xref: /openbmc/qemu/target/riscv/csr.c (revision 621f35bb)
1 /*
2  * RISC-V Control and Status Registers.
3  *
4  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
5  * Copyright (c) 2017-2018 SiFive, Inc.
6  *
7  * This program is free software; you can redistribute it and/or modify it
8  * under the terms and conditions of the GNU General Public License,
9  * version 2 or later, as published by the Free Software Foundation.
10  *
11  * This program is distributed in the hope it will be useful, but WITHOUT
12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
14  * more details.
15  *
16  * You should have received a copy of the GNU General Public License along with
17  * this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qemu/log.h"
22 #include "qemu/timer.h"
23 #include "cpu.h"
24 #include "qemu/main-loop.h"
25 #include "exec/exec-all.h"
26 #include "sysemu/cpu-timers.h"
27 #include "qemu/guest-random.h"
28 #include "qapi/error.h"
29 
30 /* CSR function table public API */
31 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
32 {
33     *ops = csr_ops[csrno & (CSR_TABLE_SIZE - 1)];
34 }
35 
36 void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
37 {
38     csr_ops[csrno & (CSR_TABLE_SIZE - 1)] = *ops;
39 }
40 
41 /* Predicates */
42 static RISCVException fs(CPURISCVState *env, int csrno)
43 {
44 #if !defined(CONFIG_USER_ONLY)
45     if (!env->debugger && !riscv_cpu_fp_enabled(env) &&
46         !RISCV_CPU(env_cpu(env))->cfg.ext_zfinx) {
47         return RISCV_EXCP_ILLEGAL_INST;
48     }
49 #endif
50     return RISCV_EXCP_NONE;
51 }
52 
53 static RISCVException vs(CPURISCVState *env, int csrno)
54 {
55     CPUState *cs = env_cpu(env);
56     RISCVCPU *cpu = RISCV_CPU(cs);
57 
58     if (env->misa_ext & RVV ||
59         cpu->cfg.ext_zve32f || cpu->cfg.ext_zve64f) {
60 #if !defined(CONFIG_USER_ONLY)
61         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
62             return RISCV_EXCP_ILLEGAL_INST;
63         }
64 #endif
65         return RISCV_EXCP_NONE;
66     }
67     return RISCV_EXCP_ILLEGAL_INST;
68 }
69 
70 static RISCVException ctr(CPURISCVState *env, int csrno)
71 {
72 #if !defined(CONFIG_USER_ONLY)
73     CPUState *cs = env_cpu(env);
74     RISCVCPU *cpu = RISCV_CPU(cs);
75     int ctr_index;
76     int base_csrno = CSR_HPMCOUNTER3;
77     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
78 
79     if (rv32 && csrno >= CSR_CYCLEH) {
80         /* Offset for RV32 hpmcounternh counters */
81         base_csrno += 0x80;
82     }
83     ctr_index = csrno - base_csrno;
84 
85     if (!cpu->cfg.pmu_num || ctr_index >= (cpu->cfg.pmu_num)) {
86         /* No counter is enabled in PMU or the counter is out of range */
87         return RISCV_EXCP_ILLEGAL_INST;
88     }
89 
90     if (env->priv == PRV_S) {
91         switch (csrno) {
92         case CSR_CYCLE:
93             if (!get_field(env->mcounteren, COUNTEREN_CY)) {
94                 return RISCV_EXCP_ILLEGAL_INST;
95             }
96             break;
97         case CSR_TIME:
98             if (!get_field(env->mcounteren, COUNTEREN_TM)) {
99                 return RISCV_EXCP_ILLEGAL_INST;
100             }
101             break;
102         case CSR_INSTRET:
103             if (!get_field(env->mcounteren, COUNTEREN_IR)) {
104                 return RISCV_EXCP_ILLEGAL_INST;
105             }
106             break;
107         case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
108             ctr_index = csrno - CSR_CYCLE;
109             if (!get_field(env->mcounteren, 1 << ctr_index)) {
110                 return RISCV_EXCP_ILLEGAL_INST;
111             }
112             break;
113         }
114         if (rv32) {
115             switch (csrno) {
116             case CSR_CYCLEH:
117                 if (!get_field(env->mcounteren, COUNTEREN_CY)) {
118                     return RISCV_EXCP_ILLEGAL_INST;
119                 }
120                 break;
121             case CSR_TIMEH:
122                 if (!get_field(env->mcounteren, COUNTEREN_TM)) {
123                     return RISCV_EXCP_ILLEGAL_INST;
124                 }
125                 break;
126             case CSR_INSTRETH:
127                 if (!get_field(env->mcounteren, COUNTEREN_IR)) {
128                     return RISCV_EXCP_ILLEGAL_INST;
129                 }
130                 break;
131             case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
132                 ctr_index = csrno - CSR_CYCLEH;
133                 if (!get_field(env->mcounteren, 1 << ctr_index)) {
134                     return RISCV_EXCP_ILLEGAL_INST;
135                 }
136                 break;
137             }
138         }
139     }
140 
141     if (riscv_cpu_virt_enabled(env)) {
142         switch (csrno) {
143         case CSR_CYCLE:
144             if (!get_field(env->hcounteren, COUNTEREN_CY) &&
145                 get_field(env->mcounteren, COUNTEREN_CY)) {
146                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
147             }
148             break;
149         case CSR_TIME:
150             if (!get_field(env->hcounteren, COUNTEREN_TM) &&
151                 get_field(env->mcounteren, COUNTEREN_TM)) {
152                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
153             }
154             break;
155         case CSR_INSTRET:
156             if (!get_field(env->hcounteren, COUNTEREN_IR) &&
157                 get_field(env->mcounteren, COUNTEREN_IR)) {
158                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
159             }
160             break;
161         case CSR_HPMCOUNTER3...CSR_HPMCOUNTER31:
162             ctr_index = csrno - CSR_CYCLE;
163             if (!get_field(env->hcounteren, 1 << ctr_index) &&
164                  get_field(env->mcounteren, 1 << ctr_index)) {
165                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
166             }
167             break;
168         }
169         if (rv32) {
170             switch (csrno) {
171             case CSR_CYCLEH:
172                 if (!get_field(env->hcounteren, COUNTEREN_CY) &&
173                     get_field(env->mcounteren, COUNTEREN_CY)) {
174                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
175                 }
176                 break;
177             case CSR_TIMEH:
178                 if (!get_field(env->hcounteren, COUNTEREN_TM) &&
179                     get_field(env->mcounteren, COUNTEREN_TM)) {
180                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
181                 }
182                 break;
183             case CSR_INSTRETH:
184                 if (!get_field(env->hcounteren, COUNTEREN_IR) &&
185                     get_field(env->mcounteren, COUNTEREN_IR)) {
186                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
187                 }
188                 break;
189             case CSR_HPMCOUNTER3H...CSR_HPMCOUNTER31H:
190                 ctr_index = csrno - CSR_CYCLEH;
191                 if (!get_field(env->hcounteren, 1 << ctr_index) &&
192                      get_field(env->mcounteren, 1 << ctr_index)) {
193                     return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
194                 }
195                 break;
196             }
197         }
198     }
199 #endif
200     return RISCV_EXCP_NONE;
201 }
202 
203 static RISCVException ctr32(CPURISCVState *env, int csrno)
204 {
205     if (riscv_cpu_mxl(env) != MXL_RV32) {
206         return RISCV_EXCP_ILLEGAL_INST;
207     }
208 
209     return ctr(env, csrno);
210 }
211 
212 #if !defined(CONFIG_USER_ONLY)
213 static RISCVException mctr(CPURISCVState *env, int csrno)
214 {
215     CPUState *cs = env_cpu(env);
216     RISCVCPU *cpu = RISCV_CPU(cs);
217     int ctr_index;
218     int base_csrno = CSR_MHPMCOUNTER3;
219 
220     if ((riscv_cpu_mxl(env) == MXL_RV32) && csrno >= CSR_MCYCLEH) {
221         /* Offset for RV32 mhpmcounternh counters */
222         base_csrno += 0x80;
223     }
224     ctr_index = csrno - base_csrno;
225     if (!cpu->cfg.pmu_num || ctr_index >= cpu->cfg.pmu_num) {
226         /* The PMU is not enabled or counter is out of range*/
227         return RISCV_EXCP_ILLEGAL_INST;
228     }
229 
230     return RISCV_EXCP_NONE;
231 }
232 
233 static RISCVException mctr32(CPURISCVState *env, int csrno)
234 {
235     if (riscv_cpu_mxl(env) != MXL_RV32) {
236         return RISCV_EXCP_ILLEGAL_INST;
237     }
238 
239     return mctr(env, csrno);
240 }
241 
242 static RISCVException any(CPURISCVState *env, int csrno)
243 {
244     return RISCV_EXCP_NONE;
245 }
246 
247 static RISCVException any32(CPURISCVState *env, int csrno)
248 {
249     if (riscv_cpu_mxl(env) != MXL_RV32) {
250         return RISCV_EXCP_ILLEGAL_INST;
251     }
252 
253     return any(env, csrno);
254 
255 }
256 
257 static int aia_any(CPURISCVState *env, int csrno)
258 {
259     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
260         return RISCV_EXCP_ILLEGAL_INST;
261     }
262 
263     return any(env, csrno);
264 }
265 
266 static int aia_any32(CPURISCVState *env, int csrno)
267 {
268     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
269         return RISCV_EXCP_ILLEGAL_INST;
270     }
271 
272     return any32(env, csrno);
273 }
274 
275 static RISCVException smode(CPURISCVState *env, int csrno)
276 {
277     if (riscv_has_ext(env, RVS)) {
278         return RISCV_EXCP_NONE;
279     }
280 
281     return RISCV_EXCP_ILLEGAL_INST;
282 }
283 
284 static int smode32(CPURISCVState *env, int csrno)
285 {
286     if (riscv_cpu_mxl(env) != MXL_RV32) {
287         return RISCV_EXCP_ILLEGAL_INST;
288     }
289 
290     return smode(env, csrno);
291 }
292 
293 static int aia_smode(CPURISCVState *env, int csrno)
294 {
295     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
296         return RISCV_EXCP_ILLEGAL_INST;
297     }
298 
299     return smode(env, csrno);
300 }
301 
302 static int aia_smode32(CPURISCVState *env, int csrno)
303 {
304     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
305         return RISCV_EXCP_ILLEGAL_INST;
306     }
307 
308     return smode32(env, csrno);
309 }
310 
311 static RISCVException hmode(CPURISCVState *env, int csrno)
312 {
313     if (riscv_has_ext(env, RVS) &&
314         riscv_has_ext(env, RVH)) {
315         /* Hypervisor extension is supported */
316         if ((env->priv == PRV_S && !riscv_cpu_virt_enabled(env)) ||
317             env->priv == PRV_M) {
318             return RISCV_EXCP_NONE;
319         } else {
320             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
321         }
322     }
323 
324     return RISCV_EXCP_ILLEGAL_INST;
325 }
326 
327 static RISCVException hmode32(CPURISCVState *env, int csrno)
328 {
329     if (riscv_cpu_mxl(env) != MXL_RV32) {
330         if (!riscv_cpu_virt_enabled(env)) {
331             return RISCV_EXCP_ILLEGAL_INST;
332         } else {
333             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
334         }
335     }
336 
337     return hmode(env, csrno);
338 
339 }
340 
341 /* Checks if PointerMasking registers could be accessed */
342 static RISCVException pointer_masking(CPURISCVState *env, int csrno)
343 {
344     /* Check if j-ext is present */
345     if (riscv_has_ext(env, RVJ)) {
346         return RISCV_EXCP_NONE;
347     }
348     return RISCV_EXCP_ILLEGAL_INST;
349 }
350 
351 static int aia_hmode(CPURISCVState *env, int csrno)
352 {
353     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
354         return RISCV_EXCP_ILLEGAL_INST;
355      }
356 
357      return hmode(env, csrno);
358 }
359 
360 static int aia_hmode32(CPURISCVState *env, int csrno)
361 {
362     if (!riscv_feature(env, RISCV_FEATURE_AIA)) {
363         return RISCV_EXCP_ILLEGAL_INST;
364     }
365 
366     return hmode32(env, csrno);
367 }
368 
369 static RISCVException pmp(CPURISCVState *env, int csrno)
370 {
371     if (riscv_feature(env, RISCV_FEATURE_PMP)) {
372         return RISCV_EXCP_NONE;
373     }
374 
375     return RISCV_EXCP_ILLEGAL_INST;
376 }
377 
378 static RISCVException epmp(CPURISCVState *env, int csrno)
379 {
380     if (env->priv == PRV_M && riscv_feature(env, RISCV_FEATURE_EPMP)) {
381         return RISCV_EXCP_NONE;
382     }
383 
384     return RISCV_EXCP_ILLEGAL_INST;
385 }
386 
387 static RISCVException debug(CPURISCVState *env, int csrno)
388 {
389     if (riscv_feature(env, RISCV_FEATURE_DEBUG)) {
390         return RISCV_EXCP_NONE;
391     }
392 
393     return RISCV_EXCP_ILLEGAL_INST;
394 }
395 #endif
396 
397 static RISCVException seed(CPURISCVState *env, int csrno)
398 {
399     RISCVCPU *cpu = env_archcpu(env);
400 
401     if (!cpu->cfg.ext_zkr) {
402         return RISCV_EXCP_ILLEGAL_INST;
403     }
404 
405 #if !defined(CONFIG_USER_ONLY)
406     /*
407      * With a CSR read-write instruction:
408      * 1) The seed CSR is always available in machine mode as normal.
409      * 2) Attempted access to seed from virtual modes VS and VU always raises
410      * an exception(virtual instruction exception only if mseccfg.sseed=1).
411      * 3) Without the corresponding access control bit set to 1, any attempted
412      * access to seed from U, S or HS modes will raise an illegal instruction
413      * exception.
414      */
415     if (env->priv == PRV_M) {
416         return RISCV_EXCP_NONE;
417     } else if (riscv_cpu_virt_enabled(env)) {
418         if (env->mseccfg & MSECCFG_SSEED) {
419             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
420         } else {
421             return RISCV_EXCP_ILLEGAL_INST;
422         }
423     } else {
424         if (env->priv == PRV_S && (env->mseccfg & MSECCFG_SSEED)) {
425             return RISCV_EXCP_NONE;
426         } else if (env->priv == PRV_U && (env->mseccfg & MSECCFG_USEED)) {
427             return RISCV_EXCP_NONE;
428         } else {
429             return RISCV_EXCP_ILLEGAL_INST;
430         }
431     }
432 #else
433     return RISCV_EXCP_NONE;
434 #endif
435 }
436 
437 /* User Floating-Point CSRs */
438 static RISCVException read_fflags(CPURISCVState *env, int csrno,
439                                   target_ulong *val)
440 {
441     *val = riscv_cpu_get_fflags(env);
442     return RISCV_EXCP_NONE;
443 }
444 
445 static RISCVException write_fflags(CPURISCVState *env, int csrno,
446                                    target_ulong val)
447 {
448 #if !defined(CONFIG_USER_ONLY)
449     if (riscv_has_ext(env, RVF)) {
450         env->mstatus |= MSTATUS_FS;
451     }
452 #endif
453     riscv_cpu_set_fflags(env, val & (FSR_AEXC >> FSR_AEXC_SHIFT));
454     return RISCV_EXCP_NONE;
455 }
456 
457 static RISCVException read_frm(CPURISCVState *env, int csrno,
458                                target_ulong *val)
459 {
460     *val = env->frm;
461     return RISCV_EXCP_NONE;
462 }
463 
464 static RISCVException write_frm(CPURISCVState *env, int csrno,
465                                 target_ulong val)
466 {
467 #if !defined(CONFIG_USER_ONLY)
468     if (riscv_has_ext(env, RVF)) {
469         env->mstatus |= MSTATUS_FS;
470     }
471 #endif
472     env->frm = val & (FSR_RD >> FSR_RD_SHIFT);
473     return RISCV_EXCP_NONE;
474 }
475 
476 static RISCVException read_fcsr(CPURISCVState *env, int csrno,
477                                 target_ulong *val)
478 {
479     *val = (riscv_cpu_get_fflags(env) << FSR_AEXC_SHIFT)
480         | (env->frm << FSR_RD_SHIFT);
481     return RISCV_EXCP_NONE;
482 }
483 
484 static RISCVException write_fcsr(CPURISCVState *env, int csrno,
485                                  target_ulong val)
486 {
487 #if !defined(CONFIG_USER_ONLY)
488     if (riscv_has_ext(env, RVF)) {
489         env->mstatus |= MSTATUS_FS;
490     }
491 #endif
492     env->frm = (val & FSR_RD) >> FSR_RD_SHIFT;
493     riscv_cpu_set_fflags(env, (val & FSR_AEXC) >> FSR_AEXC_SHIFT);
494     return RISCV_EXCP_NONE;
495 }
496 
497 static RISCVException read_vtype(CPURISCVState *env, int csrno,
498                                  target_ulong *val)
499 {
500     uint64_t vill;
501     switch (env->xl) {
502     case MXL_RV32:
503         vill = (uint32_t)env->vill << 31;
504         break;
505     case MXL_RV64:
506         vill = (uint64_t)env->vill << 63;
507         break;
508     default:
509         g_assert_not_reached();
510     }
511     *val = (target_ulong)vill | env->vtype;
512     return RISCV_EXCP_NONE;
513 }
514 
515 static RISCVException read_vl(CPURISCVState *env, int csrno,
516                               target_ulong *val)
517 {
518     *val = env->vl;
519     return RISCV_EXCP_NONE;
520 }
521 
522 static int read_vlenb(CPURISCVState *env, int csrno, target_ulong *val)
523 {
524     *val = env_archcpu(env)->cfg.vlen >> 3;
525     return RISCV_EXCP_NONE;
526 }
527 
528 static RISCVException read_vxrm(CPURISCVState *env, int csrno,
529                                 target_ulong *val)
530 {
531     *val = env->vxrm;
532     return RISCV_EXCP_NONE;
533 }
534 
535 static RISCVException write_vxrm(CPURISCVState *env, int csrno,
536                                  target_ulong val)
537 {
538 #if !defined(CONFIG_USER_ONLY)
539     env->mstatus |= MSTATUS_VS;
540 #endif
541     env->vxrm = val;
542     return RISCV_EXCP_NONE;
543 }
544 
545 static RISCVException read_vxsat(CPURISCVState *env, int csrno,
546                                  target_ulong *val)
547 {
548     *val = env->vxsat;
549     return RISCV_EXCP_NONE;
550 }
551 
552 static RISCVException write_vxsat(CPURISCVState *env, int csrno,
553                                   target_ulong val)
554 {
555 #if !defined(CONFIG_USER_ONLY)
556     env->mstatus |= MSTATUS_VS;
557 #endif
558     env->vxsat = val;
559     return RISCV_EXCP_NONE;
560 }
561 
562 static RISCVException read_vstart(CPURISCVState *env, int csrno,
563                                   target_ulong *val)
564 {
565     *val = env->vstart;
566     return RISCV_EXCP_NONE;
567 }
568 
569 static RISCVException write_vstart(CPURISCVState *env, int csrno,
570                                    target_ulong val)
571 {
572 #if !defined(CONFIG_USER_ONLY)
573     env->mstatus |= MSTATUS_VS;
574 #endif
575     /*
576      * The vstart CSR is defined to have only enough writable bits
577      * to hold the largest element index, i.e. lg2(VLEN) bits.
578      */
579     env->vstart = val & ~(~0ULL << ctzl(env_archcpu(env)->cfg.vlen));
580     return RISCV_EXCP_NONE;
581 }
582 
583 static int read_vcsr(CPURISCVState *env, int csrno, target_ulong *val)
584 {
585     *val = (env->vxrm << VCSR_VXRM_SHIFT) | (env->vxsat << VCSR_VXSAT_SHIFT);
586     return RISCV_EXCP_NONE;
587 }
588 
589 static int write_vcsr(CPURISCVState *env, int csrno, target_ulong val)
590 {
591 #if !defined(CONFIG_USER_ONLY)
592     env->mstatus |= MSTATUS_VS;
593 #endif
594     env->vxrm = (val & VCSR_VXRM) >> VCSR_VXRM_SHIFT;
595     env->vxsat = (val & VCSR_VXSAT) >> VCSR_VXSAT_SHIFT;
596     return RISCV_EXCP_NONE;
597 }
598 
599 /* User Timers and Counters */
600 static RISCVException read_instret(CPURISCVState *env, int csrno,
601                                    target_ulong *val)
602 {
603 #if !defined(CONFIG_USER_ONLY)
604     if (icount_enabled()) {
605         *val = icount_get();
606     } else {
607         *val = cpu_get_host_ticks();
608     }
609 #else
610     *val = cpu_get_host_ticks();
611 #endif
612     return RISCV_EXCP_NONE;
613 }
614 
615 static RISCVException read_instreth(CPURISCVState *env, int csrno,
616                                     target_ulong *val)
617 {
618 #if !defined(CONFIG_USER_ONLY)
619     if (icount_enabled()) {
620         *val = icount_get() >> 32;
621     } else {
622         *val = cpu_get_host_ticks() >> 32;
623     }
624 #else
625     *val = cpu_get_host_ticks() >> 32;
626 #endif
627     return RISCV_EXCP_NONE;
628 }
629 
630 #if defined(CONFIG_USER_ONLY)
631 static RISCVException read_time(CPURISCVState *env, int csrno,
632                                 target_ulong *val)
633 {
634     *val = cpu_get_host_ticks();
635     return RISCV_EXCP_NONE;
636 }
637 
638 static RISCVException read_timeh(CPURISCVState *env, int csrno,
639                                  target_ulong *val)
640 {
641     *val = cpu_get_host_ticks() >> 32;
642     return RISCV_EXCP_NONE;
643 }
644 
645 #else /* CONFIG_USER_ONLY */
646 
647 static int read_mhpmevent(CPURISCVState *env, int csrno, target_ulong *val)
648 {
649     int evt_index = csrno - CSR_MHPMEVENT3;
650 
651     *val = env->mhpmevent_val[evt_index];
652 
653     return RISCV_EXCP_NONE;
654 }
655 
656 static int write_mhpmevent(CPURISCVState *env, int csrno, target_ulong val)
657 {
658     int evt_index = csrno - CSR_MHPMEVENT3;
659 
660     env->mhpmevent_val[evt_index] = val;
661 
662     return RISCV_EXCP_NONE;
663 }
664 
665 static int write_mhpmcounter(CPURISCVState *env, int csrno, target_ulong val)
666 {
667     int ctr_index = csrno - CSR_MHPMCOUNTER3 + 3;
668 
669     env->mhpmcounter_val[ctr_index] = val;
670 
671     return RISCV_EXCP_NONE;
672 }
673 
674 static int write_mhpmcounterh(CPURISCVState *env, int csrno, target_ulong val)
675 {
676     int ctr_index = csrno - CSR_MHPMCOUNTER3H + 3;
677 
678     env->mhpmcounterh_val[ctr_index] = val;
679 
680     return RISCV_EXCP_NONE;
681 }
682 
683 static int read_hpmcounter(CPURISCVState *env, int csrno, target_ulong *val)
684 {
685     int ctr_index;
686 
687     if (csrno >= CSR_MCYCLE && csrno <= CSR_MHPMCOUNTER31) {
688         ctr_index = csrno - CSR_MHPMCOUNTER3 + 3;
689     } else if (csrno >= CSR_CYCLE && csrno <= CSR_HPMCOUNTER31) {
690         ctr_index = csrno - CSR_HPMCOUNTER3 + 3;
691     } else {
692         return RISCV_EXCP_ILLEGAL_INST;
693     }
694     *val = env->mhpmcounter_val[ctr_index];
695 
696     return RISCV_EXCP_NONE;
697 }
698 
699 static int read_hpmcounterh(CPURISCVState *env, int csrno, target_ulong *val)
700 {
701     int ctr_index;
702 
703     if (csrno >= CSR_MCYCLEH && csrno <= CSR_MHPMCOUNTER31H) {
704         ctr_index = csrno - CSR_MHPMCOUNTER3H + 3;
705     } else if (csrno >= CSR_CYCLEH && csrno <= CSR_HPMCOUNTER31H) {
706         ctr_index = csrno - CSR_HPMCOUNTER3H + 3;
707     } else {
708         return RISCV_EXCP_ILLEGAL_INST;
709     }
710     *val = env->mhpmcounterh_val[ctr_index];
711 
712     return RISCV_EXCP_NONE;
713 }
714 
715 
716 static RISCVException read_time(CPURISCVState *env, int csrno,
717                                 target_ulong *val)
718 {
719     uint64_t delta = riscv_cpu_virt_enabled(env) ? env->htimedelta : 0;
720 
721     if (!env->rdtime_fn) {
722         return RISCV_EXCP_ILLEGAL_INST;
723     }
724 
725     *val = env->rdtime_fn(env->rdtime_fn_arg) + delta;
726     return RISCV_EXCP_NONE;
727 }
728 
729 static RISCVException read_timeh(CPURISCVState *env, int csrno,
730                                  target_ulong *val)
731 {
732     uint64_t delta = riscv_cpu_virt_enabled(env) ? env->htimedelta : 0;
733 
734     if (!env->rdtime_fn) {
735         return RISCV_EXCP_ILLEGAL_INST;
736     }
737 
738     *val = (env->rdtime_fn(env->rdtime_fn_arg) + delta) >> 32;
739     return RISCV_EXCP_NONE;
740 }
741 
742 /* Machine constants */
743 
744 #define M_MODE_INTERRUPTS  ((uint64_t)(MIP_MSIP | MIP_MTIP | MIP_MEIP))
745 #define S_MODE_INTERRUPTS  ((uint64_t)(MIP_SSIP | MIP_STIP | MIP_SEIP))
746 #define VS_MODE_INTERRUPTS ((uint64_t)(MIP_VSSIP | MIP_VSTIP | MIP_VSEIP))
747 #define HS_MODE_INTERRUPTS ((uint64_t)(MIP_SGEIP | VS_MODE_INTERRUPTS))
748 
749 #define VSTOPI_NUM_SRCS 5
750 
751 static const uint64_t delegable_ints = S_MODE_INTERRUPTS |
752                                            VS_MODE_INTERRUPTS;
753 static const uint64_t vs_delegable_ints = VS_MODE_INTERRUPTS;
754 static const uint64_t all_ints = M_MODE_INTERRUPTS | S_MODE_INTERRUPTS |
755                                      HS_MODE_INTERRUPTS;
756 #define DELEGABLE_EXCPS ((1ULL << (RISCV_EXCP_INST_ADDR_MIS)) | \
757                          (1ULL << (RISCV_EXCP_INST_ACCESS_FAULT)) | \
758                          (1ULL << (RISCV_EXCP_ILLEGAL_INST)) | \
759                          (1ULL << (RISCV_EXCP_BREAKPOINT)) | \
760                          (1ULL << (RISCV_EXCP_LOAD_ADDR_MIS)) | \
761                          (1ULL << (RISCV_EXCP_LOAD_ACCESS_FAULT)) | \
762                          (1ULL << (RISCV_EXCP_STORE_AMO_ADDR_MIS)) | \
763                          (1ULL << (RISCV_EXCP_STORE_AMO_ACCESS_FAULT)) | \
764                          (1ULL << (RISCV_EXCP_U_ECALL)) | \
765                          (1ULL << (RISCV_EXCP_S_ECALL)) | \
766                          (1ULL << (RISCV_EXCP_VS_ECALL)) | \
767                          (1ULL << (RISCV_EXCP_M_ECALL)) | \
768                          (1ULL << (RISCV_EXCP_INST_PAGE_FAULT)) | \
769                          (1ULL << (RISCV_EXCP_LOAD_PAGE_FAULT)) | \
770                          (1ULL << (RISCV_EXCP_STORE_PAGE_FAULT)) | \
771                          (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) | \
772                          (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) | \
773                          (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) | \
774                          (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)))
775 static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
776     ~((1ULL << (RISCV_EXCP_S_ECALL)) |
777       (1ULL << (RISCV_EXCP_VS_ECALL)) |
778       (1ULL << (RISCV_EXCP_M_ECALL)) |
779       (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) |
780       (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) |
781       (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) |
782       (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)));
783 static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
784     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
785     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
786 static const target_ulong sip_writable_mask = SIP_SSIP | MIP_USIP | MIP_UEIP;
787 static const target_ulong hip_writable_mask = MIP_VSSIP;
788 static const target_ulong hvip_writable_mask = MIP_VSSIP | MIP_VSTIP | MIP_VSEIP;
789 static const target_ulong vsip_writable_mask = MIP_VSSIP;
790 
791 static const char valid_vm_1_10_32[16] = {
792     [VM_1_10_MBARE] = 1,
793     [VM_1_10_SV32] = 1
794 };
795 
796 static const char valid_vm_1_10_64[16] = {
797     [VM_1_10_MBARE] = 1,
798     [VM_1_10_SV39] = 1,
799     [VM_1_10_SV48] = 1,
800     [VM_1_10_SV57] = 1
801 };
802 
803 /* Machine Information Registers */
804 static RISCVException read_zero(CPURISCVState *env, int csrno,
805                                 target_ulong *val)
806 {
807     *val = 0;
808     return RISCV_EXCP_NONE;
809 }
810 
811 static RISCVException write_ignore(CPURISCVState *env, int csrno,
812                                    target_ulong val)
813 {
814     return RISCV_EXCP_NONE;
815 }
816 
817 static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
818                                      target_ulong *val)
819 {
820     CPUState *cs = env_cpu(env);
821     RISCVCPU *cpu = RISCV_CPU(cs);
822 
823     *val = cpu->cfg.mvendorid;
824     return RISCV_EXCP_NONE;
825 }
826 
827 static RISCVException read_marchid(CPURISCVState *env, int csrno,
828                                    target_ulong *val)
829 {
830     CPUState *cs = env_cpu(env);
831     RISCVCPU *cpu = RISCV_CPU(cs);
832 
833     *val = cpu->cfg.marchid;
834     return RISCV_EXCP_NONE;
835 }
836 
837 static RISCVException read_mimpid(CPURISCVState *env, int csrno,
838                                   target_ulong *val)
839 {
840     CPUState *cs = env_cpu(env);
841     RISCVCPU *cpu = RISCV_CPU(cs);
842 
843     *val = cpu->cfg.mimpid;
844     return RISCV_EXCP_NONE;
845 }
846 
847 static RISCVException read_mhartid(CPURISCVState *env, int csrno,
848                                    target_ulong *val)
849 {
850     *val = env->mhartid;
851     return RISCV_EXCP_NONE;
852 }
853 
854 /* Machine Trap Setup */
855 
856 /* We do not store SD explicitly, only compute it on demand. */
857 static uint64_t add_status_sd(RISCVMXL xl, uint64_t status)
858 {
859     if ((status & MSTATUS_FS) == MSTATUS_FS ||
860         (status & MSTATUS_VS) == MSTATUS_VS ||
861         (status & MSTATUS_XS) == MSTATUS_XS) {
862         switch (xl) {
863         case MXL_RV32:
864             return status | MSTATUS32_SD;
865         case MXL_RV64:
866             return status | MSTATUS64_SD;
867         case MXL_RV128:
868             return MSTATUSH128_SD;
869         default:
870             g_assert_not_reached();
871         }
872     }
873     return status;
874 }
875 
876 static RISCVException read_mstatus(CPURISCVState *env, int csrno,
877                                    target_ulong *val)
878 {
879     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus);
880     return RISCV_EXCP_NONE;
881 }
882 
883 static int validate_vm(CPURISCVState *env, target_ulong vm)
884 {
885     if (riscv_cpu_mxl(env) == MXL_RV32) {
886         return valid_vm_1_10_32[vm & 0xf];
887     } else {
888         return valid_vm_1_10_64[vm & 0xf];
889     }
890 }
891 
892 static RISCVException write_mstatus(CPURISCVState *env, int csrno,
893                                     target_ulong val)
894 {
895     uint64_t mstatus = env->mstatus;
896     uint64_t mask = 0;
897     RISCVMXL xl = riscv_cpu_mxl(env);
898 
899     /* flush tlb on mstatus fields that affect VM */
900     if ((val ^ mstatus) & (MSTATUS_MXR | MSTATUS_MPP | MSTATUS_MPV |
901             MSTATUS_MPRV | MSTATUS_SUM)) {
902         tlb_flush(env_cpu(env));
903     }
904     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
905         MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
906         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
907         MSTATUS_TW | MSTATUS_VS;
908 
909     if (riscv_has_ext(env, RVF)) {
910         mask |= MSTATUS_FS;
911     }
912 
913     if (xl != MXL_RV32 || env->debugger) {
914         /*
915          * RV32: MPV and GVA are not in mstatus. The current plan is to
916          * add them to mstatush. For now, we just don't support it.
917          */
918         mask |= MSTATUS_MPV | MSTATUS_GVA;
919         if ((val & MSTATUS64_UXL) != 0) {
920             mask |= MSTATUS64_UXL;
921         }
922     }
923 
924     mstatus = (mstatus & ~mask) | (val & mask);
925 
926     if (xl > MXL_RV32) {
927         /* SXL field is for now read only */
928         mstatus = set_field(mstatus, MSTATUS64_SXL, xl);
929     }
930     env->mstatus = mstatus;
931     env->xl = cpu_recompute_xl(env);
932 
933     return RISCV_EXCP_NONE;
934 }
935 
936 static RISCVException read_mstatush(CPURISCVState *env, int csrno,
937                                     target_ulong *val)
938 {
939     *val = env->mstatus >> 32;
940     return RISCV_EXCP_NONE;
941 }
942 
943 static RISCVException write_mstatush(CPURISCVState *env, int csrno,
944                                      target_ulong val)
945 {
946     uint64_t valh = (uint64_t)val << 32;
947     uint64_t mask = MSTATUS_MPV | MSTATUS_GVA;
948 
949     if ((valh ^ env->mstatus) & (MSTATUS_MPV)) {
950         tlb_flush(env_cpu(env));
951     }
952 
953     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
954 
955     return RISCV_EXCP_NONE;
956 }
957 
958 static RISCVException read_mstatus_i128(CPURISCVState *env, int csrno,
959                                         Int128 *val)
960 {
961     *val = int128_make128(env->mstatus, add_status_sd(MXL_RV128, env->mstatus));
962     return RISCV_EXCP_NONE;
963 }
964 
965 static RISCVException read_misa_i128(CPURISCVState *env, int csrno,
966                                      Int128 *val)
967 {
968     *val = int128_make128(env->misa_ext, (uint64_t)MXL_RV128 << 62);
969     return RISCV_EXCP_NONE;
970 }
971 
972 static RISCVException read_misa(CPURISCVState *env, int csrno,
973                                 target_ulong *val)
974 {
975     target_ulong misa;
976 
977     switch (env->misa_mxl) {
978     case MXL_RV32:
979         misa = (target_ulong)MXL_RV32 << 30;
980         break;
981 #ifdef TARGET_RISCV64
982     case MXL_RV64:
983         misa = (target_ulong)MXL_RV64 << 62;
984         break;
985 #endif
986     default:
987         g_assert_not_reached();
988     }
989 
990     *val = misa | env->misa_ext;
991     return RISCV_EXCP_NONE;
992 }
993 
994 static RISCVException write_misa(CPURISCVState *env, int csrno,
995                                  target_ulong val)
996 {
997     if (!riscv_feature(env, RISCV_FEATURE_MISA)) {
998         /* drop write to misa */
999         return RISCV_EXCP_NONE;
1000     }
1001 
1002     /* 'I' or 'E' must be present */
1003     if (!(val & (RVI | RVE))) {
1004         /* It is not, drop write to misa */
1005         return RISCV_EXCP_NONE;
1006     }
1007 
1008     /* 'E' excludes all other extensions */
1009     if (val & RVE) {
1010         /* when we support 'E' we can do "val = RVE;" however
1011          * for now we just drop writes if 'E' is present.
1012          */
1013         return RISCV_EXCP_NONE;
1014     }
1015 
1016     /*
1017      * misa.MXL writes are not supported by QEMU.
1018      * Drop writes to those bits.
1019      */
1020 
1021     /* Mask extensions that are not supported by this hart */
1022     val &= env->misa_ext_mask;
1023 
1024     /* Mask extensions that are not supported by QEMU */
1025     val &= (RVI | RVE | RVM | RVA | RVF | RVD | RVC | RVS | RVU | RVV);
1026 
1027     /* 'D' depends on 'F', so clear 'D' if 'F' is not present */
1028     if ((val & RVD) && !(val & RVF)) {
1029         val &= ~RVD;
1030     }
1031 
1032     /* Suppress 'C' if next instruction is not aligned
1033      * TODO: this should check next_pc
1034      */
1035     if ((val & RVC) && (GETPC() & ~3) != 0) {
1036         val &= ~RVC;
1037     }
1038 
1039     /* If nothing changed, do nothing. */
1040     if (val == env->misa_ext) {
1041         return RISCV_EXCP_NONE;
1042     }
1043 
1044     if (!(val & RVF)) {
1045         env->mstatus &= ~MSTATUS_FS;
1046     }
1047 
1048     /* flush translation cache */
1049     tb_flush(env_cpu(env));
1050     env->misa_ext = val;
1051     env->xl = riscv_cpu_mxl(env);
1052     return RISCV_EXCP_NONE;
1053 }
1054 
1055 static RISCVException read_medeleg(CPURISCVState *env, int csrno,
1056                                    target_ulong *val)
1057 {
1058     *val = env->medeleg;
1059     return RISCV_EXCP_NONE;
1060 }
1061 
1062 static RISCVException write_medeleg(CPURISCVState *env, int csrno,
1063                                     target_ulong val)
1064 {
1065     env->medeleg = (env->medeleg & ~DELEGABLE_EXCPS) | (val & DELEGABLE_EXCPS);
1066     return RISCV_EXCP_NONE;
1067 }
1068 
1069 static RISCVException rmw_mideleg64(CPURISCVState *env, int csrno,
1070                                     uint64_t *ret_val,
1071                                     uint64_t new_val, uint64_t wr_mask)
1072 {
1073     uint64_t mask = wr_mask & delegable_ints;
1074 
1075     if (ret_val) {
1076         *ret_val = env->mideleg;
1077     }
1078 
1079     env->mideleg = (env->mideleg & ~mask) | (new_val & mask);
1080 
1081     if (riscv_has_ext(env, RVH)) {
1082         env->mideleg |= HS_MODE_INTERRUPTS;
1083     }
1084 
1085     return RISCV_EXCP_NONE;
1086 }
1087 
1088 static RISCVException rmw_mideleg(CPURISCVState *env, int csrno,
1089                                   target_ulong *ret_val,
1090                                   target_ulong new_val, target_ulong wr_mask)
1091 {
1092     uint64_t rval;
1093     RISCVException ret;
1094 
1095     ret = rmw_mideleg64(env, csrno, &rval, new_val, wr_mask);
1096     if (ret_val) {
1097         *ret_val = rval;
1098     }
1099 
1100     return ret;
1101 }
1102 
1103 static RISCVException rmw_midelegh(CPURISCVState *env, int csrno,
1104                                    target_ulong *ret_val,
1105                                    target_ulong new_val,
1106                                    target_ulong wr_mask)
1107 {
1108     uint64_t rval;
1109     RISCVException ret;
1110 
1111     ret = rmw_mideleg64(env, csrno, &rval,
1112         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1113     if (ret_val) {
1114         *ret_val = rval >> 32;
1115     }
1116 
1117     return ret;
1118 }
1119 
1120 static RISCVException rmw_mie64(CPURISCVState *env, int csrno,
1121                                 uint64_t *ret_val,
1122                                 uint64_t new_val, uint64_t wr_mask)
1123 {
1124     uint64_t mask = wr_mask & all_ints;
1125 
1126     if (ret_val) {
1127         *ret_val = env->mie;
1128     }
1129 
1130     env->mie = (env->mie & ~mask) | (new_val & mask);
1131 
1132     if (!riscv_has_ext(env, RVH)) {
1133         env->mie &= ~((uint64_t)MIP_SGEIP);
1134     }
1135 
1136     return RISCV_EXCP_NONE;
1137 }
1138 
1139 static RISCVException rmw_mie(CPURISCVState *env, int csrno,
1140                               target_ulong *ret_val,
1141                               target_ulong new_val, target_ulong wr_mask)
1142 {
1143     uint64_t rval;
1144     RISCVException ret;
1145 
1146     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask);
1147     if (ret_val) {
1148         *ret_val = rval;
1149     }
1150 
1151     return ret;
1152 }
1153 
1154 static RISCVException rmw_mieh(CPURISCVState *env, int csrno,
1155                                target_ulong *ret_val,
1156                                target_ulong new_val, target_ulong wr_mask)
1157 {
1158     uint64_t rval;
1159     RISCVException ret;
1160 
1161     ret = rmw_mie64(env, csrno, &rval,
1162         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1163     if (ret_val) {
1164         *ret_val = rval >> 32;
1165     }
1166 
1167     return ret;
1168 }
1169 
1170 static int read_mtopi(CPURISCVState *env, int csrno, target_ulong *val)
1171 {
1172     int irq;
1173     uint8_t iprio;
1174 
1175     irq = riscv_cpu_mirq_pending(env);
1176     if (irq <= 0 || irq > 63) {
1177         *val = 0;
1178     } else {
1179         iprio = env->miprio[irq];
1180         if (!iprio) {
1181             if (riscv_cpu_default_priority(irq) > IPRIO_DEFAULT_M) {
1182                 iprio = IPRIO_MMAXIPRIO;
1183             }
1184         }
1185         *val = (irq & TOPI_IID_MASK) << TOPI_IID_SHIFT;
1186         *val |= iprio;
1187     }
1188 
1189     return RISCV_EXCP_NONE;
1190 }
1191 
1192 static int aia_xlate_vs_csrno(CPURISCVState *env, int csrno)
1193 {
1194     if (!riscv_cpu_virt_enabled(env)) {
1195         return csrno;
1196     }
1197 
1198     switch (csrno) {
1199     case CSR_SISELECT:
1200         return CSR_VSISELECT;
1201     case CSR_SIREG:
1202         return CSR_VSIREG;
1203     case CSR_SSETEIPNUM:
1204         return CSR_VSSETEIPNUM;
1205     case CSR_SCLREIPNUM:
1206         return CSR_VSCLREIPNUM;
1207     case CSR_SSETEIENUM:
1208         return CSR_VSSETEIENUM;
1209     case CSR_SCLREIENUM:
1210         return CSR_VSCLREIENUM;
1211     case CSR_STOPEI:
1212         return CSR_VSTOPEI;
1213     default:
1214         return csrno;
1215     };
1216 }
1217 
1218 static int rmw_xiselect(CPURISCVState *env, int csrno, target_ulong *val,
1219                         target_ulong new_val, target_ulong wr_mask)
1220 {
1221     target_ulong *iselect;
1222 
1223     /* Translate CSR number for VS-mode */
1224     csrno = aia_xlate_vs_csrno(env, csrno);
1225 
1226     /* Find the iselect CSR based on CSR number */
1227     switch (csrno) {
1228     case CSR_MISELECT:
1229         iselect = &env->miselect;
1230         break;
1231     case CSR_SISELECT:
1232         iselect = &env->siselect;
1233         break;
1234     case CSR_VSISELECT:
1235         iselect = &env->vsiselect;
1236         break;
1237     default:
1238          return RISCV_EXCP_ILLEGAL_INST;
1239     };
1240 
1241     if (val) {
1242         *val = *iselect;
1243     }
1244 
1245     wr_mask &= ISELECT_MASK;
1246     if (wr_mask) {
1247         *iselect = (*iselect & ~wr_mask) | (new_val & wr_mask);
1248     }
1249 
1250     return RISCV_EXCP_NONE;
1251 }
1252 
1253 static int rmw_iprio(target_ulong xlen,
1254                      target_ulong iselect, uint8_t *iprio,
1255                      target_ulong *val, target_ulong new_val,
1256                      target_ulong wr_mask, int ext_irq_no)
1257 {
1258     int i, firq, nirqs;
1259     target_ulong old_val;
1260 
1261     if (iselect < ISELECT_IPRIO0 || ISELECT_IPRIO15 < iselect) {
1262         return -EINVAL;
1263     }
1264     if (xlen != 32 && iselect & 0x1) {
1265         return -EINVAL;
1266     }
1267 
1268     nirqs = 4 * (xlen / 32);
1269     firq = ((iselect - ISELECT_IPRIO0) / (xlen / 32)) * (nirqs);
1270 
1271     old_val = 0;
1272     for (i = 0; i < nirqs; i++) {
1273         old_val |= ((target_ulong)iprio[firq + i]) << (IPRIO_IRQ_BITS * i);
1274     }
1275 
1276     if (val) {
1277         *val = old_val;
1278     }
1279 
1280     if (wr_mask) {
1281         new_val = (old_val & ~wr_mask) | (new_val & wr_mask);
1282         for (i = 0; i < nirqs; i++) {
1283             /*
1284              * M-level and S-level external IRQ priority always read-only
1285              * zero. This means default priority order is always preferred
1286              * for M-level and S-level external IRQs.
1287              */
1288             if ((firq + i) == ext_irq_no) {
1289                 continue;
1290             }
1291             iprio[firq + i] = (new_val >> (IPRIO_IRQ_BITS * i)) & 0xff;
1292         }
1293     }
1294 
1295     return 0;
1296 }
1297 
1298 static int rmw_xireg(CPURISCVState *env, int csrno, target_ulong *val,
1299                      target_ulong new_val, target_ulong wr_mask)
1300 {
1301     bool virt;
1302     uint8_t *iprio;
1303     int ret = -EINVAL;
1304     target_ulong priv, isel, vgein;
1305 
1306     /* Translate CSR number for VS-mode */
1307     csrno = aia_xlate_vs_csrno(env, csrno);
1308 
1309     /* Decode register details from CSR number */
1310     virt = false;
1311     switch (csrno) {
1312     case CSR_MIREG:
1313         iprio = env->miprio;
1314         isel = env->miselect;
1315         priv = PRV_M;
1316         break;
1317     case CSR_SIREG:
1318         iprio = env->siprio;
1319         isel = env->siselect;
1320         priv = PRV_S;
1321         break;
1322     case CSR_VSIREG:
1323         iprio = env->hviprio;
1324         isel = env->vsiselect;
1325         priv = PRV_S;
1326         virt = true;
1327         break;
1328     default:
1329          goto done;
1330     };
1331 
1332     /* Find the selected guest interrupt file */
1333     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
1334 
1335     if (ISELECT_IPRIO0 <= isel && isel <= ISELECT_IPRIO15) {
1336         /* Local interrupt priority registers not available for VS-mode */
1337         if (!virt) {
1338             ret = rmw_iprio(riscv_cpu_mxl_bits(env),
1339                             isel, iprio, val, new_val, wr_mask,
1340                             (priv == PRV_M) ? IRQ_M_EXT : IRQ_S_EXT);
1341         }
1342     } else if (ISELECT_IMSIC_FIRST <= isel && isel <= ISELECT_IMSIC_LAST) {
1343         /* IMSIC registers only available when machine implements it. */
1344         if (env->aia_ireg_rmw_fn[priv]) {
1345             /* Selected guest interrupt file should not be zero */
1346             if (virt && (!vgein || env->geilen < vgein)) {
1347                 goto done;
1348             }
1349             /* Call machine specific IMSIC register emulation */
1350             ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
1351                                     AIA_MAKE_IREG(isel, priv, virt, vgein,
1352                                                   riscv_cpu_mxl_bits(env)),
1353                                     val, new_val, wr_mask);
1354         }
1355     }
1356 
1357 done:
1358     if (ret) {
1359         return (riscv_cpu_virt_enabled(env) && virt) ?
1360                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
1361     }
1362     return RISCV_EXCP_NONE;
1363 }
1364 
1365 static int rmw_xsetclreinum(CPURISCVState *env, int csrno, target_ulong *val,
1366                             target_ulong new_val, target_ulong wr_mask)
1367 {
1368     int ret = -EINVAL;
1369     bool set, pend, virt;
1370     target_ulong priv, isel, vgein, xlen, nval, wmask;
1371 
1372     /* Translate CSR number for VS-mode */
1373     csrno = aia_xlate_vs_csrno(env, csrno);
1374 
1375     /* Decode register details from CSR number */
1376     virt = set = pend = false;
1377     switch (csrno) {
1378     case CSR_MSETEIPNUM:
1379         priv = PRV_M;
1380         set = true;
1381         pend = true;
1382         break;
1383     case CSR_MCLREIPNUM:
1384         priv = PRV_M;
1385         pend = true;
1386         break;
1387     case CSR_MSETEIENUM:
1388         priv = PRV_M;
1389         set = true;
1390         break;
1391     case CSR_MCLREIENUM:
1392         priv = PRV_M;
1393         break;
1394     case CSR_SSETEIPNUM:
1395         priv = PRV_S;
1396         set = true;
1397         pend = true;
1398         break;
1399     case CSR_SCLREIPNUM:
1400         priv = PRV_S;
1401         pend = true;
1402         break;
1403     case CSR_SSETEIENUM:
1404         priv = PRV_S;
1405         set = true;
1406         break;
1407     case CSR_SCLREIENUM:
1408         priv = PRV_S;
1409         break;
1410     case CSR_VSSETEIPNUM:
1411         priv = PRV_S;
1412         virt = true;
1413         set = true;
1414         pend = true;
1415         break;
1416     case CSR_VSCLREIPNUM:
1417         priv = PRV_S;
1418         virt = true;
1419         pend = true;
1420         break;
1421     case CSR_VSSETEIENUM:
1422         priv = PRV_S;
1423         virt = true;
1424         set = true;
1425         break;
1426     case CSR_VSCLREIENUM:
1427         priv = PRV_S;
1428         virt = true;
1429         break;
1430     default:
1431          goto done;
1432     };
1433 
1434     /* IMSIC CSRs only available when machine implements IMSIC. */
1435     if (!env->aia_ireg_rmw_fn[priv]) {
1436         goto done;
1437     }
1438 
1439     /* Find the selected guest interrupt file */
1440     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
1441 
1442     /* Selected guest interrupt file should be valid */
1443     if (virt && (!vgein || env->geilen < vgein)) {
1444         goto done;
1445     }
1446 
1447     /* Set/Clear CSRs always read zero */
1448     if (val) {
1449         *val = 0;
1450     }
1451 
1452     if (wr_mask) {
1453         /* Get interrupt number */
1454         new_val &= wr_mask;
1455 
1456         /* Find target interrupt pending/enable register */
1457         xlen = riscv_cpu_mxl_bits(env);
1458         isel = (new_val / xlen);
1459         isel *= (xlen / IMSIC_EIPx_BITS);
1460         isel += (pend) ? ISELECT_IMSIC_EIP0 : ISELECT_IMSIC_EIE0;
1461 
1462         /* Find the interrupt bit to be set/clear */
1463         wmask = ((target_ulong)1) << (new_val % xlen);
1464         nval = (set) ? wmask : 0;
1465 
1466         /* Call machine specific IMSIC register emulation */
1467         ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
1468                                          AIA_MAKE_IREG(isel, priv, virt,
1469                                                        vgein, xlen),
1470                                          NULL, nval, wmask);
1471     } else {
1472         ret = 0;
1473     }
1474 
1475 done:
1476     if (ret) {
1477         return (riscv_cpu_virt_enabled(env) && virt) ?
1478                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
1479     }
1480     return RISCV_EXCP_NONE;
1481 }
1482 
1483 static int rmw_xtopei(CPURISCVState *env, int csrno, target_ulong *val,
1484                       target_ulong new_val, target_ulong wr_mask)
1485 {
1486     bool virt;
1487     int ret = -EINVAL;
1488     target_ulong priv, vgein;
1489 
1490     /* Translate CSR number for VS-mode */
1491     csrno = aia_xlate_vs_csrno(env, csrno);
1492 
1493     /* Decode register details from CSR number */
1494     virt = false;
1495     switch (csrno) {
1496     case CSR_MTOPEI:
1497         priv = PRV_M;
1498         break;
1499     case CSR_STOPEI:
1500         priv = PRV_S;
1501         break;
1502     case CSR_VSTOPEI:
1503         priv = PRV_S;
1504         virt = true;
1505         break;
1506     default:
1507         goto done;
1508     };
1509 
1510     /* IMSIC CSRs only available when machine implements IMSIC. */
1511     if (!env->aia_ireg_rmw_fn[priv]) {
1512         goto done;
1513     }
1514 
1515     /* Find the selected guest interrupt file */
1516     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
1517 
1518     /* Selected guest interrupt file should be valid */
1519     if (virt && (!vgein || env->geilen < vgein)) {
1520         goto done;
1521     }
1522 
1523     /* Call machine specific IMSIC register emulation for TOPEI */
1524     ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
1525                     AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, priv, virt, vgein,
1526                                   riscv_cpu_mxl_bits(env)),
1527                     val, new_val, wr_mask);
1528 
1529 done:
1530     if (ret) {
1531         return (riscv_cpu_virt_enabled(env) && virt) ?
1532                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
1533     }
1534     return RISCV_EXCP_NONE;
1535 }
1536 
1537 static RISCVException read_mtvec(CPURISCVState *env, int csrno,
1538                                  target_ulong *val)
1539 {
1540     *val = env->mtvec;
1541     return RISCV_EXCP_NONE;
1542 }
1543 
1544 static RISCVException write_mtvec(CPURISCVState *env, int csrno,
1545                                   target_ulong val)
1546 {
1547     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
1548     if ((val & 3) < 2) {
1549         env->mtvec = val;
1550     } else {
1551         qemu_log_mask(LOG_UNIMP, "CSR_MTVEC: reserved mode not supported\n");
1552     }
1553     return RISCV_EXCP_NONE;
1554 }
1555 
1556 static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
1557                                          target_ulong *val)
1558 {
1559     if (env->priv_ver < PRIV_VERSION_1_11_0) {
1560         return RISCV_EXCP_ILLEGAL_INST;
1561     }
1562 
1563     *val = env->mcountinhibit;
1564     return RISCV_EXCP_NONE;
1565 }
1566 
1567 static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
1568                                           target_ulong val)
1569 {
1570     if (env->priv_ver < PRIV_VERSION_1_11_0) {
1571         return RISCV_EXCP_ILLEGAL_INST;
1572     }
1573 
1574     env->mcountinhibit = val;
1575     return RISCV_EXCP_NONE;
1576 }
1577 
1578 static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
1579                                       target_ulong *val)
1580 {
1581     *val = env->mcounteren;
1582     return RISCV_EXCP_NONE;
1583 }
1584 
1585 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
1586                                        target_ulong val)
1587 {
1588     env->mcounteren = val;
1589     return RISCV_EXCP_NONE;
1590 }
1591 
1592 /* Machine Trap Handling */
1593 static RISCVException read_mscratch_i128(CPURISCVState *env, int csrno,
1594                                          Int128 *val)
1595 {
1596     *val = int128_make128(env->mscratch, env->mscratchh);
1597     return RISCV_EXCP_NONE;
1598 }
1599 
1600 static RISCVException write_mscratch_i128(CPURISCVState *env, int csrno,
1601                                           Int128 val)
1602 {
1603     env->mscratch = int128_getlo(val);
1604     env->mscratchh = int128_gethi(val);
1605     return RISCV_EXCP_NONE;
1606 }
1607 
1608 static RISCVException read_mscratch(CPURISCVState *env, int csrno,
1609                                     target_ulong *val)
1610 {
1611     *val = env->mscratch;
1612     return RISCV_EXCP_NONE;
1613 }
1614 
1615 static RISCVException write_mscratch(CPURISCVState *env, int csrno,
1616                                      target_ulong val)
1617 {
1618     env->mscratch = val;
1619     return RISCV_EXCP_NONE;
1620 }
1621 
1622 static RISCVException read_mepc(CPURISCVState *env, int csrno,
1623                                      target_ulong *val)
1624 {
1625     *val = env->mepc;
1626     return RISCV_EXCP_NONE;
1627 }
1628 
1629 static RISCVException write_mepc(CPURISCVState *env, int csrno,
1630                                      target_ulong val)
1631 {
1632     env->mepc = val;
1633     return RISCV_EXCP_NONE;
1634 }
1635 
1636 static RISCVException read_mcause(CPURISCVState *env, int csrno,
1637                                      target_ulong *val)
1638 {
1639     *val = env->mcause;
1640     return RISCV_EXCP_NONE;
1641 }
1642 
1643 static RISCVException write_mcause(CPURISCVState *env, int csrno,
1644                                      target_ulong val)
1645 {
1646     env->mcause = val;
1647     return RISCV_EXCP_NONE;
1648 }
1649 
1650 static RISCVException read_mtval(CPURISCVState *env, int csrno,
1651                                  target_ulong *val)
1652 {
1653     *val = env->mtval;
1654     return RISCV_EXCP_NONE;
1655 }
1656 
1657 static RISCVException write_mtval(CPURISCVState *env, int csrno,
1658                                   target_ulong val)
1659 {
1660     env->mtval = val;
1661     return RISCV_EXCP_NONE;
1662 }
1663 
1664 /* Execution environment configuration setup */
1665 static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
1666                                  target_ulong *val)
1667 {
1668     *val = env->menvcfg;
1669     return RISCV_EXCP_NONE;
1670 }
1671 
1672 static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
1673                                   target_ulong val)
1674 {
1675     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE | MENVCFG_CBZE;
1676 
1677     if (riscv_cpu_mxl(env) == MXL_RV64) {
1678         mask |= MENVCFG_PBMTE | MENVCFG_STCE;
1679     }
1680     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
1681 
1682     return RISCV_EXCP_NONE;
1683 }
1684 
1685 static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
1686                                  target_ulong *val)
1687 {
1688     *val = env->menvcfg >> 32;
1689     return RISCV_EXCP_NONE;
1690 }
1691 
1692 static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
1693                                   target_ulong val)
1694 {
1695     uint64_t mask = MENVCFG_PBMTE | MENVCFG_STCE;
1696     uint64_t valh = (uint64_t)val << 32;
1697 
1698     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
1699 
1700     return RISCV_EXCP_NONE;
1701 }
1702 
1703 static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
1704                                  target_ulong *val)
1705 {
1706     *val = env->senvcfg;
1707     return RISCV_EXCP_NONE;
1708 }
1709 
1710 static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
1711                                   target_ulong val)
1712 {
1713     uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
1714 
1715     env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
1716 
1717     return RISCV_EXCP_NONE;
1718 }
1719 
1720 static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
1721                                  target_ulong *val)
1722 {
1723     *val = env->henvcfg;
1724     return RISCV_EXCP_NONE;
1725 }
1726 
1727 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
1728                                   target_ulong val)
1729 {
1730     uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
1731 
1732     if (riscv_cpu_mxl(env) == MXL_RV64) {
1733         mask |= HENVCFG_PBMTE | HENVCFG_STCE;
1734     }
1735 
1736     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
1737 
1738     return RISCV_EXCP_NONE;
1739 }
1740 
1741 static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
1742                                  target_ulong *val)
1743 {
1744     *val = env->henvcfg >> 32;
1745     return RISCV_EXCP_NONE;
1746 }
1747 
1748 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
1749                                   target_ulong val)
1750 {
1751     uint64_t mask = HENVCFG_PBMTE | HENVCFG_STCE;
1752     uint64_t valh = (uint64_t)val << 32;
1753 
1754     env->henvcfg = (env->henvcfg & ~mask) | (valh & mask);
1755 
1756     return RISCV_EXCP_NONE;
1757 }
1758 
1759 static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
1760                                 uint64_t *ret_val,
1761                                 uint64_t new_val, uint64_t wr_mask)
1762 {
1763     RISCVCPU *cpu = env_archcpu(env);
1764     uint64_t old_mip, mask = wr_mask & delegable_ints;
1765     uint32_t gin;
1766 
1767     if (mask & MIP_SEIP) {
1768         env->software_seip = new_val & MIP_SEIP;
1769         new_val |= env->external_seip * MIP_SEIP;
1770     }
1771 
1772     if (mask) {
1773         old_mip = riscv_cpu_update_mip(cpu, mask, (new_val & mask));
1774     } else {
1775         old_mip = env->mip;
1776     }
1777 
1778     if (csrno != CSR_HVIP) {
1779         gin = get_field(env->hstatus, HSTATUS_VGEIN);
1780         old_mip |= (env->hgeip & ((target_ulong)1 << gin)) ? MIP_VSEIP : 0;
1781     }
1782 
1783     if (ret_val) {
1784         *ret_val = old_mip;
1785     }
1786 
1787     return RISCV_EXCP_NONE;
1788 }
1789 
1790 static RISCVException rmw_mip(CPURISCVState *env, int csrno,
1791                               target_ulong *ret_val,
1792                               target_ulong new_val, target_ulong wr_mask)
1793 {
1794     uint64_t rval;
1795     RISCVException ret;
1796 
1797     ret = rmw_mip64(env, csrno, &rval, new_val, wr_mask);
1798     if (ret_val) {
1799         *ret_val = rval;
1800     }
1801 
1802     return ret;
1803 }
1804 
1805 static RISCVException rmw_miph(CPURISCVState *env, int csrno,
1806                                target_ulong *ret_val,
1807                                target_ulong new_val, target_ulong wr_mask)
1808 {
1809     uint64_t rval;
1810     RISCVException ret;
1811 
1812     ret = rmw_mip64(env, csrno, &rval,
1813         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1814     if (ret_val) {
1815         *ret_val = rval >> 32;
1816     }
1817 
1818     return ret;
1819 }
1820 
1821 /* Supervisor Trap Setup */
1822 static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
1823                                         Int128 *val)
1824 {
1825     uint64_t mask = sstatus_v1_10_mask;
1826     uint64_t sstatus = env->mstatus & mask;
1827     if (env->xl != MXL_RV32 || env->debugger) {
1828         mask |= SSTATUS64_UXL;
1829     }
1830 
1831     *val = int128_make128(sstatus, add_status_sd(MXL_RV128, sstatus));
1832     return RISCV_EXCP_NONE;
1833 }
1834 
1835 static RISCVException read_sstatus(CPURISCVState *env, int csrno,
1836                                    target_ulong *val)
1837 {
1838     target_ulong mask = (sstatus_v1_10_mask);
1839     if (env->xl != MXL_RV32 || env->debugger) {
1840         mask |= SSTATUS64_UXL;
1841     }
1842     /* TODO: Use SXL not MXL. */
1843     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus & mask);
1844     return RISCV_EXCP_NONE;
1845 }
1846 
1847 static RISCVException write_sstatus(CPURISCVState *env, int csrno,
1848                                     target_ulong val)
1849 {
1850     target_ulong mask = (sstatus_v1_10_mask);
1851 
1852     if (env->xl != MXL_RV32 || env->debugger) {
1853         if ((val & SSTATUS64_UXL) != 0) {
1854             mask |= SSTATUS64_UXL;
1855         }
1856     }
1857     target_ulong newval = (env->mstatus & ~mask) | (val & mask);
1858     return write_mstatus(env, CSR_MSTATUS, newval);
1859 }
1860 
1861 static RISCVException rmw_vsie64(CPURISCVState *env, int csrno,
1862                                  uint64_t *ret_val,
1863                                  uint64_t new_val, uint64_t wr_mask)
1864 {
1865     RISCVException ret;
1866     uint64_t rval, vsbits, mask = env->hideleg & VS_MODE_INTERRUPTS;
1867 
1868     /* Bring VS-level bits to correct position */
1869     vsbits = new_val & (VS_MODE_INTERRUPTS >> 1);
1870     new_val &= ~(VS_MODE_INTERRUPTS >> 1);
1871     new_val |= vsbits << 1;
1872     vsbits = wr_mask & (VS_MODE_INTERRUPTS >> 1);
1873     wr_mask &= ~(VS_MODE_INTERRUPTS >> 1);
1874     wr_mask |= vsbits << 1;
1875 
1876     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask & mask);
1877     if (ret_val) {
1878         rval &= mask;
1879         vsbits = rval & VS_MODE_INTERRUPTS;
1880         rval &= ~VS_MODE_INTERRUPTS;
1881         *ret_val = rval | (vsbits >> 1);
1882     }
1883 
1884     return ret;
1885 }
1886 
1887 static RISCVException rmw_vsie(CPURISCVState *env, int csrno,
1888                                target_ulong *ret_val,
1889                                target_ulong new_val, target_ulong wr_mask)
1890 {
1891     uint64_t rval;
1892     RISCVException ret;
1893 
1894     ret = rmw_vsie64(env, csrno, &rval, new_val, wr_mask);
1895     if (ret_val) {
1896         *ret_val = rval;
1897     }
1898 
1899     return ret;
1900 }
1901 
1902 static RISCVException rmw_vsieh(CPURISCVState *env, int csrno,
1903                                 target_ulong *ret_val,
1904                                 target_ulong new_val, target_ulong wr_mask)
1905 {
1906     uint64_t rval;
1907     RISCVException ret;
1908 
1909     ret = rmw_vsie64(env, csrno, &rval,
1910         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1911     if (ret_val) {
1912         *ret_val = rval >> 32;
1913     }
1914 
1915     return ret;
1916 }
1917 
1918 static RISCVException rmw_sie64(CPURISCVState *env, int csrno,
1919                                 uint64_t *ret_val,
1920                                 uint64_t new_val, uint64_t wr_mask)
1921 {
1922     RISCVException ret;
1923     uint64_t mask = env->mideleg & S_MODE_INTERRUPTS;
1924 
1925     if (riscv_cpu_virt_enabled(env)) {
1926         if (env->hvictl & HVICTL_VTI) {
1927             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
1928         }
1929         ret = rmw_vsie64(env, CSR_VSIE, ret_val, new_val, wr_mask);
1930     } else {
1931         ret = rmw_mie64(env, csrno, ret_val, new_val, wr_mask & mask);
1932     }
1933 
1934     if (ret_val) {
1935         *ret_val &= mask;
1936     }
1937 
1938     return ret;
1939 }
1940 
1941 static RISCVException rmw_sie(CPURISCVState *env, int csrno,
1942                               target_ulong *ret_val,
1943                               target_ulong new_val, target_ulong wr_mask)
1944 {
1945     uint64_t rval;
1946     RISCVException ret;
1947 
1948     ret = rmw_sie64(env, csrno, &rval, new_val, wr_mask);
1949     if (ret == RISCV_EXCP_NONE && ret_val) {
1950         *ret_val = rval;
1951     }
1952 
1953     return ret;
1954 }
1955 
1956 static RISCVException rmw_sieh(CPURISCVState *env, int csrno,
1957                                target_ulong *ret_val,
1958                                target_ulong new_val, target_ulong wr_mask)
1959 {
1960     uint64_t rval;
1961     RISCVException ret;
1962 
1963     ret = rmw_sie64(env, csrno, &rval,
1964         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1965     if (ret_val) {
1966         *ret_val = rval >> 32;
1967     }
1968 
1969     return ret;
1970 }
1971 
1972 static RISCVException read_stvec(CPURISCVState *env, int csrno,
1973                                  target_ulong *val)
1974 {
1975     *val = env->stvec;
1976     return RISCV_EXCP_NONE;
1977 }
1978 
1979 static RISCVException write_stvec(CPURISCVState *env, int csrno,
1980                                   target_ulong val)
1981 {
1982     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
1983     if ((val & 3) < 2) {
1984         env->stvec = val;
1985     } else {
1986         qemu_log_mask(LOG_UNIMP, "CSR_STVEC: reserved mode not supported\n");
1987     }
1988     return RISCV_EXCP_NONE;
1989 }
1990 
1991 static RISCVException read_scounteren(CPURISCVState *env, int csrno,
1992                                       target_ulong *val)
1993 {
1994     *val = env->scounteren;
1995     return RISCV_EXCP_NONE;
1996 }
1997 
1998 static RISCVException write_scounteren(CPURISCVState *env, int csrno,
1999                                        target_ulong val)
2000 {
2001     env->scounteren = val;
2002     return RISCV_EXCP_NONE;
2003 }
2004 
2005 /* Supervisor Trap Handling */
2006 static RISCVException read_sscratch_i128(CPURISCVState *env, int csrno,
2007                                          Int128 *val)
2008 {
2009     *val = int128_make128(env->sscratch, env->sscratchh);
2010     return RISCV_EXCP_NONE;
2011 }
2012 
2013 static RISCVException write_sscratch_i128(CPURISCVState *env, int csrno,
2014                                           Int128 val)
2015 {
2016     env->sscratch = int128_getlo(val);
2017     env->sscratchh = int128_gethi(val);
2018     return RISCV_EXCP_NONE;
2019 }
2020 
2021 static RISCVException read_sscratch(CPURISCVState *env, int csrno,
2022                                     target_ulong *val)
2023 {
2024     *val = env->sscratch;
2025     return RISCV_EXCP_NONE;
2026 }
2027 
2028 static RISCVException write_sscratch(CPURISCVState *env, int csrno,
2029                                      target_ulong val)
2030 {
2031     env->sscratch = val;
2032     return RISCV_EXCP_NONE;
2033 }
2034 
2035 static RISCVException read_sepc(CPURISCVState *env, int csrno,
2036                                 target_ulong *val)
2037 {
2038     *val = env->sepc;
2039     return RISCV_EXCP_NONE;
2040 }
2041 
2042 static RISCVException write_sepc(CPURISCVState *env, int csrno,
2043                                  target_ulong val)
2044 {
2045     env->sepc = val;
2046     return RISCV_EXCP_NONE;
2047 }
2048 
2049 static RISCVException read_scause(CPURISCVState *env, int csrno,
2050                                   target_ulong *val)
2051 {
2052     *val = env->scause;
2053     return RISCV_EXCP_NONE;
2054 }
2055 
2056 static RISCVException write_scause(CPURISCVState *env, int csrno,
2057                                    target_ulong val)
2058 {
2059     env->scause = val;
2060     return RISCV_EXCP_NONE;
2061 }
2062 
2063 static RISCVException read_stval(CPURISCVState *env, int csrno,
2064                                  target_ulong *val)
2065 {
2066     *val = env->stval;
2067     return RISCV_EXCP_NONE;
2068 }
2069 
2070 static RISCVException write_stval(CPURISCVState *env, int csrno,
2071                                   target_ulong val)
2072 {
2073     env->stval = val;
2074     return RISCV_EXCP_NONE;
2075 }
2076 
2077 static RISCVException rmw_vsip64(CPURISCVState *env, int csrno,
2078                                  uint64_t *ret_val,
2079                                  uint64_t new_val, uint64_t wr_mask)
2080 {
2081     RISCVException ret;
2082     uint64_t rval, vsbits, mask = env->hideleg & vsip_writable_mask;
2083 
2084     /* Bring VS-level bits to correct position */
2085     vsbits = new_val & (VS_MODE_INTERRUPTS >> 1);
2086     new_val &= ~(VS_MODE_INTERRUPTS >> 1);
2087     new_val |= vsbits << 1;
2088     vsbits = wr_mask & (VS_MODE_INTERRUPTS >> 1);
2089     wr_mask &= ~(VS_MODE_INTERRUPTS >> 1);
2090     wr_mask |= vsbits << 1;
2091 
2092     ret = rmw_mip64(env, csrno, &rval, new_val, wr_mask & mask);
2093     if (ret_val) {
2094         rval &= mask;
2095         vsbits = rval & VS_MODE_INTERRUPTS;
2096         rval &= ~VS_MODE_INTERRUPTS;
2097         *ret_val = rval | (vsbits >> 1);
2098     }
2099 
2100     return ret;
2101 }
2102 
2103 static RISCVException rmw_vsip(CPURISCVState *env, int csrno,
2104                                target_ulong *ret_val,
2105                                target_ulong new_val, target_ulong wr_mask)
2106 {
2107     uint64_t rval;
2108     RISCVException ret;
2109 
2110     ret = rmw_vsip64(env, csrno, &rval, new_val, wr_mask);
2111     if (ret_val) {
2112         *ret_val = rval;
2113     }
2114 
2115     return ret;
2116 }
2117 
2118 static RISCVException rmw_vsiph(CPURISCVState *env, int csrno,
2119                                 target_ulong *ret_val,
2120                                 target_ulong new_val, target_ulong wr_mask)
2121 {
2122     uint64_t rval;
2123     RISCVException ret;
2124 
2125     ret = rmw_vsip64(env, csrno, &rval,
2126         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2127     if (ret_val) {
2128         *ret_val = rval >> 32;
2129     }
2130 
2131     return ret;
2132 }
2133 
2134 static RISCVException rmw_sip64(CPURISCVState *env, int csrno,
2135                                 uint64_t *ret_val,
2136                                 uint64_t new_val, uint64_t wr_mask)
2137 {
2138     RISCVException ret;
2139     uint64_t mask = env->mideleg & sip_writable_mask;
2140 
2141     if (riscv_cpu_virt_enabled(env)) {
2142         if (env->hvictl & HVICTL_VTI) {
2143             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
2144         }
2145         ret = rmw_vsip64(env, CSR_VSIP, ret_val, new_val, wr_mask);
2146     } else {
2147         ret = rmw_mip64(env, csrno, ret_val, new_val, wr_mask & mask);
2148     }
2149 
2150     if (ret_val) {
2151         *ret_val &= env->mideleg & S_MODE_INTERRUPTS;
2152     }
2153 
2154     return ret;
2155 }
2156 
2157 static RISCVException rmw_sip(CPURISCVState *env, int csrno,
2158                               target_ulong *ret_val,
2159                               target_ulong new_val, target_ulong wr_mask)
2160 {
2161     uint64_t rval;
2162     RISCVException ret;
2163 
2164     ret = rmw_sip64(env, csrno, &rval, new_val, wr_mask);
2165     if (ret_val) {
2166         *ret_val = rval;
2167     }
2168 
2169     return ret;
2170 }
2171 
2172 static RISCVException rmw_siph(CPURISCVState *env, int csrno,
2173                                target_ulong *ret_val,
2174                                target_ulong new_val, target_ulong wr_mask)
2175 {
2176     uint64_t rval;
2177     RISCVException ret;
2178 
2179     ret = rmw_sip64(env, csrno, &rval,
2180         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2181     if (ret_val) {
2182         *ret_val = rval >> 32;
2183     }
2184 
2185     return ret;
2186 }
2187 
2188 /* Supervisor Protection and Translation */
2189 static RISCVException read_satp(CPURISCVState *env, int csrno,
2190                                 target_ulong *val)
2191 {
2192     if (!riscv_feature(env, RISCV_FEATURE_MMU)) {
2193         *val = 0;
2194         return RISCV_EXCP_NONE;
2195     }
2196 
2197     if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
2198         return RISCV_EXCP_ILLEGAL_INST;
2199     } else {
2200         *val = env->satp;
2201     }
2202 
2203     return RISCV_EXCP_NONE;
2204 }
2205 
2206 static RISCVException write_satp(CPURISCVState *env, int csrno,
2207                                  target_ulong val)
2208 {
2209     target_ulong vm, mask;
2210 
2211     if (!riscv_feature(env, RISCV_FEATURE_MMU)) {
2212         return RISCV_EXCP_NONE;
2213     }
2214 
2215     if (riscv_cpu_mxl(env) == MXL_RV32) {
2216         vm = validate_vm(env, get_field(val, SATP32_MODE));
2217         mask = (val ^ env->satp) & (SATP32_MODE | SATP32_ASID | SATP32_PPN);
2218     } else {
2219         vm = validate_vm(env, get_field(val, SATP64_MODE));
2220         mask = (val ^ env->satp) & (SATP64_MODE | SATP64_ASID | SATP64_PPN);
2221     }
2222 
2223     if (vm && mask) {
2224         if (env->priv == PRV_S && get_field(env->mstatus, MSTATUS_TVM)) {
2225             return RISCV_EXCP_ILLEGAL_INST;
2226         } else {
2227             /*
2228              * The ISA defines SATP.MODE=Bare as "no translation", but we still
2229              * pass these through QEMU's TLB emulation as it improves
2230              * performance.  Flushing the TLB on SATP writes with paging
2231              * enabled avoids leaking those invalid cached mappings.
2232              */
2233             tlb_flush(env_cpu(env));
2234             env->satp = val;
2235         }
2236     }
2237     return RISCV_EXCP_NONE;
2238 }
2239 
2240 static int read_vstopi(CPURISCVState *env, int csrno, target_ulong *val)
2241 {
2242     int irq, ret;
2243     target_ulong topei;
2244     uint64_t vseip, vsgein;
2245     uint32_t iid, iprio, hviid, hviprio, gein;
2246     uint32_t s, scount = 0, siid[VSTOPI_NUM_SRCS], siprio[VSTOPI_NUM_SRCS];
2247 
2248     gein = get_field(env->hstatus, HSTATUS_VGEIN);
2249     hviid = get_field(env->hvictl, HVICTL_IID);
2250     hviprio = get_field(env->hvictl, HVICTL_IPRIO);
2251 
2252     if (gein) {
2253         vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
2254         vseip = env->mie & (env->mip | vsgein) & MIP_VSEIP;
2255         if (gein <= env->geilen && vseip) {
2256             siid[scount] = IRQ_S_EXT;
2257             siprio[scount] = IPRIO_MMAXIPRIO + 1;
2258             if (env->aia_ireg_rmw_fn[PRV_S]) {
2259                 /*
2260                  * Call machine specific IMSIC register emulation for
2261                  * reading TOPEI.
2262                  */
2263                 ret = env->aia_ireg_rmw_fn[PRV_S](
2264                         env->aia_ireg_rmw_fn_arg[PRV_S],
2265                         AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, PRV_S, true, gein,
2266                                       riscv_cpu_mxl_bits(env)),
2267                         &topei, 0, 0);
2268                 if (!ret && topei) {
2269                     siprio[scount] = topei & IMSIC_TOPEI_IPRIO_MASK;
2270                 }
2271             }
2272             scount++;
2273         }
2274     } else {
2275         if (hviid == IRQ_S_EXT && hviprio) {
2276             siid[scount] = IRQ_S_EXT;
2277             siprio[scount] = hviprio;
2278             scount++;
2279         }
2280     }
2281 
2282     if (env->hvictl & HVICTL_VTI) {
2283         if (hviid != IRQ_S_EXT) {
2284             siid[scount] = hviid;
2285             siprio[scount] = hviprio;
2286             scount++;
2287         }
2288     } else {
2289         irq = riscv_cpu_vsirq_pending(env);
2290         if (irq != IRQ_S_EXT && 0 < irq && irq <= 63) {
2291             siid[scount] = irq;
2292             siprio[scount] = env->hviprio[irq];
2293             scount++;
2294         }
2295     }
2296 
2297     iid = 0;
2298     iprio = UINT_MAX;
2299     for (s = 0; s < scount; s++) {
2300         if (siprio[s] < iprio) {
2301             iid = siid[s];
2302             iprio = siprio[s];
2303         }
2304     }
2305 
2306     if (iid) {
2307         if (env->hvictl & HVICTL_IPRIOM) {
2308             if (iprio > IPRIO_MMAXIPRIO) {
2309                 iprio = IPRIO_MMAXIPRIO;
2310             }
2311             if (!iprio) {
2312                 if (riscv_cpu_default_priority(iid) > IPRIO_DEFAULT_S) {
2313                     iprio = IPRIO_MMAXIPRIO;
2314                 }
2315             }
2316         } else {
2317             iprio = 1;
2318         }
2319     } else {
2320         iprio = 0;
2321     }
2322 
2323     *val = (iid & TOPI_IID_MASK) << TOPI_IID_SHIFT;
2324     *val |= iprio;
2325     return RISCV_EXCP_NONE;
2326 }
2327 
2328 static int read_stopi(CPURISCVState *env, int csrno, target_ulong *val)
2329 {
2330     int irq;
2331     uint8_t iprio;
2332 
2333     if (riscv_cpu_virt_enabled(env)) {
2334         return read_vstopi(env, CSR_VSTOPI, val);
2335     }
2336 
2337     irq = riscv_cpu_sirq_pending(env);
2338     if (irq <= 0 || irq > 63) {
2339         *val = 0;
2340     } else {
2341         iprio = env->siprio[irq];
2342         if (!iprio) {
2343             if (riscv_cpu_default_priority(irq) > IPRIO_DEFAULT_S) {
2344                 iprio = IPRIO_MMAXIPRIO;
2345            }
2346         }
2347         *val = (irq & TOPI_IID_MASK) << TOPI_IID_SHIFT;
2348         *val |= iprio;
2349     }
2350 
2351     return RISCV_EXCP_NONE;
2352 }
2353 
2354 /* Hypervisor Extensions */
2355 static RISCVException read_hstatus(CPURISCVState *env, int csrno,
2356                                    target_ulong *val)
2357 {
2358     *val = env->hstatus;
2359     if (riscv_cpu_mxl(env) != MXL_RV32) {
2360         /* We only support 64-bit VSXL */
2361         *val = set_field(*val, HSTATUS_VSXL, 2);
2362     }
2363     /* We only support little endian */
2364     *val = set_field(*val, HSTATUS_VSBE, 0);
2365     return RISCV_EXCP_NONE;
2366 }
2367 
2368 static RISCVException write_hstatus(CPURISCVState *env, int csrno,
2369                                     target_ulong val)
2370 {
2371     env->hstatus = val;
2372     if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
2373         qemu_log_mask(LOG_UNIMP, "QEMU does not support mixed HSXLEN options.");
2374     }
2375     if (get_field(val, HSTATUS_VSBE) != 0) {
2376         qemu_log_mask(LOG_UNIMP, "QEMU does not support big endian guests.");
2377     }
2378     return RISCV_EXCP_NONE;
2379 }
2380 
2381 static RISCVException read_hedeleg(CPURISCVState *env, int csrno,
2382                                    target_ulong *val)
2383 {
2384     *val = env->hedeleg;
2385     return RISCV_EXCP_NONE;
2386 }
2387 
2388 static RISCVException write_hedeleg(CPURISCVState *env, int csrno,
2389                                     target_ulong val)
2390 {
2391     env->hedeleg = val & vs_delegable_excps;
2392     return RISCV_EXCP_NONE;
2393 }
2394 
2395 static RISCVException rmw_hideleg64(CPURISCVState *env, int csrno,
2396                                     uint64_t *ret_val,
2397                                     uint64_t new_val, uint64_t wr_mask)
2398 {
2399     uint64_t mask = wr_mask & vs_delegable_ints;
2400 
2401     if (ret_val) {
2402         *ret_val = env->hideleg & vs_delegable_ints;
2403     }
2404 
2405     env->hideleg = (env->hideleg & ~mask) | (new_val & mask);
2406     return RISCV_EXCP_NONE;
2407 }
2408 
2409 static RISCVException rmw_hideleg(CPURISCVState *env, int csrno,
2410                                   target_ulong *ret_val,
2411                                   target_ulong new_val, target_ulong wr_mask)
2412 {
2413     uint64_t rval;
2414     RISCVException ret;
2415 
2416     ret = rmw_hideleg64(env, csrno, &rval, new_val, wr_mask);
2417     if (ret_val) {
2418         *ret_val = rval;
2419     }
2420 
2421     return ret;
2422 }
2423 
2424 static RISCVException rmw_hidelegh(CPURISCVState *env, int csrno,
2425                                    target_ulong *ret_val,
2426                                    target_ulong new_val, target_ulong wr_mask)
2427 {
2428     uint64_t rval;
2429     RISCVException ret;
2430 
2431     ret = rmw_hideleg64(env, csrno, &rval,
2432         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2433     if (ret_val) {
2434         *ret_val = rval >> 32;
2435     }
2436 
2437     return ret;
2438 }
2439 
2440 static RISCVException rmw_hvip64(CPURISCVState *env, int csrno,
2441                                  uint64_t *ret_val,
2442                                  uint64_t new_val, uint64_t wr_mask)
2443 {
2444     RISCVException ret;
2445 
2446     ret = rmw_mip64(env, csrno, ret_val, new_val,
2447                     wr_mask & hvip_writable_mask);
2448     if (ret_val) {
2449         *ret_val &= VS_MODE_INTERRUPTS;
2450     }
2451 
2452     return ret;
2453 }
2454 
2455 static RISCVException rmw_hvip(CPURISCVState *env, int csrno,
2456                                target_ulong *ret_val,
2457                                target_ulong new_val, target_ulong wr_mask)
2458 {
2459     uint64_t rval;
2460     RISCVException ret;
2461 
2462     ret = rmw_hvip64(env, csrno, &rval, new_val, wr_mask);
2463     if (ret_val) {
2464         *ret_val = rval;
2465     }
2466 
2467     return ret;
2468 }
2469 
2470 static RISCVException rmw_hviph(CPURISCVState *env, int csrno,
2471                                 target_ulong *ret_val,
2472                                 target_ulong new_val, target_ulong wr_mask)
2473 {
2474     uint64_t rval;
2475     RISCVException ret;
2476 
2477     ret = rmw_hvip64(env, csrno, &rval,
2478         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2479     if (ret_val) {
2480         *ret_val = rval >> 32;
2481     }
2482 
2483     return ret;
2484 }
2485 
2486 static RISCVException rmw_hip(CPURISCVState *env, int csrno,
2487                               target_ulong *ret_value,
2488                               target_ulong new_value, target_ulong write_mask)
2489 {
2490     int ret = rmw_mip(env, csrno, ret_value, new_value,
2491                       write_mask & hip_writable_mask);
2492 
2493     if (ret_value) {
2494         *ret_value &= HS_MODE_INTERRUPTS;
2495     }
2496     return ret;
2497 }
2498 
2499 static RISCVException rmw_hie(CPURISCVState *env, int csrno,
2500                               target_ulong *ret_val,
2501                               target_ulong new_val, target_ulong wr_mask)
2502 {
2503     uint64_t rval;
2504     RISCVException ret;
2505 
2506     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask & HS_MODE_INTERRUPTS);
2507     if (ret_val) {
2508         *ret_val = rval & HS_MODE_INTERRUPTS;
2509     }
2510 
2511     return ret;
2512 }
2513 
2514 static RISCVException read_hcounteren(CPURISCVState *env, int csrno,
2515                                       target_ulong *val)
2516 {
2517     *val = env->hcounteren;
2518     return RISCV_EXCP_NONE;
2519 }
2520 
2521 static RISCVException write_hcounteren(CPURISCVState *env, int csrno,
2522                                        target_ulong val)
2523 {
2524     env->hcounteren = val;
2525     return RISCV_EXCP_NONE;
2526 }
2527 
2528 static RISCVException read_hgeie(CPURISCVState *env, int csrno,
2529                                  target_ulong *val)
2530 {
2531     if (val) {
2532         *val = env->hgeie;
2533     }
2534     return RISCV_EXCP_NONE;
2535 }
2536 
2537 static RISCVException write_hgeie(CPURISCVState *env, int csrno,
2538                                   target_ulong val)
2539 {
2540     /* Only GEILEN:1 bits implemented and BIT0 is never implemented */
2541     val &= ((((target_ulong)1) << env->geilen) - 1) << 1;
2542     env->hgeie = val;
2543     /* Update mip.SGEIP bit */
2544     riscv_cpu_update_mip(env_archcpu(env), MIP_SGEIP,
2545                          BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
2546     return RISCV_EXCP_NONE;
2547 }
2548 
2549 static RISCVException read_htval(CPURISCVState *env, int csrno,
2550                                  target_ulong *val)
2551 {
2552     *val = env->htval;
2553     return RISCV_EXCP_NONE;
2554 }
2555 
2556 static RISCVException write_htval(CPURISCVState *env, int csrno,
2557                                   target_ulong val)
2558 {
2559     env->htval = val;
2560     return RISCV_EXCP_NONE;
2561 }
2562 
2563 static RISCVException read_htinst(CPURISCVState *env, int csrno,
2564                                   target_ulong *val)
2565 {
2566     *val = env->htinst;
2567     return RISCV_EXCP_NONE;
2568 }
2569 
2570 static RISCVException write_htinst(CPURISCVState *env, int csrno,
2571                                    target_ulong val)
2572 {
2573     return RISCV_EXCP_NONE;
2574 }
2575 
2576 static RISCVException read_hgeip(CPURISCVState *env, int csrno,
2577                                  target_ulong *val)
2578 {
2579     if (val) {
2580         *val = env->hgeip;
2581     }
2582     return RISCV_EXCP_NONE;
2583 }
2584 
2585 static RISCVException read_hgatp(CPURISCVState *env, int csrno,
2586                                  target_ulong *val)
2587 {
2588     *val = env->hgatp;
2589     return RISCV_EXCP_NONE;
2590 }
2591 
2592 static RISCVException write_hgatp(CPURISCVState *env, int csrno,
2593                                   target_ulong val)
2594 {
2595     env->hgatp = val;
2596     return RISCV_EXCP_NONE;
2597 }
2598 
2599 static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
2600                                       target_ulong *val)
2601 {
2602     if (!env->rdtime_fn) {
2603         return RISCV_EXCP_ILLEGAL_INST;
2604     }
2605 
2606     *val = env->htimedelta;
2607     return RISCV_EXCP_NONE;
2608 }
2609 
2610 static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
2611                                        target_ulong val)
2612 {
2613     if (!env->rdtime_fn) {
2614         return RISCV_EXCP_ILLEGAL_INST;
2615     }
2616 
2617     if (riscv_cpu_mxl(env) == MXL_RV32) {
2618         env->htimedelta = deposit64(env->htimedelta, 0, 32, (uint64_t)val);
2619     } else {
2620         env->htimedelta = val;
2621     }
2622     return RISCV_EXCP_NONE;
2623 }
2624 
2625 static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
2626                                        target_ulong *val)
2627 {
2628     if (!env->rdtime_fn) {
2629         return RISCV_EXCP_ILLEGAL_INST;
2630     }
2631 
2632     *val = env->htimedelta >> 32;
2633     return RISCV_EXCP_NONE;
2634 }
2635 
2636 static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
2637                                         target_ulong val)
2638 {
2639     if (!env->rdtime_fn) {
2640         return RISCV_EXCP_ILLEGAL_INST;
2641     }
2642 
2643     env->htimedelta = deposit64(env->htimedelta, 32, 32, (uint64_t)val);
2644     return RISCV_EXCP_NONE;
2645 }
2646 
2647 static int read_hvictl(CPURISCVState *env, int csrno, target_ulong *val)
2648 {
2649     *val = env->hvictl;
2650     return RISCV_EXCP_NONE;
2651 }
2652 
2653 static int write_hvictl(CPURISCVState *env, int csrno, target_ulong val)
2654 {
2655     env->hvictl = val & HVICTL_VALID_MASK;
2656     return RISCV_EXCP_NONE;
2657 }
2658 
2659 static int read_hvipriox(CPURISCVState *env, int first_index,
2660                          uint8_t *iprio, target_ulong *val)
2661 {
2662     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
2663 
2664     /* First index has to be a multiple of number of irqs per register */
2665     if (first_index % num_irqs) {
2666         return (riscv_cpu_virt_enabled(env)) ?
2667                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
2668     }
2669 
2670     /* Fill-up return value */
2671     *val = 0;
2672     for (i = 0; i < num_irqs; i++) {
2673         if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
2674             continue;
2675         }
2676         if (rdzero) {
2677             continue;
2678         }
2679         *val |= ((target_ulong)iprio[irq]) << (i * 8);
2680     }
2681 
2682     return RISCV_EXCP_NONE;
2683 }
2684 
2685 static int write_hvipriox(CPURISCVState *env, int first_index,
2686                           uint8_t *iprio, target_ulong val)
2687 {
2688     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
2689 
2690     /* First index has to be a multiple of number of irqs per register */
2691     if (first_index % num_irqs) {
2692         return (riscv_cpu_virt_enabled(env)) ?
2693                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
2694     }
2695 
2696     /* Fill-up priority arrary */
2697     for (i = 0; i < num_irqs; i++) {
2698         if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
2699             continue;
2700         }
2701         if (rdzero) {
2702             iprio[irq] = 0;
2703         } else {
2704             iprio[irq] = (val >> (i * 8)) & 0xff;
2705         }
2706     }
2707 
2708     return RISCV_EXCP_NONE;
2709 }
2710 
2711 static int read_hviprio1(CPURISCVState *env, int csrno, target_ulong *val)
2712 {
2713     return read_hvipriox(env, 0, env->hviprio, val);
2714 }
2715 
2716 static int write_hviprio1(CPURISCVState *env, int csrno, target_ulong val)
2717 {
2718     return write_hvipriox(env, 0, env->hviprio, val);
2719 }
2720 
2721 static int read_hviprio1h(CPURISCVState *env, int csrno, target_ulong *val)
2722 {
2723     return read_hvipriox(env, 4, env->hviprio, val);
2724 }
2725 
2726 static int write_hviprio1h(CPURISCVState *env, int csrno, target_ulong val)
2727 {
2728     return write_hvipriox(env, 4, env->hviprio, val);
2729 }
2730 
2731 static int read_hviprio2(CPURISCVState *env, int csrno, target_ulong *val)
2732 {
2733     return read_hvipriox(env, 8, env->hviprio, val);
2734 }
2735 
2736 static int write_hviprio2(CPURISCVState *env, int csrno, target_ulong val)
2737 {
2738     return write_hvipriox(env, 8, env->hviprio, val);
2739 }
2740 
2741 static int read_hviprio2h(CPURISCVState *env, int csrno, target_ulong *val)
2742 {
2743     return read_hvipriox(env, 12, env->hviprio, val);
2744 }
2745 
2746 static int write_hviprio2h(CPURISCVState *env, int csrno, target_ulong val)
2747 {
2748     return write_hvipriox(env, 12, env->hviprio, val);
2749 }
2750 
2751 /* Virtual CSR Registers */
2752 static RISCVException read_vsstatus(CPURISCVState *env, int csrno,
2753                                     target_ulong *val)
2754 {
2755     *val = env->vsstatus;
2756     return RISCV_EXCP_NONE;
2757 }
2758 
2759 static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
2760                                      target_ulong val)
2761 {
2762     uint64_t mask = (target_ulong)-1;
2763     if ((val & VSSTATUS64_UXL) == 0) {
2764         mask &= ~VSSTATUS64_UXL;
2765     }
2766     env->vsstatus = (env->vsstatus & ~mask) | (uint64_t)val;
2767     return RISCV_EXCP_NONE;
2768 }
2769 
2770 static int read_vstvec(CPURISCVState *env, int csrno, target_ulong *val)
2771 {
2772     *val = env->vstvec;
2773     return RISCV_EXCP_NONE;
2774 }
2775 
2776 static RISCVException write_vstvec(CPURISCVState *env, int csrno,
2777                                    target_ulong val)
2778 {
2779     env->vstvec = val;
2780     return RISCV_EXCP_NONE;
2781 }
2782 
2783 static RISCVException read_vsscratch(CPURISCVState *env, int csrno,
2784                                      target_ulong *val)
2785 {
2786     *val = env->vsscratch;
2787     return RISCV_EXCP_NONE;
2788 }
2789 
2790 static RISCVException write_vsscratch(CPURISCVState *env, int csrno,
2791                                       target_ulong val)
2792 {
2793     env->vsscratch = val;
2794     return RISCV_EXCP_NONE;
2795 }
2796 
2797 static RISCVException read_vsepc(CPURISCVState *env, int csrno,
2798                                  target_ulong *val)
2799 {
2800     *val = env->vsepc;
2801     return RISCV_EXCP_NONE;
2802 }
2803 
2804 static RISCVException write_vsepc(CPURISCVState *env, int csrno,
2805                                   target_ulong val)
2806 {
2807     env->vsepc = val;
2808     return RISCV_EXCP_NONE;
2809 }
2810 
2811 static RISCVException read_vscause(CPURISCVState *env, int csrno,
2812                                    target_ulong *val)
2813 {
2814     *val = env->vscause;
2815     return RISCV_EXCP_NONE;
2816 }
2817 
2818 static RISCVException write_vscause(CPURISCVState *env, int csrno,
2819                                     target_ulong val)
2820 {
2821     env->vscause = val;
2822     return RISCV_EXCP_NONE;
2823 }
2824 
2825 static RISCVException read_vstval(CPURISCVState *env, int csrno,
2826                                   target_ulong *val)
2827 {
2828     *val = env->vstval;
2829     return RISCV_EXCP_NONE;
2830 }
2831 
2832 static RISCVException write_vstval(CPURISCVState *env, int csrno,
2833                                    target_ulong val)
2834 {
2835     env->vstval = val;
2836     return RISCV_EXCP_NONE;
2837 }
2838 
2839 static RISCVException read_vsatp(CPURISCVState *env, int csrno,
2840                                  target_ulong *val)
2841 {
2842     *val = env->vsatp;
2843     return RISCV_EXCP_NONE;
2844 }
2845 
2846 static RISCVException write_vsatp(CPURISCVState *env, int csrno,
2847                                   target_ulong val)
2848 {
2849     env->vsatp = val;
2850     return RISCV_EXCP_NONE;
2851 }
2852 
2853 static RISCVException read_mtval2(CPURISCVState *env, int csrno,
2854                                   target_ulong *val)
2855 {
2856     *val = env->mtval2;
2857     return RISCV_EXCP_NONE;
2858 }
2859 
2860 static RISCVException write_mtval2(CPURISCVState *env, int csrno,
2861                                    target_ulong val)
2862 {
2863     env->mtval2 = val;
2864     return RISCV_EXCP_NONE;
2865 }
2866 
2867 static RISCVException read_mtinst(CPURISCVState *env, int csrno,
2868                                   target_ulong *val)
2869 {
2870     *val = env->mtinst;
2871     return RISCV_EXCP_NONE;
2872 }
2873 
2874 static RISCVException write_mtinst(CPURISCVState *env, int csrno,
2875                                    target_ulong val)
2876 {
2877     env->mtinst = val;
2878     return RISCV_EXCP_NONE;
2879 }
2880 
2881 /* Physical Memory Protection */
2882 static RISCVException read_mseccfg(CPURISCVState *env, int csrno,
2883                                    target_ulong *val)
2884 {
2885     *val = mseccfg_csr_read(env);
2886     return RISCV_EXCP_NONE;
2887 }
2888 
2889 static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
2890                          target_ulong val)
2891 {
2892     mseccfg_csr_write(env, val);
2893     return RISCV_EXCP_NONE;
2894 }
2895 
2896 static bool check_pmp_reg_index(CPURISCVState *env, uint32_t reg_index)
2897 {
2898     /* TODO: RV128 restriction check */
2899     if ((reg_index & 1) && (riscv_cpu_mxl(env) == MXL_RV64)) {
2900         return false;
2901     }
2902     return true;
2903 }
2904 
2905 static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
2906                                   target_ulong *val)
2907 {
2908     uint32_t reg_index = csrno - CSR_PMPCFG0;
2909 
2910     if (!check_pmp_reg_index(env, reg_index)) {
2911         return RISCV_EXCP_ILLEGAL_INST;
2912     }
2913     *val = pmpcfg_csr_read(env, csrno - CSR_PMPCFG0);
2914     return RISCV_EXCP_NONE;
2915 }
2916 
2917 static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
2918                                    target_ulong val)
2919 {
2920     uint32_t reg_index = csrno - CSR_PMPCFG0;
2921 
2922     if (!check_pmp_reg_index(env, reg_index)) {
2923         return RISCV_EXCP_ILLEGAL_INST;
2924     }
2925     pmpcfg_csr_write(env, csrno - CSR_PMPCFG0, val);
2926     return RISCV_EXCP_NONE;
2927 }
2928 
2929 static RISCVException read_pmpaddr(CPURISCVState *env, int csrno,
2930                                    target_ulong *val)
2931 {
2932     *val = pmpaddr_csr_read(env, csrno - CSR_PMPADDR0);
2933     return RISCV_EXCP_NONE;
2934 }
2935 
2936 static RISCVException write_pmpaddr(CPURISCVState *env, int csrno,
2937                                     target_ulong val)
2938 {
2939     pmpaddr_csr_write(env, csrno - CSR_PMPADDR0, val);
2940     return RISCV_EXCP_NONE;
2941 }
2942 
2943 static RISCVException read_tselect(CPURISCVState *env, int csrno,
2944                                    target_ulong *val)
2945 {
2946     *val = tselect_csr_read(env);
2947     return RISCV_EXCP_NONE;
2948 }
2949 
2950 static RISCVException write_tselect(CPURISCVState *env, int csrno,
2951                                     target_ulong val)
2952 {
2953     tselect_csr_write(env, val);
2954     return RISCV_EXCP_NONE;
2955 }
2956 
2957 static RISCVException read_tdata(CPURISCVState *env, int csrno,
2958                                  target_ulong *val)
2959 {
2960     /* return 0 in tdata1 to end the trigger enumeration */
2961     if (env->trigger_cur >= TRIGGER_NUM && csrno == CSR_TDATA1) {
2962         *val = 0;
2963         return RISCV_EXCP_NONE;
2964     }
2965 
2966     if (!tdata_available(env, csrno - CSR_TDATA1)) {
2967         return RISCV_EXCP_ILLEGAL_INST;
2968     }
2969 
2970     *val = tdata_csr_read(env, csrno - CSR_TDATA1);
2971     return RISCV_EXCP_NONE;
2972 }
2973 
2974 static RISCVException write_tdata(CPURISCVState *env, int csrno,
2975                                   target_ulong val)
2976 {
2977     if (!tdata_available(env, csrno - CSR_TDATA1)) {
2978         return RISCV_EXCP_ILLEGAL_INST;
2979     }
2980 
2981     tdata_csr_write(env, csrno - CSR_TDATA1, val);
2982     return RISCV_EXCP_NONE;
2983 }
2984 
2985 /*
2986  * Functions to access Pointer Masking feature registers
2987  * We have to check if current priv lvl could modify
2988  * csr in given mode
2989  */
2990 static bool check_pm_current_disabled(CPURISCVState *env, int csrno)
2991 {
2992     int csr_priv = get_field(csrno, 0x300);
2993     int pm_current;
2994 
2995     if (env->debugger) {
2996         return false;
2997     }
2998     /*
2999      * If priv lvls differ that means we're accessing csr from higher priv lvl,
3000      * so allow the access
3001      */
3002     if (env->priv != csr_priv) {
3003         return false;
3004     }
3005     switch (env->priv) {
3006     case PRV_M:
3007         pm_current = get_field(env->mmte, M_PM_CURRENT);
3008         break;
3009     case PRV_S:
3010         pm_current = get_field(env->mmte, S_PM_CURRENT);
3011         break;
3012     case PRV_U:
3013         pm_current = get_field(env->mmte, U_PM_CURRENT);
3014         break;
3015     default:
3016         g_assert_not_reached();
3017     }
3018     /* It's same priv lvl, so we allow to modify csr only if pm.current==1 */
3019     return !pm_current;
3020 }
3021 
3022 static RISCVException read_mmte(CPURISCVState *env, int csrno,
3023                                 target_ulong *val)
3024 {
3025     *val = env->mmte & MMTE_MASK;
3026     return RISCV_EXCP_NONE;
3027 }
3028 
3029 static RISCVException write_mmte(CPURISCVState *env, int csrno,
3030                                  target_ulong val)
3031 {
3032     uint64_t mstatus;
3033     target_ulong wpri_val = val & MMTE_MASK;
3034 
3035     if (val != wpri_val) {
3036         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
3037                       "MMTE: WPRI violation written 0x", val,
3038                       "vs expected 0x", wpri_val);
3039     }
3040     /* for machine mode pm.current is hardwired to 1 */
3041     wpri_val |= MMTE_M_PM_CURRENT;
3042 
3043     /* hardwiring pm.instruction bit to 0, since it's not supported yet */
3044     wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
3045     env->mmte = wpri_val | PM_EXT_DIRTY;
3046     riscv_cpu_update_mask(env);
3047 
3048     /* Set XS and SD bits, since PM CSRs are dirty */
3049     mstatus = env->mstatus | MSTATUS_XS;
3050     write_mstatus(env, csrno, mstatus);
3051     return RISCV_EXCP_NONE;
3052 }
3053 
3054 static RISCVException read_smte(CPURISCVState *env, int csrno,
3055                                 target_ulong *val)
3056 {
3057     *val = env->mmte & SMTE_MASK;
3058     return RISCV_EXCP_NONE;
3059 }
3060 
3061 static RISCVException write_smte(CPURISCVState *env, int csrno,
3062                                  target_ulong val)
3063 {
3064     target_ulong wpri_val = val & SMTE_MASK;
3065 
3066     if (val != wpri_val) {
3067         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
3068                       "SMTE: WPRI violation written 0x", val,
3069                       "vs expected 0x", wpri_val);
3070     }
3071 
3072     /* if pm.current==0 we can't modify current PM CSRs */
3073     if (check_pm_current_disabled(env, csrno)) {
3074         return RISCV_EXCP_NONE;
3075     }
3076 
3077     wpri_val |= (env->mmte & ~SMTE_MASK);
3078     write_mmte(env, csrno, wpri_val);
3079     return RISCV_EXCP_NONE;
3080 }
3081 
3082 static RISCVException read_umte(CPURISCVState *env, int csrno,
3083                                 target_ulong *val)
3084 {
3085     *val = env->mmte & UMTE_MASK;
3086     return RISCV_EXCP_NONE;
3087 }
3088 
3089 static RISCVException write_umte(CPURISCVState *env, int csrno,
3090                                  target_ulong val)
3091 {
3092     target_ulong wpri_val = val & UMTE_MASK;
3093 
3094     if (val != wpri_val) {
3095         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s" TARGET_FMT_lx "\n",
3096                       "UMTE: WPRI violation written 0x", val,
3097                       "vs expected 0x", wpri_val);
3098     }
3099 
3100     if (check_pm_current_disabled(env, csrno)) {
3101         return RISCV_EXCP_NONE;
3102     }
3103 
3104     wpri_val |= (env->mmte & ~UMTE_MASK);
3105     write_mmte(env, csrno, wpri_val);
3106     return RISCV_EXCP_NONE;
3107 }
3108 
3109 static RISCVException read_mpmmask(CPURISCVState *env, int csrno,
3110                                    target_ulong *val)
3111 {
3112     *val = env->mpmmask;
3113     return RISCV_EXCP_NONE;
3114 }
3115 
3116 static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
3117                                     target_ulong val)
3118 {
3119     uint64_t mstatus;
3120 
3121     env->mpmmask = val;
3122     if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
3123         env->cur_pmmask = val;
3124     }
3125     env->mmte |= PM_EXT_DIRTY;
3126 
3127     /* Set XS and SD bits, since PM CSRs are dirty */
3128     mstatus = env->mstatus | MSTATUS_XS;
3129     write_mstatus(env, csrno, mstatus);
3130     return RISCV_EXCP_NONE;
3131 }
3132 
3133 static RISCVException read_spmmask(CPURISCVState *env, int csrno,
3134                                    target_ulong *val)
3135 {
3136     *val = env->spmmask;
3137     return RISCV_EXCP_NONE;
3138 }
3139 
3140 static RISCVException write_spmmask(CPURISCVState *env, int csrno,
3141                                     target_ulong val)
3142 {
3143     uint64_t mstatus;
3144 
3145     /* if pm.current==0 we can't modify current PM CSRs */
3146     if (check_pm_current_disabled(env, csrno)) {
3147         return RISCV_EXCP_NONE;
3148     }
3149     env->spmmask = val;
3150     if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
3151         env->cur_pmmask = val;
3152     }
3153     env->mmte |= PM_EXT_DIRTY;
3154 
3155     /* Set XS and SD bits, since PM CSRs are dirty */
3156     mstatus = env->mstatus | MSTATUS_XS;
3157     write_mstatus(env, csrno, mstatus);
3158     return RISCV_EXCP_NONE;
3159 }
3160 
3161 static RISCVException read_upmmask(CPURISCVState *env, int csrno,
3162                                    target_ulong *val)
3163 {
3164     *val = env->upmmask;
3165     return RISCV_EXCP_NONE;
3166 }
3167 
3168 static RISCVException write_upmmask(CPURISCVState *env, int csrno,
3169                                     target_ulong val)
3170 {
3171     uint64_t mstatus;
3172 
3173     /* if pm.current==0 we can't modify current PM CSRs */
3174     if (check_pm_current_disabled(env, csrno)) {
3175         return RISCV_EXCP_NONE;
3176     }
3177     env->upmmask = val;
3178     if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
3179         env->cur_pmmask = val;
3180     }
3181     env->mmte |= PM_EXT_DIRTY;
3182 
3183     /* Set XS and SD bits, since PM CSRs are dirty */
3184     mstatus = env->mstatus | MSTATUS_XS;
3185     write_mstatus(env, csrno, mstatus);
3186     return RISCV_EXCP_NONE;
3187 }
3188 
3189 static RISCVException read_mpmbase(CPURISCVState *env, int csrno,
3190                                    target_ulong *val)
3191 {
3192     *val = env->mpmbase;
3193     return RISCV_EXCP_NONE;
3194 }
3195 
3196 static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
3197                                     target_ulong val)
3198 {
3199     uint64_t mstatus;
3200 
3201     env->mpmbase = val;
3202     if ((env->priv == PRV_M) && (env->mmte & M_PM_ENABLE)) {
3203         env->cur_pmbase = val;
3204     }
3205     env->mmte |= PM_EXT_DIRTY;
3206 
3207     /* Set XS and SD bits, since PM CSRs are dirty */
3208     mstatus = env->mstatus | MSTATUS_XS;
3209     write_mstatus(env, csrno, mstatus);
3210     return RISCV_EXCP_NONE;
3211 }
3212 
3213 static RISCVException read_spmbase(CPURISCVState *env, int csrno,
3214                                    target_ulong *val)
3215 {
3216     *val = env->spmbase;
3217     return RISCV_EXCP_NONE;
3218 }
3219 
3220 static RISCVException write_spmbase(CPURISCVState *env, int csrno,
3221                                     target_ulong val)
3222 {
3223     uint64_t mstatus;
3224 
3225     /* if pm.current==0 we can't modify current PM CSRs */
3226     if (check_pm_current_disabled(env, csrno)) {
3227         return RISCV_EXCP_NONE;
3228     }
3229     env->spmbase = val;
3230     if ((env->priv == PRV_S) && (env->mmte & S_PM_ENABLE)) {
3231         env->cur_pmbase = val;
3232     }
3233     env->mmte |= PM_EXT_DIRTY;
3234 
3235     /* Set XS and SD bits, since PM CSRs are dirty */
3236     mstatus = env->mstatus | MSTATUS_XS;
3237     write_mstatus(env, csrno, mstatus);
3238     return RISCV_EXCP_NONE;
3239 }
3240 
3241 static RISCVException read_upmbase(CPURISCVState *env, int csrno,
3242                                    target_ulong *val)
3243 {
3244     *val = env->upmbase;
3245     return RISCV_EXCP_NONE;
3246 }
3247 
3248 static RISCVException write_upmbase(CPURISCVState *env, int csrno,
3249                                     target_ulong val)
3250 {
3251     uint64_t mstatus;
3252 
3253     /* if pm.current==0 we can't modify current PM CSRs */
3254     if (check_pm_current_disabled(env, csrno)) {
3255         return RISCV_EXCP_NONE;
3256     }
3257     env->upmbase = val;
3258     if ((env->priv == PRV_U) && (env->mmte & U_PM_ENABLE)) {
3259         env->cur_pmbase = val;
3260     }
3261     env->mmte |= PM_EXT_DIRTY;
3262 
3263     /* Set XS and SD bits, since PM CSRs are dirty */
3264     mstatus = env->mstatus | MSTATUS_XS;
3265     write_mstatus(env, csrno, mstatus);
3266     return RISCV_EXCP_NONE;
3267 }
3268 
3269 #endif
3270 
3271 /* Crypto Extension */
3272 static RISCVException rmw_seed(CPURISCVState *env, int csrno,
3273                                target_ulong *ret_value,
3274                                target_ulong new_value,
3275                                target_ulong write_mask)
3276 {
3277     uint16_t random_v;
3278     Error *random_e = NULL;
3279     int random_r;
3280     target_ulong rval;
3281 
3282     random_r = qemu_guest_getrandom(&random_v, 2, &random_e);
3283     if (unlikely(random_r < 0)) {
3284         /*
3285          * Failed, for unknown reasons in the crypto subsystem.
3286          * The best we can do is log the reason and return a
3287          * failure indication to the guest.  There is no reason
3288          * we know to expect the failure to be transitory, so
3289          * indicate DEAD to avoid having the guest spin on WAIT.
3290          */
3291         qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
3292                       __func__, error_get_pretty(random_e));
3293         error_free(random_e);
3294         rval = SEED_OPST_DEAD;
3295     } else {
3296         rval = random_v | SEED_OPST_ES16;
3297     }
3298 
3299     if (ret_value) {
3300         *ret_value = rval;
3301     }
3302 
3303     return RISCV_EXCP_NONE;
3304 }
3305 
3306 /*
3307  * riscv_csrrw - read and/or update control and status register
3308  *
3309  * csrr   <->  riscv_csrrw(env, csrno, ret_value, 0, 0);
3310  * csrrw  <->  riscv_csrrw(env, csrno, ret_value, value, -1);
3311  * csrrs  <->  riscv_csrrw(env, csrno, ret_value, -1, value);
3312  * csrrc  <->  riscv_csrrw(env, csrno, ret_value, 0, value);
3313  */
3314 
3315 static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
3316                                                int csrno,
3317                                                bool write_mask,
3318                                                RISCVCPU *cpu)
3319 {
3320     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
3321     int read_only = get_field(csrno, 0xC00) == 3;
3322     int csr_min_priv = csr_ops[csrno].min_priv_ver;
3323 #if !defined(CONFIG_USER_ONLY)
3324     int csr_priv, effective_priv = env->priv;
3325 
3326     if (riscv_has_ext(env, RVH) && env->priv == PRV_S) {
3327         /*
3328          * We are in either HS or VS mode.
3329          * Add 1 to the effective privledge level to allow us to access the
3330          * Hypervisor CSRs. The `hmode` predicate will determine if access
3331          * should be allowed(HS) or if a virtual instruction exception should be
3332          * raised(VS).
3333          */
3334         effective_priv++;
3335     }
3336 
3337     csr_priv = get_field(csrno, 0x300);
3338     if (!env->debugger && (effective_priv < csr_priv)) {
3339         if (csr_priv == (PRV_S + 1) && riscv_cpu_virt_enabled(env)) {
3340             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
3341         }
3342         return RISCV_EXCP_ILLEGAL_INST;
3343     }
3344 #endif
3345     if (write_mask && read_only) {
3346         return RISCV_EXCP_ILLEGAL_INST;
3347     }
3348 
3349     /* ensure the CSR extension is enabled. */
3350     if (!cpu->cfg.ext_icsr) {
3351         return RISCV_EXCP_ILLEGAL_INST;
3352     }
3353 
3354     /* check predicate */
3355     if (!csr_ops[csrno].predicate) {
3356         return RISCV_EXCP_ILLEGAL_INST;
3357     }
3358 
3359     if (env->priv_ver < csr_min_priv) {
3360         return RISCV_EXCP_ILLEGAL_INST;
3361     }
3362 
3363     return csr_ops[csrno].predicate(env, csrno);
3364 }
3365 
3366 static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
3367                                        target_ulong *ret_value,
3368                                        target_ulong new_value,
3369                                        target_ulong write_mask)
3370 {
3371     RISCVException ret;
3372     target_ulong old_value;
3373 
3374     /* execute combined read/write operation if it exists */
3375     if (csr_ops[csrno].op) {
3376         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
3377     }
3378 
3379     /* if no accessor exists then return failure */
3380     if (!csr_ops[csrno].read) {
3381         return RISCV_EXCP_ILLEGAL_INST;
3382     }
3383     /* read old value */
3384     ret = csr_ops[csrno].read(env, csrno, &old_value);
3385     if (ret != RISCV_EXCP_NONE) {
3386         return ret;
3387     }
3388 
3389     /* write value if writable and write mask set, otherwise drop writes */
3390     if (write_mask) {
3391         new_value = (old_value & ~write_mask) | (new_value & write_mask);
3392         if (csr_ops[csrno].write) {
3393             ret = csr_ops[csrno].write(env, csrno, new_value);
3394             if (ret != RISCV_EXCP_NONE) {
3395                 return ret;
3396             }
3397         }
3398     }
3399 
3400     /* return old value */
3401     if (ret_value) {
3402         *ret_value = old_value;
3403     }
3404 
3405     return RISCV_EXCP_NONE;
3406 }
3407 
3408 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
3409                            target_ulong *ret_value,
3410                            target_ulong new_value, target_ulong write_mask)
3411 {
3412     RISCVCPU *cpu = env_archcpu(env);
3413 
3414     RISCVException ret = riscv_csrrw_check(env, csrno, write_mask, cpu);
3415     if (ret != RISCV_EXCP_NONE) {
3416         return ret;
3417     }
3418 
3419     return riscv_csrrw_do64(env, csrno, ret_value, new_value, write_mask);
3420 }
3421 
3422 static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
3423                                         Int128 *ret_value,
3424                                         Int128 new_value,
3425                                         Int128 write_mask)
3426 {
3427     RISCVException ret;
3428     Int128 old_value;
3429 
3430     /* read old value */
3431     ret = csr_ops[csrno].read128(env, csrno, &old_value);
3432     if (ret != RISCV_EXCP_NONE) {
3433         return ret;
3434     }
3435 
3436     /* write value if writable and write mask set, otherwise drop writes */
3437     if (int128_nz(write_mask)) {
3438         new_value = int128_or(int128_and(old_value, int128_not(write_mask)),
3439                               int128_and(new_value, write_mask));
3440         if (csr_ops[csrno].write128) {
3441             ret = csr_ops[csrno].write128(env, csrno, new_value);
3442             if (ret != RISCV_EXCP_NONE) {
3443                 return ret;
3444             }
3445         } else if (csr_ops[csrno].write) {
3446             /* avoids having to write wrappers for all registers */
3447             ret = csr_ops[csrno].write(env, csrno, int128_getlo(new_value));
3448             if (ret != RISCV_EXCP_NONE) {
3449                 return ret;
3450             }
3451         }
3452     }
3453 
3454     /* return old value */
3455     if (ret_value) {
3456         *ret_value = old_value;
3457     }
3458 
3459     return RISCV_EXCP_NONE;
3460 }
3461 
3462 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
3463                                 Int128 *ret_value,
3464                                 Int128 new_value, Int128 write_mask)
3465 {
3466     RISCVException ret;
3467     RISCVCPU *cpu = env_archcpu(env);
3468 
3469     ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask), cpu);
3470     if (ret != RISCV_EXCP_NONE) {
3471         return ret;
3472     }
3473 
3474     if (csr_ops[csrno].read128) {
3475         return riscv_csrrw_do128(env, csrno, ret_value, new_value, write_mask);
3476     }
3477 
3478     /*
3479      * Fall back to 64-bit version for now, if the 128-bit alternative isn't
3480      * at all defined.
3481      * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
3482      * significant), for those, this fallback is correctly handling the accesses
3483      */
3484     target_ulong old_value;
3485     ret = riscv_csrrw_do64(env, csrno, &old_value,
3486                            int128_getlo(new_value),
3487                            int128_getlo(write_mask));
3488     if (ret == RISCV_EXCP_NONE && ret_value) {
3489         *ret_value = int128_make64(old_value);
3490     }
3491     return ret;
3492 }
3493 
3494 /*
3495  * Debugger support.  If not in user mode, set env->debugger before the
3496  * riscv_csrrw call and clear it after the call.
3497  */
3498 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
3499                                  target_ulong *ret_value,
3500                                  target_ulong new_value,
3501                                  target_ulong write_mask)
3502 {
3503     RISCVException ret;
3504 #if !defined(CONFIG_USER_ONLY)
3505     env->debugger = true;
3506 #endif
3507     ret = riscv_csrrw(env, csrno, ret_value, new_value, write_mask);
3508 #if !defined(CONFIG_USER_ONLY)
3509     env->debugger = false;
3510 #endif
3511     return ret;
3512 }
3513 
3514 /* Control and Status Register function table */
3515 riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
3516     /* User Floating-Point CSRs */
3517     [CSR_FFLAGS]   = { "fflags",   fs,     read_fflags,  write_fflags },
3518     [CSR_FRM]      = { "frm",      fs,     read_frm,     write_frm    },
3519     [CSR_FCSR]     = { "fcsr",     fs,     read_fcsr,    write_fcsr   },
3520     /* Vector CSRs */
3521     [CSR_VSTART]   = { "vstart",   vs,    read_vstart,  write_vstart,
3522                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3523     [CSR_VXSAT]    = { "vxsat",    vs,    read_vxsat,   write_vxsat,
3524                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3525     [CSR_VXRM]     = { "vxrm",     vs,    read_vxrm,    write_vxrm,
3526                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3527     [CSR_VCSR]     = { "vcsr",     vs,    read_vcsr,    write_vcsr,
3528                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3529     [CSR_VL]       = { "vl",       vs,    read_vl,
3530                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3531     [CSR_VTYPE]    = { "vtype",    vs,    read_vtype,
3532                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3533     [CSR_VLENB]    = { "vlenb",    vs,    read_vlenb,
3534                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3535     /* User Timers and Counters */
3536     [CSR_CYCLE]    = { "cycle",    ctr,    read_instret  },
3537     [CSR_INSTRET]  = { "instret",  ctr,    read_instret  },
3538     [CSR_CYCLEH]   = { "cycleh",   ctr32,  read_instreth },
3539     [CSR_INSTRETH] = { "instreth", ctr32,  read_instreth },
3540 
3541     /*
3542      * In privileged mode, the monitor will have to emulate TIME CSRs only if
3543      * rdtime callback is not provided by machine/platform emulation.
3544      */
3545     [CSR_TIME]  = { "time",  ctr,   read_time  },
3546     [CSR_TIMEH] = { "timeh", ctr32, read_timeh },
3547 
3548     /* Crypto Extension */
3549     [CSR_SEED] = { "seed", seed, NULL, NULL, rmw_seed },
3550 
3551 #if !defined(CONFIG_USER_ONLY)
3552     /* Machine Timers and Counters */
3553     [CSR_MCYCLE]    = { "mcycle",    any,   read_instret  },
3554     [CSR_MINSTRET]  = { "minstret",  any,   read_instret  },
3555     [CSR_MCYCLEH]   = { "mcycleh",   any32, read_instreth },
3556     [CSR_MINSTRETH] = { "minstreth", any32, read_instreth },
3557 
3558     /* Machine Information Registers */
3559     [CSR_MVENDORID] = { "mvendorid", any,   read_mvendorid },
3560     [CSR_MARCHID]   = { "marchid",   any,   read_marchid   },
3561     [CSR_MIMPID]    = { "mimpid",    any,   read_mimpid    },
3562     [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid   },
3563 
3564     [CSR_MCONFIGPTR]  = { "mconfigptr", any,   read_zero,
3565                                         .min_priv_ver = PRIV_VERSION_1_12_0 },
3566     /* Machine Trap Setup */
3567     [CSR_MSTATUS]     = { "mstatus",    any,   read_mstatus,     write_mstatus, NULL,
3568                                                read_mstatus_i128                   },
3569     [CSR_MISA]        = { "misa",       any,   read_misa,        write_misa, NULL,
3570                                                read_misa_i128                      },
3571     [CSR_MIDELEG]     = { "mideleg",    any,   NULL,    NULL,    rmw_mideleg       },
3572     [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg,     write_medeleg     },
3573     [CSR_MIE]         = { "mie",        any,   NULL,    NULL,    rmw_mie           },
3574     [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,       write_mtvec       },
3575     [CSR_MCOUNTEREN]  = { "mcounteren", any,   read_mcounteren,  write_mcounteren  },
3576 
3577     [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,    write_mstatush    },
3578 
3579     /* Machine Trap Handling */
3580     [CSR_MSCRATCH] = { "mscratch", any,  read_mscratch,      write_mscratch, NULL,
3581                                          read_mscratch_i128, write_mscratch_i128   },
3582     [CSR_MEPC]     = { "mepc",     any,  read_mepc,     write_mepc     },
3583     [CSR_MCAUSE]   = { "mcause",   any,  read_mcause,   write_mcause   },
3584     [CSR_MTVAL]    = { "mtval",    any,  read_mtval,    write_mtval    },
3585     [CSR_MIP]      = { "mip",      any,  NULL,    NULL, rmw_mip        },
3586 
3587     /* Machine-Level Window to Indirectly Accessed Registers (AIA) */
3588     [CSR_MISELECT] = { "miselect", aia_any,   NULL, NULL,    rmw_xiselect },
3589     [CSR_MIREG]    = { "mireg",    aia_any,   NULL, NULL,    rmw_xireg },
3590 
3591     /* Machine-Level Interrupts (AIA) */
3592     [CSR_MTOPI]    = { "mtopi",    aia_any,   read_mtopi },
3593 
3594     /* Machine-Level IMSIC Interface (AIA) */
3595     [CSR_MSETEIPNUM] = { "mseteipnum", aia_any, NULL, NULL, rmw_xsetclreinum },
3596     [CSR_MCLREIPNUM] = { "mclreipnum", aia_any, NULL, NULL, rmw_xsetclreinum },
3597     [CSR_MSETEIENUM] = { "mseteienum", aia_any, NULL, NULL, rmw_xsetclreinum },
3598     [CSR_MCLREIENUM] = { "mclreienum", aia_any, NULL, NULL, rmw_xsetclreinum },
3599     [CSR_MTOPEI]     = { "mtopei",     aia_any, NULL, NULL, rmw_xtopei },
3600 
3601     /* Virtual Interrupts for Supervisor Level (AIA) */
3602     [CSR_MVIEN]      = { "mvien", aia_any, read_zero, write_ignore },
3603     [CSR_MVIP]       = { "mvip",  aia_any, read_zero, write_ignore },
3604 
3605     /* Machine-Level High-Half CSRs (AIA) */
3606     [CSR_MIDELEGH] = { "midelegh", aia_any32, NULL, NULL, rmw_midelegh },
3607     [CSR_MIEH]     = { "mieh",     aia_any32, NULL, NULL, rmw_mieh     },
3608     [CSR_MVIENH]   = { "mvienh",   aia_any32, read_zero,  write_ignore },
3609     [CSR_MVIPH]    = { "mviph",    aia_any32, read_zero,  write_ignore },
3610     [CSR_MIPH]     = { "miph",     aia_any32, NULL, NULL, rmw_miph     },
3611 
3612     /* Execution environment configuration */
3613     [CSR_MENVCFG]  = { "menvcfg",  any,   read_menvcfg,  write_menvcfg,
3614                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3615     [CSR_MENVCFGH] = { "menvcfgh", any32, read_menvcfgh, write_menvcfgh,
3616                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3617     [CSR_SENVCFG]  = { "senvcfg",  smode, read_senvcfg,  write_senvcfg,
3618                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3619     [CSR_HENVCFG]  = { "henvcfg",  hmode, read_henvcfg, write_henvcfg,
3620                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3621     [CSR_HENVCFGH] = { "henvcfgh", hmode32, read_henvcfgh, write_henvcfgh,
3622                                           .min_priv_ver = PRIV_VERSION_1_12_0 },
3623 
3624     /* Supervisor Trap Setup */
3625     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus, NULL,
3626                                               read_sstatus_i128                 },
3627     [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie          },
3628     [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec      },
3629     [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren, write_scounteren },
3630 
3631     /* Supervisor Trap Handling */
3632     [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch, NULL,
3633                                           read_sscratch_i128, write_sscratch_i128  },
3634     [CSR_SEPC]     = { "sepc",     smode, read_sepc,     write_sepc     },
3635     [CSR_SCAUSE]   = { "scause",   smode, read_scause,   write_scause   },
3636     [CSR_STVAL]    = { "stval",    smode, read_stval,   write_stval   },
3637     [CSR_SIP]      = { "sip",      smode, NULL,    NULL, rmw_sip        },
3638 
3639     /* Supervisor Protection and Translation */
3640     [CSR_SATP]     = { "satp",     smode, read_satp,    write_satp      },
3641 
3642     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
3643     [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
3644     [CSR_SIREG]      = { "sireg",      aia_smode, NULL, NULL, rmw_xireg },
3645 
3646     /* Supervisor-Level Interrupts (AIA) */
3647     [CSR_STOPI]      = { "stopi",      aia_smode, read_stopi },
3648 
3649     /* Supervisor-Level IMSIC Interface (AIA) */
3650     [CSR_SSETEIPNUM] = { "sseteipnum", aia_smode, NULL, NULL, rmw_xsetclreinum },
3651     [CSR_SCLREIPNUM] = { "sclreipnum", aia_smode, NULL, NULL, rmw_xsetclreinum },
3652     [CSR_SSETEIENUM] = { "sseteienum", aia_smode, NULL, NULL, rmw_xsetclreinum },
3653     [CSR_SCLREIENUM] = { "sclreienum", aia_smode, NULL, NULL, rmw_xsetclreinum },
3654     [CSR_STOPEI]     = { "stopei",     aia_smode, NULL, NULL, rmw_xtopei },
3655 
3656     /* Supervisor-Level High-Half CSRs (AIA) */
3657     [CSR_SIEH]       = { "sieh",   aia_smode32, NULL, NULL, rmw_sieh },
3658     [CSR_SIPH]       = { "siph",   aia_smode32, NULL, NULL, rmw_siph },
3659 
3660     [CSR_HSTATUS]     = { "hstatus",     hmode,   read_hstatus,   write_hstatus,
3661                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3662     [CSR_HEDELEG]     = { "hedeleg",     hmode,   read_hedeleg,   write_hedeleg,
3663                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3664     [CSR_HIDELEG]     = { "hideleg",     hmode,   NULL,   NULL, rmw_hideleg,
3665                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3666     [CSR_HVIP]        = { "hvip",        hmode,   NULL,   NULL,   rmw_hvip,
3667                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3668     [CSR_HIP]         = { "hip",         hmode,   NULL,   NULL,   rmw_hip,
3669                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3670     [CSR_HIE]         = { "hie",         hmode,   NULL,   NULL,    rmw_hie,
3671                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3672     [CSR_HCOUNTEREN]  = { "hcounteren",  hmode,   read_hcounteren, write_hcounteren,
3673                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3674     [CSR_HGEIE]       = { "hgeie",       hmode,   read_hgeie,       write_hgeie,
3675                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3676     [CSR_HTVAL]       = { "htval",       hmode,   read_htval,     write_htval,
3677                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3678     [CSR_HTINST]      = { "htinst",      hmode,   read_htinst,    write_htinst,
3679                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3680     [CSR_HGEIP]       = { "hgeip",       hmode,   read_hgeip,
3681                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3682     [CSR_HGATP]       = { "hgatp",       hmode,   read_hgatp,     write_hgatp,
3683                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3684     [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta, write_htimedelta,
3685                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3686     [CSR_HTIMEDELTAH] = { "htimedeltah", hmode32, read_htimedeltah, write_htimedeltah,
3687                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3688 
3689     [CSR_VSSTATUS]    = { "vsstatus",    hmode,   read_vsstatus,  write_vsstatus,
3690                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3691     [CSR_VSIP]        = { "vsip",        hmode,   NULL,    NULL,  rmw_vsip,
3692                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3693     [CSR_VSIE]        = { "vsie",        hmode,   NULL,    NULL,    rmw_vsie ,
3694                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3695     [CSR_VSTVEC]      = { "vstvec",      hmode,   read_vstvec,    write_vstvec,
3696                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3697     [CSR_VSSCRATCH]   = { "vsscratch",   hmode,   read_vsscratch, write_vsscratch,
3698                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3699     [CSR_VSEPC]       = { "vsepc",       hmode,   read_vsepc,     write_vsepc,
3700                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3701     [CSR_VSCAUSE]     = { "vscause",     hmode,   read_vscause,   write_vscause,
3702                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3703     [CSR_VSTVAL]      = { "vstval",      hmode,   read_vstval,    write_vstval,
3704                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3705     [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,     write_vsatp,
3706                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3707 
3708     [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,    write_mtval2,
3709                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3710     [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,    write_mtinst,
3711                                          .min_priv_ver = PRIV_VERSION_1_12_0 },
3712 
3713     /* Virtual Interrupts and Interrupt Priorities (H-extension with AIA) */
3714     [CSR_HVIEN]       = { "hvien",       aia_hmode, read_zero, write_ignore },
3715     [CSR_HVICTL]      = { "hvictl",      aia_hmode, read_hvictl, write_hvictl },
3716     [CSR_HVIPRIO1]    = { "hviprio1",    aia_hmode, read_hviprio1,   write_hviprio1 },
3717     [CSR_HVIPRIO2]    = { "hviprio2",    aia_hmode, read_hviprio2,   write_hviprio2 },
3718 
3719     /*
3720      * VS-Level Window to Indirectly Accessed Registers (H-extension with AIA)
3721      */
3722     [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,      rmw_xiselect },
3723     [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL,      rmw_xireg },
3724 
3725     /* VS-Level Interrupts (H-extension with AIA) */
3726     [CSR_VSTOPI]      = { "vstopi",      aia_hmode, read_vstopi },
3727 
3728     /* VS-Level IMSIC Interface (H-extension with AIA) */
3729     [CSR_VSSETEIPNUM] = { "vsseteipnum", aia_hmode, NULL, NULL, rmw_xsetclreinum },
3730     [CSR_VSCLREIPNUM] = { "vsclreipnum", aia_hmode, NULL, NULL, rmw_xsetclreinum },
3731     [CSR_VSSETEIENUM] = { "vsseteienum", aia_hmode, NULL, NULL, rmw_xsetclreinum },
3732     [CSR_VSCLREIENUM] = { "vsclreienum", aia_hmode, NULL, NULL, rmw_xsetclreinum },
3733     [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
3734 
3735     /* Hypervisor and VS-Level High-Half CSRs (H-extension with AIA) */
3736     [CSR_HIDELEGH]    = { "hidelegh",    aia_hmode32, NULL, NULL, rmw_hidelegh },
3737     [CSR_HVIENH]      = { "hvienh",      aia_hmode32, read_zero, write_ignore },
3738     [CSR_HVIPH]       = { "hviph",       aia_hmode32, NULL, NULL, rmw_hviph },
3739     [CSR_HVIPRIO1H]   = { "hviprio1h",   aia_hmode32, read_hviprio1h, write_hviprio1h },
3740     [CSR_HVIPRIO2H]   = { "hviprio2h",   aia_hmode32, read_hviprio2h, write_hviprio2h },
3741     [CSR_VSIEH]       = { "vsieh",       aia_hmode32, NULL, NULL, rmw_vsieh },
3742     [CSR_VSIPH]       = { "vsiph",       aia_hmode32, NULL, NULL, rmw_vsiph },
3743 
3744     /* Physical Memory Protection */
3745     [CSR_MSECCFG]    = { "mseccfg",  epmp, read_mseccfg, write_mseccfg,
3746                                      .min_priv_ver = PRIV_VERSION_1_12_0 },
3747     [CSR_PMPCFG0]    = { "pmpcfg0",   pmp, read_pmpcfg,  write_pmpcfg  },
3748     [CSR_PMPCFG1]    = { "pmpcfg1",   pmp, read_pmpcfg,  write_pmpcfg  },
3749     [CSR_PMPCFG2]    = { "pmpcfg2",   pmp, read_pmpcfg,  write_pmpcfg  },
3750     [CSR_PMPCFG3]    = { "pmpcfg3",   pmp, read_pmpcfg,  write_pmpcfg  },
3751     [CSR_PMPADDR0]   = { "pmpaddr0",  pmp, read_pmpaddr, write_pmpaddr },
3752     [CSR_PMPADDR1]   = { "pmpaddr1",  pmp, read_pmpaddr, write_pmpaddr },
3753     [CSR_PMPADDR2]   = { "pmpaddr2",  pmp, read_pmpaddr, write_pmpaddr },
3754     [CSR_PMPADDR3]   = { "pmpaddr3",  pmp, read_pmpaddr, write_pmpaddr },
3755     [CSR_PMPADDR4]   = { "pmpaddr4",  pmp, read_pmpaddr, write_pmpaddr },
3756     [CSR_PMPADDR5]   = { "pmpaddr5",  pmp, read_pmpaddr, write_pmpaddr },
3757     [CSR_PMPADDR6]   = { "pmpaddr6",  pmp, read_pmpaddr, write_pmpaddr },
3758     [CSR_PMPADDR7]   = { "pmpaddr7",  pmp, read_pmpaddr, write_pmpaddr },
3759     [CSR_PMPADDR8]   = { "pmpaddr8",  pmp, read_pmpaddr, write_pmpaddr },
3760     [CSR_PMPADDR9]   = { "pmpaddr9",  pmp, read_pmpaddr, write_pmpaddr },
3761     [CSR_PMPADDR10]  = { "pmpaddr10", pmp, read_pmpaddr, write_pmpaddr },
3762     [CSR_PMPADDR11]  = { "pmpaddr11", pmp, read_pmpaddr, write_pmpaddr },
3763     [CSR_PMPADDR12]  = { "pmpaddr12", pmp, read_pmpaddr, write_pmpaddr },
3764     [CSR_PMPADDR13]  = { "pmpaddr13", pmp, read_pmpaddr, write_pmpaddr },
3765     [CSR_PMPADDR14] =  { "pmpaddr14", pmp, read_pmpaddr, write_pmpaddr },
3766     [CSR_PMPADDR15] =  { "pmpaddr15", pmp, read_pmpaddr, write_pmpaddr },
3767 
3768     /* Debug CSRs */
3769     [CSR_TSELECT]   =  { "tselect", debug, read_tselect, write_tselect },
3770     [CSR_TDATA1]    =  { "tdata1",  debug, read_tdata,   write_tdata   },
3771     [CSR_TDATA2]    =  { "tdata2",  debug, read_tdata,   write_tdata   },
3772     [CSR_TDATA3]    =  { "tdata3",  debug, read_tdata,   write_tdata   },
3773 
3774     /* User Pointer Masking */
3775     [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,    write_umte    },
3776     [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask, write_upmmask },
3777     [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase, write_upmbase },
3778     /* Machine Pointer Masking */
3779     [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,    write_mmte    },
3780     [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask, write_mpmmask },
3781     [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase, write_mpmbase },
3782     /* Supervisor Pointer Masking */
3783     [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,    write_smte    },
3784     [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask, write_spmmask },
3785     [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase, write_spmbase },
3786 
3787     /* Performance Counters */
3788     [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
3789     [CSR_HPMCOUNTER4]    = { "hpmcounter4",    ctr,    read_hpmcounter },
3790     [CSR_HPMCOUNTER5]    = { "hpmcounter5",    ctr,    read_hpmcounter },
3791     [CSR_HPMCOUNTER6]    = { "hpmcounter6",    ctr,    read_hpmcounter },
3792     [CSR_HPMCOUNTER7]    = { "hpmcounter7",    ctr,    read_hpmcounter },
3793     [CSR_HPMCOUNTER8]    = { "hpmcounter8",    ctr,    read_hpmcounter },
3794     [CSR_HPMCOUNTER9]    = { "hpmcounter9",    ctr,    read_hpmcounter },
3795     [CSR_HPMCOUNTER10]   = { "hpmcounter10",   ctr,    read_hpmcounter },
3796     [CSR_HPMCOUNTER11]   = { "hpmcounter11",   ctr,    read_hpmcounter },
3797     [CSR_HPMCOUNTER12]   = { "hpmcounter12",   ctr,    read_hpmcounter },
3798     [CSR_HPMCOUNTER13]   = { "hpmcounter13",   ctr,    read_hpmcounter },
3799     [CSR_HPMCOUNTER14]   = { "hpmcounter14",   ctr,    read_hpmcounter },
3800     [CSR_HPMCOUNTER15]   = { "hpmcounter15",   ctr,    read_hpmcounter },
3801     [CSR_HPMCOUNTER16]   = { "hpmcounter16",   ctr,    read_hpmcounter },
3802     [CSR_HPMCOUNTER17]   = { "hpmcounter17",   ctr,    read_hpmcounter },
3803     [CSR_HPMCOUNTER18]   = { "hpmcounter18",   ctr,    read_hpmcounter },
3804     [CSR_HPMCOUNTER19]   = { "hpmcounter19",   ctr,    read_hpmcounter },
3805     [CSR_HPMCOUNTER20]   = { "hpmcounter20",   ctr,    read_hpmcounter },
3806     [CSR_HPMCOUNTER21]   = { "hpmcounter21",   ctr,    read_hpmcounter },
3807     [CSR_HPMCOUNTER22]   = { "hpmcounter22",   ctr,    read_hpmcounter },
3808     [CSR_HPMCOUNTER23]   = { "hpmcounter23",   ctr,    read_hpmcounter },
3809     [CSR_HPMCOUNTER24]   = { "hpmcounter24",   ctr,    read_hpmcounter },
3810     [CSR_HPMCOUNTER25]   = { "hpmcounter25",   ctr,    read_hpmcounter },
3811     [CSR_HPMCOUNTER26]   = { "hpmcounter26",   ctr,    read_hpmcounter },
3812     [CSR_HPMCOUNTER27]   = { "hpmcounter27",   ctr,    read_hpmcounter },
3813     [CSR_HPMCOUNTER28]   = { "hpmcounter28",   ctr,    read_hpmcounter },
3814     [CSR_HPMCOUNTER29]   = { "hpmcounter29",   ctr,    read_hpmcounter },
3815     [CSR_HPMCOUNTER30]   = { "hpmcounter30",   ctr,    read_hpmcounter },
3816     [CSR_HPMCOUNTER31]   = { "hpmcounter31",   ctr,    read_hpmcounter },
3817 
3818     [CSR_MHPMCOUNTER3]   = { "mhpmcounter3",   mctr,    read_hpmcounter,
3819                                                        write_mhpmcounter },
3820     [CSR_MHPMCOUNTER4]   = { "mhpmcounter4",   mctr,    read_hpmcounter,
3821                                                        write_mhpmcounter },
3822     [CSR_MHPMCOUNTER5]   = { "mhpmcounter5",   mctr,    read_hpmcounter,
3823                                                        write_mhpmcounter },
3824     [CSR_MHPMCOUNTER6]   = { "mhpmcounter6",   mctr,    read_hpmcounter,
3825                                                        write_mhpmcounter },
3826     [CSR_MHPMCOUNTER7]   = { "mhpmcounter7",   mctr,    read_hpmcounter,
3827                                                        write_mhpmcounter },
3828     [CSR_MHPMCOUNTER8]   = { "mhpmcounter8",   mctr,    read_hpmcounter,
3829                                                        write_mhpmcounter },
3830     [CSR_MHPMCOUNTER9]   = { "mhpmcounter9",   mctr,    read_hpmcounter,
3831                                                        write_mhpmcounter },
3832     [CSR_MHPMCOUNTER10]  = { "mhpmcounter10",  mctr,    read_hpmcounter,
3833                                                        write_mhpmcounter },
3834     [CSR_MHPMCOUNTER11]  = { "mhpmcounter11",  mctr,    read_hpmcounter,
3835                                                        write_mhpmcounter },
3836     [CSR_MHPMCOUNTER12]  = { "mhpmcounter12",  mctr,    read_hpmcounter,
3837                                                        write_mhpmcounter },
3838     [CSR_MHPMCOUNTER13]  = { "mhpmcounter13",  mctr,    read_hpmcounter,
3839                                                        write_mhpmcounter },
3840     [CSR_MHPMCOUNTER14]  = { "mhpmcounter14",  mctr,    read_hpmcounter,
3841                                                        write_mhpmcounter },
3842     [CSR_MHPMCOUNTER15]  = { "mhpmcounter15",  mctr,    read_hpmcounter,
3843                                                        write_mhpmcounter },
3844     [CSR_MHPMCOUNTER16]  = { "mhpmcounter16",  mctr,    read_hpmcounter,
3845                                                        write_mhpmcounter },
3846     [CSR_MHPMCOUNTER17]  = { "mhpmcounter17",  mctr,    read_hpmcounter,
3847                                                        write_mhpmcounter },
3848     [CSR_MHPMCOUNTER18]  = { "mhpmcounter18",  mctr,    read_hpmcounter,
3849                                                        write_mhpmcounter },
3850     [CSR_MHPMCOUNTER19]  = { "mhpmcounter19",  mctr,    read_hpmcounter,
3851                                                        write_mhpmcounter },
3852     [CSR_MHPMCOUNTER20]  = { "mhpmcounter20",  mctr,    read_hpmcounter,
3853                                                        write_mhpmcounter },
3854     [CSR_MHPMCOUNTER21]  = { "mhpmcounter21",  mctr,    read_hpmcounter,
3855                                                        write_mhpmcounter },
3856     [CSR_MHPMCOUNTER22]  = { "mhpmcounter22",  mctr,    read_hpmcounter,
3857                                                        write_mhpmcounter },
3858     [CSR_MHPMCOUNTER23]  = { "mhpmcounter23",  mctr,    read_hpmcounter,
3859                                                        write_mhpmcounter },
3860     [CSR_MHPMCOUNTER24]  = { "mhpmcounter24",  mctr,    read_hpmcounter,
3861                                                        write_mhpmcounter },
3862     [CSR_MHPMCOUNTER25]  = { "mhpmcounter25",  mctr,    read_hpmcounter,
3863                                                        write_mhpmcounter },
3864     [CSR_MHPMCOUNTER26]  = { "mhpmcounter26",  mctr,    read_hpmcounter,
3865                                                        write_mhpmcounter },
3866     [CSR_MHPMCOUNTER27]  = { "mhpmcounter27",  mctr,    read_hpmcounter,
3867                                                        write_mhpmcounter },
3868     [CSR_MHPMCOUNTER28]  = { "mhpmcounter28",  mctr,    read_hpmcounter,
3869                                                        write_mhpmcounter },
3870     [CSR_MHPMCOUNTER29]  = { "mhpmcounter29",  mctr,    read_hpmcounter,
3871                                                        write_mhpmcounter },
3872     [CSR_MHPMCOUNTER30]  = { "mhpmcounter30",  mctr,    read_hpmcounter,
3873                                                        write_mhpmcounter },
3874     [CSR_MHPMCOUNTER31]  = { "mhpmcounter31",  mctr,    read_hpmcounter,
3875                                                        write_mhpmcounter },
3876 
3877     [CSR_MCOUNTINHIBIT]  = { "mcountinhibit",  any, read_mcountinhibit,
3878                                                     write_mcountinhibit },
3879 
3880     [CSR_MHPMEVENT3]     = { "mhpmevent3",     any,    read_mhpmevent,
3881                                                        write_mhpmevent },
3882     [CSR_MHPMEVENT4]     = { "mhpmevent4",     any,    read_mhpmevent,
3883                                                        write_mhpmevent },
3884     [CSR_MHPMEVENT5]     = { "mhpmevent5",     any,    read_mhpmevent,
3885                                                        write_mhpmevent },
3886     [CSR_MHPMEVENT6]     = { "mhpmevent6",     any,    read_mhpmevent,
3887                                                        write_mhpmevent },
3888     [CSR_MHPMEVENT7]     = { "mhpmevent7",     any,    read_mhpmevent,
3889                                                        write_mhpmevent },
3890     [CSR_MHPMEVENT8]     = { "mhpmevent8",     any,    read_mhpmevent,
3891                                                        write_mhpmevent },
3892     [CSR_MHPMEVENT9]     = { "mhpmevent9",     any,    read_mhpmevent,
3893                                                        write_mhpmevent },
3894     [CSR_MHPMEVENT10]    = { "mhpmevent10",    any,    read_mhpmevent,
3895                                                        write_mhpmevent },
3896     [CSR_MHPMEVENT11]    = { "mhpmevent11",    any,    read_mhpmevent,
3897                                                        write_mhpmevent },
3898     [CSR_MHPMEVENT12]    = { "mhpmevent12",    any,    read_mhpmevent,
3899                                                        write_mhpmevent },
3900     [CSR_MHPMEVENT13]    = { "mhpmevent13",    any,    read_mhpmevent,
3901                                                        write_mhpmevent },
3902     [CSR_MHPMEVENT14]    = { "mhpmevent14",    any,    read_mhpmevent,
3903                                                        write_mhpmevent },
3904     [CSR_MHPMEVENT15]    = { "mhpmevent15",    any,    read_mhpmevent,
3905                                                        write_mhpmevent },
3906     [CSR_MHPMEVENT16]    = { "mhpmevent16",    any,    read_mhpmevent,
3907                                                        write_mhpmevent },
3908     [CSR_MHPMEVENT17]    = { "mhpmevent17",    any,    read_mhpmevent,
3909                                                        write_mhpmevent },
3910     [CSR_MHPMEVENT18]    = { "mhpmevent18",    any,    read_mhpmevent,
3911                                                        write_mhpmevent },
3912     [CSR_MHPMEVENT19]    = { "mhpmevent19",    any,    read_mhpmevent,
3913                                                        write_mhpmevent },
3914     [CSR_MHPMEVENT20]    = { "mhpmevent20",    any,    read_mhpmevent,
3915                                                        write_mhpmevent },
3916     [CSR_MHPMEVENT21]    = { "mhpmevent21",    any,    read_mhpmevent,
3917                                                        write_mhpmevent },
3918     [CSR_MHPMEVENT22]    = { "mhpmevent22",    any,    read_mhpmevent,
3919                                                        write_mhpmevent },
3920     [CSR_MHPMEVENT23]    = { "mhpmevent23",    any,    read_mhpmevent,
3921                                                        write_mhpmevent },
3922     [CSR_MHPMEVENT24]    = { "mhpmevent24",    any,    read_mhpmevent,
3923                                                        write_mhpmevent },
3924     [CSR_MHPMEVENT25]    = { "mhpmevent25",    any,    read_mhpmevent,
3925                                                        write_mhpmevent },
3926     [CSR_MHPMEVENT26]    = { "mhpmevent26",    any,    read_mhpmevent,
3927                                                        write_mhpmevent },
3928     [CSR_MHPMEVENT27]    = { "mhpmevent27",    any,    read_mhpmevent,
3929                                                        write_mhpmevent },
3930     [CSR_MHPMEVENT28]    = { "mhpmevent28",    any,    read_mhpmevent,
3931                                                        write_mhpmevent },
3932     [CSR_MHPMEVENT29]    = { "mhpmevent29",    any,    read_mhpmevent,
3933                                                        write_mhpmevent },
3934     [CSR_MHPMEVENT30]    = { "mhpmevent30",    any,    read_mhpmevent,
3935                                                        write_mhpmevent },
3936     [CSR_MHPMEVENT31]    = { "mhpmevent31",    any,    read_mhpmevent,
3937                                                        write_mhpmevent },
3938 
3939     [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
3940     [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
3941     [CSR_HPMCOUNTER5H]   = { "hpmcounter5h",   ctr32,  read_hpmcounterh },
3942     [CSR_HPMCOUNTER6H]   = { "hpmcounter6h",   ctr32,  read_hpmcounterh },
3943     [CSR_HPMCOUNTER7H]   = { "hpmcounter7h",   ctr32,  read_hpmcounterh },
3944     [CSR_HPMCOUNTER8H]   = { "hpmcounter8h",   ctr32,  read_hpmcounterh },
3945     [CSR_HPMCOUNTER9H]   = { "hpmcounter9h",   ctr32,  read_hpmcounterh },
3946     [CSR_HPMCOUNTER10H]  = { "hpmcounter10h",  ctr32,  read_hpmcounterh },
3947     [CSR_HPMCOUNTER11H]  = { "hpmcounter11h",  ctr32,  read_hpmcounterh },
3948     [CSR_HPMCOUNTER12H]  = { "hpmcounter12h",  ctr32,  read_hpmcounterh },
3949     [CSR_HPMCOUNTER13H]  = { "hpmcounter13h",  ctr32,  read_hpmcounterh },
3950     [CSR_HPMCOUNTER14H]  = { "hpmcounter14h",  ctr32,  read_hpmcounterh },
3951     [CSR_HPMCOUNTER15H]  = { "hpmcounter15h",  ctr32,  read_hpmcounterh },
3952     [CSR_HPMCOUNTER16H]  = { "hpmcounter16h",  ctr32,  read_hpmcounterh },
3953     [CSR_HPMCOUNTER17H]  = { "hpmcounter17h",  ctr32,  read_hpmcounterh },
3954     [CSR_HPMCOUNTER18H]  = { "hpmcounter18h",  ctr32,  read_hpmcounterh },
3955     [CSR_HPMCOUNTER19H]  = { "hpmcounter19h",  ctr32,  read_hpmcounterh },
3956     [CSR_HPMCOUNTER20H]  = { "hpmcounter20h",  ctr32,  read_hpmcounterh },
3957     [CSR_HPMCOUNTER21H]  = { "hpmcounter21h",  ctr32,  read_hpmcounterh },
3958     [CSR_HPMCOUNTER22H]  = { "hpmcounter22h",  ctr32,  read_hpmcounterh },
3959     [CSR_HPMCOUNTER23H]  = { "hpmcounter23h",  ctr32,  read_hpmcounterh },
3960     [CSR_HPMCOUNTER24H]  = { "hpmcounter24h",  ctr32,  read_hpmcounterh },
3961     [CSR_HPMCOUNTER25H]  = { "hpmcounter25h",  ctr32,  read_hpmcounterh },
3962     [CSR_HPMCOUNTER26H]  = { "hpmcounter26h",  ctr32,  read_hpmcounterh },
3963     [CSR_HPMCOUNTER27H]  = { "hpmcounter27h",  ctr32,  read_hpmcounterh },
3964     [CSR_HPMCOUNTER28H]  = { "hpmcounter28h",  ctr32,  read_hpmcounterh },
3965     [CSR_HPMCOUNTER29H]  = { "hpmcounter29h",  ctr32,  read_hpmcounterh },
3966     [CSR_HPMCOUNTER30H]  = { "hpmcounter30h",  ctr32,  read_hpmcounterh },
3967     [CSR_HPMCOUNTER31H]  = { "hpmcounter31h",  ctr32,  read_hpmcounterh },
3968 
3969     [CSR_MHPMCOUNTER3H]  = { "mhpmcounter3h",  mctr32,  read_hpmcounterh,
3970                                                        write_mhpmcounterh },
3971     [CSR_MHPMCOUNTER4H]  = { "mhpmcounter4h",  mctr32,  read_hpmcounterh,
3972                                                        write_mhpmcounterh },
3973     [CSR_MHPMCOUNTER5H]  = { "mhpmcounter5h",  mctr32,  read_hpmcounterh,
3974                                                        write_mhpmcounterh },
3975     [CSR_MHPMCOUNTER6H]  = { "mhpmcounter6h",  mctr32,  read_hpmcounterh,
3976                                                        write_mhpmcounterh },
3977     [CSR_MHPMCOUNTER7H]  = { "mhpmcounter7h",  mctr32,  read_hpmcounterh,
3978                                                        write_mhpmcounterh },
3979     [CSR_MHPMCOUNTER8H]  = { "mhpmcounter8h",  mctr32,  read_hpmcounterh,
3980                                                        write_mhpmcounterh },
3981     [CSR_MHPMCOUNTER9H]  = { "mhpmcounter9h",  mctr32,  read_hpmcounterh,
3982                                                        write_mhpmcounterh },
3983     [CSR_MHPMCOUNTER10H] = { "mhpmcounter10h", mctr32,  read_hpmcounterh,
3984                                                        write_mhpmcounterh },
3985     [CSR_MHPMCOUNTER11H] = { "mhpmcounter11h", mctr32,  read_hpmcounterh,
3986                                                        write_mhpmcounterh },
3987     [CSR_MHPMCOUNTER12H] = { "mhpmcounter12h", mctr32,  read_hpmcounterh,
3988                                                        write_mhpmcounterh },
3989     [CSR_MHPMCOUNTER13H] = { "mhpmcounter13h", mctr32,  read_hpmcounterh,
3990                                                        write_mhpmcounterh },
3991     [CSR_MHPMCOUNTER14H] = { "mhpmcounter14h", mctr32,  read_hpmcounterh,
3992                                                        write_mhpmcounterh },
3993     [CSR_MHPMCOUNTER15H] = { "mhpmcounter15h", mctr32,  read_hpmcounterh,
3994                                                        write_mhpmcounterh },
3995     [CSR_MHPMCOUNTER16H] = { "mhpmcounter16h", mctr32,  read_hpmcounterh,
3996                                                        write_mhpmcounterh },
3997     [CSR_MHPMCOUNTER17H] = { "mhpmcounter17h", mctr32,  read_hpmcounterh,
3998                                                        write_mhpmcounterh },
3999     [CSR_MHPMCOUNTER18H] = { "mhpmcounter18h", mctr32,  read_hpmcounterh,
4000                                                        write_mhpmcounterh },
4001     [CSR_MHPMCOUNTER19H] = { "mhpmcounter19h", mctr32,  read_hpmcounterh,
4002                                                        write_mhpmcounterh },
4003     [CSR_MHPMCOUNTER20H] = { "mhpmcounter20h", mctr32,  read_hpmcounterh,
4004                                                        write_mhpmcounterh },
4005     [CSR_MHPMCOUNTER21H] = { "mhpmcounter21h", mctr32,  read_hpmcounterh,
4006                                                        write_mhpmcounterh },
4007     [CSR_MHPMCOUNTER22H] = { "mhpmcounter22h", mctr32,  read_hpmcounterh,
4008                                                        write_mhpmcounterh },
4009     [CSR_MHPMCOUNTER23H] = { "mhpmcounter23h", mctr32,  read_hpmcounterh,
4010                                                        write_mhpmcounterh },
4011     [CSR_MHPMCOUNTER24H] = { "mhpmcounter24h", mctr32,  read_hpmcounterh,
4012                                                        write_mhpmcounterh },
4013     [CSR_MHPMCOUNTER25H] = { "mhpmcounter25h", mctr32,  read_hpmcounterh,
4014                                                        write_mhpmcounterh },
4015     [CSR_MHPMCOUNTER26H] = { "mhpmcounter26h", mctr32,  read_hpmcounterh,
4016                                                        write_mhpmcounterh },
4017     [CSR_MHPMCOUNTER27H] = { "mhpmcounter27h", mctr32,  read_hpmcounterh,
4018                                                        write_mhpmcounterh },
4019     [CSR_MHPMCOUNTER28H] = { "mhpmcounter28h", mctr32,  read_hpmcounterh,
4020                                                        write_mhpmcounterh },
4021     [CSR_MHPMCOUNTER29H] = { "mhpmcounter29h", mctr32,  read_hpmcounterh,
4022                                                        write_mhpmcounterh },
4023     [CSR_MHPMCOUNTER30H] = { "mhpmcounter30h", mctr32,  read_hpmcounterh,
4024                                                        write_mhpmcounterh },
4025     [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
4026                                                        write_mhpmcounterh },
4027 #endif /* !CONFIG_USER_ONLY */
4028 };
4029