pmp, read_pmpcfg,  write_pmpcfg  },
4328     [CSR_PMPCFG2]    = { "pmpcfg2",   pmp, read_pmpcfg,  write_pmpcfg  },
4329     [CSR_PMPCFG3]    = { "pmpcfg3",   pmp, read_pmpcfg,  write_pmpcfg  },
4330     [CSR_PMPADDR0]   = { "pmpaddr0",  pmp, read_pmpaddr, write_pmpaddr },
4331     [CSR_PMPADDR1]   = { "pmpaddr1",  pmp, read_pmpaddr, write_pmpaddr },
4332     [CSR_PMPADDR2]   = { "pmpaddr2",  pmp, read_pmpaddr, write_pmpaddr },
4333     [CSR_PMPADDR3]   = { "pmpaddr3",  pmp, read_pmpaddr, write_pmpaddr },
4334     [CSR_PMPADDR4]   = { "pmpaddr4",  pmp, read_pmpaddr, write_pmpaddr },
4335     [CSR_PMPADDR5]   = { "pmpaddr5",  pmp, read_pmpaddr, write_pmpaddr },
4336     [CSR_PMPADDR6]   = { "pmpaddr6",  pmp, read_pmpaddr, write_pmpaddr },
4337     [CSR_PMPADDR7]   = { "pmpaddr7",  pmp, read_pmpaddr, write_pmpaddr },
4338     [CSR_PMPADDR8]   = { "pmpaddr8",  pmp, read_pmpaddr, write_pmpaddr },
4339     [CSR_PMPADDR9]   = { "pmpaddr9",  pmp, read_pmpaddr, write_pmpaddr },
4340     [CSR_PMPADDR10]  = { "pmpaddr10", pmp, read_pmpaddr, write_pmpaddr },
4341     [CSR_PMPADDR11]  = { "pmpaddr11", pmp, read_pmpaddr, write_pmpaddr },
4342     [CSR_PMPADDR12]  = { "pmpaddr12", pmp, read_pmpaddr, write_pmpaddr },
4343     [CSR_PMPADDR13]  = { "pmpaddr13", pmp, read_pmpaddr, write_pmpaddr },
4344     [CSR_PMPADDR14] =  { "pmpaddr14", pmp, read_pmpaddr, write_pmpaddr },
4345     [CSR_PMPADDR15] =  { "pmpaddr15", pmp, read_pmpaddr, write_pmpaddr },
4346 
4347     /* Debug CSRs */
4348     [CSR_TSELECT]   =  { "tselect", debug, read_tselect, write_tselect },
4349     [CSR_TDATA1]    =  { "tdata1",  debug, read_tdata,   write_tdata   },
4350     [CSR_TDATA2]    =  { "tdata2",  debug, read_tdata,   write_tdata   },
4351     [CSR_TDATA3]    =  { "tdata3",  debug, read_tdata,   write_tdata   },
4352     [CSR_TINFO]     =  { "tinfo",   debug, read_tinfo,   write_ignore  },
4353 
4354     /* User Pointer Masking */
4355     [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,  write_umte },
4356     [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask,
4357                          write_upmmask                                      },
4358     [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase,
4359                          write_upmbase                                      },
4360     /* Machine Pointer Masking */
4361     [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,  write_mmte },
4362     [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask,
4363                          write_mpmmask                                      },
4364     [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase,
4365                          write_mpmbase                                      },
4366     /* Supervisor Pointer Masking */
4367     [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,  write_smte },
4368     [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask,
4369                          write_spmmask                                      },
4370     [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase,
4371                          write_spmbase                                      },
4372 
4373     /* Performance Counters */
4374     [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
4375     [CSR_HPMCOUNTER4]    = { "hpmcounter4",    ctr,    read_hpmcounter },
4376     [CSR_HPMCOUNTER5]    = { "hpmcounter5",    ctr,    read_hpmcounter },
4377     [CSR_HPMCOUNTER6]    = { "hpmcounter6",    ctr,    read_hpmcounter },
4378     [CSR_HPMCOUNTER7]    = { "hpmcounter7",    ctr,    read_hpmcounter },
4379     [CSR_HPMCOUNTER8]    = { "hpmcounter8",    ctr,    read_hpmcounter },
4380     [CSR_HPMCOUNTER9]    = { "hpmcounter9",    ctr,    read_hpmcounter },
4381     [CSR_HPMCOUNTER10]   = { "hpmcounter10",   ctr,    read_hpmcounter },
4382     [CSR_HPMCOUNTER11]   = { "hpmcounter11",   ctr,    read_hpmcounter },
4383     [CSR_HPMCOUNTER12]   = { "hpmcounter12",   ctr,    read_hpmcounter },
4384     [CSR_HPMCOUNTER13]   = { "hpmcounter13",   ctr,    read_hpmcounter },
4385     [CSR_HPMCOUNTER14]   = { "hpmcounter14",   ctr,    read_hpmcounter },
4386     [CSR_HPMCOUNTER15]   = { "hpmcounter15",   ctr,    read_hpmcounter },
4387     [CSR_HPMCOUNTER16]   = { "hpmcounter16",   ctr,    read_hpmcounter },
4388     [CSR_HPMCOUNTER17]   = { "hpmcounter17",   ctr,    read_hpmcounter },
4389     [CSR_HPMCOUNTER18]   = { "hpmcounter18",   ctr,    read_hpmcounter },
4390     [CSR_HPMCOUNTER19]   = { "hpmcounter19",   ctr,    read_hpmcounter },
4391     [CSR_HPMCOUNTER20]   = { "hpmcounter20",   ctr,    read_hpmcounter },
4392     [CSR_HPMCOUNTER21]   = { "hpmcounter21",   ctr,    read_hpmcounter },
4393     [CSR_HPMCOUNTER22]   = { "hpmcounter22",   ctr,    read_hpmcounter },
4394     [CSR_HPMCOUNTER23]   = { "hpmcounter23",   ctr,    read_hpmcounter },
4395     [CSR_HPMCOUNTER24]   = { "hpmcounter24",   ctr,    read_hpmcounter },
4396     [CSR_HPMCOUNTER25]   = { "hpmcounter25",   ctr,    read_hpmcounter },
4397     [CSR_HPMCOUNTER26]   = { "hpmcounter26",   ctr,    read_hpmcounter },
4398     [CSR_HPMCOUNTER27]   = { "hpmcounter27",   ctr,    read_hpmcounter },
4399     [CSR_HPMCOUNTER28]   = { "hpmcounter28",   ctr,    read_hpmcounter },
4400     [CSR_HPMCOUNTER29]   = { "hpmcounter29",   ctr,    read_hpmcounter },
4401     [CSR_HPMCOUNTER30]   = { "hpmcounter30",   ctr,    read_hpmcounter },
4402     [CSR_HPMCOUNTER31]   = { "hpmcounter31",   ctr,    read_hpmcounter },
4403 
4404     [CSR_MHPMCOUNTER3]   = { "mhpmcounter3",   mctr,    read_hpmcounter,
4405                              write_mhpmcounter                         },
4406     [CSR_MHPMCOUNTER4]   = { "mhpmcounter4",   mctr,    read_hpmcounter,
4407                              write_mhpmcounter                         },
4408     [CSR_MHPMCOUNTER5]   = { "mhpmcounter5",   mctr,    read_hpmcounter,
4409                              write_mhpmcounter                         },
4410     [CSR_MHPMCOUNTER6]   = { "mhpmcounter6",   mctr,    read_hpmcounter,
4411                              write_mhpmcounter                         },
4412     [CSR_MHPMCOUNTER7]   = { "mhpmcounter7",   mctr,    read_hpmcounter,
4413                              write_mhpmcounter                         },
4414     [CSR_MHPMCOUNTER8]   = { "mhpmcounter8",   mctr,    read_hpmcounter,
4415                              write_mhpmcounter                         },
4416     [CSR_MHPMCOUNTER9]   = { "mhpmcounter9",   mctr,    read_hpmcounter,
4417                              write_mhpmcounter                         },
4418     [CSR_MHPMCOUNTER10]  = { "mhpmcounter10",  mctr,    read_hpmcounter,
4419                              write_mhpmcounter                         },
4420     [CSR_MHPMCOUNTER11]  = { "mhpmcounter11",  mctr,    read_hpmcounter,
4421                              write_mhpmcounter                         },
4422     [CSR_MHPMCOUNTER12]  = { "mhpmcounter12",  mctr,    read_hpmcounter,
4423                              write_mhpmcounter                         },
4424     [CSR_MHPMCOUNTER13]  = { "mhpmcounter13",  mctr,    read_hpmcounter,
4425                              write_mhpmcounter                         },
4426     [CSR_MHPMCOUNTER14]  = { "mhpmcounter14",  mctr,    read_hpmcounter,
4427                              write_mhpmcounter                         },
4428     [CSR_MHPMCOUNTER15]  = { "mhpmcounter15",  mctr,    read_hpmcounter,
4429                              write_mhpmcounter                         },
4430     [CSR_MHPMCOUNTER16]  = { "mhpmcounter16",  mctr,    read_hpmcounter,
4431                              write_mhpmcounter                         },
4432     [CSR_MHPMCOUNTER17]  = { "mhpmcounter17",  mctr,    read_hpmcounter,
4433                              write_mhpmcounter                         },
4434     [CSR_MHPMCOUNTER18]  = { "mhpmcounter18",  mctr,    read_hpmcounter,
4435                              write_mhpmcounter                         },
4436     [CSR_MHPMCOUNTER19]  = { "mhpmcounter19",  mctr,    read_hpmcounter,
4437                              write_mhpmcounter                         },
4438     [CSR_MHPMCOUNTER20]  = { "mhpmcounter20",  mctr,    read_hpmcounter,
4439                              write_mhpmcounter                         },
4440     [CSR_MHPMCOUNTER21]  = { "mhpmcounter21",  mctr,    read_hpmcounter,
4441                              write_mhpmcounter                         },
4442     [CSR_MHPMCOUNTER22]  = { "mhpmcounter22",  mctr,    read_hpmcounter,
4443                              write_mhpmcounter                         },
4444     [CSR_MHPMCOUNTER23]  = { "mhpmcounter23",  mctr,    read_hpmcounter,
4445                              write_mhpmcounter                         },
4446     [CSR_MHPMCOUNTER24]  = { "mhpmcounter24",  mctr,    read_hpmcounter,
4447                              write_mhpmcounter                         },
4448     [CSR_MHPMCOUNTER25]  = { "mhpmcounter25",  mctr,    read_hpmcounter,
4449                              write_mhpmcounter                         },
4450     [CSR_MHPMCOUNTER26]  = { "mhpmcounter26",  mctr,    read_hpmcounter,
4451                              write_mhpmcounter                         },
4452     [CSR_MHPMCOUNTER27]  = { "mhpmcounter27",  mctr,    read_hpmcounter,
4453                              write_mhpmcounter                         },
4454     [CSR_MHPMCOUNTER28]  = { "mhpmcounter28",  mctr,    read_hpmcounter,
4455                              write_mhpmcounter                         },
4456     [CSR_MHPMCOUNTER29]  = { "mhpmcounter29",  mctr,    read_hpmcounter,
4457                              write_mhpmcounter                         },
4458     [CSR_MHPMCOUNTER30]  = { "mhpmcounter30",  mctr,    read_hpmcounter,
4459                              write_mhpmcounter                         },
4460     [CSR_MHPMCOUNTER31]  = { "mhpmcounter31",  mctr,    read_hpmcounter,
4461                              write_mhpmcounter                         },
4462 
4463     [CSR_MCOUNTINHIBIT]  = { "mcountinhibit",  any, read_mcountinhibit,
4464                              write_mcountinhibit,
4465                              .min_priv_ver = PRIV_VERSION_1_11_0       },
4466 
4467     [CSR_MHPMEVENT3]     = { "mhpmevent3",     any,    read_mhpmevent,
4468                              write_mhpmevent                           },
4469     [CSR_MHPMEVENT4]     = { "mhpmevent4",     any,    read_mhpmevent,
4470                              write_mhpmevent                           },
4471     [CSR_MHPMEVENT5]     = { "mhpmevent5",     any,    read_mhpmevent,
4472                              write_mhpmevent                           },
4473     [CSR_MHPMEVENT6]     = { "mhpmevent6",     any,    read_mhpmevent,
4474                              write_mhpmevent                           },
4475     [CSR_MHPMEVENT7]     = { "mhpmevent7",     any,    read_mhpmevent,
4476                              write_mhpmevent                           },
4477     [CSR_MHPMEVENT8]     = { "mhpmevent8",     any,    read_mhpmevent,
4478                              write_mhpmevent                           },
4479     [CSR_MHPMEVENT9]     = { "mhpmevent9",     any,    read_mhpmevent,
4480                              write_mhpmevent                           },
4481     [CSR_MHPMEVENT10]    = { "mhpmevent10",    any,    read_mhpmevent,
4482                              write_mhpmevent                           },
4483     [CSR_MHPMEVENT11]    = { "mhpmevent11",    any,    read_mhpmevent,
4484                              write_mhpmevent                           },
4485     [CSR_MHPMEVENT12]    = { "mhpmevent12",    any,    read_mhpmevent,
4486                              write_mhpmevent                           },
4487     [CSR_MHPMEVENT13]    = { "mhpmevent13",    any,    read_mhpmevent,
4488                              write_mhpmevent                           },
4489     [CSR_MHPMEVENT14]    = { "mhpmevent14",    any,    read_mhpmevent,
4490                              write_mhpmevent                           },
4491     [CSR_MHPMEVENT15]    = { "mhpmevent15",    any,    read_mhpmevent,
4492                              write_mhpmevent                           },
4493     [CSR_MHPMEVENT16]    = { "mhpmevent16",    any,    read_mhpmevent,
4494                              write_mhpmevent                           },
4495     [CSR_MHPMEVENT17]    = { "mhpmevent17",    any,    read_mhpmevent,
4496                              write_mhpmevent                           },
4497     [CSR_MHPMEVENT18]    = { "mhpmevent18",    any,    read_mhpmevent,
4498                              write_mhpmevent                           },
4499     [CSR_MHPMEVENT19]    = { "mhpmevent19",    any,    read_mhpmevent,
4500                              write_mhpmevent                           },
4501     [CSR_MHPMEVENT20]    = { "mhpmevent20",    any,    read_mhpmevent,
4502                              write_mhpmevent                           },
4503     [CSR_MHPMEVENT21]    = { "mhpmevent21",    any,    read_mhpmevent,
4504                              write_mhpmevent                           },
4505     [CSR_MHPMEVENT22]    = { "mhpmevent22",    any,    read_mhpmevent,
4506                              write_mhpmevent                           },
4507     [CSR_MHPMEVENT23]    = { "mhpmevent23",    any,    read_mhpmevent,
4508                              write_mhpmevent                           },
4509     [CSR_MHPMEVENT24]    = { "mhpmevent24",    any,    read_mhpmevent,
4510                              write_mhpmevent                           },
4511     [CSR_MHPMEVENT25]    = { "mhpmevent25",    any,    read_mhpmevent,
4512                              write_mhpmevent                           },
4513     [CSR_MHPMEVENT26]    = { "mhpmevent26",    any,    read_mhpmevent,
4514                              write_mhpmevent                           },
4515     [CSR_MHPMEVENT27]    = { "mhpmevent27",    any,    read_mhpmevent,
4516                              write_mhpmevent                           },
4517     [CSR_MHPMEVENT28]    = { "mhpmevent28",    any,    read_mhpmevent,
4518                              write_mhpmevent                           },
4519     [CSR_MHPMEVENT29]    = { "mhpmevent29",    any,    read_mhpmevent,
4520                              write_mhpmevent                           },
4521     [CSR_MHPMEVENT30]    = { "mhpmevent30",    any,    read_mhpmevent,
4522                              write_mhpmevent                           },
4523     [CSR_MHPMEVENT31]    = { "mhpmevent31",    any,    read_mhpmevent,
4524                              write_mhpmevent                           },
4525 
4526     [CSR_MHPMEVENT3H]    = { "mhpmevent3h",    sscofpmf,  read_mhpmeventh,
4527                              write_mhpmeventh,
4528                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4529     [CSR_MHPMEVENT4H]    = { "mhpmevent4h",    sscofpmf,  read_mhpmeventh,
4530                              write_mhpmeventh,
4531                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4532     [CSR_MHPMEVENT5H]    = { "mhpmevent5h",    sscofpmf,  read_mhpmeventh,
4533                              write_mhpmeventh,
4534                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4535     [CSR_MHPMEVENT6H]    = { "mhpmevent6h",    sscofpmf,  read_mhpmeventh,
4536                              write_mhpmeventh,
4537                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4538     [CSR_MHPMEVENT7H]    = { "mhpmevent7h",    sscofpmf,  read_mhpmeventh,
4539                              write_mhpmeventh,
4540                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4541     [CSR_MHPMEVENT8H]    = { "mhpmevent8h",    sscofpmf,  read_mhpmeventh,
4542                              write_mhpmeventh,
4543                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4544     [CSR_MHPMEVENT9H]    = { "mhpmevent9h",    sscofpmf,  read_mhpmeventh,
4545                              write_mhpmeventh,
4546                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4547     [CSR_MHPMEVENT10H]   = { "mhpmevent10h",    sscofpmf,  read_mhpmeventh,
4548                              write_mhpmeventh,
4549                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4550     [CSR_MHPMEVENT11H]   = { "mhpmevent11h",    sscofpmf,  read_mhpmeventh,
4551                              write_mhpmeventh,
4552                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4553     [CSR_MHPMEVENT12H]   = { "mhpmevent12h",    sscofpmf,  read_mhpmeventh,
4554                              write_mhpmeventh,
4555                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4556     [CSR_MHPMEVENT13H]   = { "mhpmevent13h",    sscofpmf,  read_mhpmeventh,
4557                              write_mhpmeventh,
4558                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4559     [CSR_MHPMEVENT14H]   = { "mhpmevent14h",    sscofpmf,  read_mhpmeventh,
4560                              write_mhpmeventh,
4561                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4562     [CSR_MHPMEVENT15H]   = { "mhpmevent15h",    sscofpmf,  read_mhpmeventh,
4563                              write_mhpmeventh,
4564                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4565     [CSR_MHPMEVENT16H]   = { "mhpmevent16h",    sscofpmf,  read_mhpmeventh,
4566                              write_mhpmeventh,
4567                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4568     [CSR_MHPMEVENT17H]   = { "mhpmevent17h",    sscofpmf,  read_mhpmeventh,
4569                              write_mhpmeventh,
4570                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4571     [CSR_MHPMEVENT18H]   = { "mhpmevent18h",    sscofpmf,  read_mhpmeventh,
4572                              write_mhpmeventh,
4573                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4574     [CSR_MHPMEVENT19H]   = { "mhpmevent19h",    sscofpmf,  read_mhpmeventh,
4575                              write_mhpmeventh,
4576                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4577     [CSR_MHPMEVENT20H]   = { "mhpmevent20h",    sscofpmf,  read_mhpmeventh,
4578                              write_mhpmeventh,
4579                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4580     [CSR_MHPMEVENT21H]   = { "mhpmevent21h",    sscofpmf,  read_mhpmeventh,
4581                              write_mhpmeventh,
4582                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4583     [CSR_MHPMEVENT22H]   = { "mhpmevent22h",    sscofpmf,  read_mhpmeventh,
4584                              write_mhpmeventh,
4585                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4586     [CSR_MHPMEVENT23H]   = { "mhpmevent23h",    sscofpmf,  read_mhpmeventh,
4587                              write_mhpmeventh,
4588                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4589     [CSR_MHPMEVENT24H]   = { "mhpmevent24h",    sscofpmf,  read_mhpmeventh,
4590                              write_mhpmeventh,
4591                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4592     [CSR_MHPMEVENT25H]   = { "mhpmevent25h",    sscofpmf,  read_mhpmeventh,
4593                              write_mhpmeventh,
4594                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4595     [CSR_MHPMEVENT26H]   = { "mhpmevent26h",    sscofpmf,  read_mhpmeventh,
4596                              write_mhpmeventh,
4597                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4598     [CSR_MHPMEVENT27H]   = { "mhpmevent27h",    sscofpmf,  read_mhpmeventh,
4599                              write_mhpmeventh,
4600                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4601     [CSR_MHPMEVENT28H]   = { "mhpmevent28h",    sscofpmf,  read_mhpmeventh,
4602                              write_mhpmeventh,
4603                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4604     [CSR_MHPMEVENT29H]   = { "mhpmevent29h",    sscofpmf,  read_mhpmeventh,
4605                              write_mhpmeventh,
4606                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4607     [CSR_MHPMEVENT30H]   = { "mhpmevent30h",    sscofpmf,  read_mhpmeventh,
4608                              write_mhpmeventh,
4609                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4610     [CSR_MHPMEVENT31H]   = { "mhpmevent31h",    sscofpmf,  read_mhpmeventh,
4611                              write_mhpmeventh,
4612                              .min_priv_ver = PRIV_VERSION_1_12_0        },
4613 
4614     [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
4615     [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
4616     [CSR_HPMCOUNTER5H]   = { "hpmcounter5h",   ctr32,  read_hpmcounterh },
4617     [CSR_HPMCOUNTER6H]   = { "hpmcounter6h",   ctr32,  read_hpmcounterh },
4618     [CSR_HPMCOUNTER7H]   = { "hpmcounter7h",   ctr32,  read_hpmcounterh },
4619     [CSR_HPMCOUNTER8H]   = { "hpmcounter8h",   ctr32,  read_hpmcounterh },
4620     [CSR_HPMCOUNTER9H]   = { "hpmcounter9h",   ctr32,  read_hpmcounterh },
4621     [CSR_HPMCOUNTER10H]  = { "hpmcounter10h",  ctr32,  read_hpmcounterh },
4622     [CSR_HPMCOUNTER11H]  = { "hpmcounter11h",  ctr32,  read_hpmcounterh },
4623     [CSR_HPMCOUNTER12H]  = { "hpmcounter12h",  ctr32,  read_hpmcounterh },
4624     [CSR_HPMCOUNTER13H]  = { "hpmcounter13h",  ctr32,  read_hpmcounterh },
4625     [CSR_HPMCOUNTER14H]  = { "hpmcounter14h",  ctr32,  read_hpmcounterh },
4626     [CSR_HPMCOUNTER15H]  = { "hpmcounter15h",  ctr32,  read_hpmcounterh },
4627     [CSR_HPMCOUNTER16H]  = { "hpmcounter16h",  ctr32,  read_hpmcounterh },
4628     [CSR_HPMCOUNTER17H]  = { "hpmcounter17h",  ctr32,  read_hpmcounterh },
4629     [CSR_HPMCOUNTER18H]  = { "hpmcounter18h",  ctr32,  read_hpmcounterh },
4630     [CSR_HPMCOUNTER19H]  = { "hpmcounter19h",  ctr32,  read_hpmcounterh },
4631     [CSR_HPMCOUNTER20H]  = { "hpmcounter20h",  ctr32,  read_hpmcounterh },
4632     [CSR_HPMCOUNTER21H]  = { "hpmcounter21h",  ctr32,  read_hpmcounterh },
4633     [CSR_HPMCOUNTER22H]  = { "hpmcounter22h",  ctr32,  read_hpmcounterh },
4634     [CSR_HPMCOUNTER23H]  = { "hpmcounter23h",  ctr32,  read_hpmcounterh },
4635     [CSR_HPMCOUNTER24H]  = { "hpmcounter24h",  ctr32,  read_hpmcounterh },
4636     [CSR_HPMCOUNTER25H]  = { "hpmcounter25h",  ctr32,  read_hpmcounterh },
4637     [CSR_HPMCOUNTER26H]  = { "hpmcounter26h",  ctr32,  read_hpmcounterh },
4638     [CSR_HPMCOUNTER27H]  = { "hpmcounter27h",  ctr32,  read_hpmcounterh },
4639     [CSR_HPMCOUNTER28H]  = { "hpmcounter28h",  ctr32,  read_hpmcounterh },
4640     [CSR_HPMCOUNTER29H]  = { "hpmcounter29h",  ctr32,  read_hpmcounterh },
4641     [CSR_HPMCOUNTER30H]  = { "hpmcounter30h",  ctr32,  read_hpmcounterh },
4642     [CSR_HPMCOUNTER31H]  = { "hpmcounter31h",  ctr32,  read_hpmcounterh },
4643 
4644     [CSR_MHPMCOUNTER3H]  = { "mhpmcounter3h",  mctr32,  read_hpmcounterh,
4645                              write_mhpmcounterh                         },
4646     [CSR_MHPMCOUNTER4H]  = { "mhpmcounter4h",  mctr32,  read_hpmcounterh,
4647                              write_mhpmcounterh                         },
4648     [CSR_MHPMCOUNTER5H]  = { "mhpmcounter5h",  mctr32,  read_hpmcounterh,
4649                              write_mhpmcounterh                         },
4650     [CSR_MHPMCOUNTER6H]  = { "mhpmcounter6h",  mctr32,  read_hpmcounterh,
4651                              write_mhpmcounterh                         },
4652     [CSR_MHPMCOUNTER7H]  = { "mhpmcounter7h",  mctr32,  read_hpmcounterh,
4653                              write_mhpmcounterh                         },
4654     [CSR_MHPMCOUNTER8H]  = { "mhpmcounter8h",  mctr32,  read_hpmcounterh,
4655                              write_mhpmcounterh                         },
4656     [CSR_MHPMCOUNTER9H]  = { "mhpmcounter9h",  mctr32,  read_hpmcounterh,
4657                              write_mhpmcounterh                         },
4658     [CSR_MHPMCOUNTER10H] = { "mhpmcounter10h", mctr32,  read_hpmcounterh,
4659                              write_mhpmcounterh                         },
4660     [CSR_MHPMCOUNTER11H] = { "mhpmcounter11h", mctr32,  read_hpmcounterh,
4661                              write_mhpmcounterh                         },
4662     [CSR_MHPMCOUNTER12H] = { "mhpmcounter12h", mctr32,  read_hpmcounterh,
4663                              write_mhpmcounterh                         },
4664     [CSR_MHPMCOUNTER13H] = { "mhpmcounter13h", mctr32,  read_hpmcounterh,
4665                              write_mhpmcounterh                         },
4666     [CSR_MHPMCOUNTER14H] = { "mhpmcounter14h", mctr32,  read_hpmcounterh,
4667                              write_mhpmcounterh                         },
4668     [CSR_MHPMCOUNTER15H] = { "mhpmcounter15h", mctr32,  read_hpmcounterh,
4669                              write_mhpmcounterh                         },
4670     [CSR_MHPMCOUNTER16H] = { "mhpmcounter16h", mctr32,  read_hpmcounterh,
4671                              write_mhpmcounterh                         },
4672     [CSR_MHPMCOUNTER17H] = { "mhpmcounter17h", mctr32,  read_hpmcounterh,
4673                              write_mhpmcounterh                         },
4674     [CSR_MHPMCOUNTER18H] = { "mhpmcounter18h", mctr32,  read_hpmcounterh,
4675                              write_mhpmcounterh                         },
4676     [CSR_MHPMCOUNTER19H] = { "mhpmcounter19h", mctr32,  read_hpmcounterh,
4677                              write_mhpmcounterh                         },
4678     [CSR_MHPMCOUNTER20H] = { "mhpmcounter20h", mctr32,  read_hpmcounterh,
4679                              write_mhpmcounterh                         },
4680     [CSR_MHPMCOUNTER21H] = { "mhpmcounter21h", mctr32,  read_hpmcounterh,
4681                              write_mhpmcounterh                         },
4682     [CSR_MHPMCOUNTER22H] = { "mhpmcounter22h", mctr32,  read_hpmcounterh,
4683                              write_mhpmcounterh                         },
4684     [CSR_MHPMCOUNTER23H] = { "mhpmcounter23h", mctr32,  read_hpmcounterh,
4685                              write_mhpmcounterh                         },
4686     [CSR_MHPMCOUNTER24H] = { "mhpmcounter24h", mctr32,  read_hpmcounterh,
4687                              write_mhpmcounterh                         },
4688     [CSR_MHPMCOUNTER25H] = { "mhpmcounter25h", mctr32,  read_hpmcounterh,
4689                              write_mhpmcounterh                         },
4690     [CSR_MHPMCOUNTER26H] = { "mhpmcounter26h", mctr32,  read_hpmcounterh,
4691                              write_mhpmcounterh                         },
4692     [CSR_MHPMCOUNTER27H] = { "mhpmcounter27h", mctr32,  read_hpmcounterh,
4693                              write_mhpmcounterh                         },
4694     [CSR_MHPMCOUNTER28H] = { "mhpmcounter28h", mctr32,  read_hpmcounterh,
4695                              write_mhpmcounterh                         },
4696     [CSR_MHPMCOUNTER29H] = { "mhpmcounter29h", mctr32,  read_hpmcounterh,
4697                              write_mhpmcounterh                         },
4698     [CSR_MHPMCOUNTER30H] = { "mhpmcounter30h", mctr32,  read_hpmcounterh,
4699                              write_mhpmcounterh                         },
4700     [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
4701                              write_mhpmcounterh                         },
4702     [CSR_SCOUNTOVF]      = { "scountovf", sscofpmf,  read_scountovf,
4703                              .min_priv_ver = PRIV_VERSION_1_12_0 },
4704 
4705 #endif /* !CONFIG_USER_ONLY */
4706 };
4707