xref: /openbmc/qemu/target/riscv/csr.c (revision 3780e337)
1 /*
2  * RISC-V Control and Status Registers.
3  *
4  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
5  * Copyright (c) 2017-2018 SiFive, Inc.
6  *
7  * This program is free software; you can redistribute it and/or modify it
8  * under the terms and conditions of the GNU General Public License,
9  * version 2 or later, as published by the Free Software Foundation.
10  *
11  * This program is distributed in the hope it will be useful, but WITHOUT
12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
14  * more details.
15  *
16  * You should have received a copy of the GNU General Public License along with
17  * this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qemu/log.h"
22 #include "qemu/timer.h"
23 #include "cpu.h"
24 #include "pmu.h"
25 #include "qemu/main-loop.h"
26 #include "exec/exec-all.h"
27 #include "sysemu/cpu-timers.h"
28 #include "qemu/guest-random.h"
29 #include "qapi/error.h"
30 
31 /* CSR function table public API */
32 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
33 {
34     *ops = csr_ops[csrno & (CSR_TABLE_SIZE - 1)];
35 }
36 
37 void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
38 {
39     csr_ops[csrno & (CSR_TABLE_SIZE - 1)] = *ops;
40 }
41 
42 /* Predicates */
43 static RISCVException fs(CPURISCVState *env, int csrno)
44 {
45 #if !defined(CONFIG_USER_ONLY)
46     if (!env->debugger && !riscv_cpu_fp_enabled(env) &&
47         !RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
48         return RISCV_EXCP_ILLEGAL_INST;
49     }
50 #endif
51     return RISCV_EXCP_NONE;
52 }
53 
54 static RISCVException vs(CPURISCVState *env, int csrno)
55 {
56     CPUState *cs = env_cpu(env);
57     RISCVCPU *cpu = RISCV_CPU(cs);
58 
59     if (env->misa_ext & RVV ||
60         cpu->cfg.ext_zve32f || cpu->cfg.ext_zve64f) {
61 #if !defined(CONFIG_USER_ONLY)
62         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
63             return RISCV_EXCP_ILLEGAL_INST;
64         }
65 #endif
66         return RISCV_EXCP_NONE;
67     }
68     return RISCV_EXCP_ILLEGAL_INST;
69 }
70 
71 static RISCVException ctr(CPURISCVState *env, int csrno)
72 {
73 #if !defined(CONFIG_USER_ONLY)
74     CPUState *cs = env_cpu(env);
75     RISCVCPU *cpu = RISCV_CPU(cs);
76     int ctr_index;
77     int base_csrno = CSR_HPMCOUNTER3;
78     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
79 
80     if (rv32 && csrno >= CSR_CYCLEH) {
81         /* Offset for RV32 hpmcounternh counters */
82         base_csrno += 0x80;
83     }
84     ctr_index = csrno - base_csrno;
85 
86     if (!cpu->cfg.pmu_num || ctr_index >= (cpu->cfg.pmu_num)) {
87         /* No counter is enabled in PMU or the counter is out of range */
88         return RISCV_EXCP_ILLEGAL_INST;
89     }
90 
91     if (env->priv == PRV_S) {
92         switch (csrno) {
93         case CSR_CYCLE:
94             if (!get_field(env->mcounteren, COUNTEREN_CY)) {
95                 return RISCV_EXCP_ILLEGAL_INST;
96             }
97             break;
98         case CSR_TIME:
99             if (!get_field(env->mcounteren, COUNTEREN_TM)) {
100                 return RISCV_EXCP_ILLEGAL_INST;
101             }
102             break;
103         case CSR_INSTRET:
104             if (!get_field(env->mcounteren, COUNTEREN_IR)) {
105                 return RISCV_EXCP_ILLEGAL_INST;
106             }
107             break;
108         case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
109             ctr_index = csrno - CSR_CYCLE;
110             if (!get_field(env->mcounteren, 1 << ctr_index)) {
111                 return RISCV_EXCP_ILLEGAL_INST;
112             }
113             break;
114         }
115         if (rv32) {
116             switch (csrno) {
117             case CSR_CYCLEH:
118                 if (!get_field(env->mcounteren, COUNTEREN_CY)) {
119                     return RISCV_EXCP_ILLEGAL_INST;
120                 }
121                 break;
122             case CSR_TIMEH:
123                 if (!get_field(env->mcounteren, COUNTEREN_TM)) {
124                     return RISCV_EXCP_ILLEGAL_INST;
125                 }
126                 break;
127             case CSR_INSTRETH:
128                 if (!get_field(env->mcounteren, COUNTEREN_IR)) {
129                     return RISCV_EXCP_ILLEGAL_INST;
130                 }
131                 break;
132             case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
133                 ctr_index = csrno - CSR_CYCLEH;
134                 if (!get_field(env->mcounteren, 1 << ctr_index)) {
135                     return RISCV_EXCP_ILLEGAL_INST;
136                 }
137                 break;
138             }
139         }
140     }
141 
142     if (riscv_cpu_virt_enabled(env)) {
143         switch (csrno) {
144         case CSR_CYCLE:
145             if (!get_field(env->hcounteren, COUNTEREN_CY) &&
146                 get_field(env->mcounteren, COUNTEREN_CY)) {
147                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
148             }
149             break;
150         case CSR_TIME:
151             if (!get_field(env->hcounteren, COUNTEREN_TM) &&
152                 get_field(env->mcounteren, COUNTEREN_TM)) {
153                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
154             }
155             break;
156         case CSR_INSTRET:
157             if (!get_field(env->hcounteren, COUNTEREN_IR) &&
158                 get_field(env->mcounteren, COUNTEREN_IR)) {
159                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
160             }
161             break;
162         case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
163             ctr_index = csrno - CSR_CYCLE;
164             if (!get_field(env->hcounteren, 1 << ctr_index) &&
165                  get_field(env->mcounteren, 1 << ctr_index)) {
166                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
167             }
168             break;
169         }
170         if (rv32) {
171             switch (csrno) {
172             case CSR_CYCLEH:
173                 if (!get_field(env->hcounteren, COUNTEREN_CY) &&
174                     get_field(env->mcounteren, COUNTEREN_CY)) {
175                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
176                 }
177                 break;
178             case CSR_TIMEH:
179                 if (!get_field(env->hcounteren, COUNTEREN_TM) &&
180                     get_field(env->mcounteren, COUNTEREN_TM)) {
181                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
182                 }
183                 break;
184             case CSR_INSTRETH:
185                 if (!get_field(env->hcounteren, COUNTEREN_IR) &&
186                     get_field(env->mcounteren, COUNTEREN_IR)) {
187                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
188                 }
189                 break;
190             case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
191                 ctr_index = csrno - CSR_CYCLEH;
192                 if (!get_field(env->hcounteren, 1 << ctr_index) &&
193                      get_field(env->mcounteren, 1 << ctr_index)) {
194                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
195                 }
196                 break;
197             }
198         }
199     }
200 #endif
201     return RISCV_EXCP_NONE;
202 }
203 
204 static RISCVException ctr32(CPURISCVState *env, int csrno)
205 {
206     if (riscv_cpu_mxl(env) != MXL_RV32) {
207         return RISCV_EXCP_ILLEGAL_INST;
208     }
209 
210     return ctr(env, csrno);
211 }
212 
213 #if !defined(CONFIG_USER_ONLY)
214 static RISCVException mctr(CPURISCVState *env, int csrno)
215 {
216     CPUState *cs = env_cpu(env);
217     RISCVCPU *cpu = RISCV_CPU(cs);
218     int ctr_index;
219     int base_csrno = CSR_MHPMCOUNTER3;
220 
221     if ((riscv_cpu_mxl(env) == MXL_RV32) && csrno >= CSR_MCYCLEH) {
222         /* Offset for RV32 mhpmcounternh counters */
223         base_csrno += 0x80;
224     }
225     ctr_index = csrno - base_csrno;
226     if (!cpu->cfg.pmu_num || ctr_index >= cpu->cfg.pmu_num) {
227         /* The PMU is not enabled or counter is out of range*/
228         return RISCV_EXCP_ILLEGAL_INST;
229     }
230 
231     return RISCV_EXCP_NONE;
232 }
233 
234 static RISCVException mctr32(CPURISCVState *env, int csrno)
235 {
236     if (riscv_cpu_mxl(env) != MXL_RV32) {
237         return RISCV_EXCP_ILLEGAL_INST;
238     }
239 
240     return mctr(env, csrno);
241 }
242 
243 static RISCVException any(CPURISCVState *env, int csrno)
244 {
245     return RISCV_EXCP_NONE;
246 }
247 
248 static RISCVException any32(CPURISCVState *env, int csrno)
249 {
250     if (riscv_cpu_mxl(env) != MXL_RV32) {
251         return RISCV_EXCP_ILLEGAL_INST;
252     }
253 
254     return any(env, csrno);
255 
256 }
257 
258 static int aia_any(CPURISCVState *env, int csrno)
259 {
260     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
261         return RISCV_EXCP_ILLEGAL_INST;
262     }
263 
264     return any(env, csrno);
265 }
266 
267 static int aia_any32(CPURISCVState *env, int csrno)
268 {
269     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
270         return RISCV_EXCP_ILLEGAL_INST;
271     }
272 
273     return any32(env, csrno);
274 }
275 
276 static RISCVException smode(CPURISCVState *env, int csrno)
277 {
278     if (riscv_has_ext(env, RVS)) {
279         return RISCV_EXCP_NONE;
280     }
281 
282     return RISCV_EXCP_ILLEGAL_INST;
283 }
284 
285 static int smode32(CPURISCVState *env, int csrno)
286 {
287     if (riscv_cpu_mxl(env) != MXL_RV32) {
288         return RISCV_EXCP_ILLEGAL_INST;
289     }
290 
291     return smode(env, csrno);
292 }
293 
294 static int aia_smode(CPURISCVState *env, int csrno)
295 {
296     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
297         return RISCV_EXCP_ILLEGAL_INST;
298     }
299 
300     return smode(env, csrno);
301 }
302 
303 static int aia_smode32(CPURISCVState *env, int csrno)
304 {
305     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
306         return RISCV_EXCP_ILLEGAL_INST;
307     }
308 
309     return smode32(env, csrno);
310 }
311 
312 static RISCVException hmode(CPURISCVState *env, int csrno)
313 {
314     if (riscv_has_ext(env, RVS) &&
315         riscv_has_ext(env, RVH)) {
316         /* Hypervisor extension is supported */
317         if ((env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
318             env->priv == PRV_M) {
319             return RISCV_EXCP_NONE;
320         } else {
321             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
322         }
323     }
324 
325     return RISCV_EXCP_ILLEGAL_INST;
326 }
327 
328 static RISCVException hmode32(CPURISCVState *env, int csrno)
329 {
330     if (riscv_cpu_mxl(env) != MXL_RV32) {
331         if (!riscv_cpu_virt_enabled(env)) {
332             return RISCV_EXCP_ILLEGAL_INST;
333         } else {
334             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
335         }
336     }
337 
338     return hmode(env, csrno);
339 
340 }
341 
342 /* Checks if PointerMasking registers could be accessed */
343 static RISCVException pointer_masking(CPURISCVState *env, int csrno)
344 {
345     /* Check if j-ext is present */
346     if (riscv_has_ext(env, RVJ)) {
347         return RISCV_EXCP_NONE;
348     }
349     return RISCV_EXCP_ILLEGAL_INST;
350 }
351 
352 static int aia_hmode(CPURISCVState *env, int csrno)
353 {
354     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
355         return RISCV_EXCP_ILLEGAL_INST;
356      }
357 
358      return hmode(env, csrno);
359 }
360 
361 static int aia_hmode32(CPURISCVState *env, int csrno)
362 {
363     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
364         return RISCV_EXCP_ILLEGAL_INST;
365     }
366 
367     return hmode32(env, csrno);
368 }
369 
370 static RISCVException pmp(CPURISCVState *env, int csrno)
371 {
372     if (riscv_feature(env, RISCV_FEATURE_PMP)) {
373         return RISCV_EXCP_NONE;
374     }
375 
376     return RISCV_EXCP_ILLEGAL_INST;
377 }
378 
379 static RISCVException epmp(CPURISCVState *env, int csrno)
380 {
381     if (env->priv == PRV_M && riscv_feature(env, RISCV_FEATURE_EPMP)) {
382         return RISCV_EXCP_NONE;
383     }
384 
385     return RISCV_EXCP_ILLEGAL_INST;
386 }
387 
388 static RISCVException debug(CPURISCVState *env, int csrno)
389 {
390     if (riscv_feature(env, RISCV_FEATURE_DEBUG)) {
391         return RISCV_EXCP_NONE;
392     }
393 
394     return RISCV_EXCP_ILLEGAL_INST;
395 }
396 #endif
397 
398 static RISCVException seed(CPURISCVState *env, int csrno)
399 {
400     RISCVCPU *cpu = env_archcpu(env);
401 
402     if (!cpu->cfg.ext_zkr) {
403         return RISCV_EXCP_ILLEGAL_INST;
404     }
405 
406 #if !defined(CONFIG_USER_ONLY)
407     /*
408      * With a CSR read-write instruction:
409      * 1) The seed CSR is always available in machine mode as normal.
410      * 2) Attempted access to seed from virtual modes VS and VU always raises
411      * an exception(virtual instruction exception only if mseccfg.sseed=1).
412      * 3) Without the corresponding access control bit set to 1, any attempted
413      * access to seed from U, S or HS modes will raise an illegal instruction
414      * exception.
415      */
416     if (env->priv == PRV_M) {
417         return RISCV_EXCP_NONE;
418     } else if (riscv_cpu_virt_enabled(env)) {
419         if (env->mseccfg & MSECCFG_SSEED) {
420             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
421         } else {
422             return RISCV_EXCP_ILLEGAL_INST;
423         }
424     } else {
425         if (env->priv == PRV_S && (env->mseccfg & MSECCFG_SSEED)) {
426             return RISCV_EXCP_NONE;
427         } else if (env->priv == PRV_U && (env->mseccfg & MSECCFG_USEED)) {
428             return RISCV_EXCP_NONE;
429         } else {
430             return RISCV_EXCP_ILLEGAL_INST;
431         }
432     }
433 #else
434     return RISCV_EXCP_NONE;
435 #endif
436 }
437 
438 /* User Floating-Point CSRs */
439 static RISCVException read_fflags(CPURISCVState *env, int csrno,
440                                   target_ulong *val)
441 {
442     *val = riscv_cpu_get_fflags(env);
443     return RISCV_EXCP_NONE;
444 }
445 
446 static RISCVException write_fflags(CPURISCVState *env, int csrno,
447                                    target_ulong val)
448 {
449 #if !defined(CONFIG_USER_ONLY)
450     if (riscv_has_ext(env, RVF)) {
451         env->mstatus |= MSTATUS_FS;
452     }
453 #endif
454     riscv_cpu_set_fflags(env, val & (FSR_AEXC >> FSR_AEXC_SHIFT));
455     return RISCV_EXCP_NONE;
456 }
457 
458 static RISCVException read_frm(CPURISCVState *env, int csrno,
459                                target_ulong *val)
460 {
461     *val = env->frm;
462     return RISCV_EXCP_NONE;
463 }
464 
465 static RISCVException write_frm(CPURISCVState *env, int csrno,
466                                 target_ulong val)
467 {
468 #if !defined(CONFIG_USER_ONLY)
469     if (riscv_has_ext(env, RVF)) {
470         env->mstatus |= MSTATUS_FS;
471     }
472 #endif
473     env->frm = val & (FSR_RD >> FSR_RD_SHIFT);
474     return RISCV_EXCP_NONE;
475 }
476 
477 static RISCVException read_fcsr(CPURISCVState *env, int csrno,
478                                 target_ulong *val)
479 {
480     *val = (riscv_cpu_get_fflags(env) << FSR_AEXC_SHIFT)
481         | (env->frm << FSR_RD_SHIFT);
482     return RISCV_EXCP_NONE;
483 }
484 
485 static RISCVException write_fcsr(CPURISCVState *env, int csrno,
486                                  target_ulong val)
487 {
488 #if !defined(CONFIG_USER_ONLY)
489     if (riscv_has_ext(env, RVF)) {
490         env->mstatus |= MSTATUS_FS;
491     }
492 #endif
493     env->frm = (val & FSR_RD) >> FSR_RD_SHIFT;
494     riscv_cpu_set_fflags(env, (val & FSR_AEXC) >> FSR_AEXC_SHIFT);
495     return RISCV_EXCP_NONE;
496 }
497 
498 static RISCVException read_vtype(CPURISCVState *env, int csrno,
499                                  target_ulong *val)
500 {
501     uint64_t vill;
502     switch (env->xl) {
503     case MXL_RV32:
504         vill = (uint32_t)env->vill << 31;
505         break;
506     case MXL_RV64:
507         vill = (uint64_t)env->vill << 63;
508         break;
509     default:
510         g_assert_not_reached();
511     }
512     *val = (target_ulong)vill | env->vtype;
513     return RISCV_EXCP_NONE;
514 }
515 
516 static RISCVException read_vl(CPURISCVState *env, int csrno,
517                               target_ulong *val)
518 {
519     *val = env->vl;
520     return RISCV_EXCP_NONE;
521 }
522 
523 static int read_vlenb(CPURISCVState *env, int csrno, target_ulong *val)
524 {
525     *val = env_archcpu(env)->cfg.vlen >> 3;
526     return RISCV_EXCP_NONE;
527 }
528 
529 static RISCVException read_vxrm(CPURISCVState *env, int csrno,
530                                 target_ulong *val)
531 {
532     *val = env->vxrm;
533     return RISCV_EXCP_NONE;
534 }
535 
536 static RISCVException write_vxrm(CPURISCVState *env, int csrno,
537                                  target_ulong val)
538 {
539 #if !defined(CONFIG_USER_ONLY)
540     env->mstatus |= MSTATUS_VS;
541 #endif
542     env->vxrm = val;
543     return RISCV_EXCP_NONE;
544 }
545 
546 static RISCVException read_vxsat(CPURISCVState *env, int csrno,
547                                  target_ulong *val)
548 {
549     *val = env->vxsat;
550     return RISCV_EXCP_NONE;
551 }
552 
553 static RISCVException write_vxsat(CPURISCVState *env, int csrno,
554                                   target_ulong val)
555 {
556 #if !defined(CONFIG_USER_ONLY)
557     env->mstatus |= MSTATUS_VS;
558 #endif
559     env->vxsat = val;
560     return RISCV_EXCP_NONE;
561 }
562 
563 static RISCVException read_vstart(CPURISCVState *env, int csrno,
564                                   target_ulong *val)
565 {
566     *val = env->vstart;
567     return RISCV_EXCP_NONE;
568 }
569 
570 static RISCVException write_vstart(CPURISCVState *env, int csrno,
571                                    target_ulong val)
572 {
573 #if !defined(CONFIG_USER_ONLY)
574     env->mstatus |= MSTATUS_VS;
575 #endif
576     /*
577      * The vstart CSR is defined to have only enough writable bits
578      * to hold the largest element index, i.e. lg2(VLEN) bits.
579      */
580     env->vstart = val & ~(~0ULL << ctzl(env_archcpu(env)->cfg.vlen));
581     return RISCV_EXCP_NONE;
582 }
583 
584 static int read_vcsr(CPURISCVState *env, int csrno, target_ulong *val)
585 {
586     *val = (env->vxrm << VCSR_VXRM_SHIFT) | (env->vxsat << VCSR_VXSAT_SHIFT);
587     return RISCV_EXCP_NONE;
588 }
589 
590 static int write_vcsr(CPURISCVState *env, int csrno, target_ulong val)
591 {
592 #if !defined(CONFIG_USER_ONLY)
593     env->mstatus |= MSTATUS_VS;
594 #endif
595     env->vxrm = (val & VCSR_VXRM) >> VCSR_VXRM_SHIFT;
596     env->vxsat = (val & VCSR_VXSAT) >> VCSR_VXSAT_SHIFT;
597     return RISCV_EXCP_NONE;
598 }
599 
600 /* User Timers and Counters */
601 static target_ulong get_ticks(bool shift)
602 {
603     int64_t val;
604     target_ulong result;
605 
606 #if !defined(CONFIG_USER_ONLY)
607     if (icount_enabled()) {
608         val = icount_get();
609     } else {
610         val = cpu_get_host_ticks();
611     }
612 #else
613     val = cpu_get_host_ticks();
614 #endif
615 
616     if (shift) {
617         result = val >> 32;
618     } else {
619         result = val;
620     }
621 
622     return result;
623 }
624 
625 #if defined(CONFIG_USER_ONLY)
626 static RISCVException read_time(CPURISCVState *env, int csrno,
627                                 target_ulong *val)
628 {
629     *val = cpu_get_host_ticks();
630     return RISCV_EXCP_NONE;
631 }
632 
633 static RISCVException read_timeh(CPURISCVState *env, int csrno,
634                                  target_ulong *val)
635 {
636     *val = cpu_get_host_ticks() >> 32;
637     return RISCV_EXCP_NONE;
638 }
639 
640 static int read_hpmcounter(CPURISCVState *env, int csrno, target_ulong *val)
641 {
642     *val = get_ticks(false);
643     return RISCV_EXCP_NONE;
644 }
645 
646 static int read_hpmcounterh(CPURISCVState *env, int csrno, target_ulong *val)
647 {
648     *val = get_ticks(true);
649     return RISCV_EXCP_NONE;
650 }
651 
652 #else /* CONFIG_USER_ONLY */
653 
654 static int read_mhpmevent(CPURISCVState *env, int csrno, target_ulong *val)
655 {
656     int evt_index = csrno - CSR_MCOUNTINHIBIT;
657 
658     *val = env->mhpmevent_val[evt_index];
659 
660     return RISCV_EXCP_NONE;
661 }
662 
663 static int write_mhpmevent(CPURISCVState *env, int csrno, target_ulong val)
664 {
665     int evt_index = csrno - CSR_MCOUNTINHIBIT;
666 
667     env->mhpmevent_val[evt_index] = val;
668 
669     return RISCV_EXCP_NONE;
670 }
671 
672 static int write_mhpmcounter(CPURISCVState *env, int csrno, target_ulong val)
673 {
674     int ctr_idx = csrno - CSR_MCYCLE;
675     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
676 
677     counter->mhpmcounter_val = val;
678     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
679         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
680         counter->mhpmcounter_prev = get_ticks(false);
681     } else {
682         /* Other counters can keep incrementing from the given value */
683         counter->mhpmcounter_prev = val;
684     }
685 
686     return RISCV_EXCP_NONE;
687 }
688 
689 static int write_mhpmcounterh(CPURISCVState *env, int csrno, target_ulong val)
690 {
691     int ctr_idx = csrno - CSR_MCYCLEH;
692     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
693 
694     counter->mhpmcounterh_val = val;
695     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
696         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
697         counter->mhpmcounterh_prev = get_ticks(true);
698     } else {
699         counter->mhpmcounterh_prev = val;
700     }
701 
702     return RISCV_EXCP_NONE;
703 }
704 
705 static RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
706                                          bool upper_half, uint32_t ctr_idx)
707 {
708     PMUCTRState counter = env->pmu_ctrs[ctr_idx];
709     target_ulong ctr_prev = upper_half ? counter.mhpmcounterh_prev :
710                                          counter.mhpmcounter_prev;
711     target_ulong ctr_val = upper_half ? counter.mhpmcounterh_val :
712                                         counter.mhpmcounter_val;
713 
714     if (get_field(env->mcountinhibit, BIT(ctr_idx))) {
715         /**
716          * Counter should not increment if inhibit bit is set. We can't really
717          * stop the icount counting. Just return the counter value written by
718          * the supervisor to indicate that counter was not incremented.
719          */
720         if (!counter.started) {
721             *val = ctr_val;
722             return RISCV_EXCP_NONE;
723         } else {
724             /* Mark that the counter has been stopped */
725             counter.started = false;
726         }
727     }
728 
729     /**
730      * The kernel computes the perf delta by subtracting the current value from
731      * the value it initialized previously (ctr_val).
732      */
733     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
734         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
735         *val = get_ticks(upper_half) - ctr_prev + ctr_val;
736     } else {
737         *val = ctr_val;
738     }
739 
740     return RISCV_EXCP_NONE;
741 }
742 
743 static int read_hpmcounter(CPURISCVState *env, int csrno, target_ulong *val)
744 {
745     uint16_t ctr_index;
746 
747     if (csrno >= CSR_MCYCLE && csrno <= CSR_MHPMCOUNTER31) {
748         ctr_index = csrno - CSR_MCYCLE;
749     } else if (csrno >= CSR_CYCLE && csrno <= CSR_HPMCOUNTER31) {
750         ctr_index = csrno - CSR_CYCLE;
751     } else {
752         return RISCV_EXCP_ILLEGAL_INST;
753     }
754 
755     return riscv_pmu_read_ctr(env, val, false, ctr_index);
756 }
757 
758 static int read_hpmcounterh(CPURISCVState *env, int csrno, target_ulong *val)
759 {
760     uint16_t ctr_index;
761 
762     if (csrno >= CSR_MCYCLEH && csrno <= CSR_MHPMCOUNTER31H) {
763         ctr_index = csrno - CSR_MCYCLEH;
764     } else if (csrno >= CSR_CYCLEH && csrno <= CSR_HPMCOUNTER31H) {
765         ctr_index = csrno - CSR_CYCLEH;
766     } else {
767         return RISCV_EXCP_ILLEGAL_INST;
768     }
769 
770     return riscv_pmu_read_ctr(env, val, true, ctr_index);
771 }
772 
773 static RISCVException read_time(CPURISCVState *env, int csrno,
774                                 target_ulong *val)
775 {
776     uint64_t delta = riscv_cpu_virt_enabled(env) ? env->htimedelta : 0;
777 
778     if (!env->rdtime_fn) {
779         return RISCV_EXCP_ILLEGAL_INST;
780     }
781 
782     *val = env->rdtime_fn(env->rdtime_fn_arg) + delta;
783     return RISCV_EXCP_NONE;
784 }
785 
786 static RISCVException read_timeh(CPURISCVState *env, int csrno,
787                                  target_ulong *val)
788 {
789     uint64_t delta = riscv_cpu_virt_enabled(env) ? env->htimedelta : 0;
790 
791     if (!env->rdtime_fn) {
792         return RISCV_EXCP_ILLEGAL_INST;
793     }
794 
795     *val = (env->rdtime_fn(env->rdtime_fn_arg) + delta) >> 32;
796     return RISCV_EXCP_NONE;
797 }
798 
799 /* Machine constants */
800 
801 #define M_MODE_INTERRUPTS  ((uint64_t)(MIP_MSIP | MIP_MTIP | MIP_MEIP))
802 #define S_MODE_INTERRUPTS  ((uint64_t)(MIP_SSIP | MIP_STIP | MIP_SEIP))
803 #define VS_MODE_INTERRUPTS ((uint64_t)(MIP_VSSIP | MIP_VSTIP | MIP_VSEIP))
804 #define HS_MODE_INTERRUPTS ((uint64_t)(MIP_SGEIP | VS_MODE_INTERRUPTS))
805 
806 #define VSTOPI_NUM_SRCS 5
807 
808 static const uint64_t delegable_ints = S_MODE_INTERRUPTS |
809                                            VS_MODE_INTERRUPTS;
810 static const uint64_t vs_delegable_ints = VS_MODE_INTERRUPTS;
811 static const uint64_t all_ints = M_MODE_INTERRUPTS | S_MODE_INTERRUPTS |
812                                      HS_MODE_INTERRUPTS;
813 #define DELEGABLE_EXCPS ((1ULL << (RISCV_EXCP_INST_ADDR_MIS)) | \
814                          (1ULL << (RISCV_EXCP_INST_ACCESS_FAULT)) | \
815                          (1ULL << (RISCV_EXCP_ILLEGAL_INST)) | \
816                          (1ULL << (RISCV_EXCP_BREAKPOINT)) | \
817                          (1ULL << (RISCV_EXCP_LOAD_ADDR_MIS)) | \
818                          (1ULL << (RISCV_EXCP_LOAD_ACCESS_FAULT)) | \
819                          (1ULL << (RISCV_EXCP_STORE_AMO_ADDR_MIS)) | \
820                          (1ULL << (RISCV_EXCP_STORE_AMO_ACCESS_FAULT)) | \
821                          (1ULL << (RISCV_EXCP_U_ECALL)) | \
822                          (1ULL << (RISCV_EXCP_S_ECALL)) | \
823                          (1ULL << (RISCV_EXCP_VS_ECALL)) | \
824                          (1ULL << (RISCV_EXCP_M_ECALL)) | \
825                          (1ULL << (RISCV_EXCP_INST_PAGE_FAULT)) | \
826                          (1ULL << (RISCV_EXCP_LOAD_PAGE_FAULT)) | \
827                          (1ULL << (RISCV_EXCP_STORE_PAGE_FAULT)) | \
828                          (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) | \
829                          (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) | \
830                          (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) | \
831                          (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)))
832 static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
833     ~((1ULL << (RISCV_EXCP_S_ECALL)) |
834       (1ULL << (RISCV_EXCP_VS_ECALL)) |
835       (1ULL << (RISCV_EXCP_M_ECALL)) |
836       (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) |
837       (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) |
838       (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) |
839       (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)));
840 static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
841     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
842     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
843 static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
844 static const target_ulong hip_writable_mask = MIP_VSSIP;
845 static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
846 static const target_ulong vsip_writable_mask = MIP_VSSIP;
847 
848 static const char valid_vm_1_10_32[16] = {
849     [VM_1_10_MBARE] = 1,
850     [VM_1_10_SV32] = 1
851 };
852 
853 static const char valid_vm_1_10_64[16] = {
854     [VM_1_10_MBARE] = 1,
855     [VM_1_10_SV39] = 1,
856     [VM_1_10_SV48] = 1,
857     [VM_1_10_SV57] = 1
858 };
859 
860 /* Machine Information Registers */
861 static RISCVException read_zero(CPURISCVState *env, int csrno,
862                                 target_ulong *val)
863 {
864     *val = 0;
865     return RISCV_EXCP_NONE;
866 }
867 
868 static RISCVException write_ignore(CPURISCVState *env, int csrno,
869                                    target_ulong val)
870 {
871     return RISCV_EXCP_NONE;
872 }
873 
874 static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
875                                      target_ulong *val)
876 {
877     CPUState *cs = env_cpu(env);
878     RISCVCPU *cpu = RISCV_CPU(cs);
879 
880     *val = cpu->cfg.mvendorid;
881     return RISCV_EXCP_NONE;
882 }
883 
884 static RISCVException read_marchid(CPURISCVState *env, int csrno,
885                                    target_ulong *val)
886 {
887     CPUState *cs = env_cpu(env);
888     RISCVCPU *cpu = RISCV_CPU(cs);
889 
890     *val = cpu->cfg.marchid;
891     return RISCV_EXCP_NONE;
892 }
893 
894 static RISCVException read_mimpid(CPURISCVState *env, int csrno,
895                                   target_ulong *val)
896 {
897     CPUState *cs = env_cpu(env);
898     RISCVCPU *cpu = RISCV_CPU(cs);
899 
900     *val = cpu->cfg.mimpid;
901     return RISCV_EXCP_NONE;
902 }
903 
904 static RISCVException read_mhartid(CPURISCVState *env, int csrno,
905                                    target_ulong *val)
906 {
907     *val = env->mhartid;
908     return RISCV_EXCP_NONE;
909 }
910 
911 /* Machine Trap Setup */
912 
913 /* We do not store SD explicitly, only compute it on demand. */
914 static uint64_t add_status_sd(RISCVMXL xl, uint64_t status)
915 {
916     if ((status & MSTATUS_FS) == MSTATUS_FS ||
917         (status & MSTATUS_VS) == MSTATUS_VS ||
918         (status & MSTATUS_XS) == MSTATUS_XS) {
919         switch (xl) {
920         case MXL_RV32:
921             return status | MSTATUS32_SD;
922         case MXL_RV64:
923             return status | MSTATUS64_SD;
924         case MXL_RV128:
925             return MSTATUSH128_SD;
926         default:
927             g_assert_not_reached();
928         }
929     }
930     return status;
931 }
932 
933 static RISCVException read_mstatus(CPURISCVState *env, int csrno,
934                                    target_ulong *val)
935 {
936     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus);
937     return RISCV_EXCP_NONE;
938 }
939 
940 static int validate_vm(CPURISCVState *env, target_ulong vm)
941 {
942     if (riscv_cpu_mxl(env) == MXL_RV32) {
943         return valid_vm_1_10_32[vm & 0xf];
944     } else {
945         return valid_vm_1_10_64[vm & 0xf];
946     }
947 }
948 
949 static RISCVException write_mstatus(CPURISCVState *env, int csrno,
950                                     target_ulong val)
951 {
952     uint64_t mstatus = env->mstatus;
953     uint64_t mask = 0;
954     RISCVMXL xl = riscv_cpu_mxl(env);
955 
956     /* flush tlb on mstatus fields that affect VM */
957     if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPP | MSTATUS_MPV |
958             MSTATUS_MPRV | MSTATUS_SUM)) {
959         tlb_flush(env_cpu(env));
960     }
961     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
962         MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
963         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
964         MSTATUS_TW | MSTATUS_VS;
965 
966     if (riscv_has_ext(env, RVF)) {
967         mask |= MSTATUS_FS;
968     }
969 
970     if (xl != MXL_RV32 || env->debugger) {
971         /*
972          * RV32: MPV and GVA are not in mstatus. The current plan is to
973          * add them to mstatush. For now, we just don't support it.
974          */
975         mask |= MSTATUS_MPV | MSTATUS_GVA;
976         if ((val & MSTATUS64_UXL) != 0) {
977             mask |= MSTATUS64_UXL;
978         }
979     }
980 
981     mstatus = (mstatus & ~mask) | (val & mask);
982 
983     if (xl > MXL_RV32) {
984         /* SXL field is for now read only */
985         mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
986     }
987     env->mstatus = mstatus;
988     env->xl = cpu_recompute_xl(env);
989 
990     return RISCV_EXCP_NONE;
991 }
992 
993 static RISCVException read_mstatush(CPURISCVState *env, int csrno,
994                                     target_ulong *val)
995 {
996     *val = env->mstatus >> 32;
997     return RISCV_EXCP_NONE;
998 }
999 
1000 static RISCVException write_mstatush(CPURISCVState *env, int csrno,
1001                                      target_ulong val)
1002 {
1003     uint64_t valh = (uint64_t)val << 32;
1004     uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
1005 
1006     if ((valh ^ env->mstatus) & (MSTATUS_MPV)) {
1007         tlb_flush(env_cpu(env));
1008     }
1009 
1010     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
1011 
1012     return RISCV_EXCP_NONE;
1013 }
1014 
1015 static RISCVException read_mstatus_i128(CPURISCVState *env, int csrno,
1016                                         Int128 *val)
1017 {
1018     *val = int128_make128(env->mstatus, add_status_sd(MXL_RV128, env->mstatus));
1019     return RISCV_EXCP_NONE;
1020 }
1021 
1022 static RISCVException read_misa_i128(CPURISCVState *env, int csrno,
1023                                      Int128 *val)
1024 {
1025     *val = int128_make128(env->misa_ext, (uint64_t)MXL_RV128 << 62);
1026     return RISCV_EXCP_NONE;
1027 }
1028 
1029 static RISCVException read_misa(CPURISCVState *env, int csrno,
1030                                 target_ulong *val)
1031 {
1032     target_ulong misa;
1033 
1034     switch (env->misa_mxl) {
1035     case MXL_RV32:
1036         misa = (target_ulong)MXL_RV32 << 30;
1037         break;
1038 #ifdef TARGET_RISCV64
1039     case MXL_RV64:
1040         misa = (target_ulong)MXL_RV64 << 62;
1041         break;
1042 #endif
1043     default:
1044         g_assert_not_reached();
1045     }
1046 
1047     *val = misa | env->misa_ext;
1048     return RISCV_EXCP_NONE;
1049 }
1050 
1051 static RISCVException write_misa(CPURISCVState *env, int csrno,
1052                                  target_ulong val)
1053 {
1054     if (!riscv_feature(env, RISCV_FEATURE_MISA)) {
1055         /* drop write to misa */
1056         return RISCV_EXCP_NONE;
1057     }
1058 
1059     /* 'I' or 'E' must be present */
1060     if (!(val & (RVI | RVE))) {
1061         /* It is not, drop write to misa */
1062         return RISCV_EXCP_NONE;
1063     }
1064 
1065     /* 'E' excludes all other extensions */
1066     if (val & RVE) {
1067         /* when we support 'E' we can do "val = RVE;" however
1068          * for now we just drop writes if 'E' is present.
1069          */
1070         return RISCV_EXCP_NONE;
1071     }
1072 
1073     /*
1074      * misa.MXL writes are not supported by QEMU.
1075      * Drop writes to those bits.
1076      */
1077 
1078     /* Mask extensions that are not supported by this hart */
1079     val &= env->misa_ext_mask;
1080 
1081     /* Mask extensions that are not supported by QEMU */
1082     val &= (RVI | RVE | RVM | RVA | RVF | RVD | RVC | RVS | RVU | RVV);
1083 
1084     /* 'D' depends on 'F', so clear 'D' if 'F' is not present */
1085     if ((val & RVD) && !(val & RVF)) {
1086         val &= ~RVD;
1087     }
1088 
1089     /* Suppress 'C' if next instruction is not aligned
1090      * TODO: this should check next_pc
1091      */
1092     if ((val & RVC) && (GETPC() & ~3) != 0) {
1093         val &= ~RVC;
1094     }
1095 
1096     /* If nothing changed, do nothing. */
1097     if (val == env->misa_ext) {
1098         return RISCV_EXCP_NONE;
1099     }
1100 
1101     if (!(val & RVF)) {
1102         env->mstatus &= ~MSTATUS_FS;
1103     }
1104 
1105     /* flush translation cache */
1106     tb_flush(env_cpu(env));
1107     env->misa_ext = val;
1108     env->xl = riscv_cpu_mxl(env);
1109     return RISCV_EXCP_NONE;
1110 }
1111 
1112 static RISCVException read_medeleg(CPURISCVState *env, int csrno,
1113                                    target_ulong *val)
1114 {
1115     *val = env->medeleg;
1116     return RISCV_EXCP_NONE;
1117 }
1118 
1119 static RISCVException write_medeleg(CPURISCVState *env, int csrno,
1120                                     target_ulong val)
1121 {
1122     env->medeleg = (env->medeleg & ~DELEGABLE_EXCPS) | (val & DELEGABLE_EXCPS);
1123     return RISCV_EXCP_NONE;
1124 }
1125 
1126 static RISCVException rmw_mideleg64(CPURISCVState *env, int csrno,
1127                                     uint64_t *ret_val,
1128                                     uint64_t new_val, uint64_t wr_mask)
1129 {
1130     uint64_t mask = wr_mask & delegable_ints;
1131 
1132     if (ret_val) {
1133         *ret_val = env->mideleg;
1134     }
1135 
1136     env->mideleg = (env->mideleg & ~mask) | (new_val & mask);
1137 
1138     if (riscv_has_ext(env, RVH)) {
1139         env->mideleg |= HS_MODE_INTERRUPTS;
1140     }
1141 
1142     return RISCV_EXCP_NONE;
1143 }
1144 
1145 static RISCVException rmw_mideleg(CPURISCVState *env, int csrno,
1146                                   target_ulong *ret_val,
1147                                   target_ulong new_val, target_ulong wr_mask)
1148 {
1149     uint64_t rval;
1150     RISCVException ret;
1151 
1152     ret = rmw_mideleg64(env, csrno, &rval, new_val, wr_mask);
1153     if (ret_val) {
1154         *ret_val = rval;
1155     }
1156 
1157     return ret;
1158 }
1159 
1160 static RISCVException rmw_midelegh(CPURISCVState *env, int csrno,
1161                                    target_ulong *ret_val,
1162                                    target_ulong new_val,
1163                                    target_ulong wr_mask)
1164 {
1165     uint64_t rval;
1166     RISCVException ret;
1167 
1168     ret = rmw_mideleg64(env, csrno, &rval,
1169         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1170     if (ret_val) {
1171         *ret_val = rval >> 32;
1172     }
1173 
1174     return ret;
1175 }
1176 
1177 static RISCVException rmw_mie64(CPURISCVState *env, int csrno,
1178                                 uint64_t *ret_val,
1179                                 uint64_t new_val, uint64_t wr_mask)
1180 {
1181     uint64_t mask = wr_mask & all_ints;
1182 
1183     if (ret_val) {
1184         *ret_val = env->mie;
1185     }
1186 
1187     env->mie = (env->mie & ~mask) | (new_val & mask);
1188 
1189     if (!riscv_has_ext(env, RVH)) {
1190         env->mie &= ~((uint64_t)MIP_SGEIP);
1191     }
1192 
1193     return RISCV_EXCP_NONE;
1194 }
1195 
1196 static RISCVException rmw_mie(CPURISCVState *env, int csrno,
1197                               target_ulong *ret_val,
1198                               target_ulong new_val, target_ulong wr_mask)
1199 {
1200     uint64_t rval;
1201     RISCVException ret;
1202 
1203     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask);
1204     if (ret_val) {
1205         *ret_val = rval;
1206     }
1207 
1208     return ret;
1209 }
1210 
1211 static RISCVException rmw_mieh(CPURISCVState *env, int csrno,
1212                                target_ulong *ret_val,
1213                                target_ulong new_val, target_ulong wr_mask)
1214 {
1215     uint64_t rval;
1216     RISCVException ret;
1217 
1218     ret = rmw_mie64(env, csrno, &rval,
1219         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1220     if (ret_val) {
1221         *ret_val = rval >> 32;
1222     }
1223 
1224     return ret;
1225 }
1226 
1227 static int read_mtopi(CPURISCVState *env, int csrno, target_ulong *val)
1228 {
1229     int irq;
1230     uint8_t iprio;
1231 
1232     irq = riscv_cpu_mirq_pending(env);
1233     if (irq <= 0 || irq > 63) {
1234         *val = 0;
1235     } else {
1236         iprio = env->miprio[irq];
1237         if (!iprio) {
1238             if (riscv_cpu_default_priority(irq) > IPRIO_DEFAULT_M) {
1239                 iprio = IPRIO_MMAXIPRIO;
1240             }
1241         }
1242         *val = (irq & TOPI_IID_MASK) << TOPI_IID_SHIFT;
1243         *val |= iprio;
1244     }
1245 
1246     return RISCV_EXCP_NONE;
1247 }
1248 
1249 static int aia_xlate_vs_csrno(CPURISCVState *env, int csrno)
1250 {
1251     if (!riscv_cpu_virt_enabled(env)) {
1252         return csrno;
1253     }
1254 
1255     switch (csrno) {
1256     case CSR_SISELECT:
1257         return CSR_VSISELECT;
1258     case CSR_SIREG:
1259         return CSR_VSIREG;
1260     case CSR_SSETEIPNUM:
1261         return CSR_VSSETEIPNUM;
1262     case CSR_SCLREIPNUM:
1263         return CSR_VSCLREIPNUM;
1264     case CSR_SSETEIENUM:
1265         return CSR_VSSETEIENUM;
1266     case CSR_SCLREIENUM:
1267         return CSR_VSCLREIENUM;
1268     case CSR_STOPEI:
1269         return CSR_VSTOPEI;
1270     default:
1271         return csrno;
1272     };
1273 }
1274 
1275 static int rmw_xiselect(CPURISCVState *env, int csrno, target_ulong *val,
1276                         target_ulong new_val, target_ulong wr_mask)
1277 {
1278     target_ulong *iselect;
1279 
1280     /* Translate CSR number for VS-mode */
1281     csrno = aia_xlate_vs_csrno(env, csrno);
1282 
1283     /* Find the iselect CSR based on CSR number */
1284     switch (csrno) {
1285     case CSR_MISELECT:
1286         iselect = &env->miselect;
1287         break;
1288     case CSR_SISELECT:
1289         iselect = &env->siselect;
1290         break;
1291     case CSR_VSISELECT:
1292         iselect = &env->vsiselect;
1293         break;
1294     default:
1295          return RISCV_EXCP_ILLEGAL_INST;
1296     };
1297 
1298     if (val) {
1299         *val = *iselect;
1300     }
1301 
1302     wr_mask &= ISELECT_MASK;
1303     if (wr_mask) {
1304         *iselect = (*iselect & ~wr_mask) | (new_val & wr_mask);
1305     }
1306 
1307     return RISCV_EXCP_NONE;
1308 }
1309 
1310 static int rmw_iprio(target_ulong xlen,
1311                      target_ulong iselect, uint8_t *iprio,
1312                      target_ulong *val, target_ulong new_val,
1313                      target_ulong wr_mask, int ext_irq_no)
1314 {
1315     int i, firq, nirqs;
1316     target_ulong old_val;
1317 
1318     if (iselect < ISELECT_IPRIO0 || ISELECT_IPRIO15 < iselect) {
1319         return -EINVAL;
1320     }
1321     if (xlen != 32 && iselect & 0x1) {
1322         return -EINVAL;
1323     }
1324 
1325     nirqs = 4 * (xlen / 32);
1326     firq = ((iselect - ISELECT_IPRIO0) / (xlen / 32)) * (nirqs);
1327 
1328     old_val = 0;
1329     for (i = 0; i < nirqs; i++) {
1330         old_val |= ((target_ulong)iprio[firq + i]) << (IPRIO_IRQ_BITS * i);
1331     }
1332 
1333     if (val) {
1334         *val = old_val;
1335     }
1336 
1337     if (wr_mask) {
1338         new_val = (old_val & ~wr_mask) | (new_val & wr_mask);
1339         for (i = 0; i < nirqs; i++) {
1340             /*
1341              * M-level and S-level external IRQ priority always read-only
1342              * zero. This means default priority order is always preferred
1343              * for M-level and S-level external IRQs.
1344              */
1345             if ((firq + i) == ext_irq_no) {
1346                 continue;
1347             }
1348             iprio[firq + i] = (new_val >> (IPRIO_IRQ_BITS * i)) & 0xff;
1349         }
1350     }
1351 
1352     return 0;
1353 }
1354 
1355 static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
1356                      target_ulong new_val, target_ulong wr_mask)
1357 {
1358     bool virt;
1359     uint8_t *iprio;
1360     int ret = -EINVAL;
1361     target_ulong priv, isel, vgein;
1362 
1363     /* Translate CSR number for VS-mode */
1364     csrno = aia_xlate_vs_csrno(env, csrno);
1365 
1366     /* Decode register details from CSR number */
1367     virt = false;
1368     switch (csrno) {
1369     case CSR_MIREG:
1370         iprio = env->miprio;
1371         isel = env->miselect;
1372         priv = PRV_M;
1373         break;
1374     case CSR_SIREG:
1375         iprio = env->siprio;
1376         isel = env->siselect;
1377         priv = PRV_S;
1378         break;
1379     case CSR_VSIREG:
1380         iprio = env->hviprio;
1381         isel = env->vsiselect;
1382         priv = PRV_S;
1383         virt = true;
1384         break;
1385     default:
1386          goto done;
1387     };
1388 
1389     /* Find the selected guest interrupt file */
1390     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
1391 
1392     if (ISELECT_IPRIO0 <= isel && isel <= ISELECT_IPRIO15) {
1393         /* Local interrupt priority registers not available for VS-mode */
1394         if (!virt) {
1395             ret = rmw_iprio(riscv_cpu_mxl_bits(env),
1396                             isel, iprio, val, new_val, wr_mask,
1397                             (priv == PRV_M) ? IRQ_M_EXT : IRQ_S_EXT);
1398         }
1399     } else if (ISELECT_IMSIC_FIRST <= isel && isel <= ISELECT_IMSIC_LAST) {
1400         /* IMSIC registers only available when machine implements it. */
1401         if (env->aia_ireg_rmw_fn[priv]) {
1402             /* Selected guest interrupt file should not be zero */
1403             if (virt && (!vgein || env->geilen < vgein)) {
1404                 goto done;
1405             }
1406             /* Call machine specific IMSIC register emulation */
1407             ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
1408                                     AIA_MAKE_IREG(isel, priv, virt, vgein,
1409                                                   riscv_cpu_mxl_bits(env)),
1410                                     val, new_val, wr_mask);
1411         }
1412     }
1413 
1414 done:
1415     if (ret) {
1416         return (riscv_cpu_virt_enabled(env) && virt) ?
1417                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
1418     }
1419     return RISCV_EXCP_NONE;
1420 }
1421 
1422 static int rmw_xsetclreinum(CPURISCVState *env, int csrno, target_ulong *val,
1423                             target_ulong new_val, target_ulong wr_mask)
1424 {
1425     int ret = -EINVAL;
1426     bool set, pend, virt;
1427     target_ulong priv, isel, vgein, xlen, nval, wmask;
1428 
1429     /* Translate CSR number for VS-mode */
1430     csrno = aia_xlate_vs_csrno(env, csrno);
1431 
1432     /* Decode register details from CSR number */
1433     virt = set = pend = false;
1434     switch (csrno) {
1435     case CSR_MSETEIPNUM:
1436         priv = PRV_M;
1437         set = true;
1438         pend = true;
1439         break;
1440     case CSR_MCLREIPNUM:
1441         priv = PRV_M;
1442         pend = true;
1443         break;
1444     case CSR_MSETEIENUM:
1445         priv = PRV_M;
1446         set = true;
1447         break;
1448     case CSR_MCLREIENUM:
1449         priv = PRV_M;
1450         break;
1451     case CSR_SSETEIPNUM:
1452         priv = PRV_S;
1453         set = true;
1454         pend = true;
1455         break;
1456     case CSR_SCLREIPNUM:
1457         priv = PRV_S;
1458         pend = true;
1459         break;
1460     case CSR_SSETEIENUM:
1461         priv = PRV_S;
1462         set = true;
1463         break;
1464     case CSR_SCLREIENUM:
1465         priv = PRV_S;
1466         break;
1467     case CSR_VSSETEIPNUM:
1468         priv = PRV_S;
1469         virt = true;
1470         set = true;
1471         pend = true;
1472         break;
1473     case CSR_VSCLREIPNUM:
1474         priv = PRV_S;
1475         virt = true;
1476         pend = true;
1477         break;
1478     case CSR_VSSETEIENUM:
1479         priv = PRV_S;
1480         virt = true;
1481         set = true;
1482         break;
1483     case CSR_VSCLREIENUM:
1484         priv = PRV_S;
1485         virt = true;
1486         break;
1487     default:
1488          goto done;
1489     };
1490 
1491     /* IMSIC CSRs only available when machine implements IMSIC. */
1492     if (!env->aia_ireg_rmw_fn[priv]) {
1493         goto done;
1494     }
1495 
1496     /* Find the selected guest interrupt file */
1497     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
1498 
1499     /* Selected guest interrupt file should be valid */
1500     if (virt && (!vgein || env->geilen < vgein)) {
1501         goto done;
1502     }
1503 
1504     /* Set/Clear CSRs always read zero */
1505     if (val) {
1506         *val = 0;
1507     }
1508 
1509     if (wr_mask) {
1510         /* Get interrupt number */
1511         new_val &= wr_mask;
1512 
1513         /* Find target interrupt pending/enable register */
1514         xlen = riscv_cpu_mxl_bits(env);
1515         isel = (new_val / xlen);
1516         isel *= (xlen / IMSIC_EIPx_BITS);
1517         isel += (pend) ? ISELECT_IMSIC_EIP0 : ISELECT_IMSIC_EIE0;
1518 
1519         /* Find the interrupt bit to be set/clear */
1520         wmask = ((target_ulong)1) << (new_val % xlen);
1521         nval = (set) ? wmask : 0;
1522 
1523         /* Call machine specific IMSIC register emulation */
1524         ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
1525                                          AIA_MAKE_IREG(isel, priv, virt,
1526                                                        vgein, xlen),
1527                                          NULL, nval, wmask);
1528     } else {
1529         ret = 0;
1530     }
1531 
1532 done:
1533     if (ret) {
1534         return (riscv_cpu_virt_enabled(env) && virt) ?
1535                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
1536     }
1537     return RISCV_EXCP_NONE;
1538 }
1539 
1540 static int rmw_xtopei(CPURISCVState *env, int csrno, target_ulong *val,
1541                       target_ulong new_val, target_ulong wr_mask)
1542 {
1543     bool virt;
1544     int ret = -EINVAL;
1545     target_ulong priv, vgein;
1546 
1547     /* Translate CSR number for VS-mode */
1548     csrno = aia_xlate_vs_csrno(env, csrno);
1549 
1550     /* Decode register details from CSR number */
1551     virt = false;
1552     switch (csrno) {
1553     case CSR_MTOPEI:
1554         priv = PRV_M;
1555         break;
1556     case CSR_STOPEI:
1557         priv = PRV_S;
1558         break;
1559     case CSR_VSTOPEI:
1560         priv = PRV_S;
1561         virt = true;
1562         break;
1563     default:
1564         goto done;
1565     };
1566 
1567     /* IMSIC CSRs only available when machine implements IMSIC. */
1568     if (!env->aia_ireg_rmw_fn[priv]) {
1569         goto done;
1570     }
1571 
1572     /* Find the selected guest interrupt file */
1573     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
1574 
1575     /* Selected guest interrupt file should be valid */
1576     if (virt && (!vgein || env->geilen < vgein)) {
1577         goto done;
1578     }
1579 
1580     /* Call machine specific IMSIC register emulation for TOPEI */
1581     ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
1582                     AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, priv, virt, vgein,
1583                                   riscv_cpu_mxl_bits(env)),
1584                     val, new_val, wr_mask);
1585 
1586 done:
1587     if (ret) {
1588         return (riscv_cpu_virt_enabled(env) && virt) ?
1589                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
1590     }
1591     return RISCV_EXCP_NONE;
1592 }
1593 
1594 static RISCVException read_mtvec(CPURISCVState *env, int csrno,
1595                                  target_ulong *val)
1596 {
1597     *val = env->mtvec;
1598     return RISCV_EXCP_NONE;
1599 }
1600 
1601 static RISCVException write_mtvec(CPURISCVState *env, int csrno,
1602                                   target_ulong val)
1603 {
1604     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
1605     if ((val & 3) < 2) {
1606         env->mtvec = val;
1607     } else {
1608         qemu_log_mask(LOG_UNIMP, "CSR_MTVEC: reserved mode not supported\n");
1609     }
1610     return RISCV_EXCP_NONE;
1611 }
1612 
1613 static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
1614                                          target_ulong *val)
1615 {
1616     if (env->priv_ver < PRIV_VERSION_1_11_0) {
1617         return RISCV_EXCP_ILLEGAL_INST;
1618     }
1619 
1620     *val = env->mcountinhibit;
1621     return RISCV_EXCP_NONE;
1622 }
1623 
1624 static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
1625                                           target_ulong val)
1626 {
1627     int cidx;
1628     PMUCTRState *counter;
1629 
1630     if (env->priv_ver < PRIV_VERSION_1_11_0) {
1631         return RISCV_EXCP_ILLEGAL_INST;
1632     }
1633 
1634     env->mcountinhibit = val;
1635 
1636     /* Check if any other counter is also monitoring cycles/instructions */
1637     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
1638         if (!get_field(env->mcountinhibit, BIT(cidx))) {
1639             counter = &env->pmu_ctrs[cidx];
1640             counter->started = true;
1641         }
1642     }
1643 
1644     return RISCV_EXCP_NONE;
1645 }
1646 
1647 static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
1648                                       target_ulong *val)
1649 {
1650     *val = env->mcounteren;
1651     return RISCV_EXCP_NONE;
1652 }
1653 
1654 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
1655                                        target_ulong val)
1656 {
1657     env->mcounteren = val;
1658     return RISCV_EXCP_NONE;
1659 }
1660 
1661 /* Machine Trap Handling */
1662 static RISCVException read_mscratch_i128(CPURISCVState *env, int csrno,
1663                                          Int128 *val)
1664 {
1665     *val = int128_make128(env->mscratch, env->mscratchh);
1666     return RISCV_EXCP_NONE;
1667 }
1668 
1669 static RISCVException write_mscratch_i128(CPURISCVState *env, int csrno,
1670                                           Int128 val)
1671 {
1672     env->mscratch = int128_getlo(val);
1673     env->mscratchh = int128_gethi(val);
1674     return RISCV_EXCP_NONE;
1675 }
1676 
1677 static RISCVException read_mscratch(CPURISCVState *env, int csrno,
1678                                     target_ulong *val)
1679 {
1680     *val = env->mscratch;
1681     return RISCV_EXCP_NONE;
1682 }
1683 
1684 static RISCVException write_mscratch(CPURISCVState *env, int csrno,
1685                                      target_ulong val)
1686 {
1687     env->mscratch = val;
1688     return RISCV_EXCP_NONE;
1689 }
1690 
1691 static RISCVException read_mepc(CPURISCVState *env, int csrno,
1692                                      target_ulong *val)
1693 {
1694     *val = env->mepc;
1695     return RISCV_EXCP_NONE;
1696 }
1697 
1698 static RISCVException write_mepc(CPURISCVState *env, int csrno,
1699                                      target_ulong val)
1700 {
1701     env->mepc = val;
1702     return RISCV_EXCP_NONE;
1703 }
1704 
1705 static RISCVException read_mcause(CPURISCVState *env, int csrno,
1706                                      target_ulong *val)
1707 {
1708     *val = env->mcause;
1709     return RISCV_EXCP_NONE;
1710 }
1711 
1712 static RISCVException write_mcause(CPURISCVState *env, int csrno,
1713                                      target_ulong val)
1714 {
1715     env->mcause = val;
1716     return RISCV_EXCP_NONE;
1717 }
1718 
1719 static RISCVException read_mtval(CPURISCVState *env, int csrno,
1720                                  target_ulong *val)
1721 {
1722     *val = env->mtval;
1723     return RISCV_EXCP_NONE;
1724 }
1725 
1726 static RISCVException write_mtval(CPURISCVState *env, int csrno,
1727                                   target_ulong val)
1728 {
1729     env->mtval = val;
1730     return RISCV_EXCP_NONE;
1731 }
1732 
1733 /* Execution environment configuration setup */
1734 static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
1735                                  target_ulong *val)
1736 {
1737     *val = env->menvcfg;
1738     return RISCV_EXCP_NONE;
1739 }
1740 
1741 static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
1742                                   target_ulong val)
1743 {
1744     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE | MENVCFG_CBZE;
1745 
1746     if (riscv_cpu_mxl(env) == MXL_RV64) {
1747         mask |= MENVCFG_PBMTE | MENVCFG_STCE;
1748     }
1749     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
1750 
1751     return RISCV_EXCP_NONE;
1752 }
1753 
1754 static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
1755                                  target_ulong *val)
1756 {
1757     *val = env->menvcfg >> 32;
1758     return RISCV_EXCP_NONE;
1759 }
1760 
1761 static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
1762                                   target_ulong val)
1763 {
1764     uint64_t mask = MENVCFG_PBMTE | MENVCFG_STCE;
1765     uint64_t valh = (uint64_t)val << 32;
1766 
1767     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
1768 
1769     return RISCV_EXCP_NONE;
1770 }
1771 
1772 static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
1773                                  target_ulong *val)
1774 {
1775     *val = env->senvcfg;
1776     return RISCV_EXCP_NONE;
1777 }
1778 
1779 static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
1780                                   target_ulong val)
1781 {
1782     uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
1783 
1784     env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
1785 
1786     return RISCV_EXCP_NONE;
1787 }
1788 
1789 static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
1790                                  target_ulong *val)
1791 {
1792     *val = env->henvcfg;
1793     return RISCV_EXCP_NONE;
1794 }
1795 
1796 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
1797                                   target_ulong val)
1798 {
1799     uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
1800 
1801     if (riscv_cpu_mxl(env) == MXL_RV64) {
1802         mask |= HENVCFG_PBMTE | HENVCFG_STCE;
1803     }
1804 
1805     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
1806 
1807     return RISCV_EXCP_NONE;
1808 }
1809 
1810 static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
1811                                  target_ulong *val)
1812 {
1813     *val = env->henvcfg >> 32;
1814     return RISCV_EXCP_NONE;
1815 }
1816 
1817 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
1818                                   target_ulong val)
1819 {
1820     uint64_t mask = HENVCFG_PBMTE | HENVCFG_STCE;
1821     uint64_t valh = (uint64_t)val << 32;
1822 
1823     env->henvcfg = (env->henvcfg & ~mask) | (valh & mask);
1824 
1825     return RISCV_EXCP_NONE;
1826 }
1827 
1828 static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
1829                                 uint64_t *ret_val,
1830                                 uint64_t new_val, uint64_t wr_mask)
1831 {
1832     RISCVCPU *cpu = env_archcpu(env);
1833     uint64_t old_mip, mask = wr_mask & delegable_ints;
1834     uint32_t gin;
1835 
1836     if (mask & MIP_SEIP) {
1837         env->software_seip = new_val & MIP_SEIP;
1838         new_val |= env->external_seip * MIP_SEIP;
1839     }
1840 
1841     if (mask) {
1842         old_mip = riscv_cpu_update_mip(cpu, mask, (new_val & mask));
1843     } else {
1844         old_mip = env->mip;
1845     }
1846 
1847     if (csrno != CSR_HVIP) {
1848         gin = get_field(env->hstatus, HSTATUS_VGEIN);
1849         old_mip |= (env->hgeip & ((target_ulong)1 << gin)) ? MIP_VSEIP : 0;
1850     }
1851 
1852     if (ret_val) {
1853         *ret_val = old_mip;
1854     }
1855 
1856     return RISCV_EXCP_NONE;
1857 }
1858 
1859 static RISCVException rmw_mip(CPURISCVState *env, int csrno,
1860                               target_ulong *ret_val,
1861                               target_ulong new_val, target_ulong wr_mask)
1862 {
1863     uint64_t rval;
1864     RISCVException ret;
1865 
1866     ret = rmw_mip64(env, csrno, &rval, new_val, wr_mask);
1867     if (ret_val) {
1868         *ret_val = rval;
1869     }
1870 
1871     return ret;
1872 }
1873 
1874 static RISCVException rmw_miph(CPURISCVState *env, int csrno,
1875                                target_ulong *ret_val,
1876                                target_ulong new_val, target_ulong wr_mask)
1877 {
1878     uint64_t rval;
1879     RISCVException ret;
1880 
1881     ret = rmw_mip64(env, csrno, &rval,
1882         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1883     if (ret_val) {
1884         *ret_val = rval >> 32;
1885     }
1886 
1887     return ret;
1888 }
1889 
1890 /* Supervisor Trap Setup */
1891 static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
1892                                         Int128 *val)
1893 {
1894     uint64_t mask = sstatus_v1_10_mask;
1895     uint64_t sstatus = env->mstatus & mask;
1896     if (env->xl != MXL_RV32 || env->debugger) {
1897         mask |= SSTATUS64_UXL;
1898     }
1899 
1900     *val = int128_make128(sstatus, add_status_sd(MXL_RV128, sstatus));
1901     return RISCV_EXCP_NONE;
1902 }
1903 
1904 static RISCVException read_sstatus(CPURISCVState *env, int csrno,
1905                                    target_ulong *val)
1906 {
1907     target_ulong mask = (sstatus_v1_10_mask);
1908     if (env->xl != MXL_RV32 || env->debugger) {
1909         mask |= SSTATUS64_UXL;
1910     }
1911     /* TODO: Use SXL not MXL. */
1912     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus & mask);
1913     return RISCV_EXCP_NONE;
1914 }
1915 
1916 static RISCVException write_sstatus(CPURISCVState *env, int csrno,
1917                                     target_ulong val)
1918 {
1919     target_ulong mask = (sstatus_v1_10_mask);
1920 
1921     if (env->xl != MXL_RV32 || env->debugger) {
1922         if ((val & SSTATUS64_UXL) != 0) {
1923             mask |= SSTATUS64_UXL;
1924         }
1925     }
1926     target_ulong newval = (env->mstatus & ~mask) | (val & mask);
1927     return write_mstatus(env, CSR_MSTATUS, newval);
1928 }
1929 
1930 static RISCVException rmw_vsie64(CPURISCVState *env, int csrno,
1931                                  uint64_t *ret_val,
1932                                  uint64_t new_val, uint64_t wr_mask)
1933 {
1934     RISCVException ret;
1935     uint64_t rval, vsbits, mask = env->hideleg & VS_MODE_INTERRUPTS;
1936 
1937     /* Bring VS-level bits to correct position */
1938     vsbits = new_val & (VS_MODE_INTERRUPTS >> 1);
1939     new_val &= ~(VS_MODE_INTERRUPTS >> 1);
1940     new_val |= vsbits << 1;
1941     vsbits = wr_mask & (VS_MODE_INTERRUPTS >> 1);
1942     wr_mask &= ~(VS_MODE_INTERRUPTS >> 1);
1943     wr_mask |= vsbits << 1;
1944 
1945     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask & mask);
1946     if (ret_val) {
1947         rval &= mask;
1948         vsbits = rval & VS_MODE_INTERRUPTS;
1949         rval &= ~VS_MODE_INTERRUPTS;
1950         *ret_val = rval | (vsbits >> 1);
1951     }
1952 
1953     return ret;
1954 }
1955 
1956 static RISCVException rmw_vsie(CPURISCVState *env, int csrno,
1957                                target_ulong *ret_val,
1958                                target_ulong new_val, target_ulong wr_mask)
1959 {
1960     uint64_t rval;
1961     RISCVException ret;
1962 
1963     ret = rmw_vsie64(env, csrno, &rval, new_val, wr_mask);
1964     if (ret_val) {
1965         *ret_val = rval;
1966     }
1967 
1968     return ret;
1969 }
1970 
1971 static RISCVException rmw_vsieh(CPURISCVState *env, int csrno,
1972                                 target_ulong *ret_val,
1973                                 target_ulong new_val, target_ulong wr_mask)
1974 {
1975     uint64_t rval;
1976     RISCVException ret;
1977 
1978     ret = rmw_vsie64(env, csrno, &rval,
1979         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1980     if (ret_val) {
1981         *ret_val = rval >> 32;
1982     }
1983 
1984     return ret;
1985 }
1986 
1987 static RISCVException rmw_sie64(CPURISCVState *env, int csrno,
1988                                 uint64_t *ret_val,
1989                                 uint64_t new_val, uint64_t wr_mask)
1990 {
1991     RISCVException ret;
1992     uint64_t mask = env->mideleg & S_MODE_INTERRUPTS;
1993 
1994     if (riscv_cpu_virt_enabled(env)) {
1995         if (env->hvictl & HVICTL_VTI) {
1996             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
1997         }
1998         ret = rmw_vsie64(env, CSR_VSIE, ret_val, new_val, wr_mask);
1999     } else {
2000         ret = rmw_mie64(env, csrno, ret_val, new_val, wr_mask & mask);
2001     }
2002 
2003     if (ret_val) {
2004         *ret_val &= mask;
2005     }
2006 
2007     return ret;
2008 }
2009 
2010 static RISCVException rmw_sie(CPURISCVState *env, int csrno,
2011                               target_ulong *ret_val,
2012                               target_ulong new_val, target_ulong wr_mask)
2013 {
2014     uint64_t rval;
2015     RISCVException ret;
2016 
2017     ret = rmw_sie64(env, csrno, &rval, new_val, wr_mask);
2018     if (ret == RISCV_EXCP_NONE && ret_val) {
2019         *ret_val = rval;
2020     }
2021 
2022     return ret;
2023 }
2024 
2025 static RISCVException rmw_sieh(CPURISCVState *env, int csrno,
2026                                target_ulong *ret_val,
2027                                target_ulong new_val, target_ulong wr_mask)
2028 {
2029     uint64_t rval;
2030     RISCVException ret;
2031 
2032     ret = rmw_sie64(env, csrno, &rval,
2033         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2034     if (ret_val) {
2035         *ret_val = rval >> 32;
2036     }
2037 
2038     return ret;
2039 }
2040 
2041 static RISCVException read_stvec(CPURISCVState *env, int csrno,
2042                                  target_ulong *val)
2043 {
2044     *val = env->stvec;
2045     return RISCV_EXCP_NONE;
2046 }
2047 
2048 static RISCVException write_stvec(CPURISCVState *env, int csrno,
2049                                   target_ulong val)
2050 {
2051     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
2052     if ((val & 3) < 2) {
2053         env->stvec = val;
2054     } else {
2055         qemu_log_mask(LOG_UNIMP, "CSR_STVEC: reserved mode not supported\n");
2056     }
2057     return RISCV_EXCP_NONE;
2058 }
2059 
2060 static RISCVException read_scounteren(CPURISCVState *env, int csrno,
2061                                       target_ulong *val)
2062 {
2063     *val = env->scounteren;
2064     return RISCV_EXCP_NONE;
2065 }
2066 
2067 static RISCVException write_scounteren(CPURISCVState *env, int csrno,
2068                                        target_ulong val)
2069 {
2070     env->scounteren = val;
2071     return RISCV_EXCP_NONE;
2072 }
2073 
2074 /* Supervisor Trap Handling */
2075 static RISCVException read_sscratch_i128(CPURISCVState *env, int csrno,
2076                                          Int128 *val)
2077 {
2078     *val = int128_make128(env->sscratch, env->sscratchh);
2079     return RISCV_EXCP_NONE;
2080 }
2081 
2082 static RISCVException write_sscratch_i128(CPURISCVState *env, int csrno,
2083                                           Int128 val)
2084 {
2085     env->sscratch = int128_getlo(val);
2086     env->sscratchh = int128_gethi(val);
2087     return RISCV_EXCP_NONE;
2088 }
2089 
2090 static RISCVException read_sscratch(CPURISCVState *env, int csrno,
2091                                     target_ulong *val)
2092 {
2093     *val = env->sscratch;
2094     return RISCV_EXCP_NONE;
2095 }
2096 
2097 static RISCVException write_sscratch(CPURISCVState *env, int csrno,
2098                                      target_ulong val)
2099 {
2100     env->sscratch = val;
2101     return RISCV_EXCP_NONE;
2102 }
2103 
2104 static RISCVException read_sepc(CPURISCVState *env, int csrno,
2105                                 target_ulong *val)
2106 {
2107     *val = env->sepc;
2108     return RISCV_EXCP_NONE;
2109 }
2110 
2111 static RISCVException write_sepc(CPURISCVState *env, int csrno,
2112                                  target_ulong val)
2113 {
2114     env->sepc = val;
2115     return RISCV_EXCP_NONE;
2116 }
2117 
2118 static RISCVException read_scause(CPURISCVState *env, int csrno,
2119                                   target_ulong *val)
2120 {
2121     *val = env->scause;
2122     return RISCV_EXCP_NONE;
2123 }
2124 
2125 static RISCVException write_scause(CPURISCVState *env, int csrno,
2126                                    target_ulong val)
2127 {
2128     env->scause = val;
2129     return RISCV_EXCP_NONE;
2130 }
2131 
2132 static RISCVException read_stval(CPURISCVState *env, int csrno,
2133                                  target_ulong *val)
2134 {
2135     *val = env->stval;
2136     return RISCV_EXCP_NONE;
2137 }
2138 
2139 static RISCVException write_stval(CPURISCVState *env, int csrno,
2140                                   target_ulong val)
2141 {
2142     env->stval = val;
2143     return RISCV_EXCP_NONE;
2144 }
2145 
2146 static RISCVException rmw_vsip64(CPURISCVState *env, int csrno,
2147                                  uint64_t *ret_val,
2148                                  uint64_t new_val, uint64_t wr_mask)
2149 {
2150     RISCVException ret;
2151     uint64_t rval, vsbits, mask = env->hideleg & vsip_writable_mask;
2152 
2153     /* Bring VS-level bits to correct position */
2154     vsbits = new_val & (VS_MODE_INTERRUPTS >> 1);
2155     new_val &= ~(VS_MODE_INTERRUPTS >> 1);
2156     new_val |= vsbits << 1;
2157     vsbits = wr_mask & (VS_MODE_INTERRUPTS >> 1);
2158     wr_mask &= ~(VS_MODE_INTERRUPTS >> 1);
2159     wr_mask |= vsbits << 1;
2160 
2161     ret = rmw_mip64(env, csrno, &rval, new_val, wr_mask & mask);
2162     if (ret_val) {
2163         rval &= mask;
2164         vsbits = rval & VS_MODE_INTERRUPTS;
2165         rval &= ~VS_MODE_INTERRUPTS;
2166         *ret_val = rval | (vsbits >> 1);
2167     }
2168 
2169     return ret;
2170 }
2171 
2172 static RISCVException rmw_vsip(CPURISCVState *env, int csrno,
2173                                target_ulong *ret_val,
2174                                target_ulong new_val, target_ulong wr_mask)
2175 {
2176     uint64_t rval;
2177     RISCVException ret;
2178 
2179     ret = rmw_vsip64(env, csrno, &rval, new_val, wr_mask);
2180     if (ret_val) {
2181         *ret_val = rval;
2182     }
2183 
2184     return ret;
2185 }
2186 
2187 static RISCVException rmw_vsiph(CPURISCVState *env, int csrno,
2188                                 target_ulong *ret_val,
2189                                 target_ulong new_val, target_ulong wr_mask)
2190 {
2191     uint64_t rval;
2192     RISCVException ret;
2193 
2194     ret = rmw_vsip64(env, csrno, &rval,
2195         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2196     if (ret_val) {
2197         *ret_val = rval >> 32;
2198     }
2199 
2200     return ret;
2201 }
2202 
2203 static RISCVException rmw_sip64(CPURISCVState *env, int csrno,
2204                                 uint64_t *ret_val,
2205                                 uint64_t new_val, uint64_t wr_mask)
2206 {
2207     RISCVException ret;
2208     uint64_t mask = env->mideleg & sip_writable_mask;
2209 
2210     if (riscv_cpu_virt_enabled(env)) {
2211         if (env->hvictl & HVICTL_VTI) {
2212             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
2213         }
2214         ret = rmw_vsip64(env, CSR_VSIP, ret_val, new_val, wr_mask);
2215     } else {
2216         ret = rmw_mip64(env, csrno, ret_val, new_val, wr_mask & mask);
2217     }
2218 
2219     if (ret_val) {
2220         *ret_val &= env->mideleg & S_MODE_INTERRUPTS;
2221     }
2222 
2223     return ret;
2224 }
2225 
2226 static RISCVException rmw_sip(CPURISCVState *env, int csrno,
2227                               target_ulong *ret_val,
2228                               target_ulong new_val, target_ulong wr_mask)
2229 {
2230     uint64_t rval;
2231     RISCVException ret;
2232 
2233     ret = rmw_sip64(env, csrno, &rval, new_val, wr_mask);
2234     if (ret_val) {
2235         *ret_val = rval;
2236     }
2237 
2238     return ret;
2239 }
2240 
2241 static RISCVException rmw_siph(CPURISCVState *env, int csrno,
2242                                target_ulong *ret_val,
2243                                target_ulong new_val, target_ulong wr_mask)
2244 {
2245     uint64_t rval;
2246     RISCVException ret;
2247 
2248     ret = rmw_sip64(env, csrno, &rval,
2249         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2250     if (ret_val) {
2251         *ret_val = rval >> 32;
2252     }
2253 
2254     return ret;
2255 }
2256 
2257 /* Supervisor Protection and Translation */
2258 static RISCVException read_satp(CPURISCVState *env, int csrno,
2259                                 target_ulong *val)
2260 {
2261     if (!riscv_feature(env, RISCV_FEATURE_MMU)) {
2262         *val = 0;
2263         return RISCV_EXCP_NONE;
2264     }
2265 
2266     if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
2267         return RISCV_EXCP_ILLEGAL_INST;
2268     } else {
2269         *val = env->satp;
2270     }
2271 
2272     return RISCV_EXCP_NONE;
2273 }
2274 
2275 static RISCVException write_satp(CPURISCVState *env, int csrno,
2276                                  target_ulong val)
2277 {
2278     target_ulong vm, mask;
2279 
2280     if (!riscv_feature(env, RISCV_FEATURE_MMU)) {
2281         return RISCV_EXCP_NONE;
2282     }
2283 
2284     if (riscv_cpu_mxl(env) == MXL_RV32) {
2285         vm = validate_vm(env, get_field(val, SATP32_MODE));
2286         mask = (val ^ env->satp) & (SATP32_MODE | SATP32_ASID | SATP32_PPN);
2287     } else {
2288         vm = validate_vm(env, get_field(val, SATP64_MODE));
2289         mask = (val ^ env->satp) & (SATP64_MODE | SATP64_ASID | SATP64_PPN);
2290     }
2291 
2292     if (vm && mask) {
2293         if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
2294             return RISCV_EXCP_ILLEGAL_INST;
2295         } else {
2296             /*
2297              * The ISA defines SATP.MODE=Bare as "no translation", but we still
2298              * pass these through QEMU's TLB emulation as it improves
2299              * performance.  Flushing the TLB on SATP writes with paging
2300              * enabled avoids leaking those invalid cached mappings.
2301              */
2302             tlb_flush(env_cpu(env));
2303             env->satp = val;
2304         }
2305     }
2306     return RISCV_EXCP_NONE;
2307 }
2308 
2309 static int read_vstopi(CPURISCVState *env, int csrno, target_ulong *val)
2310 {
2311     int irq, ret;
2312     target_ulong topei;
2313     uint64_t vseip, vsgein;
2314     uint32_t iid, iprio, hviid, hviprio, gein;
2315     uint32_t s, scount = 0, siid[VSTOPI_NUM_SRCS], siprio[VSTOPI_NUM_SRCS];
2316 
2317     gein = get_field(env->hstatus, HSTATUS_VGEIN);
2318     hviid = get_field(env->hvictl, HVICTL_IID);
2319     hviprio = get_field(env->hvictl, HVICTL_IPRIO);
2320 
2321     if (gein) {
2322         vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
2323         vseip = env->mie & (env->mip | vsgein) & MIP_VSEIP;
2324         if (gein <= env->geilen && vseip) {
2325             siid[scount] = IRQ_S_EXT;
2326             siprio[scount] = IPRIO_MMAXIPRIO + 1;
2327             if (env->aia_ireg_rmw_fn[PRV_S]) {
2328                 /*
2329                  * Call machine specific IMSIC register emulation for
2330                  * reading TOPEI.
2331                  */
2332                 ret = env->aia_ireg_rmw_fn[PRV_S](
2333                         env->aia_ireg_rmw_fn_arg[PRV_S],
2334                         AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, PRV_S, true, gein,
2335                                       riscv_cpu_mxl_bits(env)),
2336                         &topei, 0, 0);
2337                 if (!ret && topei) {
2338                     siprio[scount] = topei & IMSIC_TOPEI_IPRIO_MASK;
2339                 }
2340             }
2341             scount++;
2342         }
2343     } else {
2344         if (hviid == IRQ_S_EXT && hviprio) {
2345             siid[scount] = IRQ_S_EXT;
2346             siprio[scount] = hviprio;
2347             scount++;
2348         }
2349     }
2350 
2351     if (env->hvictl & HVICTL_VTI) {
2352         if (hviid != IRQ_S_EXT) {
2353             siid[scount] = hviid;
2354             siprio[scount] = hviprio;
2355             scount++;
2356         }
2357     } else {
2358         irq = riscv_cpu_vsirq_pending(env);
2359         if (irq != IRQ_S_EXT && 0 < irq && irq <= 63) {
2360             siid[scount] = irq;
2361             siprio[scount] = env->hviprio[irq];
2362             scount++;
2363         }
2364     }
2365 
2366     iid = 0;
2367     iprio = UINT_MAX;
2368     for (s = 0; s < scount; s++) {
2369         if (siprio[s] < iprio) {
2370             iid = siid[s];
2371             iprio = siprio[s];
2372         }
2373     }
2374 
2375     if (iid) {
2376         if (env->hvictl & HVICTL_IPRIOM) {
2377             if (iprio > IPRIO_MMAXIPRIO) {
2378                 iprio = IPRIO_MMAXIPRIO;
2379             }
2380             if (!iprio) {
2381                 if (riscv_cpu_default_priority(iid) > IPRIO_DEFAULT_S) {
2382                     iprio = IPRIO_MMAXIPRIO;
2383                 }
2384             }
2385         } else {
2386             iprio = 1;
2387         }
2388     } else {
2389         iprio = 0;
2390     }
2391 
2392     *val = (iid & TOPI_IID_MASK) << TOPI_IID_SHIFT;
2393     *val |= iprio;
2394     return RISCV_EXCP_NONE;
2395 }
2396 
2397 static int read_stopi(CPURISCVState *env, int csrno, target_ulong *val)
2398 {
2399     int irq;
2400     uint8_t iprio;
2401 
2402     if (riscv_cpu_virt_enabled(env)) {
2403         return read_vstopi(env, CSR_VSTOPI, val);
2404     }
2405 
2406     irq = riscv_cpu_sirq_pending(env);
2407     if (irq <= 0 || irq > 63) {
2408         *val = 0;
2409     } else {
2410         iprio = env->siprio[irq];
2411         if (!iprio) {
2412             if (riscv_cpu_default_priority(irq) > IPRIO_DEFAULT_S) {
2413                 iprio = IPRIO_MMAXIPRIO;
2414            }
2415         }
2416         *val = (irq & TOPI_IID_MASK) << TOPI_IID_SHIFT;
2417         *val |= iprio;
2418     }
2419 
2420     return RISCV_EXCP_NONE;
2421 }
2422 
2423 /* Hypervisor Extensions */
2424 static RISCVException read_hstatus(CPURISCVState *env, int csrno,
2425                                    target_ulong *val)
2426 {
2427     *val = env->hstatus;
2428     if (riscv_cpu_mxl(env) != MXL_RV32) {
2429         /* We only support 64-bit VSXL */
2430         *val = set_field(*val, HSTATUS_VSXL, 2);
2431     }
2432     /* We only support little endian */
2433     *val = set_field(*val, HSTATUS_VSBE, 0);
2434     return RISCV_EXCP_NONE;
2435 }
2436 
2437 static RISCVException write_hstatus(CPURISCVState *env, int csrno,
2438                                     target_ulong val)
2439 {
2440     env->hstatus = val;
2441     if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
2442         qemu_log_mask(LOG_UNIMP, "QEMU does not support mixed HSXLEN options.");
2443     }
2444     if (get_field(val, HSTATUS_VSBE) != 0) {
2445         qemu_log_mask(LOG_UNIMP, "QEMU does not support big endian guests.");
2446     }
2447     return RISCV_EXCP_NONE;
2448 }
2449 
2450 static RISCVException read_hedeleg(CPURISCVState *env, int csrno,
2451                                    target_ulong *val)
2452 {
2453     *val = env->hedeleg;
2454     return RISCV_EXCP_NONE;
2455 }
2456 
2457 static RISCVException write_hedeleg(CPURISCVState *env, int csrno,
2458                                     target_ulong val)
2459 {
2460     env->hedeleg = val & vs_delegable_excps;
2461     return RISCV_EXCP_NONE;
2462 }
2463 
2464 static RISCVException rmw_hideleg64(CPURISCVState *env, int csrno,
2465                                     uint64_t *ret_val,
2466                                     uint64_t new_val, uint64_t wr_mask)
2467 {
2468     uint64_t mask = wr_mask & vs_delegable_ints;
2469 
2470     if (ret_val) {
2471         *ret_val = env->hideleg & vs_delegable_ints;
2472     }
2473 
2474     env->hideleg = (env->hideleg & ~mask) | (new_val & mask);
2475     return RISCV_EXCP_NONE;
2476 }
2477 
2478 static RISCVException rmw_hideleg(CPURISCVState *env, int csrno,
2479                                   target_ulong *ret_val,
2480                                   target_ulong new_val, target_ulong wr_mask)
2481 {
2482     uint64_t rval;
2483     RISCVException ret;
2484 
2485     ret = rmw_hideleg64(env, csrno, &rval, new_val, wr_mask);
2486     if (ret_val) {
2487         *ret_val = rval;
2488     }
2489 
2490     return ret;
2491 }
2492 
2493 static RISCVException rmw_hidelegh(CPURISCVState *env, int csrno,
2494                                    target_ulong *ret_val,
2495                                    target_ulong new_val, target_ulong wr_mask)
2496 {
2497     uint64_t rval;
2498     RISCVException ret;
2499 
2500     ret = rmw_hideleg64(env, csrno, &rval,
2501         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2502     if (ret_val) {
2503         *ret_val = rval >> 32;
2504     }
2505 
2506     return ret;
2507 }
2508 
2509 static RISCVException rmw_hvip64(CPURISCVState *env, int csrno,
2510                                  uint64_t *ret_val,
2511                                  uint64_t new_val, uint64_t wr_mask)
2512 {
2513     RISCVException ret;
2514 
2515     ret = rmw_mip64(env, csrno, ret_val, new_val,
2516                     wr_mask & hvip_writable_mask);
2517     if (ret_val) {
2518         *ret_val &= VS_MODE_INTERRUPTS;
2519     }
2520 
2521     return ret;
2522 }
2523 
2524 static RISCVException rmw_hvip(CPURISCVState *env, int csrno,
2525                                target_ulong *ret_val,
2526                                target_ulong new_val, target_ulong wr_mask)
2527 {
2528     uint64_t rval;
2529     RISCVException ret;
2530 
2531     ret = rmw_hvip64(env, csrno, &rval, new_val, wr_mask);
2532     if (ret_val) {
2533         *ret_val = rval;
2534     }
2535 
2536     return ret;
2537 }
2538 
2539 static RISCVException rmw_hviph(CPURISCVState *env, int csrno,
2540                                 target_ulong *ret_val,
2541                                 target_ulong new_val, target_ulong wr_mask)
2542 {
2543     uint64_t rval;
2544     RISCVException ret;
2545 
2546     ret = rmw_hvip64(env, csrno, &rval,
2547         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2548     if (ret_val) {
2549         *ret_val = rval >> 32;
2550     }
2551 
2552     return ret;
2553 }
2554 
2555 static RISCVException rmw_hip(CPURISCVState *env, int csrno,
2556                               target_ulong *ret_value,
2557                               target_ulong new_value, target_ulong write_mask)
2558 {
2559     int ret = rmw_mip(env, csrno, ret_value, new_value,
2560                       write_mask & hip_writable_mask);
2561 
2562     if (ret_value) {
2563         *ret_value &= HS_MODE_INTERRUPTS;
2564     }
2565     return ret;
2566 }
2567 
2568 static RISCVException rmw_hie(CPURISCVState *env, int csrno,
2569                               target_ulong *ret_val,
2570                               target_ulong new_val, target_ulong wr_mask)
2571 {
2572     uint64_t rval;
2573     RISCVException ret;
2574 
2575     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask & HS_MODE_INTERRUPTS);
2576     if (ret_val) {
2577         *ret_val = rval & HS_MODE_INTERRUPTS;
2578     }
2579 
2580     return ret;
2581 }
2582 
2583 static RISCVException read_hcounteren(CPURISCVState *env, int csrno,
2584                                       target_ulong *val)
2585 {
2586     *val = env->hcounteren;
2587     return RISCV_EXCP_NONE;
2588 }
2589 
2590 static RISCVException write_hcounteren(CPURISCVState *env, int csrno,
2591                                        target_ulong val)
2592 {
2593     env->hcounteren = val;
2594     return RISCV_EXCP_NONE;
2595 }
2596 
2597 static RISCVException read_hgeie(CPURISCVState *env, int csrno,
2598                                  target_ulong *val)
2599 {
2600     if (val) {
2601         *val = env->hgeie;
2602     }
2603     return RISCV_EXCP_NONE;
2604 }
2605 
2606 static RISCVException write_hgeie(CPURISCVState *env, int csrno,
2607                                   target_ulong val)
2608 {
2609     /* Only GEILEN:1 bits implemented and BIT0 is never implemented */
2610     val &= ((((target_ulong)1) << env->geilen) - 1) << 1;
2611     env->hgeie = val;
2612     /* Update mip.SGEIP bit */
2613     riscv_cpu_update_mip(env_archcpu(env), MIP_SGEIP,
2614                          BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
2615     return RISCV_EXCP_NONE;
2616 }
2617 
2618 static RISCVException read_htval(CPURISCVState *env, int csrno,
2619                                  target_ulong *val)
2620 {
2621     *val = env->htval;
2622     return RISCV_EXCP_NONE;
2623 }
2624 
2625 static RISCVException write_htval(CPURISCVState *env, int csrno,
2626                                   target_ulong val)
2627 {
2628     env->htval = val;
2629     return RISCV_EXCP_NONE;
2630 }
2631 
2632 static RISCVException read_htinst(CPURISCVState *env, int csrno,
2633                                   target_ulong *val)
2634 {
2635     *val = env->htinst;
2636     return RISCV_EXCP_NONE;
2637 }
2638 
2639 static RISCVException write_htinst(CPURISCVState *env, int csrno,
2640                                    target_ulong val)
2641 {
2642     return RISCV_EXCP_NONE;
2643 }
2644 
2645 static RISCVException read_hgeip(CPURISCVState *env, int csrno,
2646                                  target_ulong *val)
2647 {
2648     if (val) {
2649         *val = env->hgeip;
2650     }
2651     return RISCV_EXCP_NONE;
2652 }
2653 
2654 static RISCVException read_hgatp(CPURISCVState *env, int csrno,
2655                                  target_ulong *val)
2656 {
2657     *val = env->hgatp;
2658     return RISCV_EXCP_NONE;
2659 }
2660 
2661 static RISCVException write_hgatp(CPURISCVState *env, int csrno,
2662                                   target_ulong val)
2663 {
2664     env->hgatp = val;
2665     return RISCV_EXCP_NONE;
2666 }
2667 
2668 static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
2669                                       target_ulong *val)
2670 {
2671     if (!env->rdtime_fn) {
2672         return RISCV_EXCP_ILLEGAL_INST;
2673     }
2674 
2675     *val = env->htimedelta;
2676     return RISCV_EXCP_NONE;
2677 }
2678 
2679 static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
2680                                        target_ulong val)
2681 {
2682     if (!env->rdtime_fn) {
2683         return RISCV_EXCP_ILLEGAL_INST;
2684     }
2685 
2686     if (riscv_cpu_mxl(env) == MXL_RV32) {
2687         env->htimedelta = deposit64(env->htimedelta, 0, 32, (uint64_t)val);
2688     } else {
2689         env->htimedelta = val;
2690     }
2691     return RISCV_EXCP_NONE;
2692 }
2693 
2694 static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
2695                                        target_ulong *val)
2696 {
2697     if (!env->rdtime_fn) {
2698         return RISCV_EXCP_ILLEGAL_INST;
2699     }
2700 
2701     *val = env->htimedelta >> 32;
2702     return RISCV_EXCP_NONE;
2703 }
2704 
2705 static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
2706                                         target_ulong val)
2707 {
2708     if (!env->rdtime_fn) {
2709         return RISCV_EXCP_ILLEGAL_INST;
2710     }
2711 
2712     env->htimedelta = deposit64(env->htimedelta, 32, 32, (uint64_t)val);
2713     return RISCV_EXCP_NONE;
2714 }
2715 
2716 static int read_hvictl(CPURISCVState *env, int csrno, target_ulong *val)
2717 {
2718     *val = env->hvictl;
2719     return RISCV_EXCP_NONE;
2720 }
2721 
2722 static int write_hvictl(CPURISCVState *env, int csrno, target_ulong val)
2723 {
2724     env->hvictl = val & HVICTL_VALID_MASK;
2725     return RISCV_EXCP_NONE;
2726 }
2727 
2728 static int read_hvipriox(CPURISCVState *env, int first_index,
2729                          uint8_t *iprio, target_ulong *val)
2730 {
2731     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
2732 
2733     /* First index has to be a multiple of number of irqs per register */
2734     if (first_index % num_irqs) {
2735         return (riscv_cpu_virt_enabled(env)) ?
2736                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
2737     }
2738 
2739     /* Fill-up return value */
2740     *val = 0;
2741     for (i = 0; i < num_irqs; i++) {
2742         if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
2743             continue;
2744         }
2745         if (rdzero) {
2746             continue;
2747         }
2748         *val |= ((target_ulong)iprio[irq]) << (i * 8);
2749     }
2750 
2751     return RISCV_EXCP_NONE;
2752 }
2753 
2754 static int write_hvipriox(CPURISCVState *env, int first_index,
2755                           uint8_t *iprio, target_ulong val)
2756 {
2757     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
2758 
2759     /* First index has to be a multiple of number of irqs per register */
2760     if (first_index % num_irqs) {
2761         return (riscv_cpu_virt_enabled(env)) ?
2762                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
2763     }
2764 
2765     /* Fill-up priority arrary */
2766     for (i = 0; i < num_irqs; i++) {
2767         if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
2768             continue;
2769         }
2770         if (rdzero) {
2771             iprio[irq] = 0;
2772         } else {
2773             iprio[irq] = (val >> (i * 8)) & 0xff;
2774         }
2775     }
2776 
2777     return RISCV_EXCP_NONE;
2778 }
2779 
2780 static int read_hviprio1(CPURISCVState *env, int csrno, target_ulong *val)
2781 {
2782     return read_hvipriox(env, 0, env->hviprio, val);
2783 }
2784 
2785 static int write_hviprio1(CPURISCVState *env, int csrno, target_ulong val)
2786 {
2787     return write_hvipriox(env, 0, env->hviprio, val);
2788 }
2789 
2790 static int read_hviprio1h(CPURISCVState *env, int csrno, target_ulong *val)
2791 {
2792     return read_hvipriox(env, 4, env->hviprio, val);
2793 }
2794 
2795 static int write_hviprio1h(CPURISCVState *env, int csrno, target_ulong val)
2796 {
2797     return write_hvipriox(env, 4, env->hviprio, val);
2798 }
2799 
2800 static int read_hviprio2(CPURISCVState *env, int csrno, target_ulong *val)
2801 {
2802     return read_hvipriox(env, 8, env->hviprio, val);
2803 }
2804 
2805 static int write_hviprio2(CPURISCVState *env, int csrno, target_ulong val)
2806 {
2807     return write_hvipriox(env, 8, env->hviprio, val);
2808 }
2809 
2810 static int read_hviprio2h(CPURISCVState *env, int csrno, target_ulong *val)
2811 {
2812     return read_hvipriox(env, 12, env->hviprio, val);
2813 }
2814 
2815 static int write_hviprio2h(CPURISCVState *env, int csrno, target_ulong val)
2816 {
2817     return write_hvipriox(env, 12, env->hviprio, val);
2818 }
2819 
2820 /* Virtual CSR Registers */
2821 static RISCVException read_vsstatus(CPURISCVState *env, int csrno,
2822                                     target_ulong *val)
2823 {
2824     *val = env->vsstatus;
2825     return RISCV_EXCP_NONE;
2826 }
2827 
2828 static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
2829                                      target_ulong val)
2830 {
2831     uint64_t mask = (target_ulong)-1;
2832     if ((val & VSSTATUS64_UXL) == 0) {
2833         mask &= ~VSSTATUS64_UXL;
2834     }
2835     env->vsstatus = (env->vsstatus & ~mask) | (uint64_t)val;
2836     return RISCV_EXCP_NONE;
2837 }
2838 
2839 static int read_vstvec(CPURISCVState *env, int csrno, target_ulong *val)
2840 {
2841     *val = env->vstvec;
2842     return RISCV_EXCP_NONE;
2843 }
2844 
2845 static RISCVException write_vstvec(CPURISCVState *env, int csrno,
2846                                    target_ulong val)
2847 {
2848     env->vstvec = val;
2849     return RISCV_EXCP_NONE;
2850 }
2851 
2852 static RISCVException read_vsscratch(CPURISCVState *env, int csrno,
2853                                      target_ulong *val)
2854 {
2855     *val = env->vsscratch;
2856     return RISCV_EXCP_NONE;
2857 }
2858 
2859 static RISCVException write_vsscratch(CPURISCVState *env, int csrno,
2860                                       target_ulong val)
2861 {
2862     env->vsscratch = val;
2863     return RISCV_EXCP_NONE;
2864 }
2865 
2866 static RISCVException read_vsepc(CPURISCVState *env, int csrno,
2867                                  target_ulong *val)
2868 {
2869     *val = env->vsepc;
2870     return RISCV_EXCP_NONE;
2871 }
2872 
2873 static RISCVException write_vsepc(CPURISCVState *env, int csrno,
2874                                   target_ulong val)
2875 {
2876     env->vsepc = val;
2877     return RISCV_EXCP_NONE;
2878 }
2879 
2880 static RISCVException read_vscause(CPURISCVState *env, int csrno,
2881                                    target_ulong *val)
2882 {
2883     *val = env->vscause;
2884     return RISCV_EXCP_NONE;
2885 }
2886 
2887 static RISCVException write_vscause(CPURISCVState *env, int csrno,
2888                                     target_ulong val)
2889 {
2890     env->vscause = val;
2891     return RISCV_EXCP_NONE;
2892 }
2893 
2894 static RISCVException read_vstval(CPURISCVState *env, int csrno,
2895                                   target_ulong *val)
2896 {
2897     *val = env->vstval;
2898     return RISCV_EXCP_NONE;
2899 }
2900 
2901 static RISCVException write_vstval(CPURISCVState *env, int csrno,
2902                                    target_ulong val)
2903 {
2904     env->vstval = val;
2905     return RISCV_EXCP_NONE;
2906 }
2907 
2908 static RISCVException read_vsatp(CPURISCVState *env, int csrno,
2909                                  target_ulong *val)
2910 {
2911     *val = env->vsatp;
2912     return RISCV_EXCP_NONE;
2913 }
2914 
2915 static RISCVException write_vsatp(CPURISCVState *env, int csrno,
2916                                   target_ulong val)
2917 {
2918     env->vsatp = val;
2919     return RISCV_EXCP_NONE;
2920 }
2921 
2922 static RISCVException read_mtval2(CPURISCVState *env, int csrno,
2923                                   target_ulong *val)
2924 {
2925     *val = env->mtval2;
2926     return RISCV_EXCP_NONE;
2927 }
2928 
2929 static RISCVException write_mtval2(CPURISCVState *env, int csrno,
2930                                    target_ulong val)
2931 {
2932     env->mtval2 = val;
2933     return RISCV_EXCP_NONE;
2934 }
2935 
2936 static RISCVException read_mtinst(CPURISCVState *env, int csrno,
2937                                   target_ulong *val)
2938 {
2939     *val = env->mtinst;
2940     return RISCV_EXCP_NONE;
2941 }
2942 
2943 static RISCVException write_mtinst(CPURISCVState *env, int csrno,
2944                                    target_ulong val)
2945 {
2946     env->mtinst = val;
2947     return RISCV_EXCP_NONE;
2948 }
2949 
2950 /* Physical Memory Protection */
2951 static RISCVException read_mseccfg(CPURISCVState *env, int csrno,
2952                                    target_ulong *val)
2953 {
2954     *val = mseccfg_csr_read(env);
2955     return RISCV_EXCP_NONE;
2956 }
2957 
2958 static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
2959                          target_ulong val)
2960 {
2961     mseccfg_csr_write(env, val);
2962     return RISCV_EXCP_NONE;
2963 }
2964 
2965 static bool check_pmp_reg_index(CPURISCVState *env, uint32_t reg_index)
2966 {
2967     /* TODO: RV128 restriction check */
2968     if ((reg_index & 1) && (riscv_cpu_mxl(env) == MXL_RV64)) {
2969         return false;
2970     }
2971     return true;
2972 }
2973 
2974 static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
2975                                   target_ulong *val)
2976 {
2977     uint32_t reg_index = csrno - CSR_PMPCFG0;
2978 
2979     if (!check_pmp_reg_index(env, reg_index)) {
2980         return RISCV_EXCP_ILLEGAL_INST;
2981     }
2982     *val = pmpcfg_csr_read(env, csrno - CSR_PMPCFG0);
2983     return RISCV_EXCP_NONE;
2984 }
2985 
2986 static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
2987                                    target_ulong val)
2988 {
2989     uint32_t reg_index = csrno - CSR_PMPCFG0;
2990 
2991     if (!check_pmp_reg_index(env, reg_index)) {
2992         return RISCV_EXCP_ILLEGAL_INST;
2993     }
2994     pmpcfg_csr_write(env, csrno - CSR_PMPCFG0, val);
2995     return RISCV_EXCP_NONE;
2996 }
2997 
2998 static RISCVException read_pmpaddr(CPURISCVState *env, int csrno,
2999                                    target_ulong *val)
3000 {
3001     *val = pmpaddr_csr_read(env, csrno - CSR_PMPADDR0);
3002     return RISCV_EXCP_NONE;
3003 }
3004 
3005 static RISCVException write_pmpaddr(CPURISCVState *env, int csrno,
3006                                     target_ulong val)
3007 {
3008     pmpaddr_csr_write(env, csrno - CSR_PMPADDR0, val);
3009     return RISCV_EXCP_NONE;
3010 }
3011 
3012 static RISCVException read_tselect(CPURISCVState *env, int csrno,
3013                                    target_ulong *val)
3014 {
3015     *val = tselect_csr_read(env);
3016     return RISCV_EXCP_NONE;
3017 }
3018 
3019 static RISCVException write_tselect(CPURISCVState *env, int csrno,
3020                                     target_ulong val)
3021 {
3022     tselect_csr_write(env, val);
3023     return RISCV_EXCP_NONE;
3024 }
3025 
3026 static RISCVException read_tdata(CPURISCVState *env, int csrno,
3027                                  target_ulong *val)
3028 {
3029     /* return 0 in tdata1 to end the trigger enumeration */
3030     if (env->trigger_cur >= TRIGGER_NUM && csrno == CSR_TDATA1) {
3031         *val = 0;
3032         return RISCV_EXCP_NONE;
3033     }
3034 
3035     if (!tdata_available(env, csrno - CSR_TDATA1)) {
3036         return RISCV_EXCP_ILLEGAL_INST;
3037     }
3038 
3039     *val = tdata_csr_read(env, csrno - CSR_TDATA1);
3040     return RISCV_EXCP_NONE;
3041 }
3042 
3043 static RISCVException write_tdata(CPURISCVState *env, int csrno,
3044                                   target_ulong val)
3045 {
3046     if (!tdata_available(env, csrno - CSR_TDATA1)) {
3047         return RISCV_EXCP_ILLEGAL_INST;
3048     }
3049 
3050     tdata_csr_write(env, csrno - CSR_TDATA1, val);
3051     return RISCV_EXCP_NONE;
3052 }
3053 
3054 /*
3055  * Functions to access Pointer Masking feature registers
3056  * We have to check if current priv lvl could modify
3057  * csr in given mode
3058  */
3059 static bool check_pm_current_disabled(CPURISCVState *env, int csrno)
3060 {
3061     int csr_priv = get_field(csrno, 0x300);
3062     int pm_current;
3063 
3064     if (env->debugger) {
3065         return false;
3066     }
3067     /*
3068      * If priv lvls differ that means we're accessing csr from higher priv lvl,
3069      * so allow the access
3070      */
3071     if (env->priv != csr_priv) {
3072         return false;
3073     }
3074     switch (env->priv) {
3075     case PRV_M:
3076         pm_current = get_field(env->mmte, M_PM_CURRENT);
3077         break;
3078     case PRV_S:
3079         pm_current = get_field(env->mmte, S_PM_CURRENT);
3080         break;
3081     case PRV_U:
3082         pm_current = get_field(env->mmte, U_PM_CURRENT);
3083         break;
3084     default:
3085         g_assert_not_reached();
3086     }
3087     /* It's same priv lvl, so we allow to modify csr only if pm.current==1 */
3088     return !pm_current;
3089 }
3090 
3091 static RISCVException read_mmte(CPURISCVState *env, int csrno,
3092                                 target_ulong *val)
3093 {
3094     *val = env->mmte & MMTE_MASK;
3095     return RISCV_EXCP_NONE;
3096 }
3097 
3098 static RISCVException write_mmte(CPURISCVState *env, int csrno,
3099                                  target_ulong val)
3100 {
3101     uint64_t mstatus;
3102     target_ulong wpri_val = val & MMTE_MASK;
3103 
3104     if (val != wpri_val) {
3105         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
3106                       "MMTE: WPRI violation written 0x", val,
3107                       "vs expected 0x", wpri_val);
3108     }
3109     /* for machine mode pm.current is hardwired to 1 */
3110     wpri_val |= MMTE_M_PM_CURRENT;
3111 
3112     /* hardwiring pm.instruction bit to 0, since it's not supported yet */
3113     wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
3114     env->mmte = wpri_val | PM_EXT_DIRTY;
3115     riscv_cpu_update_mask(env);
3116 
3117     /* Set XS and SD bits, since PM CSRs are dirty */
3118     mstatus = env->mstatus | MSTATUS_XS;
3119     write_mstatus(env, csrno, mstatus);
3120     return RISCV_EXCP_NONE;
3121 }
3122 
3123 static RISCVException read_smte(CPURISCVState *env, int csrno,
3124                                 target_ulong *val)
3125 {
3126     *val = env->mmte & SMTE_MASK;
3127     return RISCV_EXCP_NONE;
3128 }
3129 
3130 static RISCVException write_smte(CPURISCVState *env, int csrno,
3131                                  target_ulong val)
3132 {
3133     target_ulong wpri_val = val & SMTE_MASK;
3134 
3135     if (val != wpri_val) {
3136         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
3137                       "SMTE: WPRI violation written 0x", val,
3138                       "vs expected 0x", wpri_val);
3139     }
3140 
3141     /* if pm.current==0 we can't modify current PM CSRs */
3142     if (check_pm_current_disabled(env, csrno)) {
3143         return RISCV_EXCP_NONE;
3144     }
3145 
3146     wpri_val |= (env->mmte & ~SMTE_MASK);
3147     write_mmte(env, csrno, wpri_val);
3148     return RISCV_EXCP_NONE;
3149 }
3150 
3151 static RISCVException read_umte(CPURISCVState *env, int csrno,
3152                                 target_ulong *val)
3153 {
3154     *val = env->mmte & UMTE_MASK;
3155     return RISCV_EXCP_NONE;
3156 }
3157 
3158 static RISCVException write_umte(CPURISCVState *env, int csrno,
3159                                  target_ulong val)
3160 {
3161     target_ulong wpri_val = val & UMTE_MASK;
3162 
3163     if (val != wpri_val) {
3164         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
3165                       "UMTE: WPRI violation written 0x", val,
3166                       "vs expected 0x", wpri_val);
3167     }
3168 
3169     if (check_pm_current_disabled(env, csrno)) {
3170         return RISCV_EXCP_NONE;
3171     }
3172 
3173     wpri_val |= (env->mmte & ~UMTE_MASK);
3174     write_mmte(env, csrno, wpri_val);
3175     return RISCV_EXCP_NONE;
3176 }
3177 
3178 static RISCVException read_mpmmask(CPURISCVState *env, int csrno,
3179                                    target_ulong *val)
3180 {
3181     *val = env->mpmmask;
3182     return RISCV_EXCP_NONE;
3183 }
3184 
3185 static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
3186                                     target_ulong val)
3187 {
3188     uint64_t mstatus;
3189 
3190     env->mpmmask = val;
3191     if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
3192         env->cur_pmmask = val;
3193     }
3194     env->mmte |= PM_EXT_DIRTY;
3195 
3196     /* Set XS and SD bits, since PM CSRs are dirty */
3197     mstatus = env->mstatus | MSTATUS_XS;
3198     write_mstatus(env, csrno, mstatus);
3199     return RISCV_EXCP_NONE;
3200 }
3201 
3202 static RISCVException read_spmmask(CPURISCVState *env, int csrno,
3203                                    target_ulong *val)
3204 {
3205     *val = env->spmmask;
3206     return RISCV_EXCP_NONE;
3207 }
3208 
3209 static RISCVException write_spmmask(CPURISCVState *env, int csrno,
3210                                     target_ulong val)
3211 {
3212     uint64_t mstatus;
3213 
3214     /* if pm.current==0 we can't modify current PM CSRs */
3215     if (check_pm_current_disabled(env, csrno)) {
3216         return RISCV_EXCP_NONE;
3217     }
3218     env->spmmask = val;
3219     if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
3220         env->cur_pmmask = val;
3221     }
3222     env->mmte |= PM_EXT_DIRTY;
3223 
3224     /* Set XS and SD bits, since PM CSRs are dirty */
3225     mstatus = env->mstatus | MSTATUS_XS;
3226     write_mstatus(env, csrno, mstatus);
3227     return RISCV_EXCP_NONE;
3228 }
3229 
3230 static RISCVException read_upmmask(CPURISCVState *env, int csrno,
3231                                    target_ulong *val)
3232 {
3233     *val = env->upmmask;
3234     return RISCV_EXCP_NONE;
3235 }
3236 
3237 static RISCVException write_upmmask(CPURISCVState *env, int csrno,
3238                                     target_ulong val)
3239 {
3240     uint64_t mstatus;
3241 
3242     /* if pm.current==0 we can't modify current PM CSRs */
3243     if (check_pm_current_disabled(env, csrno)) {
3244         return RISCV_EXCP_NONE;
3245     }
3246     env->upmmask = val;
3247     if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
3248         env->cur_pmmask = val;
3249     }
3250     env->mmte |= PM_EXT_DIRTY;
3251 
3252     /* Set XS and SD bits, since PM CSRs are dirty */
3253     mstatus = env->mstatus | MSTATUS_XS;
3254     write_mstatus(env, csrno, mstatus);
3255     return RISCV_EXCP_NONE;
3256 }
3257 
3258 static RISCVException read_mpmbase(CPURISCVState *env, int csrno,
3259                                    target_ulong *val)
3260 {
3261     *val = env->mpmbase;
3262     return RISCV_EXCP_NONE;
3263 }
3264 
3265 static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
3266                                     target_ulong val)
3267 {
3268     uint64_t mstatus;
3269 
3270     env->mpmbase = val;
3271     if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
3272         env->cur_pmbase = val;
3273     }
3274     env->mmte |= PM_EXT_DIRTY;
3275 
3276     /* Set XS and SD bits, since PM CSRs are dirty */
3277     mstatus = env->mstatus | MSTATUS_XS;
3278     write_mstatus(env, csrno, mstatus);
3279     return RISCV_EXCP_NONE;
3280 }
3281 
3282 static RISCVException read_spmbase(CPURISCVState *env, int csrno,
3283                                    target_ulong *val)
3284 {
3285     *val = env->spmbase;
3286     return RISCV_EXCP_NONE;
3287 }
3288 
3289 static RISCVException write_spmbase(CPURISCVState *env, int csrno,
3290                                     target_ulong val)
3291 {
3292     uint64_t mstatus;
3293 
3294     /* if pm.current==0 we can't modify current PM CSRs */
3295     if (check_pm_current_disabled(env, csrno)) {
3296         return RISCV_EXCP_NONE;
3297     }
3298     env->spmbase = val;
3299     if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
3300         env->cur_pmbase = val;
3301     }
3302     env->mmte |= PM_EXT_DIRTY;
3303 
3304     /* Set XS and SD bits, since PM CSRs are dirty */
3305     mstatus = env->mstatus | MSTATUS_XS;
3306     write_mstatus(env, csrno, mstatus);
3307     return RISCV_EXCP_NONE;
3308 }
3309 
3310 static RISCVException read_upmbase(CPURISCVState *env, int csrno,
3311                                    target_ulong *val)
3312 {
3313     *val = env->upmbase;
3314     return RISCV_EXCP_NONE;
3315 }
3316 
3317 static RISCVException write_upmbase(CPURISCVState *env, int csrno,
3318                                     target_ulong val)
3319 {
3320     uint64_t mstatus;
3321 
3322     /* if pm.current==0 we can't modify current PM CSRs */
3323     if (check_pm_current_disabled(env, csrno)) {
3324         return RISCV_EXCP_NONE;
3325     }
3326     env->upmbase = val;
3327     if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
3328         env->cur_pmbase = val;
3329     }
3330     env->mmte |= PM_EXT_DIRTY;
3331 
3332     /* Set XS and SD bits, since PM CSRs are dirty */
3333     mstatus = env->mstatus | MSTATUS_XS;
3334     write_mstatus(env, csrno, mstatus);
3335     return RISCV_EXCP_NONE;
3336 }
3337 
3338 #endif
3339 
3340 /* Crypto Extension */
3341 static RISCVException rmw_seed(CPURISCVState *env, int csrno,
3342                                target_ulong *ret_value,
3343                                target_ulong new_value,
3344                                target_ulong write_mask)
3345 {
3346     uint16_t random_v;
3347     Error *random_e = NULL;
3348     int random_r;
3349     target_ulong rval;
3350 
3351     random_r = qemu_guest_getrandom(&random_v, 2, &random_e);
3352     if (unlikely(random_r < 0)) {
3353         /*
3354          * Failed, for unknown reasons in the crypto subsystem.
3355          * The best we can do is log the reason and return a
3356          * failure indication to the guest.  There is no reason
3357          * we know to expect the failure to be transitory, so
3358          * indicate DEAD to avoid having the guest spin on WAIT.
3359          */
3360         qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
3361                       __func__, error_get_pretty(random_e));
3362         error_free(random_e);
3363         rval = SEED_OPST_DEAD;
3364     } else {
3365         rval = random_v | SEED_OPST_ES16;
3366     }
3367 
3368     if (ret_value) {
3369         *ret_value = rval;
3370     }
3371 
3372     return RISCV_EXCP_NONE;
3373 }
3374 
3375 /*
3376  * riscv_csrrw - read and/or update control and status register
3377  *
3378  * csrr   <->  riscv_csrrw(env, csrno, ret_value, 0, 0);
3379  * csrrw  <->  riscv_csrrw(env, csrno, ret_value, value, -1);
3380  * csrrs  <->  riscv_csrrw(env, csrno, ret_value, -1, value);
3381  * csrrc  <->  riscv_csrrw(env, csrno, ret_value, 0, value);
3382  */
3383 
3384 static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
3385                                                int csrno,
3386                                                bool write_mask,
3387                                                RISCVCPU *cpu)
3388 {
3389     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
3390     int read_only = get_field(csrno, 0xC00) == 3;
3391     int csr_min_priv = csr_ops[csrno].min_priv_ver;
3392 #if !defined(CONFIG_USER_ONLY)
3393     int csr_priv, effective_priv = env->priv;
3394 
3395     if (riscv_has_ext(env, RVH) && env->priv == PRV_S) {
3396         /*
3397          * We are in either HS or VS mode.
3398          * Add 1 to the effective privledge level to allow us to access the
3399          * Hypervisor CSRs. The `hmode` predicate will determine if access
3400          * should be allowed(HS) or if a virtual instruction exception should be
3401          * raised(VS).
3402          */
3403         effective_priv++;
3404     }
3405 
3406     csr_priv = get_field(csrno, 0x300);
3407     if (!env->debugger && (effective_priv < csr_priv)) {
3408         if (csr_priv == (PRV_S + 1) && riscv_cpu_virt_enabled(env)) {
3409             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
3410         }
3411         return RISCV_EXCP_ILLEGAL_INST;
3412     }
3413 #endif
3414     if (write_mask && read_only) {
3415         return RISCV_EXCP_ILLEGAL_INST;
3416     }
3417 
3418     /* ensure the CSR extension is enabled. */
3419     if (!cpu->cfg.ext_icsr) {
3420         return RISCV_EXCP_ILLEGAL_INST;
3421     }
3422 
3423     /* check predicate */
3424     if (!csr_ops[csrno].predicate) {
3425         return RISCV_EXCP_ILLEGAL_INST;
3426     }
3427 
3428     if (env->priv_ver < csr_min_priv) {
3429         return RISCV_EXCP_ILLEGAL_INST;
3430     }
3431 
3432     return csr_ops[csrno].predicate(env, csrno);
3433 }
3434 
3435 static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
3436                                        target_ulong *ret_value,
3437                                        target_ulong new_value,
3438                                        target_ulong write_mask)
3439 {
3440     RISCVException ret;
3441     target_ulong old_value;
3442 
3443     /* execute combined read/write operation if it exists */
3444     if (csr_ops[csrno].op) {
3445         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
3446     }
3447 
3448     /* if no accessor exists then return failure */
3449     if (!csr_ops[csrno].read) {
3450         return RISCV_EXCP_ILLEGAL_INST;
3451     }
3452     /* read old value */
3453     ret = csr_ops[csrno].read(env, csrno, &old_value);
3454     if (ret != RISCV_EXCP_NONE) {
3455         return ret;
3456     }
3457 
3458     /* write value if writable and write mask set, otherwise drop writes */
3459     if (write_mask) {
3460         new_value = (old_value & ~write_mask) | (new_value & write_mask);
3461         if (csr_ops[csrno].write) {
3462             ret = csr_ops[csrno].write(env, csrno, new_value);
3463             if (ret != RISCV_EXCP_NONE) {
3464                 return ret;
3465             }
3466         }
3467     }
3468 
3469     /* return old value */
3470     if (ret_value) {
3471         *ret_value = old_value;
3472     }
3473 
3474     return RISCV_EXCP_NONE;
3475 }
3476 
3477 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
3478                            target_ulong *ret_value,
3479                            target_ulong new_value, target_ulong write_mask)
3480 {
3481     RISCVCPU *cpu = env_archcpu(env);
3482 
3483     RISCVException ret = riscv_csrrw_check(env, csrno, write_mask, cpu);
3484     if (ret != RISCV_EXCP_NONE) {
3485         return ret;
3486     }
3487 
3488     return riscv_csrrw_do64(env, csrno, ret_value, new_value, write_mask);
3489 }
3490 
3491 static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
3492                                         Int128 *ret_value,
3493                                         Int128 new_value,
3494                                         Int128 write_mask)
3495 {
3496     RISCVException ret;
3497     Int128 old_value;
3498 
3499     /* read old value */
3500     ret = csr_ops[csrno].read128(env, csrno, &old_value);
3501     if (ret != RISCV_EXCP_NONE) {
3502         return ret;
3503     }
3504 
3505     /* write value if writable and write mask set, otherwise drop writes */
3506     if (int128_nz(write_mask)) {
3507         new_value = int128_or(int128_and(old_value, int128_not(write_mask)),
3508                               int128_and(new_value, write_mask));
3509         if (csr_ops[csrno].write128) {
3510             ret = csr_ops[csrno].write128(env, csrno, new_value);
3511             if (ret != RISCV_EXCP_NONE) {
3512                 return ret;
3513             }
3514         } else if (csr_ops[csrno].write) {
3515             /* avoids having to write wrappers for all registers */
3516             ret = csr_ops[csrno].write(env, csrno, int128_getlo(new_value));
3517             if (ret != RISCV_EXCP_NONE) {
3518                 return ret;
3519             }
3520         }
3521     }
3522 
3523     /* return old value */
3524     if (ret_value) {
3525         *ret_value = old_value;
3526     }
3527 
3528     return RISCV_EXCP_NONE;
3529 }
3530 
3531 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
3532                                 Int128 *ret_value,
3533                                 Int128 new_value, Int128 write_mask)
3534 {
3535     RISCVException ret;
3536     RISCVCPU *cpu = env_archcpu(env);
3537 
3538     ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask), cpu);
3539     if (ret != RISCV_EXCP_NONE) {
3540         return ret;
3541     }
3542 
3543     if (csr_ops[csrno].read128) {
3544         return riscv_csrrw_do128(env, csrno, ret_value, new_value, write_mask);
3545     }
3546 
3547     /*
3548      * Fall back to 64-bit version for now, if the 128-bit alternative isn't
3549      * at all defined.
3550      * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
3551      * significant), for those, this fallback is correctly handling the accesses
3552      */
3553     target_ulong old_value;
3554     ret = riscv_csrrw_do64(env, csrno, &old_value,
3555                            int128_getlo(new_value),
3556                            int128_getlo(write_mask));
3557     if (ret == RISCV_EXCP_NONE && ret_value) {
3558         *ret_value = int128_make64(old_value);
3559     }
3560     return ret;
3561 }
3562 
3563 /*
3564  * Debugger support.  If not in user mode, set env->debugger before the
3565  * riscv_csrrw call and clear it after the call.
3566  */
3567 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
3568                                  target_ulong *ret_value,
3569                                  target_ulong new_value,
3570                                  target_ulong write_mask)
3571 {
3572     RISCVException ret;
3573 #if !defined(CONFIG_USER_ONLY)
3574     env->debugger = true;
3575 #endif
3576     ret = riscv_csrrw(env, csrno, ret_value, new_value, write_mask);
3577 #if !defined(CONFIG_USER_ONLY)
3578     env->debugger = false;
3579 #endif
3580     return ret;
3581 }
3582 
3583 /* Control and Status Register function table */
3584 riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
3585     /* User Floating-Point CSRs */
3586     [CSR_FFLAGS]   = { "fflags",   fs,     read_fflags,  write_fflags },
3587     [CSR_FRM]      = { "frm",      fs,     read_frm,     write_frm    },
3588     [CSR_FCSR]     = { "fcsr",     fs,     read_fcsr,    write_fcsr   },
3589     /* Vector CSRs */
3590     [CSR_VSTART]   = { "vstart",   vs,    read_vstart,  write_vstart,
3591                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3592     [CSR_VXSAT]    = { "vxsat",    vs,    read_vxsat,   write_vxsat,
3593                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3594     [CSR_VXRM]     = { "vxrm",     vs,    read_vxrm,    write_vxrm,
3595                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3596     [CSR_VCSR]     = { "vcsr",     vs,    read_vcsr,    write_vcsr,
3597                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3598     [CSR_VL]       = { "vl",       vs,    read_vl,
3599                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3600     [CSR_VTYPE]    = { "vtype",    vs,    read_vtype,
3601                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3602     [CSR_VLENB]    = { "vlenb",    vs,    read_vlenb,
3603                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3604     /* User Timers and Counters */
3605     [CSR_CYCLE]    = { "cycle",    ctr,    read_hpmcounter  },
3606     [CSR_INSTRET]  = { "instret",  ctr,    read_hpmcounter  },
3607     [CSR_CYCLEH]   = { "cycleh",   ctr32,  read_hpmcounterh },
3608     [CSR_INSTRETH] = { "instreth", ctr32,  read_hpmcounterh },
3609 
3610     /*
3611      * In privileged mode, the monitor will have to emulate TIME CSRs only if
3612      * rdtime callback is not provided by machine/platform emulation.
3613      */
3614     [CSR_TIME]  = { "time",  ctr,   read_time  },
3615     [CSR_TIMEH] = { "timeh", ctr32, read_timeh },
3616 
3617     /* Crypto Extension */
3618     [CSR_SEED] = { "seed", seed, NULL, NULL, rmw_seed },
3619 
3620 #if !defined(CONFIG_USER_ONLY)
3621     /* Machine Timers and Counters */
3622     [CSR_MCYCLE]    = { "mcycle",    any,   read_hpmcounter, write_mhpmcounter},
3623     [CSR_MINSTRET]  = { "minstret",  any,   read_hpmcounter, write_mhpmcounter},
3624     [CSR_MCYCLEH]   = { "mcycleh",   any32, read_hpmcounterh, write_mhpmcounterh},
3625     [CSR_MINSTRETH] = { "minstreth", any32, read_hpmcounterh, write_mhpmcounterh},
3626 
3627     /* Machine Information Registers */
3628     [CSR_MVENDORID] = { "mvendorid", any,   read_mvendorid },
3629     [CSR_MARCHID]   = { "marchid",   any,   read_marchid   },
3630     [CSR_MIMPID]    = { "mimpid",    any,   read_mimpid    },
3631     [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid   },
3632 
3633     [CSR_MCONFIGPTR]  = { "mconfigptr", any,   read_zero,
3634                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
3635     /* Machine Trap Setup */
3636     [CSR_MSTATUS]     = { "mstatus",    any,   read_mstatus,     write_mstatus, NULL,
3637                                                read_mstatus_i128                   },
3638     [CSR_MISA]        = { "misa",       any,   read_misa,        write_misa, NULL,
3639                                                read_misa_i128                      },
3640     [CSR_MIDELEG]     = { "mideleg",    any,   NULL,    NULL,    rmw_mideleg       },
3641     [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg,     write_medeleg     },
3642     [CSR_MIE]         = { "mie",        any,   NULL,    NULL,    rmw_mie           },
3643     [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,       write_mtvec       },
3644     [CSR_MCOUNTEREN]  = { "mcounteren", any,   read_mcounteren,  write_mcounteren  },
3645 
3646     [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,    write_mstatush    },
3647 
3648     /* Machine Trap Handling */
3649     [CSR_MSCRATCH] = { "mscratch", any,  read_mscratch,      write_mscratch, NULL,
3650                                          read_mscratch_i128, write_mscratch_i128   },
3651     [CSR_MEPC]     = { "mepc",     any,  read_mepc,     write_mepc     },
3652     [CSR_MCAUSE]   = { "mcause",   any,  read_mcause,   write_mcause   },
3653     [CSR_MTVAL]    = { "mtval",    any,  read_mtval,    write_mtval    },
3654     [CSR_MIP]      = { "mip",      any,  NULL,    NULL, rmw_mip        },
3655 
3656     /* Machine-Level Window to Indirectly Accessed Registers (AIA) */
3657     [CSR_MISELECT] = { "miselect", aia_any,   NULL, NULL,    rmw_xiselect },
3658     [CSR_MIREG]    = { "mireg",    aia_any,   NULL, NULL,    rmw_xireg },
3659 
3660     /* Machine-Level Interrupts (AIA) */
3661     [CSR_MTOPI]    = { "mtopi",    aia_any,   read_mtopi },
3662 
3663     /* Machine-Level IMSIC Interface (AIA) */
3664     [CSR_MSETEIPNUM] = { "mseteipnum", aia_any, NULL, NULL, rmw_xsetclreinum },
3665     [CSR_MCLREIPNUM] = { "mclreipnum", aia_any, NULL, NULL, rmw_xsetclreinum },
3666     [CSR_MSETEIENUM] = { "mseteienum", aia_any, NULL, NULL, rmw_xsetclreinum },
3667     [CSR_MCLREIENUM] = { "mclreienum", aia_any, NULL, NULL, rmw_xsetclreinum },
3668     [CSR_MTOPEI]     = { "mtopei",     aia_any, NULL, NULL, rmw_xtopei },
3669 
3670     /* Virtual Interrupts for Supervisor Level (AIA) */
3671     [CSR_MVIEN]      = { "mvien", aia_any, read_zero, write_ignore },
3672     [CSR_MVIP]       = { "mvip",  aia_any, read_zero, write_ignore },
3673 
3674     /* Machine-Level High-Half CSRs (AIA) */
3675     [CSR_MIDELEGH] = { "midelegh", aia_any32, NULL, NULL, rmw_midelegh },
3676     [CSR_MIEH]     = { "mieh",     aia_any32, NULL, NULL, rmw_mieh     },
3677     [CSR_MVIENH]   = { "mvienh",   aia_any32, read_zero,  write_ignore },
3678     [CSR_MVIPH]    = { "mviph",    aia_any32, read_zero,  write_ignore },
3679     [CSR_MIPH]     = { "miph",     aia_any32, NULL, NULL, rmw_miph     },
3680 
3681     /* Execution environment configuration */
3682     [CSR_MENVCFG]  = { "menvcfg",  any,   read_menvcfg,  write_menvcfg,
3683                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3684     [CSR_MENVCFGH] = { "menvcfgh", any32, read_menvcfgh, write_menvcfgh,
3685                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3686     [CSR_SENVCFG]  = { "senvcfg",  smode, read_senvcfg,  write_senvcfg,
3687                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3688     [CSR_HENVCFG]  = { "henvcfg",  hmode, read_henvcfg, write_henvcfg,
3689                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3690     [CSR_HENVCFGH] = { "henvcfgh", hmode32, read_henvcfgh, write_henvcfgh,
3691                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3692 
3693     /* Supervisor Trap Setup */
3694     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus, NULL,
3695                                               read_sstatus_i128                 },
3696     [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie          },
3697     [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec      },
3698     [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren, write_scounteren },
3699 
3700     /* Supervisor Trap Handling */
3701     [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch, NULL,
3702                                           read_sscratch_i128, write_sscratch_i128  },
3703     [CSR_SEPC]     = { "sepc",     smode, read_sepc,     write_sepc     },
3704     [CSR_SCAUSE]   = { "scause",   smode, read_scause,   write_scause   },
3705     [CSR_STVAL]    = { "stval",    smode, read_stval,   write_stval   },
3706     [CSR_SIP]      = { "sip",      smode, NULL,    NULL, rmw_sip        },
3707 
3708     /* Supervisor Protection and Translation */
3709     [CSR_SATP]     = { "satp",     smode, read_satp,    write_satp      },
3710 
3711     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
3712     [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
3713     [CSR_SIREG]      = { "sireg",      aia_smode, NULL, NULL, rmw_xireg },
3714 
3715     /* Supervisor-Level Interrupts (AIA) */
3716     [CSR_STOPI]      = { "stopi",      aia_smode, read_stopi },
3717 
3718     /* Supervisor-Level IMSIC Interface (AIA) */
3719     [CSR_SSETEIPNUM] = { "sseteipnum", aia_smode, NULL, NULL, rmw_xsetclreinum },
3720     [CSR_SCLREIPNUM] = { "sclreipnum", aia_smode, NULL, NULL, rmw_xsetclreinum },
3721     [CSR_SSETEIENUM] = { "sseteienum", aia_smode, NULL, NULL, rmw_xsetclreinum },
3722     [CSR_SCLREIENUM] = { "sclreienum", aia_smode, NULL, NULL, rmw_xsetclreinum },
3723     [CSR_STOPEI]     = { "stopei",     aia_smode, NULL, NULL, rmw_xtopei },
3724 
3725     /* Supervisor-Level High-Half CSRs (AIA) */
3726     [CSR_SIEH]       = { "sieh",   aia_smode32, NULL, NULL, rmw_sieh },
3727     [CSR_SIPH]       = { "siph",   aia_smode32, NULL, NULL, rmw_siph },
3728 
3729     [CSR_HSTATUS]     = { "hstatus",     hmode,   read_hstatus,   write_hstatus,
3730                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3731     [CSR_HEDELEG]     = { "hedeleg",     hmode,   read_hedeleg,   write_hedeleg,
3732                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3733     [CSR_HIDELEG]     = { "hideleg",     hmode,   NULL,   NULL, rmw_hideleg,
3734                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3735     [CSR_HVIP]        = { "hvip",        hmode,   NULL,   NULL,   rmw_hvip,
3736                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3737     [CSR_HIP]         = { "hip",         hmode,   NULL,   NULL,   rmw_hip,
3738                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3739     [CSR_HIE]         = { "hie",         hmode,   NULL,   NULL,    rmw_hie,
3740                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3741     [CSR_HCOUNTEREN]  = { "hcounteren",  hmode,   read_hcounteren, write_hcounteren,
3742                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3743     [CSR_HGEIE]       = { "hgeie",       hmode,   read_hgeie,       write_hgeie,
3744                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3745     [CSR_HTVAL]       = { "htval",       hmode,   read_htval,     write_htval,
3746                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3747     [CSR_HTINST]      = { "htinst",      hmode,   read_htinst,    write_htinst,
3748                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3749     [CSR_HGEIP]       = { "hgeip",       hmode,   read_hgeip,
3750                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3751     [CSR_HGATP]       = { "hgatp",       hmode,   read_hgatp,     write_hgatp,
3752                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3753     [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta, write_htimedelta,
3754                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3755     [CSR_HTIMEDELTAH] = { "htimedeltah", hmode32, read_htimedeltah, write_htimedeltah,
3756                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3757 
3758     [CSR_VSSTATUS]    = { "vsstatus",    hmode,   read_vsstatus,  write_vsstatus,
3759                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3760     [CSR_VSIP]        = { "vsip",        hmode,   NULL,    NULL,  rmw_vsip,
3761                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3762     [CSR_VSIE]        = { "vsie",        hmode,   NULL,    NULL,    rmw_vsie ,
3763                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3764     [CSR_VSTVEC]      = { "vstvec",      hmode,   read_vstvec,    write_vstvec,
3765                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3766     [CSR_VSSCRATCH]   = { "vsscratch",   hmode,   read_vsscratch, write_vsscratch,
3767                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3768     [CSR_VSEPC]       = { "vsepc",       hmode,   read_vsepc,     write_vsepc,
3769                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3770     [CSR_VSCAUSE]     = { "vscause",     hmode,   read_vscause,   write_vscause,
3771                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3772     [CSR_VSTVAL]      = { "vstval",      hmode,   read_vstval,    write_vstval,
3773                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3774     [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,     write_vsatp,
3775                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3776 
3777     [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,    write_mtval2,
3778                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3779     [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,    write_mtinst,
3780                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3781 
3782     /* Virtual Interrupts and Interrupt Priorities (H-extension with AIA) */
3783     [CSR_HVIEN]       = { "hvien",       aia_hmode, read_zero, write_ignore },
3784     [CSR_HVICTL]      = { "hvictl",      aia_hmode, read_hvictl, write_hvictl },
3785     [CSR_HVIPRIO1]    = { "hviprio1",    aia_hmode, read_hviprio1,   write_hviprio1 },
3786     [CSR_HVIPRIO2]    = { "hviprio2",    aia_hmode, read_hviprio2,   write_hviprio2 },
3787 
3788     /*
3789      * VS-Level Window to Indirectly Accessed Registers (H-extension with AIA)
3790      */
3791     [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,      rmw_xiselect },
3792     [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL,      rmw_xireg },
3793 
3794     /* VS-Level Interrupts (H-extension with AIA) */
3795     [CSR_VSTOPI]      = { "vstopi",      aia_hmode, read_vstopi },
3796 
3797     /* VS-Level IMSIC Interface (H-extension with AIA) */
3798     [CSR_VSSETEIPNUM] = { "vsseteipnum", aia_hmode, NULL, NULL, rmw_xsetclreinum },
3799     [CSR_VSCLREIPNUM] = { "vsclreipnum", aia_hmode, NULL, NULL, rmw_xsetclreinum },
3800     [CSR_VSSETEIENUM] = { "vsseteienum", aia_hmode, NULL, NULL, rmw_xsetclreinum },
3801     [CSR_VSCLREIENUM] = { "vsclreienum", aia_hmode, NULL, NULL, rmw_xsetclreinum },
3802     [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
3803 
3804     /* Hypervisor and VS-Level High-Half CSRs (H-extension with AIA) */
3805     [CSR_HIDELEGH]    = { "hidelegh",    aia_hmode32, NULL, NULL, rmw_hidelegh },
3806     [CSR_HVIENH]      = { "hvienh",      aia_hmode32, read_zero, write_ignore },
3807     [CSR_HVIPH]       = { "hviph",       aia_hmode32, NULL, NULL, rmw_hviph },
3808     [CSR_HVIPRIO1H]   = { "hviprio1h",   aia_hmode32, read_hviprio1h, write_hviprio1h },
3809     [CSR_HVIPRIO2H]   = { "hviprio2h",   aia_hmode32, read_hviprio2h, write_hviprio2h },
3810     [CSR_VSIEH]       = { "vsieh",       aia_hmode32, NULL, NULL, rmw_vsieh },
3811     [CSR_VSIPH]       = { "vsiph",       aia_hmode32, NULL, NULL, rmw_vsiph },
3812 
3813     /* Physical Memory Protection */
3814     [CSR_MSECCFG]    = { "mseccfg",  epmp, read_mseccfg, write_mseccfg,
3815                                      .min_priv_ver = PRIV_VERSION_1_12_0 },
3816     [CSR_PMPCFG0]    = { "pmpcfg0",   pmp, read_pmpcfg,  write_pmpcfg  },
3817     [CSR_PMPCFG1]    = { "pmpcfg1",   pmp, read_pmpcfg,  write_pmpcfg  },
3818     [CSR_PMPCFG2]    = { "pmpcfg2",   pmp, read_pmpcfg,  write_pmpcfg  },
3819     [CSR_PMPCFG3]    = { "pmpcfg3",   pmp, read_pmpcfg,  write_pmpcfg  },
3820     [CSR_PMPADDR0]   = { "pmpaddr0",  pmp, read_pmpaddr, write_pmpaddr },
3821     [CSR_PMPADDR1]   = { "pmpaddr1",  pmp, read_pmpaddr, write_pmpaddr },
3822     [CSR_PMPADDR2]   = { "pmpaddr2",  pmp, read_pmpaddr, write_pmpaddr },
3823     [CSR_PMPADDR3]   = { "pmpaddr3",  pmp, read_pmpaddr, write_pmpaddr },
3824     [CSR_PMPADDR4]   = { "pmpaddr4",  pmp, read_pmpaddr, write_pmpaddr },
3825     [CSR_PMPADDR5]   = { "pmpaddr5",  pmp, read_pmpaddr, write_pmpaddr },
3826     [CSR_PMPADDR6]   = { "pmpaddr6",  pmp, read_pmpaddr, write_pmpaddr },
3827     [CSR_PMPADDR7]   = { "pmpaddr7",  pmp, read_pmpaddr, write_pmpaddr },
3828     [CSR_PMPADDR8]   = { "pmpaddr8",  pmp, read_pmpaddr, write_pmpaddr },
3829     [CSR_PMPADDR9]   = { "pmpaddr9",  pmp, read_pmpaddr, write_pmpaddr },
3830     [CSR_PMPADDR10]  = { "pmpaddr10", pmp, read_pmpaddr, write_pmpaddr },
3831     [CSR_PMPADDR11]  = { "pmpaddr11", pmp, read_pmpaddr, write_pmpaddr },
3832     [CSR_PMPADDR12]  = { "pmpaddr12", pmp, read_pmpaddr, write_pmpaddr },
3833     [CSR_PMPADDR13]  = { "pmpaddr13", pmp, read_pmpaddr, write_pmpaddr },
3834     [CSR_PMPADDR14] =  { "pmpaddr14", pmp, read_pmpaddr, write_pmpaddr },
3835     [CSR_PMPADDR15] =  { "pmpaddr15", pmp, read_pmpaddr, write_pmpaddr },
3836 
3837     /* Debug CSRs */
3838     [CSR_TSELECT]   =  { "tselect", debug, read_tselect, write_tselect },
3839     [CSR_TDATA1]    =  { "tdata1",  debug, read_tdata,   write_tdata   },
3840     [CSR_TDATA2]    =  { "tdata2",  debug, read_tdata,   write_tdata   },
3841     [CSR_TDATA3]    =  { "tdata3",  debug, read_tdata,   write_tdata   },
3842 
3843     /* User Pointer Masking */
3844     [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,    write_umte    },
3845     [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask, write_upmmask },
3846     [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase, write_upmbase },
3847     /* Machine Pointer Masking */
3848     [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,    write_mmte    },
3849     [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask, write_mpmmask },
3850     [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase, write_mpmbase },
3851     /* Supervisor Pointer Masking */
3852     [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,    write_smte    },
3853     [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask, write_spmmask },
3854     [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase, write_spmbase },
3855 
3856     /* Performance Counters */
3857     [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
3858     [CSR_HPMCOUNTER4]    = { "hpmcounter4",    ctr,    read_hpmcounter },
3859     [CSR_HPMCOUNTER5]    = { "hpmcounter5",    ctr,    read_hpmcounter },
3860     [CSR_HPMCOUNTER6]    = { "hpmcounter6",    ctr,    read_hpmcounter },
3861     [CSR_HPMCOUNTER7]    = { "hpmcounter7",    ctr,    read_hpmcounter },
3862     [CSR_HPMCOUNTER8]    = { "hpmcounter8",    ctr,    read_hpmcounter },
3863     [CSR_HPMCOUNTER9]    = { "hpmcounter9",    ctr,    read_hpmcounter },
3864     [CSR_HPMCOUNTER10]   = { "hpmcounter10",   ctr,    read_hpmcounter },
3865     [CSR_HPMCOUNTER11]   = { "hpmcounter11",   ctr,    read_hpmcounter },
3866     [CSR_HPMCOUNTER12]   = { "hpmcounter12",   ctr,    read_hpmcounter },
3867     [CSR_HPMCOUNTER13]   = { "hpmcounter13",   ctr,    read_hpmcounter },
3868     [CSR_HPMCOUNTER14]   = { "hpmcounter14",   ctr,    read_hpmcounter },
3869     [CSR_HPMCOUNTER15]   = { "hpmcounter15",   ctr,    read_hpmcounter },
3870     [CSR_HPMCOUNTER16]   = { "hpmcounter16",   ctr,    read_hpmcounter },
3871     [CSR_HPMCOUNTER17]   = { "hpmcounter17",   ctr,    read_hpmcounter },
3872     [CSR_HPMCOUNTER18]   = { "hpmcounter18",   ctr,    read_hpmcounter },
3873     [CSR_HPMCOUNTER19]   = { "hpmcounter19",   ctr,    read_hpmcounter },
3874     [CSR_HPMCOUNTER20]   = { "hpmcounter20",   ctr,    read_hpmcounter },
3875     [CSR_HPMCOUNTER21]   = { "hpmcounter21",   ctr,    read_hpmcounter },
3876     [CSR_HPMCOUNTER22]   = { "hpmcounter22",   ctr,    read_hpmcounter },
3877     [CSR_HPMCOUNTER23]   = { "hpmcounter23",   ctr,    read_hpmcounter },
3878     [CSR_HPMCOUNTER24]   = { "hpmcounter24",   ctr,    read_hpmcounter },
3879     [CSR_HPMCOUNTER25]   = { "hpmcounter25",   ctr,    read_hpmcounter },
3880     [CSR_HPMCOUNTER26]   = { "hpmcounter26",   ctr,    read_hpmcounter },
3881     [CSR_HPMCOUNTER27]   = { "hpmcounter27",   ctr,    read_hpmcounter },
3882     [CSR_HPMCOUNTER28]   = { "hpmcounter28",   ctr,    read_hpmcounter },
3883     [CSR_HPMCOUNTER29]   = { "hpmcounter29",   ctr,    read_hpmcounter },
3884     [CSR_HPMCOUNTER30]   = { "hpmcounter30",   ctr,    read_hpmcounter },
3885     [CSR_HPMCOUNTER31]   = { "hpmcounter31",   ctr,    read_hpmcounter },
3886 
3887     [CSR_MHPMCOUNTER3]   = { "mhpmcounter3",   mctr,    read_hpmcounter,
3888                                                        write_mhpmcounter },
3889     [CSR_MHPMCOUNTER4]   = { "mhpmcounter4",   mctr,    read_hpmcounter,
3890                                                        write_mhpmcounter },
3891     [CSR_MHPMCOUNTER5]   = { "mhpmcounter5",   mctr,    read_hpmcounter,
3892                                                        write_mhpmcounter },
3893     [CSR_MHPMCOUNTER6]   = { "mhpmcounter6",   mctr,    read_hpmcounter,
3894                                                        write_mhpmcounter },
3895     [CSR_MHPMCOUNTER7]   = { "mhpmcounter7",   mctr,    read_hpmcounter,
3896                                                        write_mhpmcounter },
3897     [CSR_MHPMCOUNTER8]   = { "mhpmcounter8",   mctr,    read_hpmcounter,
3898                                                        write_mhpmcounter },
3899     [CSR_MHPMCOUNTER9]   = { "mhpmcounter9",   mctr,    read_hpmcounter,
3900                                                        write_mhpmcounter },
3901     [CSR_MHPMCOUNTER10]  = { "mhpmcounter10",  mctr,    read_hpmcounter,
3902                                                        write_mhpmcounter },
3903     [CSR_MHPMCOUNTER11]  = { "mhpmcounter11",  mctr,    read_hpmcounter,
3904                                                        write_mhpmcounter },
3905     [CSR_MHPMCOUNTER12]  = { "mhpmcounter12",  mctr,    read_hpmcounter,
3906                                                        write_mhpmcounter },
3907     [CSR_MHPMCOUNTER13]  = { "mhpmcounter13",  mctr,    read_hpmcounter,
3908                                                        write_mhpmcounter },
3909     [CSR_MHPMCOUNTER14]  = { "mhpmcounter14",  mctr,    read_hpmcounter,
3910                                                        write_mhpmcounter },
3911     [CSR_MHPMCOUNTER15]  = { "mhpmcounter15",  mctr,    read_hpmcounter,
3912                                                        write_mhpmcounter },
3913     [CSR_MHPMCOUNTER16]  = { "mhpmcounter16",  mctr,    read_hpmcounter,
3914                                                        write_mhpmcounter },
3915     [CSR_MHPMCOUNTER17]  = { "mhpmcounter17",  mctr,    read_hpmcounter,
3916                                                        write_mhpmcounter },
3917     [CSR_MHPMCOUNTER18]  = { "mhpmcounter18",  mctr,    read_hpmcounter,
3918                                                        write_mhpmcounter },
3919     [CSR_MHPMCOUNTER19]  = { "mhpmcounter19",  mctr,    read_hpmcounter,
3920                                                        write_mhpmcounter },
3921     [CSR_MHPMCOUNTER20]  = { "mhpmcounter20",  mctr,    read_hpmcounter,
3922                                                        write_mhpmcounter },
3923     [CSR_MHPMCOUNTER21]  = { "mhpmcounter21",  mctr,    read_hpmcounter,
3924                                                        write_mhpmcounter },
3925     [CSR_MHPMCOUNTER22]  = { "mhpmcounter22",  mctr,    read_hpmcounter,
3926                                                        write_mhpmcounter },
3927     [CSR_MHPMCOUNTER23]  = { "mhpmcounter23",  mctr,    read_hpmcounter,
3928                                                        write_mhpmcounter },
3929     [CSR_MHPMCOUNTER24]  = { "mhpmcounter24",  mctr,    read_hpmcounter,
3930                                                        write_mhpmcounter },
3931     [CSR_MHPMCOUNTER25]  = { "mhpmcounter25",  mctr,    read_hpmcounter,
3932                                                        write_mhpmcounter },
3933     [CSR_MHPMCOUNTER26]  = { "mhpmcounter26",  mctr,    read_hpmcounter,
3934                                                        write_mhpmcounter },
3935     [CSR_MHPMCOUNTER27]  = { "mhpmcounter27",  mctr,    read_hpmcounter,
3936                                                        write_mhpmcounter },
3937     [CSR_MHPMCOUNTER28]  = { "mhpmcounter28",  mctr,    read_hpmcounter,
3938                                                        write_mhpmcounter },
3939     [CSR_MHPMCOUNTER29]  = { "mhpmcounter29",  mctr,    read_hpmcounter,
3940                                                        write_mhpmcounter },
3941     [CSR_MHPMCOUNTER30]  = { "mhpmcounter30",  mctr,    read_hpmcounter,
3942                                                        write_mhpmcounter },
3943     [CSR_MHPMCOUNTER31]  = { "mhpmcounter31",  mctr,    read_hpmcounter,
3944                                                        write_mhpmcounter },
3945 
3946     [CSR_MCOUNTINHIBIT]  = { "mcountinhibit",  any, read_mcountinhibit,
3947                                                     write_mcountinhibit },
3948 
3949     [CSR_MHPMEVENT3]     = { "mhpmevent3",     any,    read_mhpmevent,
3950                                                        write_mhpmevent },
3951     [CSR_MHPMEVENT4]     = { "mhpmevent4",     any,    read_mhpmevent,
3952                                                        write_mhpmevent },
3953     [CSR_MHPMEVENT5]     = { "mhpmevent5",     any,    read_mhpmevent,
3954                                                        write_mhpmevent },
3955     [CSR_MHPMEVENT6]     = { "mhpmevent6",     any,    read_mhpmevent,
3956                                                        write_mhpmevent },
3957     [CSR_MHPMEVENT7]     = { "mhpmevent7",     any,    read_mhpmevent,
3958                                                        write_mhpmevent },
3959     [CSR_MHPMEVENT8]     = { "mhpmevent8",     any,    read_mhpmevent,
3960                                                        write_mhpmevent },
3961     [CSR_MHPMEVENT9]     = { "mhpmevent9",     any,    read_mhpmevent,
3962                                                        write_mhpmevent },
3963     [CSR_MHPMEVENT10]    = { "mhpmevent10",    any,    read_mhpmevent,
3964                                                        write_mhpmevent },
3965     [CSR_MHPMEVENT11]    = { "mhpmevent11",    any,    read_mhpmevent,
3966                                                        write_mhpmevent },
3967     [CSR_MHPMEVENT12]    = { "mhpmevent12",    any,    read_mhpmevent,
3968                                                        write_mhpmevent },
3969     [CSR_MHPMEVENT13]    = { "mhpmevent13",    any,    read_mhpmevent,
3970                                                        write_mhpmevent },
3971     [CSR_MHPMEVENT14]    = { "mhpmevent14",    any,    read_mhpmevent,
3972                                                        write_mhpmevent },
3973     [CSR_MHPMEVENT15]    = { "mhpmevent15",    any,    read_mhpmevent,
3974                                                        write_mhpmevent },
3975     [CSR_MHPMEVENT16]    = { "mhpmevent16",    any,    read_mhpmevent,
3976                                                        write_mhpmevent },
3977     [CSR_MHPMEVENT17]    = { "mhpmevent17",    any,    read_mhpmevent,
3978                                                        write_mhpmevent },
3979     [CSR_MHPMEVENT18]    = { "mhpmevent18",    any,    read_mhpmevent,
3980                                                        write_mhpmevent },
3981     [CSR_MHPMEVENT19]    = { "mhpmevent19",    any,    read_mhpmevent,
3982                                                        write_mhpmevent },
3983     [CSR_MHPMEVENT20]    = { "mhpmevent20",    any,    read_mhpmevent,
3984                                                        write_mhpmevent },
3985     [CSR_MHPMEVENT21]    = { "mhpmevent21",    any,    read_mhpmevent,
3986                                                        write_mhpmevent },
3987     [CSR_MHPMEVENT22]    = { "mhpmevent22",    any,    read_mhpmevent,
3988                                                        write_mhpmevent },
3989     [CSR_MHPMEVENT23]    = { "mhpmevent23",    any,    read_mhpmevent,
3990                                                        write_mhpmevent },
3991     [CSR_MHPMEVENT24]    = { "mhpmevent24",    any,    read_mhpmevent,
3992                                                        write_mhpmevent },
3993     [CSR_MHPMEVENT25]    = { "mhpmevent25",    any,    read_mhpmevent,
3994                                                        write_mhpmevent },
3995     [CSR_MHPMEVENT26]    = { "mhpmevent26",    any,    read_mhpmevent,
3996                                                        write_mhpmevent },
3997     [CSR_MHPMEVENT27]    = { "mhpmevent27",    any,    read_mhpmevent,
3998                                                        write_mhpmevent },
3999     [CSR_MHPMEVENT28]    = { "mhpmevent28",    any,    read_mhpmevent,
4000                                                        write_mhpmevent },
4001     [CSR_MHPMEVENT29]    = { "mhpmevent29",    any,    read_mhpmevent,
4002                                                        write_mhpmevent },
4003     [CSR_MHPMEVENT30]    = { "mhpmevent30",    any,    read_mhpmevent,
4004                                                        write_mhpmevent },
4005     [CSR_MHPMEVENT31]    = { "mhpmevent31",    any,    read_mhpmevent,
4006                                                        write_mhpmevent },
4007 
4008     [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
4009     [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
4010     [CSR_HPMCOUNTER5H]   = { "hpmcounter5h",   ctr32,  read_hpmcounterh },
4011     [CSR_HPMCOUNTER6H]   = { "hpmcounter6h",   ctr32,  read_hpmcounterh },
4012     [CSR_HPMCOUNTER7H]   = { "hpmcounter7h",   ctr32,  read_hpmcounterh },
4013     [CSR_HPMCOUNTER8H]   = { "hpmcounter8h",   ctr32,  read_hpmcounterh },
4014     [CSR_HPMCOUNTER9H]   = { "hpmcounter9h",   ctr32,  read_hpmcounterh },
4015     [CSR_HPMCOUNTER10H]  = { "hpmcounter10h",  ctr32,  read_hpmcounterh },
4016     [CSR_HPMCOUNTER11H]  = { "hpmcounter11h",  ctr32,  read_hpmcounterh },
4017     [CSR_HPMCOUNTER12H]  = { "hpmcounter12h",  ctr32,  read_hpmcounterh },
4018     [CSR_HPMCOUNTER13H]  = { "hpmcounter13h",  ctr32,  read_hpmcounterh },
4019     [CSR_HPMCOUNTER14H]  = { "hpmcounter14h",  ctr32,  read_hpmcounterh },
4020     [CSR_HPMCOUNTER15H]  = { "hpmcounter15h",  ctr32,  read_hpmcounterh },
4021     [CSR_HPMCOUNTER16H]  = { "hpmcounter16h",  ctr32,  read_hpmcounterh },
4022     [CSR_HPMCOUNTER17H]  = { "hpmcounter17h",  ctr32,  read_hpmcounterh },
4023     [CSR_HPMCOUNTER18H]  = { "hpmcounter18h",  ctr32,  read_hpmcounterh },
4024     [CSR_HPMCOUNTER19H]  = { "hpmcounter19h",  ctr32,  read_hpmcounterh },
4025     [CSR_HPMCOUNTER20H]  = { "hpmcounter20h",  ctr32,  read_hpmcounterh },
4026     [CSR_HPMCOUNTER21H]  = { "hpmcounter21h",  ctr32,  read_hpmcounterh },
4027     [CSR_HPMCOUNTER22H]  = { "hpmcounter22h",  ctr32,  read_hpmcounterh },
4028     [CSR_HPMCOUNTER23H]  = { "hpmcounter23h",  ctr32,  read_hpmcounterh },
4029     [CSR_HPMCOUNTER24H]  = { "hpmcounter24h",  ctr32,  read_hpmcounterh },
4030     [CSR_HPMCOUNTER25H]  = { "hpmcounter25h",  ctr32,  read_hpmcounterh },
4031     [CSR_HPMCOUNTER26H]  = { "hpmcounter26h",  ctr32,  read_hpmcounterh },
4032     [CSR_HPMCOUNTER27H]  = { "hpmcounter27h",  ctr32,  read_hpmcounterh },
4033     [CSR_HPMCOUNTER28H]  = { "hpmcounter28h",  ctr32,  read_hpmcounterh },
4034     [CSR_HPMCOUNTER29H]  = { "hpmcounter29h",  ctr32,  read_hpmcounterh },
4035     [CSR_HPMCOUNTER30H]  = { "hpmcounter30h",  ctr32,  read_hpmcounterh },
4036     [CSR_HPMCOUNTER31H]  = { "hpmcounter31h",  ctr32,  read_hpmcounterh },
4037 
4038     [CSR_MHPMCOUNTER3H]  = { "mhpmcounter3h",  mctr32,  read_hpmcounterh,
4039                                                        write_mhpmcounterh },
4040     [CSR_MHPMCOUNTER4H]  = { "mhpmcounter4h",  mctr32,  read_hpmcounterh,
4041                                                        write_mhpmcounterh },
4042     [CSR_MHPMCOUNTER5H]  = { "mhpmcounter5h",  mctr32,  read_hpmcounterh,
4043                                                        write_mhpmcounterh },
4044     [CSR_MHPMCOUNTER6H]  = { "mhpmcounter6h",  mctr32,  read_hpmcounterh,
4045                                                        write_mhpmcounterh },
4046     [CSR_MHPMCOUNTER7H]  = { "mhpmcounter7h",  mctr32,  read_hpmcounterh,
4047                                                        write_mhpmcounterh },
4048     [CSR_MHPMCOUNTER8H]  = { "mhpmcounter8h",  mctr32,  read_hpmcounterh,
4049                                                        write_mhpmcounterh },
4050     [CSR_MHPMCOUNTER9H]  = { "mhpmcounter9h",  mctr32,  read_hpmcounterh,
4051                                                        write_mhpmcounterh },
4052     [CSR_MHPMCOUNTER10H] = { "mhpmcounter10h", mctr32,  read_hpmcounterh,
4053                                                        write_mhpmcounterh },
4054     [CSR_MHPMCOUNTER11H] = { "mhpmcounter11h", mctr32,  read_hpmcounterh,
4055                                                        write_mhpmcounterh },
4056     [CSR_MHPMCOUNTER12H] = { "mhpmcounter12h", mctr32,  read_hpmcounterh,
4057                                                        write_mhpmcounterh },
4058     [CSR_MHPMCOUNTER13H] = { "mhpmcounter13h", mctr32,  read_hpmcounterh,
4059                                                        write_mhpmcounterh },
4060     [CSR_MHPMCOUNTER14H] = { "mhpmcounter14h", mctr32,  read_hpmcounterh,
4061                                                        write_mhpmcounterh },
4062     [CSR_MHPMCOUNTER15H] = { "mhpmcounter15h", mctr32,  read_hpmcounterh,
4063                                                        write_mhpmcounterh },
4064     [CSR_MHPMCOUNTER16H] = { "mhpmcounter16h", mctr32,  read_hpmcounterh,
4065                                                        write_mhpmcounterh },
4066     [CSR_MHPMCOUNTER17H] = { "mhpmcounter17h", mctr32,  read_hpmcounterh,
4067                                                        write_mhpmcounterh },
4068     [CSR_MHPMCOUNTER18H] = { "mhpmcounter18h", mctr32,  read_hpmcounterh,
4069                                                        write_mhpmcounterh },
4070     [CSR_MHPMCOUNTER19H] = { "mhpmcounter19h", mctr32,  read_hpmcounterh,
4071                                                        write_mhpmcounterh },
4072     [CSR_MHPMCOUNTER20H] = { "mhpmcounter20h", mctr32,  read_hpmcounterh,
4073                                                        write_mhpmcounterh },
4074     [CSR_MHPMCOUNTER21H] = { "mhpmcounter21h", mctr32,  read_hpmcounterh,
4075                                                        write_mhpmcounterh },
4076     [CSR_MHPMCOUNTER22H] = { "mhpmcounter22h", mctr32,  read_hpmcounterh,
4077                                                        write_mhpmcounterh },
4078     [CSR_MHPMCOUNTER23H] = { "mhpmcounter23h", mctr32,  read_hpmcounterh,
4079                                                        write_mhpmcounterh },
4080     [CSR_MHPMCOUNTER24H] = { "mhpmcounter24h", mctr32,  read_hpmcounterh,
4081                                                        write_mhpmcounterh },
4082     [CSR_MHPMCOUNTER25H] = { "mhpmcounter25h", mctr32,  read_hpmcounterh,
4083                                                        write_mhpmcounterh },
4084     [CSR_MHPMCOUNTER26H] = { "mhpmcounter26h", mctr32,  read_hpmcounterh,
4085                                                        write_mhpmcounterh },
4086     [CSR_MHPMCOUNTER27H] = { "mhpmcounter27h", mctr32,  read_hpmcounterh,
4087                                                        write_mhpmcounterh },
4088     [CSR_MHPMCOUNTER28H] = { "mhpmcounter28h", mctr32,  read_hpmcounterh,
4089                                                        write_mhpmcounterh },
4090     [CSR_MHPMCOUNTER29H] = { "mhpmcounter29h", mctr32,  read_hpmcounterh,
4091                                                        write_mhpmcounterh },
4092     [CSR_MHPMCOUNTER30H] = { "mhpmcounter30h", mctr32,  read_hpmcounterh,
4093                                                        write_mhpmcounterh },
4094     [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
4095                                                        write_mhpmcounterh },
4096 #endif /* !CONFIG_USER_ONLY */
4097 };
4098