xref: /openbmc/qemu/target/riscv/csr.c (revision b2d7a7c7)
1 /*
2  * RISC-V Control and Status Registers.
3  *
4  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
5  * Copyright (c) 2017-2018 SiFive, Inc.
6  *
7  * This program is free software; you can redistribute it and/or modify it
8  * under the terms and conditions of the GNU General Public License,
9  * version 2 or later, as published by the Free Software Foundation.
10  *
11  * This program is distributed in the hope it will be useful, but WITHOUT
12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
14  * more details.
15  *
16  * You should have received a copy of the GNU General Public License along with
17  * this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qemu/log.h"
22 #include "qemu/timer.h"
23 #include "cpu.h"
24 #include "tcg/tcg-cpu.h"
25 #include "pmu.h"
26 #include "time_helper.h"
27 #include "exec/exec-all.h"
28 #include "exec/tb-flush.h"
29 #include "sysemu/cpu-timers.h"
30 #include "qemu/guest-random.h"
31 #include "qapi/error.h"
32 
33 /* CSR function table public API */
34 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
35 {
36     *ops = csr_ops[csrno & (CSR_TABLE_SIZE - 1)];
37 }
38 
39 void riscv_set_csr_ops(int csrno, riscv_csr_operations *ops)
40 {
41     csr_ops[csrno & (CSR_TABLE_SIZE - 1)] = *ops;
42 }
43 
44 /* Predicates */
45 #if !defined(CONFIG_USER_ONLY)
46 RISCVException smstateen_acc_ok(CPURISCVState *env, int index, uint64_t bit)
47 {
48     bool virt = env->virt_enabled;
49 
50     if (env->priv == PRV_M || !riscv_cpu_cfg(env)->ext_smstateen) {
51         return RISCV_EXCP_NONE;
52     }
53 
54     if (!(env->mstateen[index] & bit)) {
55         return RISCV_EXCP_ILLEGAL_INST;
56     }
57 
58     if (virt) {
59         if (!(env->hstateen[index] & bit)) {
60             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
61         }
62 
63         if (env->priv == PRV_U && !(env->sstateen[index] & bit)) {
64             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
65         }
66     }
67 
68     if (env->priv == PRV_U && riscv_has_ext(env, RVS)) {
69         if (!(env->sstateen[index] & bit)) {
70             return RISCV_EXCP_ILLEGAL_INST;
71         }
72     }
73 
74     return RISCV_EXCP_NONE;
75 }
76 #endif
77 
78 static RISCVException fs(CPURISCVState *env, int csrno)
79 {
80 #if !defined(CONFIG_USER_ONLY)
81     if (!env->debugger && !riscv_cpu_fp_enabled(env) &&
82         !riscv_cpu_cfg(env)->ext_zfinx) {
83         return RISCV_EXCP_ILLEGAL_INST;
84     }
85 
86     if (!env->debugger && !riscv_cpu_fp_enabled(env)) {
87         return smstateen_acc_ok(env, 0, SMSTATEEN0_FCSR);
88     }
89 #endif
90     return RISCV_EXCP_NONE;
91 }
92 
93 static RISCVException vs(CPURISCVState *env, int csrno)
94 {
95     if (riscv_cpu_cfg(env)->ext_zve32x) {
96 #if !defined(CONFIG_USER_ONLY)
97         if (!env->debugger && !riscv_cpu_vector_enabled(env)) {
98             return RISCV_EXCP_ILLEGAL_INST;
99         }
100 #endif
101         return RISCV_EXCP_NONE;
102     }
103     return RISCV_EXCP_ILLEGAL_INST;
104 }
105 
106 static RISCVException ctr(CPURISCVState *env, int csrno)
107 {
108 #if !defined(CONFIG_USER_ONLY)
109     RISCVCPU *cpu = env_archcpu(env);
110     int ctr_index;
111     target_ulong ctr_mask;
112     int base_csrno = CSR_CYCLE;
113     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
114 
115     if (rv32 && csrno >= CSR_CYCLEH) {
116         /* Offset for RV32 hpmcounternh counters */
117         base_csrno += 0x80;
118     }
119     ctr_index = csrno - base_csrno;
120     ctr_mask = BIT(ctr_index);
121 
122     if ((csrno >= CSR_CYCLE && csrno <= CSR_INSTRET) ||
123         (csrno >= CSR_CYCLEH && csrno <= CSR_INSTRETH)) {
124         if (!riscv_cpu_cfg(env)->ext_zicntr) {
125             return RISCV_EXCP_ILLEGAL_INST;
126         }
127 
128         goto skip_ext_pmu_check;
129     }
130 
131     if (!(cpu->pmu_avail_ctrs & ctr_mask)) {
132         /* No counter is enabled in PMU or the counter is out of range */
133         return RISCV_EXCP_ILLEGAL_INST;
134     }
135 
136 skip_ext_pmu_check:
137 
138     if (env->debugger) {
139         return RISCV_EXCP_NONE;
140     }
141 
142     if (env->priv < PRV_M && !get_field(env->mcounteren, ctr_mask)) {
143         return RISCV_EXCP_ILLEGAL_INST;
144     }
145 
146     if (env->virt_enabled) {
147         if (!get_field(env->hcounteren, ctr_mask) ||
148             (env->priv == PRV_U && !get_field(env->scounteren, ctr_mask))) {
149             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
150         }
151     }
152 
153     if (riscv_has_ext(env, RVS) && env->priv == PRV_U &&
154         !get_field(env->scounteren, ctr_mask)) {
155         return RISCV_EXCP_ILLEGAL_INST;
156     }
157 
158 #endif
159     return RISCV_EXCP_NONE;
160 }
161 
162 static RISCVException ctr32(CPURISCVState *env, int csrno)
163 {
164     if (riscv_cpu_mxl(env) != MXL_RV32) {
165         return RISCV_EXCP_ILLEGAL_INST;
166     }
167 
168     return ctr(env, csrno);
169 }
170 
171 static RISCVException zcmt(CPURISCVState *env, int csrno)
172 {
173     if (!riscv_cpu_cfg(env)->ext_zcmt) {
174         return RISCV_EXCP_ILLEGAL_INST;
175     }
176 
177 #if !defined(CONFIG_USER_ONLY)
178     RISCVException ret = smstateen_acc_ok(env, 0, SMSTATEEN0_JVT);
179     if (ret != RISCV_EXCP_NONE) {
180         return ret;
181     }
182 #endif
183 
184     return RISCV_EXCP_NONE;
185 }
186 
187 #if !defined(CONFIG_USER_ONLY)
188 static RISCVException mctr(CPURISCVState *env, int csrno)
189 {
190     RISCVCPU *cpu = env_archcpu(env);
191     uint32_t pmu_avail_ctrs = cpu->pmu_avail_ctrs;
192     int ctr_index;
193     int base_csrno = CSR_MHPMCOUNTER3;
194 
195     if ((riscv_cpu_mxl(env) == MXL_RV32) && csrno >= CSR_MCYCLEH) {
196         /* Offset for RV32 mhpmcounternh counters */
197         csrno -= 0x80;
198     }
199 
200     g_assert(csrno >= CSR_MHPMCOUNTER3 && csrno <= CSR_MHPMCOUNTER31);
201 
202     ctr_index = csrno - base_csrno;
203     if ((BIT(ctr_index) & pmu_avail_ctrs >> 3) == 0) {
204         /* The PMU is not enabled or counter is out of range */
205         return RISCV_EXCP_ILLEGAL_INST;
206     }
207 
208     return RISCV_EXCP_NONE;
209 }
210 
211 static RISCVException mctr32(CPURISCVState *env, int csrno)
212 {
213     if (riscv_cpu_mxl(env) != MXL_RV32) {
214         return RISCV_EXCP_ILLEGAL_INST;
215     }
216 
217     return mctr(env, csrno);
218 }
219 
220 static RISCVException sscofpmf(CPURISCVState *env, int csrno)
221 {
222     if (!riscv_cpu_cfg(env)->ext_sscofpmf) {
223         return RISCV_EXCP_ILLEGAL_INST;
224     }
225 
226     return RISCV_EXCP_NONE;
227 }
228 
229 static RISCVException sscofpmf_32(CPURISCVState *env, int csrno)
230 {
231     if (riscv_cpu_mxl(env) != MXL_RV32) {
232         return RISCV_EXCP_ILLEGAL_INST;
233     }
234 
235     return sscofpmf(env, csrno);
236 }
237 
238 static RISCVException smcntrpmf(CPURISCVState *env, int csrno)
239 {
240     if (!riscv_cpu_cfg(env)->ext_smcntrpmf) {
241         return RISCV_EXCP_ILLEGAL_INST;
242     }
243 
244     return RISCV_EXCP_NONE;
245 }
246 
247 static RISCVException smcntrpmf_32(CPURISCVState *env, int csrno)
248 {
249     if (riscv_cpu_mxl(env) != MXL_RV32) {
250         return RISCV_EXCP_ILLEGAL_INST;
251     }
252 
253     return smcntrpmf(env, csrno);
254 }
255 
256 static RISCVException any(CPURISCVState *env, int csrno)
257 {
258     return RISCV_EXCP_NONE;
259 }
260 
261 static RISCVException any32(CPURISCVState *env, int csrno)
262 {
263     if (riscv_cpu_mxl(env) != MXL_RV32) {
264         return RISCV_EXCP_ILLEGAL_INST;
265     }
266 
267     return any(env, csrno);
268 
269 }
270 
271 static RISCVException aia_any(CPURISCVState *env, int csrno)
272 {
273     if (!riscv_cpu_cfg(env)->ext_smaia) {
274         return RISCV_EXCP_ILLEGAL_INST;
275     }
276 
277     return any(env, csrno);
278 }
279 
280 static RISCVException aia_any32(CPURISCVState *env, int csrno)
281 {
282     if (!riscv_cpu_cfg(env)->ext_smaia) {
283         return RISCV_EXCP_ILLEGAL_INST;
284     }
285 
286     return any32(env, csrno);
287 }
288 
289 static RISCVException smode(CPURISCVState *env, int csrno)
290 {
291     if (riscv_has_ext(env, RVS)) {
292         return RISCV_EXCP_NONE;
293     }
294 
295     return RISCV_EXCP_ILLEGAL_INST;
296 }
297 
298 static RISCVException smode32(CPURISCVState *env, int csrno)
299 {
300     if (riscv_cpu_mxl(env) != MXL_RV32) {
301         return RISCV_EXCP_ILLEGAL_INST;
302     }
303 
304     return smode(env, csrno);
305 }
306 
307 static RISCVException aia_smode(CPURISCVState *env, int csrno)
308 {
309     if (!riscv_cpu_cfg(env)->ext_ssaia) {
310         return RISCV_EXCP_ILLEGAL_INST;
311     }
312 
313     return smode(env, csrno);
314 }
315 
316 static RISCVException aia_smode32(CPURISCVState *env, int csrno)
317 {
318     if (!riscv_cpu_cfg(env)->ext_ssaia) {
319         return RISCV_EXCP_ILLEGAL_INST;
320     }
321 
322     return smode32(env, csrno);
323 }
324 
325 static RISCVException hmode(CPURISCVState *env, int csrno)
326 {
327     if (riscv_has_ext(env, RVH)) {
328         return RISCV_EXCP_NONE;
329     }
330 
331     return RISCV_EXCP_ILLEGAL_INST;
332 }
333 
334 static RISCVException hmode32(CPURISCVState *env, int csrno)
335 {
336     if (riscv_cpu_mxl(env) != MXL_RV32) {
337         return RISCV_EXCP_ILLEGAL_INST;
338     }
339 
340     return hmode(env, csrno);
341 
342 }
343 
344 static RISCVException umode(CPURISCVState *env, int csrno)
345 {
346     if (riscv_has_ext(env, RVU)) {
347         return RISCV_EXCP_NONE;
348     }
349 
350     return RISCV_EXCP_ILLEGAL_INST;
351 }
352 
353 static RISCVException umode32(CPURISCVState *env, int csrno)
354 {
355     if (riscv_cpu_mxl(env) != MXL_RV32) {
356         return RISCV_EXCP_ILLEGAL_INST;
357     }
358 
359     return umode(env, csrno);
360 }
361 
362 static RISCVException mstateen(CPURISCVState *env, int csrno)
363 {
364     if (!riscv_cpu_cfg(env)->ext_smstateen) {
365         return RISCV_EXCP_ILLEGAL_INST;
366     }
367 
368     return any(env, csrno);
369 }
370 
371 static RISCVException hstateen_pred(CPURISCVState *env, int csrno, int base)
372 {
373     if (!riscv_cpu_cfg(env)->ext_smstateen) {
374         return RISCV_EXCP_ILLEGAL_INST;
375     }
376 
377     RISCVException ret = hmode(env, csrno);
378     if (ret != RISCV_EXCP_NONE) {
379         return ret;
380     }
381 
382     if (env->debugger) {
383         return RISCV_EXCP_NONE;
384     }
385 
386     if (env->priv < PRV_M) {
387         if (!(env->mstateen[csrno - base] & SMSTATEEN_STATEEN)) {
388             return RISCV_EXCP_ILLEGAL_INST;
389         }
390     }
391 
392     return RISCV_EXCP_NONE;
393 }
394 
395 static RISCVException hstateen(CPURISCVState *env, int csrno)
396 {
397     return hstateen_pred(env, csrno, CSR_HSTATEEN0);
398 }
399 
400 static RISCVException hstateenh(CPURISCVState *env, int csrno)
401 {
402     return hstateen_pred(env, csrno, CSR_HSTATEEN0H);
403 }
404 
405 static RISCVException sstateen(CPURISCVState *env, int csrno)
406 {
407     bool virt = env->virt_enabled;
408     int index = csrno - CSR_SSTATEEN0;
409 
410     if (!riscv_cpu_cfg(env)->ext_smstateen) {
411         return RISCV_EXCP_ILLEGAL_INST;
412     }
413 
414     RISCVException ret = smode(env, csrno);
415     if (ret != RISCV_EXCP_NONE) {
416         return ret;
417     }
418 
419     if (env->debugger) {
420         return RISCV_EXCP_NONE;
421     }
422 
423     if (env->priv < PRV_M) {
424         if (!(env->mstateen[index] & SMSTATEEN_STATEEN)) {
425             return RISCV_EXCP_ILLEGAL_INST;
426         }
427 
428         if (virt) {
429             if (!(env->hstateen[index] & SMSTATEEN_STATEEN)) {
430                 return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
431             }
432         }
433     }
434 
435     return RISCV_EXCP_NONE;
436 }
437 
438 static RISCVException sstc(CPURISCVState *env, int csrno)
439 {
440     bool hmode_check = false;
441 
442     if (!riscv_cpu_cfg(env)->ext_sstc || !env->rdtime_fn) {
443         return RISCV_EXCP_ILLEGAL_INST;
444     }
445 
446     if ((csrno == CSR_VSTIMECMP) || (csrno == CSR_VSTIMECMPH)) {
447         hmode_check = true;
448     }
449 
450     RISCVException ret = hmode_check ? hmode(env, csrno) : smode(env, csrno);
451     if (ret != RISCV_EXCP_NONE) {
452         return ret;
453     }
454 
455     if (env->debugger) {
456         return RISCV_EXCP_NONE;
457     }
458 
459     if (env->priv == PRV_M) {
460         return RISCV_EXCP_NONE;
461     }
462 
463     /*
464      * No need of separate function for rv32 as menvcfg stores both menvcfg
465      * menvcfgh for RV32.
466      */
467     if (!(get_field(env->mcounteren, COUNTEREN_TM) &&
468           get_field(env->menvcfg, MENVCFG_STCE))) {
469         return RISCV_EXCP_ILLEGAL_INST;
470     }
471 
472     if (env->virt_enabled) {
473         if (!(get_field(env->hcounteren, COUNTEREN_TM) &&
474               get_field(env->henvcfg, HENVCFG_STCE))) {
475             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
476         }
477     }
478 
479     return RISCV_EXCP_NONE;
480 }
481 
482 static RISCVException sstc_32(CPURISCVState *env, int csrno)
483 {
484     if (riscv_cpu_mxl(env) != MXL_RV32) {
485         return RISCV_EXCP_ILLEGAL_INST;
486     }
487 
488     return sstc(env, csrno);
489 }
490 
491 static RISCVException satp(CPURISCVState *env, int csrno)
492 {
493     if (env->priv == PRV_S && !env->virt_enabled &&
494         get_field(env->mstatus, MSTATUS_TVM)) {
495         return RISCV_EXCP_ILLEGAL_INST;
496     }
497     if (env->priv == PRV_S && env->virt_enabled &&
498         get_field(env->hstatus, HSTATUS_VTVM)) {
499         return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
500     }
501 
502     return smode(env, csrno);
503 }
504 
505 static RISCVException hgatp(CPURISCVState *env, int csrno)
506 {
507     if (env->priv == PRV_S && !env->virt_enabled &&
508         get_field(env->mstatus, MSTATUS_TVM)) {
509         return RISCV_EXCP_ILLEGAL_INST;
510     }
511 
512     return hmode(env, csrno);
513 }
514 
515 /* Checks if PointerMasking registers could be accessed */
516 static RISCVException pointer_masking(CPURISCVState *env, int csrno)
517 {
518     /* Check if j-ext is present */
519     if (riscv_has_ext(env, RVJ)) {
520         return RISCV_EXCP_NONE;
521     }
522     return RISCV_EXCP_ILLEGAL_INST;
523 }
524 
525 static RISCVException aia_hmode(CPURISCVState *env, int csrno)
526 {
527     if (!riscv_cpu_cfg(env)->ext_ssaia) {
528         return RISCV_EXCP_ILLEGAL_INST;
529      }
530 
531      return hmode(env, csrno);
532 }
533 
534 static RISCVException aia_hmode32(CPURISCVState *env, int csrno)
535 {
536     if (!riscv_cpu_cfg(env)->ext_ssaia) {
537         return RISCV_EXCP_ILLEGAL_INST;
538     }
539 
540     return hmode32(env, csrno);
541 }
542 
543 static RISCVException pmp(CPURISCVState *env, int csrno)
544 {
545     if (riscv_cpu_cfg(env)->pmp) {
546         if (csrno <= CSR_PMPCFG3) {
547             uint32_t reg_index = csrno - CSR_PMPCFG0;
548 
549             /* TODO: RV128 restriction check */
550             if ((reg_index & 1) && (riscv_cpu_mxl(env) == MXL_RV64)) {
551                 return RISCV_EXCP_ILLEGAL_INST;
552             }
553         }
554 
555         return RISCV_EXCP_NONE;
556     }
557 
558     return RISCV_EXCP_ILLEGAL_INST;
559 }
560 
561 static RISCVException have_mseccfg(CPURISCVState *env, int csrno)
562 {
563     if (riscv_cpu_cfg(env)->ext_smepmp) {
564         return RISCV_EXCP_NONE;
565     }
566     if (riscv_cpu_cfg(env)->ext_zkr) {
567         return RISCV_EXCP_NONE;
568     }
569 
570     return RISCV_EXCP_ILLEGAL_INST;
571 }
572 
573 static RISCVException debug(CPURISCVState *env, int csrno)
574 {
575     if (riscv_cpu_cfg(env)->debug) {
576         return RISCV_EXCP_NONE;
577     }
578 
579     return RISCV_EXCP_ILLEGAL_INST;
580 }
581 #endif
582 
583 static RISCVException seed(CPURISCVState *env, int csrno)
584 {
585     if (!riscv_cpu_cfg(env)->ext_zkr) {
586         return RISCV_EXCP_ILLEGAL_INST;
587     }
588 
589 #if !defined(CONFIG_USER_ONLY)
590     if (env->debugger) {
591         return RISCV_EXCP_NONE;
592     }
593 
594     /*
595      * With a CSR read-write instruction:
596      * 1) The seed CSR is always available in machine mode as normal.
597      * 2) Attempted access to seed from virtual modes VS and VU always raises
598      * an exception(virtual instruction exception only if mseccfg.sseed=1).
599      * 3) Without the corresponding access control bit set to 1, any attempted
600      * access to seed from U, S or HS modes will raise an illegal instruction
601      * exception.
602      */
603     if (env->priv == PRV_M) {
604         return RISCV_EXCP_NONE;
605     } else if (env->virt_enabled) {
606         if (env->mseccfg & MSECCFG_SSEED) {
607             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
608         } else {
609             return RISCV_EXCP_ILLEGAL_INST;
610         }
611     } else {
612         if (env->priv == PRV_S && (env->mseccfg & MSECCFG_SSEED)) {
613             return RISCV_EXCP_NONE;
614         } else if (env->priv == PRV_U && (env->mseccfg & MSECCFG_USEED)) {
615             return RISCV_EXCP_NONE;
616         } else {
617             return RISCV_EXCP_ILLEGAL_INST;
618         }
619     }
620 #else
621     return RISCV_EXCP_NONE;
622 #endif
623 }
624 
625 /* User Floating-Point CSRs */
626 static RISCVException read_fflags(CPURISCVState *env, int csrno,
627                                   target_ulong *val)
628 {
629     *val = riscv_cpu_get_fflags(env);
630     return RISCV_EXCP_NONE;
631 }
632 
633 static RISCVException write_fflags(CPURISCVState *env, int csrno,
634                                    target_ulong val)
635 {
636 #if !defined(CONFIG_USER_ONLY)
637     if (riscv_has_ext(env, RVF)) {
638         env->mstatus |= MSTATUS_FS;
639     }
640 #endif
641     riscv_cpu_set_fflags(env, val & (FSR_AEXC >> FSR_AEXC_SHIFT));
642     return RISCV_EXCP_NONE;
643 }
644 
645 static RISCVException read_frm(CPURISCVState *env, int csrno,
646                                target_ulong *val)
647 {
648     *val = env->frm;
649     return RISCV_EXCP_NONE;
650 }
651 
652 static RISCVException write_frm(CPURISCVState *env, int csrno,
653                                 target_ulong val)
654 {
655 #if !defined(CONFIG_USER_ONLY)
656     if (riscv_has_ext(env, RVF)) {
657         env->mstatus |= MSTATUS_FS;
658     }
659 #endif
660     env->frm = val & (FSR_RD >> FSR_RD_SHIFT);
661     return RISCV_EXCP_NONE;
662 }
663 
664 static RISCVException read_fcsr(CPURISCVState *env, int csrno,
665                                 target_ulong *val)
666 {
667     *val = (riscv_cpu_get_fflags(env) << FSR_AEXC_SHIFT)
668         | (env->frm << FSR_RD_SHIFT);
669     return RISCV_EXCP_NONE;
670 }
671 
672 static RISCVException write_fcsr(CPURISCVState *env, int csrno,
673                                  target_ulong val)
674 {
675 #if !defined(CONFIG_USER_ONLY)
676     if (riscv_has_ext(env, RVF)) {
677         env->mstatus |= MSTATUS_FS;
678     }
679 #endif
680     env->frm = (val & FSR_RD) >> FSR_RD_SHIFT;
681     riscv_cpu_set_fflags(env, (val & FSR_AEXC) >> FSR_AEXC_SHIFT);
682     return RISCV_EXCP_NONE;
683 }
684 
685 static RISCVException read_vtype(CPURISCVState *env, int csrno,
686                                  target_ulong *val)
687 {
688     uint64_t vill;
689     switch (env->xl) {
690     case MXL_RV32:
691         vill = (uint32_t)env->vill << 31;
692         break;
693     case MXL_RV64:
694         vill = (uint64_t)env->vill << 63;
695         break;
696     default:
697         g_assert_not_reached();
698     }
699     *val = (target_ulong)vill | env->vtype;
700     return RISCV_EXCP_NONE;
701 }
702 
703 static RISCVException read_vl(CPURISCVState *env, int csrno,
704                               target_ulong *val)
705 {
706     *val = env->vl;
707     return RISCV_EXCP_NONE;
708 }
709 
710 static RISCVException read_vlenb(CPURISCVState *env, int csrno,
711                                  target_ulong *val)
712 {
713     *val = riscv_cpu_cfg(env)->vlenb;
714     return RISCV_EXCP_NONE;
715 }
716 
717 static RISCVException read_vxrm(CPURISCVState *env, int csrno,
718                                 target_ulong *val)
719 {
720     *val = env->vxrm;
721     return RISCV_EXCP_NONE;
722 }
723 
724 static RISCVException write_vxrm(CPURISCVState *env, int csrno,
725                                  target_ulong val)
726 {
727 #if !defined(CONFIG_USER_ONLY)
728     env->mstatus |= MSTATUS_VS;
729 #endif
730     env->vxrm = val;
731     return RISCV_EXCP_NONE;
732 }
733 
734 static RISCVException read_vxsat(CPURISCVState *env, int csrno,
735                                  target_ulong *val)
736 {
737     *val = env->vxsat;
738     return RISCV_EXCP_NONE;
739 }
740 
741 static RISCVException write_vxsat(CPURISCVState *env, int csrno,
742                                   target_ulong val)
743 {
744 #if !defined(CONFIG_USER_ONLY)
745     env->mstatus |= MSTATUS_VS;
746 #endif
747     env->vxsat = val;
748     return RISCV_EXCP_NONE;
749 }
750 
751 static RISCVException read_vstart(CPURISCVState *env, int csrno,
752                                   target_ulong *val)
753 {
754     *val = env->vstart;
755     return RISCV_EXCP_NONE;
756 }
757 
758 static RISCVException write_vstart(CPURISCVState *env, int csrno,
759                                    target_ulong val)
760 {
761 #if !defined(CONFIG_USER_ONLY)
762     env->mstatus |= MSTATUS_VS;
763 #endif
764     /*
765      * The vstart CSR is defined to have only enough writable bits
766      * to hold the largest element index, i.e. lg2(VLEN) bits.
767      */
768     env->vstart = val & ~(~0ULL << ctzl(riscv_cpu_cfg(env)->vlenb << 3));
769     return RISCV_EXCP_NONE;
770 }
771 
772 static RISCVException read_vcsr(CPURISCVState *env, int csrno,
773                                 target_ulong *val)
774 {
775     *val = (env->vxrm << VCSR_VXRM_SHIFT) | (env->vxsat << VCSR_VXSAT_SHIFT);
776     return RISCV_EXCP_NONE;
777 }
778 
779 static RISCVException write_vcsr(CPURISCVState *env, int csrno,
780                                  target_ulong val)
781 {
782 #if !defined(CONFIG_USER_ONLY)
783     env->mstatus |= MSTATUS_VS;
784 #endif
785     env->vxrm = (val & VCSR_VXRM) >> VCSR_VXRM_SHIFT;
786     env->vxsat = (val & VCSR_VXSAT) >> VCSR_VXSAT_SHIFT;
787     return RISCV_EXCP_NONE;
788 }
789 
790 #if defined(CONFIG_USER_ONLY)
791 /* User Timers and Counters */
792 static target_ulong get_ticks(bool shift)
793 {
794     int64_t val = cpu_get_host_ticks();
795     target_ulong result = shift ? val >> 32 : val;
796 
797     return result;
798 }
799 
800 static RISCVException read_time(CPURISCVState *env, int csrno,
801                                 target_ulong *val)
802 {
803     *val = cpu_get_host_ticks();
804     return RISCV_EXCP_NONE;
805 }
806 
807 static RISCVException read_timeh(CPURISCVState *env, int csrno,
808                                  target_ulong *val)
809 {
810     *val = cpu_get_host_ticks() >> 32;
811     return RISCV_EXCP_NONE;
812 }
813 
814 static RISCVException read_hpmcounter(CPURISCVState *env, int csrno,
815                                       target_ulong *val)
816 {
817     *val = get_ticks(false);
818     return RISCV_EXCP_NONE;
819 }
820 
821 static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
822                                        target_ulong *val)
823 {
824     *val = get_ticks(true);
825     return RISCV_EXCP_NONE;
826 }
827 
828 #else /* CONFIG_USER_ONLY */
829 
830 static RISCVException read_mcyclecfg(CPURISCVState *env, int csrno,
831                                      target_ulong *val)
832 {
833     *val = env->mcyclecfg;
834     return RISCV_EXCP_NONE;
835 }
836 
837 static RISCVException write_mcyclecfg(CPURISCVState *env, int csrno,
838                                       target_ulong val)
839 {
840     uint64_t inh_avail_mask;
841 
842     if (riscv_cpu_mxl(env) == MXL_RV32) {
843         env->mcyclecfg = val;
844     } else {
845         /* Set xINH fields if priv mode supported */
846         inh_avail_mask = ~MHPMEVENT_FILTER_MASK | MCYCLECFG_BIT_MINH;
847         inh_avail_mask |= riscv_has_ext(env, RVU) ? MCYCLECFG_BIT_UINH : 0;
848         inh_avail_mask |= riscv_has_ext(env, RVS) ? MCYCLECFG_BIT_SINH : 0;
849         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
850                            riscv_has_ext(env, RVU)) ? MCYCLECFG_BIT_VUINH : 0;
851         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
852                            riscv_has_ext(env, RVS)) ? MCYCLECFG_BIT_VSINH : 0;
853         env->mcyclecfg = val & inh_avail_mask;
854     }
855 
856     return RISCV_EXCP_NONE;
857 }
858 
859 static RISCVException read_mcyclecfgh(CPURISCVState *env, int csrno,
860                                       target_ulong *val)
861 {
862     *val = env->mcyclecfgh;
863     return RISCV_EXCP_NONE;
864 }
865 
866 static RISCVException write_mcyclecfgh(CPURISCVState *env, int csrno,
867                                        target_ulong val)
868 {
869     target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
870                                                  MCYCLECFGH_BIT_MINH);
871 
872     /* Set xINH fields if priv mode supported */
873     inh_avail_mask |= riscv_has_ext(env, RVU) ? MCYCLECFGH_BIT_UINH : 0;
874     inh_avail_mask |= riscv_has_ext(env, RVS) ? MCYCLECFGH_BIT_SINH : 0;
875     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
876                        riscv_has_ext(env, RVU)) ? MCYCLECFGH_BIT_VUINH : 0;
877     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
878                        riscv_has_ext(env, RVS)) ? MCYCLECFGH_BIT_VSINH : 0;
879 
880     env->mcyclecfgh = val & inh_avail_mask;
881     return RISCV_EXCP_NONE;
882 }
883 
884 static RISCVException read_minstretcfg(CPURISCVState *env, int csrno,
885                                        target_ulong *val)
886 {
887     *val = env->minstretcfg;
888     return RISCV_EXCP_NONE;
889 }
890 
891 static RISCVException write_minstretcfg(CPURISCVState *env, int csrno,
892                                         target_ulong val)
893 {
894     uint64_t inh_avail_mask;
895 
896     if (riscv_cpu_mxl(env) == MXL_RV32) {
897         env->minstretcfg = val;
898     } else {
899         inh_avail_mask = ~MHPMEVENT_FILTER_MASK | MINSTRETCFG_BIT_MINH;
900         inh_avail_mask |= riscv_has_ext(env, RVU) ? MINSTRETCFG_BIT_UINH : 0;
901         inh_avail_mask |= riscv_has_ext(env, RVS) ? MINSTRETCFG_BIT_SINH : 0;
902         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
903                            riscv_has_ext(env, RVU)) ? MINSTRETCFG_BIT_VUINH : 0;
904         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
905                            riscv_has_ext(env, RVS)) ? MINSTRETCFG_BIT_VSINH : 0;
906         env->minstretcfg = val & inh_avail_mask;
907     }
908     return RISCV_EXCP_NONE;
909 }
910 
911 static RISCVException read_minstretcfgh(CPURISCVState *env, int csrno,
912                                         target_ulong *val)
913 {
914     *val = env->minstretcfgh;
915     return RISCV_EXCP_NONE;
916 }
917 
918 static RISCVException write_minstretcfgh(CPURISCVState *env, int csrno,
919                                          target_ulong val)
920 {
921     target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
922                                                  MINSTRETCFGH_BIT_MINH);
923 
924     inh_avail_mask |= riscv_has_ext(env, RVU) ? MINSTRETCFGH_BIT_UINH : 0;
925     inh_avail_mask |= riscv_has_ext(env, RVS) ? MINSTRETCFGH_BIT_SINH : 0;
926     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
927                        riscv_has_ext(env, RVU)) ? MINSTRETCFGH_BIT_VUINH : 0;
928     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
929                        riscv_has_ext(env, RVS)) ? MINSTRETCFGH_BIT_VSINH : 0;
930 
931     env->minstretcfgh = val & inh_avail_mask;
932     return RISCV_EXCP_NONE;
933 }
934 
935 static RISCVException read_mhpmevent(CPURISCVState *env, int csrno,
936                                      target_ulong *val)
937 {
938     int evt_index = csrno - CSR_MCOUNTINHIBIT;
939 
940     *val = env->mhpmevent_val[evt_index];
941 
942     return RISCV_EXCP_NONE;
943 }
944 
945 static RISCVException write_mhpmevent(CPURISCVState *env, int csrno,
946                                       target_ulong val)
947 {
948     int evt_index = csrno - CSR_MCOUNTINHIBIT;
949     uint64_t mhpmevt_val = val;
950     uint64_t inh_avail_mask;
951 
952     if (riscv_cpu_mxl(env) == MXL_RV32) {
953         env->mhpmevent_val[evt_index] = val;
954         mhpmevt_val = mhpmevt_val |
955                       ((uint64_t)env->mhpmeventh_val[evt_index] << 32);
956     } else {
957         inh_avail_mask = ~MHPMEVENT_FILTER_MASK | MHPMEVENT_BIT_MINH;
958         inh_avail_mask |= riscv_has_ext(env, RVU) ? MHPMEVENT_BIT_UINH : 0;
959         inh_avail_mask |= riscv_has_ext(env, RVS) ? MHPMEVENT_BIT_SINH : 0;
960         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
961                            riscv_has_ext(env, RVU)) ? MHPMEVENT_BIT_VUINH : 0;
962         inh_avail_mask |= (riscv_has_ext(env, RVH) &&
963                            riscv_has_ext(env, RVS)) ? MHPMEVENT_BIT_VSINH : 0;
964         mhpmevt_val = val & inh_avail_mask;
965         env->mhpmevent_val[evt_index] = mhpmevt_val;
966     }
967 
968     riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
969 
970     return RISCV_EXCP_NONE;
971 }
972 
973 static RISCVException read_mhpmeventh(CPURISCVState *env, int csrno,
974                                       target_ulong *val)
975 {
976     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
977 
978     *val = env->mhpmeventh_val[evt_index];
979 
980     return RISCV_EXCP_NONE;
981 }
982 
983 static RISCVException write_mhpmeventh(CPURISCVState *env, int csrno,
984                                        target_ulong val)
985 {
986     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
987     uint64_t mhpmevth_val;
988     uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
989     target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
990                                                   MHPMEVENTH_BIT_MINH);
991 
992     inh_avail_mask |= riscv_has_ext(env, RVU) ? MHPMEVENTH_BIT_UINH : 0;
993     inh_avail_mask |= riscv_has_ext(env, RVS) ? MHPMEVENTH_BIT_SINH : 0;
994     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
995                        riscv_has_ext(env, RVU)) ? MHPMEVENTH_BIT_VUINH : 0;
996     inh_avail_mask |= (riscv_has_ext(env, RVH) &&
997                        riscv_has_ext(env, RVS)) ? MHPMEVENTH_BIT_VSINH : 0;
998 
999     mhpmevth_val = val & inh_avail_mask;
1000     mhpmevt_val = mhpmevt_val | (mhpmevth_val << 32);
1001     env->mhpmeventh_val[evt_index] = mhpmevth_val;
1002 
1003     riscv_pmu_update_event_map(env, mhpmevt_val, evt_index);
1004 
1005     return RISCV_EXCP_NONE;
1006 }
1007 
1008 static target_ulong riscv_pmu_ctr_get_fixed_counters_val(CPURISCVState *env,
1009                                                          int counter_idx,
1010                                                          bool upper_half)
1011 {
1012     int inst = riscv_pmu_ctr_monitor_instructions(env, counter_idx);
1013     uint64_t *counter_arr_virt = env->pmu_fixed_ctrs[inst].counter_virt;
1014     uint64_t *counter_arr = env->pmu_fixed_ctrs[inst].counter;
1015     target_ulong result = 0;
1016     uint64_t curr_val = 0;
1017     uint64_t cfg_val = 0;
1018 
1019     if (counter_idx == 0) {
1020         cfg_val = upper_half ? ((uint64_t)env->mcyclecfgh << 32) :
1021                   env->mcyclecfg;
1022     } else if (counter_idx == 2) {
1023         cfg_val = upper_half ? ((uint64_t)env->minstretcfgh << 32) :
1024                   env->minstretcfg;
1025     } else {
1026         cfg_val = upper_half ?
1027                   ((uint64_t)env->mhpmeventh_val[counter_idx] << 32) :
1028                   env->mhpmevent_val[counter_idx];
1029         cfg_val &= MHPMEVENT_FILTER_MASK;
1030     }
1031 
1032     if (!cfg_val) {
1033         if (icount_enabled()) {
1034                 curr_val = inst ? icount_get_raw() : icount_get();
1035         } else {
1036             curr_val = cpu_get_host_ticks();
1037         }
1038 
1039         goto done;
1040     }
1041 
1042     if (!(cfg_val & MCYCLECFG_BIT_MINH)) {
1043         curr_val += counter_arr[PRV_M];
1044     }
1045 
1046     if (!(cfg_val & MCYCLECFG_BIT_SINH)) {
1047         curr_val += counter_arr[PRV_S];
1048     }
1049 
1050     if (!(cfg_val & MCYCLECFG_BIT_UINH)) {
1051         curr_val += counter_arr[PRV_U];
1052     }
1053 
1054     if (!(cfg_val & MCYCLECFG_BIT_VSINH)) {
1055         curr_val += counter_arr_virt[PRV_S];
1056     }
1057 
1058     if (!(cfg_val & MCYCLECFG_BIT_VUINH)) {
1059         curr_val += counter_arr_virt[PRV_U];
1060     }
1061 
1062 done:
1063     if (riscv_cpu_mxl(env) == MXL_RV32) {
1064         result = upper_half ? curr_val >> 32 : curr_val;
1065     } else {
1066         result = curr_val;
1067     }
1068 
1069     return result;
1070 }
1071 
1072 static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
1073                                         target_ulong val)
1074 {
1075     int ctr_idx = csrno - CSR_MCYCLE;
1076     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
1077     uint64_t mhpmctr_val = val;
1078 
1079     counter->mhpmcounter_val = val;
1080     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
1081         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
1082         counter->mhpmcounter_prev = riscv_pmu_ctr_get_fixed_counters_val(env,
1083                                                                 ctr_idx, false);
1084         if (ctr_idx > 2) {
1085             if (riscv_cpu_mxl(env) == MXL_RV32) {
1086                 mhpmctr_val = mhpmctr_val |
1087                               ((uint64_t)counter->mhpmcounterh_val << 32);
1088             }
1089             riscv_pmu_setup_timer(env, mhpmctr_val, ctr_idx);
1090         }
1091      } else {
1092         /* Other counters can keep incrementing from the given value */
1093         counter->mhpmcounter_prev = val;
1094     }
1095 
1096     return RISCV_EXCP_NONE;
1097 }
1098 
1099 static RISCVException write_mhpmcounterh(CPURISCVState *env, int csrno,
1100                                          target_ulong val)
1101 {
1102     int ctr_idx = csrno - CSR_MCYCLEH;
1103     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
1104     uint64_t mhpmctr_val = counter->mhpmcounter_val;
1105     uint64_t mhpmctrh_val = val;
1106 
1107     counter->mhpmcounterh_val = val;
1108     mhpmctr_val = mhpmctr_val | (mhpmctrh_val << 32);
1109     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
1110         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
1111         counter->mhpmcounterh_prev = riscv_pmu_ctr_get_fixed_counters_val(env,
1112                                                                  ctr_idx, true);
1113         if (ctr_idx > 2) {
1114             riscv_pmu_setup_timer(env, mhpmctr_val, ctr_idx);
1115         }
1116     } else {
1117         counter->mhpmcounterh_prev = val;
1118     }
1119 
1120     return RISCV_EXCP_NONE;
1121 }
1122 
1123 static RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
1124                                          bool upper_half, uint32_t ctr_idx)
1125 {
1126     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
1127     target_ulong ctr_prev = upper_half ? counter->mhpmcounterh_prev :
1128                                          counter->mhpmcounter_prev;
1129     target_ulong ctr_val = upper_half ? counter->mhpmcounterh_val :
1130                                         counter->mhpmcounter_val;
1131 
1132     if (get_field(env->mcountinhibit, BIT(ctr_idx))) {
1133         /*
1134          * Counter should not increment if inhibit bit is set. We can't really
1135          * stop the icount counting. Just return the counter value written by
1136          * the supervisor to indicate that counter was not incremented.
1137          */
1138         if (!counter->started) {
1139             *val = ctr_val;
1140             return RISCV_EXCP_NONE;
1141         } else {
1142             /* Mark that the counter has been stopped */
1143             counter->started = false;
1144         }
1145     }
1146 
1147     /*
1148      * The kernel computes the perf delta by subtracting the current value from
1149      * the value it initialized previously (ctr_val).
1150      */
1151     if (riscv_pmu_ctr_monitor_cycles(env, ctr_idx) ||
1152         riscv_pmu_ctr_monitor_instructions(env, ctr_idx)) {
1153         *val = riscv_pmu_ctr_get_fixed_counters_val(env, ctr_idx, upper_half) -
1154                                                     ctr_prev + ctr_val;
1155     } else {
1156         *val = ctr_val;
1157     }
1158 
1159     return RISCV_EXCP_NONE;
1160 }
1161 
1162 static RISCVException read_hpmcounter(CPURISCVState *env, int csrno,
1163                                       target_ulong *val)
1164 {
1165     uint16_t ctr_index;
1166 
1167     if (csrno >= CSR_MCYCLE && csrno <= CSR_MHPMCOUNTER31) {
1168         ctr_index = csrno - CSR_MCYCLE;
1169     } else if (csrno >= CSR_CYCLE && csrno <= CSR_HPMCOUNTER31) {
1170         ctr_index = csrno - CSR_CYCLE;
1171     } else {
1172         return RISCV_EXCP_ILLEGAL_INST;
1173     }
1174 
1175     return riscv_pmu_read_ctr(env, val, false, ctr_index);
1176 }
1177 
1178 static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
1179                                        target_ulong *val)
1180 {
1181     uint16_t ctr_index;
1182 
1183     if (csrno >= CSR_MCYCLEH && csrno <= CSR_MHPMCOUNTER31H) {
1184         ctr_index = csrno - CSR_MCYCLEH;
1185     } else if (csrno >= CSR_CYCLEH && csrno <= CSR_HPMCOUNTER31H) {
1186         ctr_index = csrno - CSR_CYCLEH;
1187     } else {
1188         return RISCV_EXCP_ILLEGAL_INST;
1189     }
1190 
1191     return riscv_pmu_read_ctr(env, val, true, ctr_index);
1192 }
1193 
1194 static RISCVException read_scountovf(CPURISCVState *env, int csrno,
1195                                      target_ulong *val)
1196 {
1197     int mhpmevt_start = CSR_MHPMEVENT3 - CSR_MCOUNTINHIBIT;
1198     int i;
1199     *val = 0;
1200     target_ulong *mhpm_evt_val;
1201     uint64_t of_bit_mask;
1202 
1203     if (riscv_cpu_mxl(env) == MXL_RV32) {
1204         mhpm_evt_val = env->mhpmeventh_val;
1205         of_bit_mask = MHPMEVENTH_BIT_OF;
1206     } else {
1207         mhpm_evt_val = env->mhpmevent_val;
1208         of_bit_mask = MHPMEVENT_BIT_OF;
1209     }
1210 
1211     for (i = mhpmevt_start; i < RV_MAX_MHPMEVENTS; i++) {
1212         if ((get_field(env->mcounteren, BIT(i))) &&
1213             (mhpm_evt_val[i] & of_bit_mask)) {
1214                     *val |= BIT(i);
1215             }
1216     }
1217 
1218     return RISCV_EXCP_NONE;
1219 }
1220 
1221 static RISCVException read_time(CPURISCVState *env, int csrno,
1222                                 target_ulong *val)
1223 {
1224     uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
1225 
1226     if (!env->rdtime_fn) {
1227         return RISCV_EXCP_ILLEGAL_INST;
1228     }
1229 
1230     *val = env->rdtime_fn(env->rdtime_fn_arg) + delta;
1231     return RISCV_EXCP_NONE;
1232 }
1233 
1234 static RISCVException read_timeh(CPURISCVState *env, int csrno,
1235                                  target_ulong *val)
1236 {
1237     uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
1238 
1239     if (!env->rdtime_fn) {
1240         return RISCV_EXCP_ILLEGAL_INST;
1241     }
1242 
1243     *val = (env->rdtime_fn(env->rdtime_fn_arg) + delta) >> 32;
1244     return RISCV_EXCP_NONE;
1245 }
1246 
1247 static RISCVException read_vstimecmp(CPURISCVState *env, int csrno,
1248                                      target_ulong *val)
1249 {
1250     *val = env->vstimecmp;
1251 
1252     return RISCV_EXCP_NONE;
1253 }
1254 
1255 static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
1256                                       target_ulong *val)
1257 {
1258     *val = env->vstimecmp >> 32;
1259 
1260     return RISCV_EXCP_NONE;
1261 }
1262 
1263 static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
1264                                       target_ulong val)
1265 {
1266     if (riscv_cpu_mxl(env) == MXL_RV32) {
1267         env->vstimecmp = deposit64(env->vstimecmp, 0, 32, (uint64_t)val);
1268     } else {
1269         env->vstimecmp = val;
1270     }
1271 
1272     riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
1273                               env->htimedelta, MIP_VSTIP);
1274 
1275     return RISCV_EXCP_NONE;
1276 }
1277 
1278 static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
1279                                        target_ulong val)
1280 {
1281     env->vstimecmp = deposit64(env->vstimecmp, 32, 32, (uint64_t)val);
1282     riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
1283                               env->htimedelta, MIP_VSTIP);
1284 
1285     return RISCV_EXCP_NONE;
1286 }
1287 
1288 static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
1289                                     target_ulong *val)
1290 {
1291     if (env->virt_enabled) {
1292         *val = env->vstimecmp;
1293     } else {
1294         *val = env->stimecmp;
1295     }
1296 
1297     return RISCV_EXCP_NONE;
1298 }
1299 
1300 static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
1301                                      target_ulong *val)
1302 {
1303     if (env->virt_enabled) {
1304         *val = env->vstimecmp >> 32;
1305     } else {
1306         *val = env->stimecmp >> 32;
1307     }
1308 
1309     return RISCV_EXCP_NONE;
1310 }
1311 
1312 static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
1313                                      target_ulong val)
1314 {
1315     if (env->virt_enabled) {
1316         if (env->hvictl & HVICTL_VTI) {
1317             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
1318         }
1319         return write_vstimecmp(env, csrno, val);
1320     }
1321 
1322     if (riscv_cpu_mxl(env) == MXL_RV32) {
1323         env->stimecmp = deposit64(env->stimecmp, 0, 32, (uint64_t)val);
1324     } else {
1325         env->stimecmp = val;
1326     }
1327 
1328     riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
1329 
1330     return RISCV_EXCP_NONE;
1331 }
1332 
1333 static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
1334                                       target_ulong val)
1335 {
1336     if (env->virt_enabled) {
1337         if (env->hvictl & HVICTL_VTI) {
1338             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
1339         }
1340         return write_vstimecmph(env, csrno, val);
1341     }
1342 
1343     env->stimecmp = deposit64(env->stimecmp, 32, 32, (uint64_t)val);
1344     riscv_timer_write_timecmp(env, env->stimer, env->stimecmp, 0, MIP_STIP);
1345 
1346     return RISCV_EXCP_NONE;
1347 }
1348 
1349 #define VSTOPI_NUM_SRCS 5
1350 
1351 /*
1352  * All core local interrupts except the fixed ones 0:12. This macro is for
1353  * virtual interrupts logic so please don't change this to avoid messing up
1354  * the whole support, For reference see AIA spec: `5.3 Interrupt filtering and
1355  * virtual interrupts for supervisor level` and `6.3.2 Virtual interrupts for
1356  * VS level`.
1357  */
1358 #define LOCAL_INTERRUPTS   (~0x1FFFULL)
1359 
1360 static const uint64_t delegable_ints =
1361     S_MODE_INTERRUPTS | VS_MODE_INTERRUPTS | MIP_LCOFIP;
1362 static const uint64_t vs_delegable_ints =
1363     (VS_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & ~MIP_LCOFIP;
1364 static const uint64_t all_ints = M_MODE_INTERRUPTS | S_MODE_INTERRUPTS |
1365                                      HS_MODE_INTERRUPTS | LOCAL_INTERRUPTS;
1366 #define DELEGABLE_EXCPS ((1ULL << (RISCV_EXCP_INST_ADDR_MIS)) | \
1367                          (1ULL << (RISCV_EXCP_INST_ACCESS_FAULT)) | \
1368                          (1ULL << (RISCV_EXCP_ILLEGAL_INST)) | \
1369                          (1ULL << (RISCV_EXCP_BREAKPOINT)) | \
1370                          (1ULL << (RISCV_EXCP_LOAD_ADDR_MIS)) | \
1371                          (1ULL << (RISCV_EXCP_LOAD_ACCESS_FAULT)) | \
1372                          (1ULL << (RISCV_EXCP_STORE_AMO_ADDR_MIS)) | \
1373                          (1ULL << (RISCV_EXCP_STORE_AMO_ACCESS_FAULT)) | \
1374                          (1ULL << (RISCV_EXCP_U_ECALL)) | \
1375                          (1ULL << (RISCV_EXCP_S_ECALL)) | \
1376                          (1ULL << (RISCV_EXCP_VS_ECALL)) | \
1377                          (1ULL << (RISCV_EXCP_M_ECALL)) | \
1378                          (1ULL << (RISCV_EXCP_INST_PAGE_FAULT)) | \
1379                          (1ULL << (RISCV_EXCP_LOAD_PAGE_FAULT)) | \
1380                          (1ULL << (RISCV_EXCP_STORE_PAGE_FAULT)) | \
1381                          (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) | \
1382                          (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) | \
1383                          (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) | \
1384                          (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)))
1385 static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
1386     ~((1ULL << (RISCV_EXCP_S_ECALL)) |
1387       (1ULL << (RISCV_EXCP_VS_ECALL)) |
1388       (1ULL << (RISCV_EXCP_M_ECALL)) |
1389       (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) |
1390       (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) |
1391       (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) |
1392       (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)));
1393 static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
1394     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
1395     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
1396 
1397 /*
1398  * Spec allows for bits 13:63 to be either read-only or writable.
1399  * So far we have interrupt LCOFIP in that region which is writable.
1400  *
1401  * Also, spec allows to inject virtual interrupts in this region even
1402  * without any hardware interrupts for that interrupt number.
1403  *
1404  * For now interrupt in 13:63 region are all kept writable. 13 being
1405  * LCOFIP and 14:63 being virtual only. Change this in future if we
1406  * introduce more interrupts that are not writable.
1407  */
1408 
1409 /* Bit STIP can be an alias of mip.STIP that's why it's writable in mvip. */
1410 static const uint64_t mvip_writable_mask = MIP_SSIP | MIP_STIP | MIP_SEIP |
1411                                     LOCAL_INTERRUPTS;
1412 static const uint64_t mvien_writable_mask = MIP_SSIP | MIP_SEIP |
1413                                     LOCAL_INTERRUPTS;
1414 
1415 static const uint64_t sip_writable_mask = SIP_SSIP | LOCAL_INTERRUPTS;
1416 static const uint64_t hip_writable_mask = MIP_VSSIP;
1417 static const uint64_t hvip_writable_mask = MIP_VSSIP | MIP_VSTIP |
1418                                     MIP_VSEIP | LOCAL_INTERRUPTS;
1419 static const uint64_t hvien_writable_mask = LOCAL_INTERRUPTS;
1420 
1421 static const uint64_t vsip_writable_mask = MIP_VSSIP | LOCAL_INTERRUPTS;
1422 
1423 const bool valid_vm_1_10_32[16] = {
1424     [VM_1_10_MBARE] = true,
1425     [VM_1_10_SV32] = true
1426 };
1427 
1428 const bool valid_vm_1_10_64[16] = {
1429     [VM_1_10_MBARE] = true,
1430     [VM_1_10_SV39] = true,
1431     [VM_1_10_SV48] = true,
1432     [VM_1_10_SV57] = true
1433 };
1434 
1435 /* Machine Information Registers */
1436 static RISCVException read_zero(CPURISCVState *env, int csrno,
1437                                 target_ulong *val)
1438 {
1439     *val = 0;
1440     return RISCV_EXCP_NONE;
1441 }
1442 
1443 static RISCVException write_ignore(CPURISCVState *env, int csrno,
1444                                    target_ulong val)
1445 {
1446     return RISCV_EXCP_NONE;
1447 }
1448 
1449 static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
1450                                      target_ulong *val)
1451 {
1452     *val = riscv_cpu_cfg(env)->mvendorid;
1453     return RISCV_EXCP_NONE;
1454 }
1455 
1456 static RISCVException read_marchid(CPURISCVState *env, int csrno,
1457                                    target_ulong *val)
1458 {
1459     *val = riscv_cpu_cfg(env)->marchid;
1460     return RISCV_EXCP_NONE;
1461 }
1462 
1463 static RISCVException read_mimpid(CPURISCVState *env, int csrno,
1464                                   target_ulong *val)
1465 {
1466     *val = riscv_cpu_cfg(env)->mimpid;
1467     return RISCV_EXCP_NONE;
1468 }
1469 
1470 static RISCVException read_mhartid(CPURISCVState *env, int csrno,
1471                                    target_ulong *val)
1472 {
1473     *val = env->mhartid;
1474     return RISCV_EXCP_NONE;
1475 }
1476 
1477 /* Machine Trap Setup */
1478 
1479 /* We do not store SD explicitly, only compute it on demand. */
1480 static uint64_t add_status_sd(RISCVMXL xl, uint64_t status)
1481 {
1482     if ((status & MSTATUS_FS) == MSTATUS_FS ||
1483         (status & MSTATUS_VS) == MSTATUS_VS ||
1484         (status & MSTATUS_XS) == MSTATUS_XS) {
1485         switch (xl) {
1486         case MXL_RV32:
1487             return status | MSTATUS32_SD;
1488         case MXL_RV64:
1489             return status | MSTATUS64_SD;
1490         case MXL_RV128:
1491             return MSTATUSH128_SD;
1492         default:
1493             g_assert_not_reached();
1494         }
1495     }
1496     return status;
1497 }
1498 
1499 static RISCVException read_mstatus(CPURISCVState *env, int csrno,
1500                                    target_ulong *val)
1501 {
1502     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus);
1503     return RISCV_EXCP_NONE;
1504 }
1505 
1506 static bool validate_vm(CPURISCVState *env, target_ulong vm)
1507 {
1508     uint64_t mode_supported = riscv_cpu_cfg(env)->satp_mode.map;
1509     return get_field(mode_supported, (1 << vm));
1510 }
1511 
1512 static target_ulong legalize_xatp(CPURISCVState *env, target_ulong old_xatp,
1513                                   target_ulong val)
1514 {
1515     target_ulong mask;
1516     bool vm;
1517     if (riscv_cpu_mxl(env) == MXL_RV32) {
1518         vm = validate_vm(env, get_field(val, SATP32_MODE));
1519         mask = (val ^ old_xatp) & (SATP32_MODE | SATP32_ASID | SATP32_PPN);
1520     } else {
1521         vm = validate_vm(env, get_field(val, SATP64_MODE));
1522         mask = (val ^ old_xatp) & (SATP64_MODE | SATP64_ASID | SATP64_PPN);
1523     }
1524 
1525     if (vm && mask) {
1526         /*
1527          * The ISA defines SATP.MODE=Bare as "no translation", but we still
1528          * pass these through QEMU's TLB emulation as it improves
1529          * performance.  Flushing the TLB on SATP writes with paging
1530          * enabled avoids leaking those invalid cached mappings.
1531          */
1532         tlb_flush(env_cpu(env));
1533         return val;
1534     }
1535     return old_xatp;
1536 }
1537 
1538 static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
1539                                  target_ulong val)
1540 {
1541     bool valid = false;
1542     target_ulong new_mpp = get_field(val, MSTATUS_MPP);
1543 
1544     switch (new_mpp) {
1545     case PRV_M:
1546         valid = true;
1547         break;
1548     case PRV_S:
1549         valid = riscv_has_ext(env, RVS);
1550         break;
1551     case PRV_U:
1552         valid = riscv_has_ext(env, RVU);
1553         break;
1554     }
1555 
1556     /* Remain field unchanged if new_mpp value is invalid */
1557     if (!valid) {
1558         val = set_field(val, MSTATUS_MPP, old_mpp);
1559     }
1560 
1561     return val;
1562 }
1563 
1564 static RISCVException write_mstatus(CPURISCVState *env, int csrno,
1565                                     target_ulong val)
1566 {
1567     uint64_t mstatus = env->mstatus;
1568     uint64_t mask = 0;
1569     RISCVMXL xl = riscv_cpu_mxl(env);
1570 
1571     /*
1572      * MPP field have been made WARL since priv version 1.11. However,
1573      * legalization for it will not break any software running on 1.10.
1574      */
1575     val = legalize_mpp(env, get_field(mstatus, MSTATUS_MPP), val);
1576 
1577     /* flush tlb on mstatus fields that affect VM */
1578     if ((val ^ mstatus) & MSTATUS_MXR) {
1579         tlb_flush(env_cpu(env));
1580     }
1581     mask = MSTATUS_SIE | MSTATUS_SPIE | MSTATUS_MIE | MSTATUS_MPIE |
1582         MSTATUS_SPP | MSTATUS_MPRV | MSTATUS_SUM |
1583         MSTATUS_MPP | MSTATUS_MXR | MSTATUS_TVM | MSTATUS_TSR |
1584         MSTATUS_TW;
1585 
1586     if (riscv_has_ext(env, RVF)) {
1587         mask |= MSTATUS_FS;
1588     }
1589     if (riscv_has_ext(env, RVV)) {
1590         mask |= MSTATUS_VS;
1591     }
1592 
1593     if (xl != MXL_RV32 || env->debugger) {
1594         if (riscv_has_ext(env, RVH)) {
1595             mask |= MSTATUS_MPV | MSTATUS_GVA;
1596         }
1597         if ((val & MSTATUS64_UXL) != 0) {
1598             mask |= MSTATUS64_UXL;
1599         }
1600     }
1601 
1602     mstatus = (mstatus & ~mask) | (val & mask);
1603 
1604     env->mstatus = mstatus;
1605 
1606     /*
1607      * Except in debug mode, UXL/SXL can only be modified by higher
1608      * privilege mode. So xl will not be changed in normal mode.
1609      */
1610     if (env->debugger) {
1611         env->xl = cpu_recompute_xl(env);
1612     }
1613 
1614     riscv_cpu_update_mask(env);
1615     return RISCV_EXCP_NONE;
1616 }
1617 
1618 static RISCVException read_mstatush(CPURISCVState *env, int csrno,
1619                                     target_ulong *val)
1620 {
1621     *val = env->mstatus >> 32;
1622     return RISCV_EXCP_NONE;
1623 }
1624 
1625 static RISCVException write_mstatush(CPURISCVState *env, int csrno,
1626                                      target_ulong val)
1627 {
1628     uint64_t valh = (uint64_t)val << 32;
1629     uint64_t mask = riscv_has_ext(env, RVH) ? MSTATUS_MPV | MSTATUS_GVA : 0;
1630 
1631     env->mstatus = (env->mstatus & ~mask) | (valh & mask);
1632 
1633     return RISCV_EXCP_NONE;
1634 }
1635 
1636 static RISCVException read_mstatus_i128(CPURISCVState *env, int csrno,
1637                                         Int128 *val)
1638 {
1639     *val = int128_make128(env->mstatus, add_status_sd(MXL_RV128,
1640                                                       env->mstatus));
1641     return RISCV_EXCP_NONE;
1642 }
1643 
1644 static RISCVException read_misa_i128(CPURISCVState *env, int csrno,
1645                                      Int128 *val)
1646 {
1647     *val = int128_make128(env->misa_ext, (uint64_t)MXL_RV128 << 62);
1648     return RISCV_EXCP_NONE;
1649 }
1650 
1651 static RISCVException read_misa(CPURISCVState *env, int csrno,
1652                                 target_ulong *val)
1653 {
1654     target_ulong misa;
1655 
1656     switch (env->misa_mxl) {
1657     case MXL_RV32:
1658         misa = (target_ulong)MXL_RV32 << 30;
1659         break;
1660 #ifdef TARGET_RISCV64
1661     case MXL_RV64:
1662         misa = (target_ulong)MXL_RV64 << 62;
1663         break;
1664 #endif
1665     default:
1666         g_assert_not_reached();
1667     }
1668 
1669     *val = misa | env->misa_ext;
1670     return RISCV_EXCP_NONE;
1671 }
1672 
1673 static RISCVException write_misa(CPURISCVState *env, int csrno,
1674                                  target_ulong val)
1675 {
1676     RISCVCPU *cpu = env_archcpu(env);
1677     uint32_t orig_misa_ext = env->misa_ext;
1678     Error *local_err = NULL;
1679 
1680     if (!riscv_cpu_cfg(env)->misa_w) {
1681         /* drop write to misa */
1682         return RISCV_EXCP_NONE;
1683     }
1684 
1685     /* Mask extensions that are not supported by this hart */
1686     val &= env->misa_ext_mask;
1687 
1688     /*
1689      * Suppress 'C' if next instruction is not aligned
1690      * TODO: this should check next_pc
1691      */
1692     if ((val & RVC) && (GETPC() & ~3) != 0) {
1693         val &= ~RVC;
1694     }
1695 
1696     /* Disable RVG if any of its dependencies are disabled */
1697     if (!(val & RVI && val & RVM && val & RVA &&
1698           val & RVF && val & RVD)) {
1699         val &= ~RVG;
1700     }
1701 
1702     /* If nothing changed, do nothing. */
1703     if (val == env->misa_ext) {
1704         return RISCV_EXCP_NONE;
1705     }
1706 
1707     env->misa_ext = val;
1708     riscv_cpu_validate_set_extensions(cpu, &local_err);
1709     if (local_err != NULL) {
1710         /* Rollback on validation error */
1711         qemu_log_mask(LOG_GUEST_ERROR, "Unable to write MISA ext value "
1712                       "0x%x, keeping existing MISA ext 0x%x\n",
1713                       env->misa_ext, orig_misa_ext);
1714 
1715         env->misa_ext = orig_misa_ext;
1716 
1717         return RISCV_EXCP_NONE;
1718     }
1719 
1720     if (!(env->misa_ext & RVF)) {
1721         env->mstatus &= ~MSTATUS_FS;
1722     }
1723 
1724     /* flush translation cache */
1725     tb_flush(env_cpu(env));
1726     env->xl = riscv_cpu_mxl(env);
1727     return RISCV_EXCP_NONE;
1728 }
1729 
1730 static RISCVException read_medeleg(CPURISCVState *env, int csrno,
1731                                    target_ulong *val)
1732 {
1733     *val = env->medeleg;
1734     return RISCV_EXCP_NONE;
1735 }
1736 
1737 static RISCVException write_medeleg(CPURISCVState *env, int csrno,
1738                                     target_ulong val)
1739 {
1740     env->medeleg = (env->medeleg & ~DELEGABLE_EXCPS) | (val & DELEGABLE_EXCPS);
1741     return RISCV_EXCP_NONE;
1742 }
1743 
1744 static RISCVException rmw_mideleg64(CPURISCVState *env, int csrno,
1745                                     uint64_t *ret_val,
1746                                     uint64_t new_val, uint64_t wr_mask)
1747 {
1748     uint64_t mask = wr_mask & delegable_ints;
1749 
1750     if (ret_val) {
1751         *ret_val = env->mideleg;
1752     }
1753 
1754     env->mideleg = (env->mideleg & ~mask) | (new_val & mask);
1755 
1756     if (riscv_has_ext(env, RVH)) {
1757         env->mideleg |= HS_MODE_INTERRUPTS;
1758     }
1759 
1760     return RISCV_EXCP_NONE;
1761 }
1762 
1763 static RISCVException rmw_mideleg(CPURISCVState *env, int csrno,
1764                                   target_ulong *ret_val,
1765                                   target_ulong new_val, target_ulong wr_mask)
1766 {
1767     uint64_t rval;
1768     RISCVException ret;
1769 
1770     ret = rmw_mideleg64(env, csrno, &rval, new_val, wr_mask);
1771     if (ret_val) {
1772         *ret_val = rval;
1773     }
1774 
1775     return ret;
1776 }
1777 
1778 static RISCVException rmw_midelegh(CPURISCVState *env, int csrno,
1779                                    target_ulong *ret_val,
1780                                    target_ulong new_val,
1781                                    target_ulong wr_mask)
1782 {
1783     uint64_t rval;
1784     RISCVException ret;
1785 
1786     ret = rmw_mideleg64(env, csrno, &rval,
1787         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1788     if (ret_val) {
1789         *ret_val = rval >> 32;
1790     }
1791 
1792     return ret;
1793 }
1794 
1795 static RISCVException rmw_mie64(CPURISCVState *env, int csrno,
1796                                 uint64_t *ret_val,
1797                                 uint64_t new_val, uint64_t wr_mask)
1798 {
1799     uint64_t mask = wr_mask & all_ints;
1800 
1801     if (ret_val) {
1802         *ret_val = env->mie;
1803     }
1804 
1805     env->mie = (env->mie & ~mask) | (new_val & mask);
1806 
1807     if (!riscv_has_ext(env, RVH)) {
1808         env->mie &= ~((uint64_t)HS_MODE_INTERRUPTS);
1809     }
1810 
1811     return RISCV_EXCP_NONE;
1812 }
1813 
1814 static RISCVException rmw_mie(CPURISCVState *env, int csrno,
1815                               target_ulong *ret_val,
1816                               target_ulong new_val, target_ulong wr_mask)
1817 {
1818     uint64_t rval;
1819     RISCVException ret;
1820 
1821     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask);
1822     if (ret_val) {
1823         *ret_val = rval;
1824     }
1825 
1826     return ret;
1827 }
1828 
1829 static RISCVException rmw_mieh(CPURISCVState *env, int csrno,
1830                                target_ulong *ret_val,
1831                                target_ulong new_val, target_ulong wr_mask)
1832 {
1833     uint64_t rval;
1834     RISCVException ret;
1835 
1836     ret = rmw_mie64(env, csrno, &rval,
1837         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1838     if (ret_val) {
1839         *ret_val = rval >> 32;
1840     }
1841 
1842     return ret;
1843 }
1844 
1845 static RISCVException rmw_mvien64(CPURISCVState *env, int csrno,
1846                                 uint64_t *ret_val,
1847                                 uint64_t new_val, uint64_t wr_mask)
1848 {
1849     uint64_t mask = wr_mask & mvien_writable_mask;
1850 
1851     if (ret_val) {
1852         *ret_val = env->mvien;
1853     }
1854 
1855     env->mvien = (env->mvien & ~mask) | (new_val & mask);
1856 
1857     return RISCV_EXCP_NONE;
1858 }
1859 
1860 static RISCVException rmw_mvien(CPURISCVState *env, int csrno,
1861                               target_ulong *ret_val,
1862                               target_ulong new_val, target_ulong wr_mask)
1863 {
1864     uint64_t rval;
1865     RISCVException ret;
1866 
1867     ret = rmw_mvien64(env, csrno, &rval, new_val, wr_mask);
1868     if (ret_val) {
1869         *ret_val = rval;
1870     }
1871 
1872     return ret;
1873 }
1874 
1875 static RISCVException rmw_mvienh(CPURISCVState *env, int csrno,
1876                                 target_ulong *ret_val,
1877                                 target_ulong new_val, target_ulong wr_mask)
1878 {
1879     uint64_t rval;
1880     RISCVException ret;
1881 
1882     ret = rmw_mvien64(env, csrno, &rval,
1883         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
1884     if (ret_val) {
1885         *ret_val = rval >> 32;
1886     }
1887 
1888     return ret;
1889 }
1890 
1891 static RISCVException read_mtopi(CPURISCVState *env, int csrno,
1892                                  target_ulong *val)
1893 {
1894     int irq;
1895     uint8_t iprio;
1896 
1897     irq = riscv_cpu_mirq_pending(env);
1898     if (irq <= 0 || irq > 63) {
1899         *val = 0;
1900     } else {
1901         iprio = env->miprio[irq];
1902         if (!iprio) {
1903             if (riscv_cpu_default_priority(irq) > IPRIO_DEFAULT_M) {
1904                 iprio = IPRIO_MMAXIPRIO;
1905             }
1906         }
1907         *val = (irq & TOPI_IID_MASK) << TOPI_IID_SHIFT;
1908         *val |= iprio;
1909     }
1910 
1911     return RISCV_EXCP_NONE;
1912 }
1913 
1914 static int aia_xlate_vs_csrno(CPURISCVState *env, int csrno)
1915 {
1916     if (!env->virt_enabled) {
1917         return csrno;
1918     }
1919 
1920     switch (csrno) {
1921     case CSR_SISELECT:
1922         return CSR_VSISELECT;
1923     case CSR_SIREG:
1924         return CSR_VSIREG;
1925     case CSR_STOPEI:
1926         return CSR_VSTOPEI;
1927     default:
1928         return csrno;
1929     };
1930 }
1931 
1932 static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
1933                                    target_ulong *val, target_ulong new_val,
1934                                    target_ulong wr_mask)
1935 {
1936     target_ulong *iselect;
1937 
1938     /* Translate CSR number for VS-mode */
1939     csrno = aia_xlate_vs_csrno(env, csrno);
1940 
1941     /* Find the iselect CSR based on CSR number */
1942     switch (csrno) {
1943     case CSR_MISELECT:
1944         iselect = &env->miselect;
1945         break;
1946     case CSR_SISELECT:
1947         iselect = &env->siselect;
1948         break;
1949     case CSR_VSISELECT:
1950         iselect = &env->vsiselect;
1951         break;
1952     default:
1953          return RISCV_EXCP_ILLEGAL_INST;
1954     };
1955 
1956     if (val) {
1957         *val = *iselect;
1958     }
1959 
1960     wr_mask &= ISELECT_MASK;
1961     if (wr_mask) {
1962         *iselect = (*iselect & ~wr_mask) | (new_val & wr_mask);
1963     }
1964 
1965     return RISCV_EXCP_NONE;
1966 }
1967 
1968 static int rmw_iprio(target_ulong xlen,
1969                      target_ulong iselect, uint8_t *iprio,
1970                      target_ulong *val, target_ulong new_val,
1971                      target_ulong wr_mask, int ext_irq_no)
1972 {
1973     int i, firq, nirqs;
1974     target_ulong old_val;
1975 
1976     if (iselect < ISELECT_IPRIO0 || ISELECT_IPRIO15 < iselect) {
1977         return -EINVAL;
1978     }
1979     if (xlen != 32 && iselect & 0x1) {
1980         return -EINVAL;
1981     }
1982 
1983     nirqs = 4 * (xlen / 32);
1984     firq = ((iselect - ISELECT_IPRIO0) / (xlen / 32)) * (nirqs);
1985 
1986     old_val = 0;
1987     for (i = 0; i < nirqs; i++) {
1988         old_val |= ((target_ulong)iprio[firq + i]) << (IPRIO_IRQ_BITS * i);
1989     }
1990 
1991     if (val) {
1992         *val = old_val;
1993     }
1994 
1995     if (wr_mask) {
1996         new_val = (old_val & ~wr_mask) | (new_val & wr_mask);
1997         for (i = 0; i < nirqs; i++) {
1998             /*
1999              * M-level and S-level external IRQ priority always read-only
2000              * zero. This means default priority order is always preferred
2001              * for M-level and S-level external IRQs.
2002              */
2003             if ((firq + i) == ext_irq_no) {
2004                 continue;
2005             }
2006             iprio[firq + i] = (new_val >> (IPRIO_IRQ_BITS * i)) & 0xff;
2007         }
2008     }
2009 
2010     return 0;
2011 }
2012 
2013 static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
2014                                 target_ulong *val, target_ulong new_val,
2015                                 target_ulong wr_mask)
2016 {
2017     bool virt, isel_reserved;
2018     uint8_t *iprio;
2019     int ret = -EINVAL;
2020     target_ulong priv, isel, vgein;
2021 
2022     /* Translate CSR number for VS-mode */
2023     csrno = aia_xlate_vs_csrno(env, csrno);
2024 
2025     /* Decode register details from CSR number */
2026     virt = false;
2027     isel_reserved = false;
2028     switch (csrno) {
2029     case CSR_MIREG:
2030         iprio = env->miprio;
2031         isel = env->miselect;
2032         priv = PRV_M;
2033         break;
2034     case CSR_SIREG:
2035         if (env->priv == PRV_S && env->mvien & MIP_SEIP &&
2036             env->siselect >= ISELECT_IMSIC_EIDELIVERY &&
2037             env->siselect <= ISELECT_IMSIC_EIE63) {
2038             goto done;
2039         }
2040         iprio = env->siprio;
2041         isel = env->siselect;
2042         priv = PRV_S;
2043         break;
2044     case CSR_VSIREG:
2045         iprio = env->hviprio;
2046         isel = env->vsiselect;
2047         priv = PRV_S;
2048         virt = true;
2049         break;
2050     default:
2051          goto done;
2052     };
2053 
2054     /* Find the selected guest interrupt file */
2055     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
2056 
2057     if (ISELECT_IPRIO0 <= isel && isel <= ISELECT_IPRIO15) {
2058         /* Local interrupt priority registers not available for VS-mode */
2059         if (!virt) {
2060             ret = rmw_iprio(riscv_cpu_mxl_bits(env),
2061                             isel, iprio, val, new_val, wr_mask,
2062                             (priv == PRV_M) ? IRQ_M_EXT : IRQ_S_EXT);
2063         }
2064     } else if (ISELECT_IMSIC_FIRST <= isel && isel <= ISELECT_IMSIC_LAST) {
2065         /* IMSIC registers only available when machine implements it. */
2066         if (env->aia_ireg_rmw_fn[priv]) {
2067             /* Selected guest interrupt file should not be zero */
2068             if (virt && (!vgein || env->geilen < vgein)) {
2069                 goto done;
2070             }
2071             /* Call machine specific IMSIC register emulation */
2072             ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
2073                                     AIA_MAKE_IREG(isel, priv, virt, vgein,
2074                                                   riscv_cpu_mxl_bits(env)),
2075                                     val, new_val, wr_mask);
2076         }
2077     } else {
2078         isel_reserved = true;
2079     }
2080 
2081 done:
2082     if (ret) {
2083         return (env->virt_enabled && virt && !isel_reserved) ?
2084                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
2085     }
2086     return RISCV_EXCP_NONE;
2087 }
2088 
2089 static RISCVException rmw_xtopei(CPURISCVState *env, int csrno,
2090                                  target_ulong *val, target_ulong new_val,
2091                                  target_ulong wr_mask)
2092 {
2093     bool virt;
2094     int ret = -EINVAL;
2095     target_ulong priv, vgein;
2096 
2097     /* Translate CSR number for VS-mode */
2098     csrno = aia_xlate_vs_csrno(env, csrno);
2099 
2100     /* Decode register details from CSR number */
2101     virt = false;
2102     switch (csrno) {
2103     case CSR_MTOPEI:
2104         priv = PRV_M;
2105         break;
2106     case CSR_STOPEI:
2107         if (env->mvien & MIP_SEIP && env->priv == PRV_S) {
2108             goto done;
2109         }
2110         priv = PRV_S;
2111         break;
2112     case CSR_VSTOPEI:
2113         priv = PRV_S;
2114         virt = true;
2115         break;
2116     default:
2117         goto done;
2118     };
2119 
2120     /* IMSIC CSRs only available when machine implements IMSIC. */
2121     if (!env->aia_ireg_rmw_fn[priv]) {
2122         goto done;
2123     }
2124 
2125     /* Find the selected guest interrupt file */
2126     vgein = (virt) ? get_field(env->hstatus, HSTATUS_VGEIN) : 0;
2127 
2128     /* Selected guest interrupt file should be valid */
2129     if (virt && (!vgein || env->geilen < vgein)) {
2130         goto done;
2131     }
2132 
2133     /* Call machine specific IMSIC register emulation for TOPEI */
2134     ret = env->aia_ireg_rmw_fn[priv](env->aia_ireg_rmw_fn_arg[priv],
2135                     AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, priv, virt, vgein,
2136                                   riscv_cpu_mxl_bits(env)),
2137                     val, new_val, wr_mask);
2138 
2139 done:
2140     if (ret) {
2141         return (env->virt_enabled && virt) ?
2142                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
2143     }
2144     return RISCV_EXCP_NONE;
2145 }
2146 
2147 static RISCVException read_mtvec(CPURISCVState *env, int csrno,
2148                                  target_ulong *val)
2149 {
2150     *val = env->mtvec;
2151     return RISCV_EXCP_NONE;
2152 }
2153 
2154 static RISCVException write_mtvec(CPURISCVState *env, int csrno,
2155                                   target_ulong val)
2156 {
2157     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
2158     if ((val & 3) < 2) {
2159         env->mtvec = val;
2160     } else {
2161         qemu_log_mask(LOG_UNIMP, "CSR_MTVEC: reserved mode not supported\n");
2162     }
2163     return RISCV_EXCP_NONE;
2164 }
2165 
2166 static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
2167                                          target_ulong *val)
2168 {
2169     *val = env->mcountinhibit;
2170     return RISCV_EXCP_NONE;
2171 }
2172 
2173 static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
2174                                           target_ulong val)
2175 {
2176     int cidx;
2177     PMUCTRState *counter;
2178     RISCVCPU *cpu = env_archcpu(env);
2179 
2180     /* WARL register - disable unavailable counters; TM bit is always 0 */
2181     env->mcountinhibit =
2182         val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR);
2183 
2184     /* Check if any other counter is also monitoring cycles/instructions */
2185     for (cidx = 0; cidx < RV_MAX_MHPMCOUNTERS; cidx++) {
2186         if (!get_field(env->mcountinhibit, BIT(cidx))) {
2187             counter = &env->pmu_ctrs[cidx];
2188             counter->started = true;
2189         }
2190     }
2191 
2192     return RISCV_EXCP_NONE;
2193 }
2194 
2195 static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
2196                                       target_ulong *val)
2197 {
2198     *val = env->mcounteren;
2199     return RISCV_EXCP_NONE;
2200 }
2201 
2202 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
2203                                        target_ulong val)
2204 {
2205     RISCVCPU *cpu = env_archcpu(env);
2206 
2207     /* WARL register - disable unavailable counters */
2208     env->mcounteren = val & (cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_TM |
2209                              COUNTEREN_IR);
2210     return RISCV_EXCP_NONE;
2211 }
2212 
2213 /* Machine Trap Handling */
2214 static RISCVException read_mscratch_i128(CPURISCVState *env, int csrno,
2215                                          Int128 *val)
2216 {
2217     *val = int128_make128(env->mscratch, env->mscratchh);
2218     return RISCV_EXCP_NONE;
2219 }
2220 
2221 static RISCVException write_mscratch_i128(CPURISCVState *env, int csrno,
2222                                           Int128 val)
2223 {
2224     env->mscratch = int128_getlo(val);
2225     env->mscratchh = int128_gethi(val);
2226     return RISCV_EXCP_NONE;
2227 }
2228 
2229 static RISCVException read_mscratch(CPURISCVState *env, int csrno,
2230                                     target_ulong *val)
2231 {
2232     *val = env->mscratch;
2233     return RISCV_EXCP_NONE;
2234 }
2235 
2236 static RISCVException write_mscratch(CPURISCVState *env, int csrno,
2237                                      target_ulong val)
2238 {
2239     env->mscratch = val;
2240     return RISCV_EXCP_NONE;
2241 }
2242 
2243 static RISCVException read_mepc(CPURISCVState *env, int csrno,
2244                                 target_ulong *val)
2245 {
2246     *val = env->mepc;
2247     return RISCV_EXCP_NONE;
2248 }
2249 
2250 static RISCVException write_mepc(CPURISCVState *env, int csrno,
2251                                  target_ulong val)
2252 {
2253     env->mepc = val;
2254     return RISCV_EXCP_NONE;
2255 }
2256 
2257 static RISCVException read_mcause(CPURISCVState *env, int csrno,
2258                                   target_ulong *val)
2259 {
2260     *val = env->mcause;
2261     return RISCV_EXCP_NONE;
2262 }
2263 
2264 static RISCVException write_mcause(CPURISCVState *env, int csrno,
2265                                    target_ulong val)
2266 {
2267     env->mcause = val;
2268     return RISCV_EXCP_NONE;
2269 }
2270 
2271 static RISCVException read_mtval(CPURISCVState *env, int csrno,
2272                                  target_ulong *val)
2273 {
2274     *val = env->mtval;
2275     return RISCV_EXCP_NONE;
2276 }
2277 
2278 static RISCVException write_mtval(CPURISCVState *env, int csrno,
2279                                   target_ulong val)
2280 {
2281     env->mtval = val;
2282     return RISCV_EXCP_NONE;
2283 }
2284 
2285 /* Execution environment configuration setup */
2286 static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
2287                                    target_ulong *val)
2288 {
2289     *val = env->menvcfg;
2290     return RISCV_EXCP_NONE;
2291 }
2292 
2293 static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
2294                                     target_ulong val)
2295 {
2296     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
2297     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE | MENVCFG_CBZE;
2298 
2299     if (riscv_cpu_mxl(env) == MXL_RV64) {
2300         mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
2301                 (cfg->ext_sstc ? MENVCFG_STCE : 0) |
2302                 (cfg->ext_svadu ? MENVCFG_ADUE : 0);
2303     }
2304     env->menvcfg = (env->menvcfg & ~mask) | (val & mask);
2305 
2306     return RISCV_EXCP_NONE;
2307 }
2308 
2309 static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
2310                                     target_ulong *val)
2311 {
2312     *val = env->menvcfg >> 32;
2313     return RISCV_EXCP_NONE;
2314 }
2315 
2316 static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
2317                                      target_ulong val)
2318 {
2319     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
2320     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
2321                     (cfg->ext_sstc ? MENVCFG_STCE : 0) |
2322                     (cfg->ext_svadu ? MENVCFG_ADUE : 0);
2323     uint64_t valh = (uint64_t)val << 32;
2324 
2325     env->menvcfg = (env->menvcfg & ~mask) | (valh & mask);
2326 
2327     return RISCV_EXCP_NONE;
2328 }
2329 
2330 static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
2331                                    target_ulong *val)
2332 {
2333     RISCVException ret;
2334 
2335     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2336     if (ret != RISCV_EXCP_NONE) {
2337         return ret;
2338     }
2339 
2340     *val = env->senvcfg;
2341     return RISCV_EXCP_NONE;
2342 }
2343 
2344 static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
2345                                     target_ulong val)
2346 {
2347     uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
2348     RISCVException ret;
2349 
2350     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2351     if (ret != RISCV_EXCP_NONE) {
2352         return ret;
2353     }
2354 
2355     env->senvcfg = (env->senvcfg & ~mask) | (val & mask);
2356     return RISCV_EXCP_NONE;
2357 }
2358 
2359 static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
2360                                    target_ulong *val)
2361 {
2362     RISCVException ret;
2363 
2364     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2365     if (ret != RISCV_EXCP_NONE) {
2366         return ret;
2367     }
2368 
2369     /*
2370      * henvcfg.pbmte is read_only 0 when menvcfg.pbmte = 0
2371      * henvcfg.stce is read_only 0 when menvcfg.stce = 0
2372      * henvcfg.adue is read_only 0 when menvcfg.adue = 0
2373      */
2374     *val = env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
2375                            env->menvcfg);
2376     return RISCV_EXCP_NONE;
2377 }
2378 
2379 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
2380                                     target_ulong val)
2381 {
2382     uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
2383     RISCVException ret;
2384 
2385     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2386     if (ret != RISCV_EXCP_NONE) {
2387         return ret;
2388     }
2389 
2390     if (riscv_cpu_mxl(env) == MXL_RV64) {
2391         mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE);
2392     }
2393 
2394     env->henvcfg = (env->henvcfg & ~mask) | (val & mask);
2395 
2396     return RISCV_EXCP_NONE;
2397 }
2398 
2399 static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
2400                                     target_ulong *val)
2401 {
2402     RISCVException ret;
2403 
2404     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2405     if (ret != RISCV_EXCP_NONE) {
2406         return ret;
2407     }
2408 
2409     *val = (env->henvcfg & (~(HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE) |
2410                             env->menvcfg)) >> 32;
2411     return RISCV_EXCP_NONE;
2412 }
2413 
2414 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
2415                                      target_ulong val)
2416 {
2417     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
2418                                     HENVCFG_ADUE);
2419     uint64_t valh = (uint64_t)val << 32;
2420     RISCVException ret;
2421 
2422     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_HSENVCFG);
2423     if (ret != RISCV_EXCP_NONE) {
2424         return ret;
2425     }
2426 
2427     env->henvcfg = (env->henvcfg & ~mask) | (valh & mask);
2428     return RISCV_EXCP_NONE;
2429 }
2430 
2431 static RISCVException read_mstateen(CPURISCVState *env, int csrno,
2432                                     target_ulong *val)
2433 {
2434     *val = env->mstateen[csrno - CSR_MSTATEEN0];
2435 
2436     return RISCV_EXCP_NONE;
2437 }
2438 
2439 static RISCVException write_mstateen(CPURISCVState *env, int csrno,
2440                                      uint64_t wr_mask, target_ulong new_val)
2441 {
2442     uint64_t *reg;
2443 
2444     reg = &env->mstateen[csrno - CSR_MSTATEEN0];
2445     *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
2446 
2447     return RISCV_EXCP_NONE;
2448 }
2449 
2450 static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
2451                                       target_ulong new_val)
2452 {
2453     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2454     if (!riscv_has_ext(env, RVF)) {
2455         wr_mask |= SMSTATEEN0_FCSR;
2456     }
2457 
2458     if (env->priv_ver >= PRIV_VERSION_1_13_0) {
2459         wr_mask |= SMSTATEEN0_P1P13;
2460     }
2461 
2462     return write_mstateen(env, csrno, wr_mask, new_val);
2463 }
2464 
2465 static RISCVException write_mstateen_1_3(CPURISCVState *env, int csrno,
2466                                          target_ulong new_val)
2467 {
2468     return write_mstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
2469 }
2470 
2471 static RISCVException read_mstateenh(CPURISCVState *env, int csrno,
2472                                      target_ulong *val)
2473 {
2474     *val = env->mstateen[csrno - CSR_MSTATEEN0H] >> 32;
2475 
2476     return RISCV_EXCP_NONE;
2477 }
2478 
2479 static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
2480                                       uint64_t wr_mask, target_ulong new_val)
2481 {
2482     uint64_t *reg, val;
2483 
2484     reg = &env->mstateen[csrno - CSR_MSTATEEN0H];
2485     val = (uint64_t)new_val << 32;
2486     val |= *reg & 0xFFFFFFFF;
2487     *reg = (*reg & ~wr_mask) | (val & wr_mask);
2488 
2489     return RISCV_EXCP_NONE;
2490 }
2491 
2492 static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
2493                                        target_ulong new_val)
2494 {
2495     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2496 
2497     if (env->priv_ver >= PRIV_VERSION_1_13_0) {
2498         wr_mask |= SMSTATEEN0_P1P13;
2499     }
2500 
2501     return write_mstateenh(env, csrno, wr_mask, new_val);
2502 }
2503 
2504 static RISCVException write_mstateenh_1_3(CPURISCVState *env, int csrno,
2505                                           target_ulong new_val)
2506 {
2507     return write_mstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
2508 }
2509 
2510 static RISCVException read_hstateen(CPURISCVState *env, int csrno,
2511                                     target_ulong *val)
2512 {
2513     int index = csrno - CSR_HSTATEEN0;
2514 
2515     *val = env->hstateen[index] & env->mstateen[index];
2516 
2517     return RISCV_EXCP_NONE;
2518 }
2519 
2520 static RISCVException write_hstateen(CPURISCVState *env, int csrno,
2521                                      uint64_t mask, target_ulong new_val)
2522 {
2523     int index = csrno - CSR_HSTATEEN0;
2524     uint64_t *reg, wr_mask;
2525 
2526     reg = &env->hstateen[index];
2527     wr_mask = env->mstateen[index] & mask;
2528     *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
2529 
2530     return RISCV_EXCP_NONE;
2531 }
2532 
2533 static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
2534                                       target_ulong new_val)
2535 {
2536     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2537 
2538     if (!riscv_has_ext(env, RVF)) {
2539         wr_mask |= SMSTATEEN0_FCSR;
2540     }
2541 
2542     return write_hstateen(env, csrno, wr_mask, new_val);
2543 }
2544 
2545 static RISCVException write_hstateen_1_3(CPURISCVState *env, int csrno,
2546                                          target_ulong new_val)
2547 {
2548     return write_hstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
2549 }
2550 
2551 static RISCVException read_hstateenh(CPURISCVState *env, int csrno,
2552                                      target_ulong *val)
2553 {
2554     int index = csrno - CSR_HSTATEEN0H;
2555 
2556     *val = (env->hstateen[index] >> 32) & (env->mstateen[index] >> 32);
2557 
2558     return RISCV_EXCP_NONE;
2559 }
2560 
2561 static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
2562                                       uint64_t mask, target_ulong new_val)
2563 {
2564     int index = csrno - CSR_HSTATEEN0H;
2565     uint64_t *reg, wr_mask, val;
2566 
2567     reg = &env->hstateen[index];
2568     val = (uint64_t)new_val << 32;
2569     val |= *reg & 0xFFFFFFFF;
2570     wr_mask = env->mstateen[index] & mask;
2571     *reg = (*reg & ~wr_mask) | (val & wr_mask);
2572 
2573     return RISCV_EXCP_NONE;
2574 }
2575 
2576 static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
2577                                        target_ulong new_val)
2578 {
2579     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2580 
2581     return write_hstateenh(env, csrno, wr_mask, new_val);
2582 }
2583 
2584 static RISCVException write_hstateenh_1_3(CPURISCVState *env, int csrno,
2585                                           target_ulong new_val)
2586 {
2587     return write_hstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
2588 }
2589 
2590 static RISCVException read_sstateen(CPURISCVState *env, int csrno,
2591                                     target_ulong *val)
2592 {
2593     bool virt = env->virt_enabled;
2594     int index = csrno - CSR_SSTATEEN0;
2595 
2596     *val = env->sstateen[index] & env->mstateen[index];
2597     if (virt) {
2598         *val &= env->hstateen[index];
2599     }
2600 
2601     return RISCV_EXCP_NONE;
2602 }
2603 
2604 static RISCVException write_sstateen(CPURISCVState *env, int csrno,
2605                                      uint64_t mask, target_ulong new_val)
2606 {
2607     bool virt = env->virt_enabled;
2608     int index = csrno - CSR_SSTATEEN0;
2609     uint64_t wr_mask;
2610     uint64_t *reg;
2611 
2612     wr_mask = env->mstateen[index] & mask;
2613     if (virt) {
2614         wr_mask &= env->hstateen[index];
2615     }
2616 
2617     reg = &env->sstateen[index];
2618     *reg = (*reg & ~wr_mask) | (new_val & wr_mask);
2619 
2620     return RISCV_EXCP_NONE;
2621 }
2622 
2623 static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
2624                                       target_ulong new_val)
2625 {
2626     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
2627 
2628     if (!riscv_has_ext(env, RVF)) {
2629         wr_mask |= SMSTATEEN0_FCSR;
2630     }
2631 
2632     return write_sstateen(env, csrno, wr_mask, new_val);
2633 }
2634 
2635 static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
2636                                       target_ulong new_val)
2637 {
2638     return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
2639 }
2640 
2641 static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
2642                                 uint64_t *ret_val,
2643                                 uint64_t new_val, uint64_t wr_mask)
2644 {
2645     uint64_t old_mip, mask = wr_mask & delegable_ints;
2646     uint32_t gin;
2647 
2648     if (mask & MIP_SEIP) {
2649         env->software_seip = new_val & MIP_SEIP;
2650         new_val |= env->external_seip * MIP_SEIP;
2651     }
2652 
2653     if (riscv_cpu_cfg(env)->ext_sstc && (env->priv == PRV_M) &&
2654         get_field(env->menvcfg, MENVCFG_STCE)) {
2655         /* sstc extension forbids STIP & VSTIP to be writeable in mip */
2656         mask = mask & ~(MIP_STIP | MIP_VSTIP);
2657     }
2658 
2659     if (mask) {
2660         old_mip = riscv_cpu_update_mip(env, mask, (new_val & mask));
2661     } else {
2662         old_mip = env->mip;
2663     }
2664 
2665     if (csrno != CSR_HVIP) {
2666         gin = get_field(env->hstatus, HSTATUS_VGEIN);
2667         old_mip |= (env->hgeip & ((target_ulong)1 << gin)) ? MIP_VSEIP : 0;
2668         old_mip |= env->vstime_irq ? MIP_VSTIP : 0;
2669     }
2670 
2671     if (ret_val) {
2672         *ret_val = old_mip;
2673     }
2674 
2675     return RISCV_EXCP_NONE;
2676 }
2677 
2678 static RISCVException rmw_mip(CPURISCVState *env, int csrno,
2679                               target_ulong *ret_val,
2680                               target_ulong new_val, target_ulong wr_mask)
2681 {
2682     uint64_t rval;
2683     RISCVException ret;
2684 
2685     ret = rmw_mip64(env, csrno, &rval, new_val, wr_mask);
2686     if (ret_val) {
2687         *ret_val = rval;
2688     }
2689 
2690     return ret;
2691 }
2692 
2693 static RISCVException rmw_miph(CPURISCVState *env, int csrno,
2694                                target_ulong *ret_val,
2695                                target_ulong new_val, target_ulong wr_mask)
2696 {
2697     uint64_t rval;
2698     RISCVException ret;
2699 
2700     ret = rmw_mip64(env, csrno, &rval,
2701         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2702     if (ret_val) {
2703         *ret_val = rval >> 32;
2704     }
2705 
2706     return ret;
2707 }
2708 
2709 /*
2710  * The function is written for two use-cases:
2711  * 1- To access mvip csr as is for m-mode access.
2712  * 2- To access sip as a combination of mip and mvip for s-mode.
2713  *
2714  * Both report bits 1, 5, 9 and 13:63 but with the exception of
2715  * STIP being read-only zero in case of mvip when sstc extension
2716  * is present.
2717  * Also, sip needs to be read-only zero when both mideleg[i] and
2718  * mvien[i] are zero but mvip needs to be an alias of mip.
2719  */
2720 static RISCVException rmw_mvip64(CPURISCVState *env, int csrno,
2721                                 uint64_t *ret_val,
2722                                 uint64_t new_val, uint64_t wr_mask)
2723 {
2724     RISCVCPU *cpu = env_archcpu(env);
2725     target_ulong ret_mip = 0;
2726     RISCVException ret;
2727     uint64_t old_mvip;
2728 
2729     /*
2730      * mideleg[i]  mvien[i]
2731      *   0           0      No delegation. mvip[i] is alias of mip[i].
2732      *   0           1      mvip[i] becomes source of interrupt, mip bypassed.
2733      *   1           X      mip[i] is source of interrupt and mvip[i] aliases
2734      *                      mip[i].
2735      *
2736      *   So alias condition would be for bits:
2737      *      ((S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & (mideleg | ~mvien)) |
2738      *          (!sstc & MIP_STIP)
2739      *
2740      *   Non-alias condition will be for bits:
2741      *      (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & (~mideleg & mvien)
2742      *
2743      *  alias_mask denotes the bits that come from mip nalias_mask denotes bits
2744      *  that come from hvip.
2745      */
2746     uint64_t alias_mask = ((S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) &
2747         (env->mideleg | ~env->mvien)) | MIP_STIP;
2748     uint64_t nalias_mask = (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) &
2749         (~env->mideleg & env->mvien);
2750     uint64_t wr_mask_mvip;
2751     uint64_t wr_mask_mip;
2752 
2753     /*
2754      * mideleg[i]  mvien[i]
2755      *   0           0      sip[i] read-only zero.
2756      *   0           1      sip[i] alias of mvip[i].
2757      *   1           X      sip[i] alias of mip[i].
2758      *
2759      *  Both alias and non-alias mask remain same for sip except for bits
2760      *  which are zero in both mideleg and mvien.
2761      */
2762     if (csrno == CSR_SIP) {
2763         /* Remove bits that are zero in both mideleg and mvien. */
2764         alias_mask &= (env->mideleg | env->mvien);
2765         nalias_mask &= (env->mideleg | env->mvien);
2766     }
2767 
2768     /*
2769      * If sstc is present, mvip.STIP is not an alias of mip.STIP so clear
2770      * that our in mip returned value.
2771      */
2772     if (cpu->cfg.ext_sstc && (env->priv == PRV_M) &&
2773         get_field(env->menvcfg, MENVCFG_STCE)) {
2774         alias_mask &= ~MIP_STIP;
2775     }
2776 
2777     wr_mask_mip = wr_mask & alias_mask & mvip_writable_mask;
2778     wr_mask_mvip = wr_mask & nalias_mask & mvip_writable_mask;
2779 
2780     /*
2781      * For bits set in alias_mask, mvip needs to be alias of mip, so forward
2782      * this to rmw_mip.
2783      */
2784     ret = rmw_mip(env, CSR_MIP, &ret_mip, new_val, wr_mask_mip);
2785     if (ret != RISCV_EXCP_NONE) {
2786         return ret;
2787     }
2788 
2789     old_mvip = env->mvip;
2790 
2791     /*
2792      * Write to mvip. Update only non-alias bits. Alias bits were updated
2793      * in mip in rmw_mip above.
2794      */
2795     if (wr_mask_mvip) {
2796         env->mvip = (env->mvip & ~wr_mask_mvip) | (new_val & wr_mask_mvip);
2797 
2798         /*
2799          * Given mvip is separate source from mip, we need to trigger interrupt
2800          * from here separately. Normally this happen from riscv_cpu_update_mip.
2801          */
2802         riscv_cpu_interrupt(env);
2803     }
2804 
2805     if (ret_val) {
2806         ret_mip &= alias_mask;
2807         old_mvip &= nalias_mask;
2808 
2809         *ret_val = old_mvip | ret_mip;
2810     }
2811 
2812     return RISCV_EXCP_NONE;
2813 }
2814 
2815 static RISCVException rmw_mvip(CPURISCVState *env, int csrno,
2816                               target_ulong *ret_val,
2817                               target_ulong new_val, target_ulong wr_mask)
2818 {
2819     uint64_t rval;
2820     RISCVException ret;
2821 
2822     ret = rmw_mvip64(env, csrno, &rval, new_val, wr_mask);
2823     if (ret_val) {
2824         *ret_val = rval;
2825     }
2826 
2827     return ret;
2828 }
2829 
2830 static RISCVException rmw_mviph(CPURISCVState *env, int csrno,
2831                                target_ulong *ret_val,
2832                                target_ulong new_val, target_ulong wr_mask)
2833 {
2834     uint64_t rval;
2835     RISCVException ret;
2836 
2837     ret = rmw_mvip64(env, csrno, &rval,
2838         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2839     if (ret_val) {
2840         *ret_val = rval >> 32;
2841     }
2842 
2843     return ret;
2844 }
2845 
2846 /* Supervisor Trap Setup */
2847 static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
2848                                         Int128 *val)
2849 {
2850     uint64_t mask = sstatus_v1_10_mask;
2851     uint64_t sstatus = env->mstatus & mask;
2852     if (env->xl != MXL_RV32 || env->debugger) {
2853         mask |= SSTATUS64_UXL;
2854     }
2855 
2856     *val = int128_make128(sstatus, add_status_sd(MXL_RV128, sstatus));
2857     return RISCV_EXCP_NONE;
2858 }
2859 
2860 static RISCVException read_sstatus(CPURISCVState *env, int csrno,
2861                                    target_ulong *val)
2862 {
2863     target_ulong mask = (sstatus_v1_10_mask);
2864     if (env->xl != MXL_RV32 || env->debugger) {
2865         mask |= SSTATUS64_UXL;
2866     }
2867     /* TODO: Use SXL not MXL. */
2868     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus & mask);
2869     return RISCV_EXCP_NONE;
2870 }
2871 
2872 static RISCVException write_sstatus(CPURISCVState *env, int csrno,
2873                                     target_ulong val)
2874 {
2875     target_ulong mask = (sstatus_v1_10_mask);
2876 
2877     if (env->xl != MXL_RV32 || env->debugger) {
2878         if ((val & SSTATUS64_UXL) != 0) {
2879             mask |= SSTATUS64_UXL;
2880         }
2881     }
2882     target_ulong newval = (env->mstatus & ~mask) | (val & mask);
2883     return write_mstatus(env, CSR_MSTATUS, newval);
2884 }
2885 
2886 static RISCVException rmw_vsie64(CPURISCVState *env, int csrno,
2887                                  uint64_t *ret_val,
2888                                  uint64_t new_val, uint64_t wr_mask)
2889 {
2890     uint64_t alias_mask = (LOCAL_INTERRUPTS | VS_MODE_INTERRUPTS) &
2891                             env->hideleg;
2892     uint64_t nalias_mask = LOCAL_INTERRUPTS & (~env->hideleg & env->hvien);
2893     uint64_t rval, rval_vs, vsbits;
2894     uint64_t wr_mask_vsie;
2895     uint64_t wr_mask_mie;
2896     RISCVException ret;
2897 
2898     /* Bring VS-level bits to correct position */
2899     vsbits = new_val & (VS_MODE_INTERRUPTS >> 1);
2900     new_val &= ~(VS_MODE_INTERRUPTS >> 1);
2901     new_val |= vsbits << 1;
2902 
2903     vsbits = wr_mask & (VS_MODE_INTERRUPTS >> 1);
2904     wr_mask &= ~(VS_MODE_INTERRUPTS >> 1);
2905     wr_mask |= vsbits << 1;
2906 
2907     wr_mask_mie = wr_mask & alias_mask;
2908     wr_mask_vsie = wr_mask & nalias_mask;
2909 
2910     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask_mie);
2911 
2912     rval_vs = env->vsie & nalias_mask;
2913     env->vsie = (env->vsie & ~wr_mask_vsie) | (new_val & wr_mask_vsie);
2914 
2915     if (ret_val) {
2916         rval &= alias_mask;
2917         vsbits = rval & VS_MODE_INTERRUPTS;
2918         rval &= ~VS_MODE_INTERRUPTS;
2919         *ret_val = rval | (vsbits >> 1) | rval_vs;
2920     }
2921 
2922     return ret;
2923 }
2924 
2925 static RISCVException rmw_vsie(CPURISCVState *env, int csrno,
2926                                target_ulong *ret_val,
2927                                target_ulong new_val, target_ulong wr_mask)
2928 {
2929     uint64_t rval;
2930     RISCVException ret;
2931 
2932     ret = rmw_vsie64(env, csrno, &rval, new_val, wr_mask);
2933     if (ret_val) {
2934         *ret_val = rval;
2935     }
2936 
2937     return ret;
2938 }
2939 
2940 static RISCVException rmw_vsieh(CPURISCVState *env, int csrno,
2941                                 target_ulong *ret_val,
2942                                 target_ulong new_val, target_ulong wr_mask)
2943 {
2944     uint64_t rval;
2945     RISCVException ret;
2946 
2947     ret = rmw_vsie64(env, csrno, &rval,
2948         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
2949     if (ret_val) {
2950         *ret_val = rval >> 32;
2951     }
2952 
2953     return ret;
2954 }
2955 
2956 static RISCVException rmw_sie64(CPURISCVState *env, int csrno,
2957                                 uint64_t *ret_val,
2958                                 uint64_t new_val, uint64_t wr_mask)
2959 {
2960     uint64_t nalias_mask = (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) &
2961         (~env->mideleg & env->mvien);
2962     uint64_t alias_mask = (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS) & env->mideleg;
2963     uint64_t sie_mask = wr_mask & nalias_mask;
2964     RISCVException ret;
2965 
2966     /*
2967      * mideleg[i]  mvien[i]
2968      *   0           0      sie[i] read-only zero.
2969      *   0           1      sie[i] is a separate writable bit.
2970      *   1           X      sie[i] alias of mie[i].
2971      *
2972      *  Both alias and non-alias mask remain same for sip except for bits
2973      *  which are zero in both mideleg and mvien.
2974      */
2975     if (env->virt_enabled) {
2976         if (env->hvictl & HVICTL_VTI) {
2977             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
2978         }
2979         ret = rmw_vsie64(env, CSR_VSIE, ret_val, new_val, wr_mask);
2980         if (ret_val) {
2981             *ret_val &= alias_mask;
2982         }
2983     } else {
2984         ret = rmw_mie64(env, csrno, ret_val, new_val, wr_mask & alias_mask);
2985         if (ret_val) {
2986             *ret_val &= alias_mask;
2987             *ret_val |= env->sie & nalias_mask;
2988         }
2989 
2990         env->sie = (env->sie & ~sie_mask) | (new_val & sie_mask);
2991     }
2992 
2993     return ret;
2994 }
2995 
2996 static RISCVException rmw_sie(CPURISCVState *env, int csrno,
2997                               target_ulong *ret_val,
2998                               target_ulong new_val, target_ulong wr_mask)
2999 {
3000     uint64_t rval;
3001     RISCVException ret;
3002 
3003     ret = rmw_sie64(env, csrno, &rval, new_val, wr_mask);
3004     if (ret == RISCV_EXCP_NONE && ret_val) {
3005         *ret_val = rval;
3006     }
3007 
3008     return ret;
3009 }
3010 
3011 static RISCVException rmw_sieh(CPURISCVState *env, int csrno,
3012                                target_ulong *ret_val,
3013                                target_ulong new_val, target_ulong wr_mask)
3014 {
3015     uint64_t rval;
3016     RISCVException ret;
3017 
3018     ret = rmw_sie64(env, csrno, &rval,
3019         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3020     if (ret_val) {
3021         *ret_val = rval >> 32;
3022     }
3023 
3024     return ret;
3025 }
3026 
3027 static RISCVException read_stvec(CPURISCVState *env, int csrno,
3028                                  target_ulong *val)
3029 {
3030     *val = env->stvec;
3031     return RISCV_EXCP_NONE;
3032 }
3033 
3034 static RISCVException write_stvec(CPURISCVState *env, int csrno,
3035                                   target_ulong val)
3036 {
3037     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
3038     if ((val & 3) < 2) {
3039         env->stvec = val;
3040     } else {
3041         qemu_log_mask(LOG_UNIMP, "CSR_STVEC: reserved mode not supported\n");
3042     }
3043     return RISCV_EXCP_NONE;
3044 }
3045 
3046 static RISCVException read_scounteren(CPURISCVState *env, int csrno,
3047                                       target_ulong *val)
3048 {
3049     *val = env->scounteren;
3050     return RISCV_EXCP_NONE;
3051 }
3052 
3053 static RISCVException write_scounteren(CPURISCVState *env, int csrno,
3054                                        target_ulong val)
3055 {
3056     env->scounteren = val;
3057     return RISCV_EXCP_NONE;
3058 }
3059 
3060 /* Supervisor Trap Handling */
3061 static RISCVException read_sscratch_i128(CPURISCVState *env, int csrno,
3062                                          Int128 *val)
3063 {
3064     *val = int128_make128(env->sscratch, env->sscratchh);
3065     return RISCV_EXCP_NONE;
3066 }
3067 
3068 static RISCVException write_sscratch_i128(CPURISCVState *env, int csrno,
3069                                           Int128 val)
3070 {
3071     env->sscratch = int128_getlo(val);
3072     env->sscratchh = int128_gethi(val);
3073     return RISCV_EXCP_NONE;
3074 }
3075 
3076 static RISCVException read_sscratch(CPURISCVState *env, int csrno,
3077                                     target_ulong *val)
3078 {
3079     *val = env->sscratch;
3080     return RISCV_EXCP_NONE;
3081 }
3082 
3083 static RISCVException write_sscratch(CPURISCVState *env, int csrno,
3084                                      target_ulong val)
3085 {
3086     env->sscratch = val;
3087     return RISCV_EXCP_NONE;
3088 }
3089 
3090 static RISCVException read_sepc(CPURISCVState *env, int csrno,
3091                                 target_ulong *val)
3092 {
3093     *val = env->sepc;
3094     return RISCV_EXCP_NONE;
3095 }
3096 
3097 static RISCVException write_sepc(CPURISCVState *env, int csrno,
3098                                  target_ulong val)
3099 {
3100     env->sepc = val;
3101     return RISCV_EXCP_NONE;
3102 }
3103 
3104 static RISCVException read_scause(CPURISCVState *env, int csrno,
3105                                   target_ulong *val)
3106 {
3107     *val = env->scause;
3108     return RISCV_EXCP_NONE;
3109 }
3110 
3111 static RISCVException write_scause(CPURISCVState *env, int csrno,
3112                                    target_ulong val)
3113 {
3114     env->scause = val;
3115     return RISCV_EXCP_NONE;
3116 }
3117 
3118 static RISCVException read_stval(CPURISCVState *env, int csrno,
3119                                  target_ulong *val)
3120 {
3121     *val = env->stval;
3122     return RISCV_EXCP_NONE;
3123 }
3124 
3125 static RISCVException write_stval(CPURISCVState *env, int csrno,
3126                                   target_ulong val)
3127 {
3128     env->stval = val;
3129     return RISCV_EXCP_NONE;
3130 }
3131 
3132 static RISCVException rmw_hvip64(CPURISCVState *env, int csrno,
3133                                  uint64_t *ret_val,
3134                                  uint64_t new_val, uint64_t wr_mask);
3135 
3136 static RISCVException rmw_vsip64(CPURISCVState *env, int csrno,
3137                                  uint64_t *ret_val,
3138                                  uint64_t new_val, uint64_t wr_mask)
3139 {
3140     RISCVException ret;
3141     uint64_t rval, mask = env->hideleg & VS_MODE_INTERRUPTS;
3142     uint64_t vsbits;
3143 
3144     /* Add virtualized bits into vsip mask. */
3145     mask |= env->hvien & ~env->hideleg;
3146 
3147     /* Bring VS-level bits to correct position */
3148     vsbits = new_val & (VS_MODE_INTERRUPTS >> 1);
3149     new_val &= ~(VS_MODE_INTERRUPTS >> 1);
3150     new_val |= vsbits << 1;
3151     vsbits = wr_mask & (VS_MODE_INTERRUPTS >> 1);
3152     wr_mask &= ~(VS_MODE_INTERRUPTS >> 1);
3153     wr_mask |= vsbits << 1;
3154 
3155     ret = rmw_hvip64(env, csrno, &rval, new_val,
3156                      wr_mask & mask & vsip_writable_mask);
3157     if (ret_val) {
3158         rval &= mask;
3159         vsbits = rval & VS_MODE_INTERRUPTS;
3160         rval &= ~VS_MODE_INTERRUPTS;
3161         *ret_val = rval | (vsbits >> 1);
3162     }
3163 
3164     return ret;
3165 }
3166 
3167 static RISCVException rmw_vsip(CPURISCVState *env, int csrno,
3168                                target_ulong *ret_val,
3169                                target_ulong new_val, target_ulong wr_mask)
3170 {
3171     uint64_t rval;
3172     RISCVException ret;
3173 
3174     ret = rmw_vsip64(env, csrno, &rval, new_val, wr_mask);
3175     if (ret_val) {
3176         *ret_val = rval;
3177     }
3178 
3179     return ret;
3180 }
3181 
3182 static RISCVException rmw_vsiph(CPURISCVState *env, int csrno,
3183                                 target_ulong *ret_val,
3184                                 target_ulong new_val, target_ulong wr_mask)
3185 {
3186     uint64_t rval;
3187     RISCVException ret;
3188 
3189     ret = rmw_vsip64(env, csrno, &rval,
3190         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3191     if (ret_val) {
3192         *ret_val = rval >> 32;
3193     }
3194 
3195     return ret;
3196 }
3197 
3198 static RISCVException rmw_sip64(CPURISCVState *env, int csrno,
3199                                 uint64_t *ret_val,
3200                                 uint64_t new_val, uint64_t wr_mask)
3201 {
3202     RISCVException ret;
3203     uint64_t mask = (env->mideleg | env->mvien) & sip_writable_mask;
3204 
3205     if (env->virt_enabled) {
3206         if (env->hvictl & HVICTL_VTI) {
3207             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
3208         }
3209         ret = rmw_vsip64(env, CSR_VSIP, ret_val, new_val, wr_mask);
3210     } else {
3211         ret = rmw_mvip64(env, csrno, ret_val, new_val, wr_mask & mask);
3212     }
3213 
3214     if (ret_val) {
3215         *ret_val &= (env->mideleg | env->mvien) &
3216             (S_MODE_INTERRUPTS | LOCAL_INTERRUPTS);
3217     }
3218 
3219     return ret;
3220 }
3221 
3222 static RISCVException rmw_sip(CPURISCVState *env, int csrno,
3223                               target_ulong *ret_val,
3224                               target_ulong new_val, target_ulong wr_mask)
3225 {
3226     uint64_t rval;
3227     RISCVException ret;
3228 
3229     ret = rmw_sip64(env, csrno, &rval, new_val, wr_mask);
3230     if (ret_val) {
3231         *ret_val = rval;
3232     }
3233 
3234     return ret;
3235 }
3236 
3237 static RISCVException rmw_siph(CPURISCVState *env, int csrno,
3238                                target_ulong *ret_val,
3239                                target_ulong new_val, target_ulong wr_mask)
3240 {
3241     uint64_t rval;
3242     RISCVException ret;
3243 
3244     ret = rmw_sip64(env, csrno, &rval,
3245         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3246     if (ret_val) {
3247         *ret_val = rval >> 32;
3248     }
3249 
3250     return ret;
3251 }
3252 
3253 /* Supervisor Protection and Translation */
3254 static RISCVException read_satp(CPURISCVState *env, int csrno,
3255                                 target_ulong *val)
3256 {
3257     if (!riscv_cpu_cfg(env)->mmu) {
3258         *val = 0;
3259         return RISCV_EXCP_NONE;
3260     }
3261     *val = env->satp;
3262     return RISCV_EXCP_NONE;
3263 }
3264 
3265 static RISCVException write_satp(CPURISCVState *env, int csrno,
3266                                  target_ulong val)
3267 {
3268     if (!riscv_cpu_cfg(env)->mmu) {
3269         return RISCV_EXCP_NONE;
3270     }
3271 
3272     env->satp = legalize_xatp(env, env->satp, val);
3273     return RISCV_EXCP_NONE;
3274 }
3275 
3276 static RISCVException read_vstopi(CPURISCVState *env, int csrno,
3277                                   target_ulong *val)
3278 {
3279     int irq, ret;
3280     target_ulong topei;
3281     uint64_t vseip, vsgein;
3282     uint32_t iid, iprio, hviid, hviprio, gein;
3283     uint32_t s, scount = 0, siid[VSTOPI_NUM_SRCS], siprio[VSTOPI_NUM_SRCS];
3284 
3285     gein = get_field(env->hstatus, HSTATUS_VGEIN);
3286     hviid = get_field(env->hvictl, HVICTL_IID);
3287     hviprio = get_field(env->hvictl, HVICTL_IPRIO);
3288 
3289     if (gein) {
3290         vsgein = (env->hgeip & (1ULL << gein)) ? MIP_VSEIP : 0;
3291         vseip = env->mie & (env->mip | vsgein) & MIP_VSEIP;
3292         if (gein <= env->geilen && vseip) {
3293             siid[scount] = IRQ_S_EXT;
3294             siprio[scount] = IPRIO_MMAXIPRIO + 1;
3295             if (env->aia_ireg_rmw_fn[PRV_S]) {
3296                 /*
3297                  * Call machine specific IMSIC register emulation for
3298                  * reading TOPEI.
3299                  */
3300                 ret = env->aia_ireg_rmw_fn[PRV_S](
3301                         env->aia_ireg_rmw_fn_arg[PRV_S],
3302                         AIA_MAKE_IREG(ISELECT_IMSIC_TOPEI, PRV_S, true, gein,
3303                                       riscv_cpu_mxl_bits(env)),
3304                         &topei, 0, 0);
3305                 if (!ret && topei) {
3306                     siprio[scount] = topei & IMSIC_TOPEI_IPRIO_MASK;
3307                 }
3308             }
3309             scount++;
3310         }
3311     } else {
3312         if (hviid == IRQ_S_EXT && hviprio) {
3313             siid[scount] = IRQ_S_EXT;
3314             siprio[scount] = hviprio;
3315             scount++;
3316         }
3317     }
3318 
3319     if (env->hvictl & HVICTL_VTI) {
3320         if (hviid != IRQ_S_EXT) {
3321             siid[scount] = hviid;
3322             siprio[scount] = hviprio;
3323             scount++;
3324         }
3325     } else {
3326         irq = riscv_cpu_vsirq_pending(env);
3327         if (irq != IRQ_S_EXT && 0 < irq && irq <= 63) {
3328             siid[scount] = irq;
3329             siprio[scount] = env->hviprio[irq];
3330             scount++;
3331         }
3332     }
3333 
3334     iid = 0;
3335     iprio = UINT_MAX;
3336     for (s = 0; s < scount; s++) {
3337         if (siprio[s] < iprio) {
3338             iid = siid[s];
3339             iprio = siprio[s];
3340         }
3341     }
3342 
3343     if (iid) {
3344         if (env->hvictl & HVICTL_IPRIOM) {
3345             if (iprio > IPRIO_MMAXIPRIO) {
3346                 iprio = IPRIO_MMAXIPRIO;
3347             }
3348             if (!iprio) {
3349                 if (riscv_cpu_default_priority(iid) > IPRIO_DEFAULT_S) {
3350                     iprio = IPRIO_MMAXIPRIO;
3351                 }
3352             }
3353         } else {
3354             iprio = 1;
3355         }
3356     } else {
3357         iprio = 0;
3358     }
3359 
3360     *val = (iid & TOPI_IID_MASK) << TOPI_IID_SHIFT;
3361     *val |= iprio;
3362 
3363     return RISCV_EXCP_NONE;
3364 }
3365 
3366 static RISCVException read_stopi(CPURISCVState *env, int csrno,
3367                                  target_ulong *val)
3368 {
3369     int irq;
3370     uint8_t iprio;
3371 
3372     if (env->virt_enabled) {
3373         return read_vstopi(env, CSR_VSTOPI, val);
3374     }
3375 
3376     irq = riscv_cpu_sirq_pending(env);
3377     if (irq <= 0 || irq > 63) {
3378         *val = 0;
3379     } else {
3380         iprio = env->siprio[irq];
3381         if (!iprio) {
3382             if (riscv_cpu_default_priority(irq) > IPRIO_DEFAULT_S) {
3383                 iprio = IPRIO_MMAXIPRIO;
3384            }
3385         }
3386         *val = (irq & TOPI_IID_MASK) << TOPI_IID_SHIFT;
3387         *val |= iprio;
3388     }
3389 
3390     return RISCV_EXCP_NONE;
3391 }
3392 
3393 /* Hypervisor Extensions */
3394 static RISCVException read_hstatus(CPURISCVState *env, int csrno,
3395                                    target_ulong *val)
3396 {
3397     *val = env->hstatus;
3398     if (riscv_cpu_mxl(env) != MXL_RV32) {
3399         /* We only support 64-bit VSXL */
3400         *val = set_field(*val, HSTATUS_VSXL, 2);
3401     }
3402     /* We only support little endian */
3403     *val = set_field(*val, HSTATUS_VSBE, 0);
3404     return RISCV_EXCP_NONE;
3405 }
3406 
3407 static RISCVException write_hstatus(CPURISCVState *env, int csrno,
3408                                     target_ulong val)
3409 {
3410     env->hstatus = val;
3411     if (riscv_cpu_mxl(env) != MXL_RV32 && get_field(val, HSTATUS_VSXL) != 2) {
3412         qemu_log_mask(LOG_UNIMP,
3413                       "QEMU does not support mixed HSXLEN options.");
3414     }
3415     if (get_field(val, HSTATUS_VSBE) != 0) {
3416         qemu_log_mask(LOG_UNIMP, "QEMU does not support big endian guests.");
3417     }
3418     return RISCV_EXCP_NONE;
3419 }
3420 
3421 static RISCVException read_hedeleg(CPURISCVState *env, int csrno,
3422                                    target_ulong *val)
3423 {
3424     *val = env->hedeleg;
3425     return RISCV_EXCP_NONE;
3426 }
3427 
3428 static RISCVException write_hedeleg(CPURISCVState *env, int csrno,
3429                                     target_ulong val)
3430 {
3431     env->hedeleg = val & vs_delegable_excps;
3432     return RISCV_EXCP_NONE;
3433 }
3434 
3435 static RISCVException read_hedelegh(CPURISCVState *env, int csrno,
3436                                    target_ulong *val)
3437 {
3438     RISCVException ret;
3439     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_P1P13);
3440     if (ret != RISCV_EXCP_NONE) {
3441         return ret;
3442     }
3443 
3444     /* Reserved, now read zero */
3445     *val = 0;
3446     return RISCV_EXCP_NONE;
3447 }
3448 
3449 static RISCVException write_hedelegh(CPURISCVState *env, int csrno,
3450                                     target_ulong val)
3451 {
3452     RISCVException ret;
3453     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_P1P13);
3454     if (ret != RISCV_EXCP_NONE) {
3455         return ret;
3456     }
3457 
3458     /* Reserved, now write ignore */
3459     return RISCV_EXCP_NONE;
3460 }
3461 
3462 static RISCVException rmw_hvien64(CPURISCVState *env, int csrno,
3463                                     uint64_t *ret_val,
3464                                     uint64_t new_val, uint64_t wr_mask)
3465 {
3466     uint64_t mask = wr_mask & hvien_writable_mask;
3467 
3468     if (ret_val) {
3469         *ret_val = env->hvien;
3470     }
3471 
3472     env->hvien = (env->hvien & ~mask) | (new_val & mask);
3473 
3474     return RISCV_EXCP_NONE;
3475 }
3476 
3477 static RISCVException rmw_hvien(CPURISCVState *env, int csrno,
3478                                target_ulong *ret_val,
3479                                target_ulong new_val, target_ulong wr_mask)
3480 {
3481     uint64_t rval;
3482     RISCVException ret;
3483 
3484     ret = rmw_hvien64(env, csrno, &rval, new_val, wr_mask);
3485     if (ret_val) {
3486         *ret_val = rval;
3487     }
3488 
3489     return ret;
3490 }
3491 
3492 static RISCVException rmw_hvienh(CPURISCVState *env, int csrno,
3493                                    target_ulong *ret_val,
3494                                    target_ulong new_val, target_ulong wr_mask)
3495 {
3496     uint64_t rval;
3497     RISCVException ret;
3498 
3499     ret = rmw_hvien64(env, csrno, &rval,
3500         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3501     if (ret_val) {
3502         *ret_val = rval >> 32;
3503     }
3504 
3505     return ret;
3506 }
3507 
3508 static RISCVException rmw_hideleg64(CPURISCVState *env, int csrno,
3509                                     uint64_t *ret_val,
3510                                     uint64_t new_val, uint64_t wr_mask)
3511 {
3512     uint64_t mask = wr_mask & vs_delegable_ints;
3513 
3514     if (ret_val) {
3515         *ret_val = env->hideleg & vs_delegable_ints;
3516     }
3517 
3518     env->hideleg = (env->hideleg & ~mask) | (new_val & mask);
3519     return RISCV_EXCP_NONE;
3520 }
3521 
3522 static RISCVException rmw_hideleg(CPURISCVState *env, int csrno,
3523                                   target_ulong *ret_val,
3524                                   target_ulong new_val, target_ulong wr_mask)
3525 {
3526     uint64_t rval;
3527     RISCVException ret;
3528 
3529     ret = rmw_hideleg64(env, csrno, &rval, new_val, wr_mask);
3530     if (ret_val) {
3531         *ret_val = rval;
3532     }
3533 
3534     return ret;
3535 }
3536 
3537 static RISCVException rmw_hidelegh(CPURISCVState *env, int csrno,
3538                                    target_ulong *ret_val,
3539                                    target_ulong new_val, target_ulong wr_mask)
3540 {
3541     uint64_t rval;
3542     RISCVException ret;
3543 
3544     ret = rmw_hideleg64(env, csrno, &rval,
3545         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3546     if (ret_val) {
3547         *ret_val = rval >> 32;
3548     }
3549 
3550     return ret;
3551 }
3552 
3553 /*
3554  * The function is written for two use-cases:
3555  * 1- To access hvip csr as is for HS-mode access.
3556  * 2- To access vsip as a combination of hvip, and mip for vs-mode.
3557  *
3558  * Both report bits 2, 6, 10 and 13:63.
3559  * vsip needs to be read-only zero when both hideleg[i] and
3560  * hvien[i] are zero.
3561  */
3562 static RISCVException rmw_hvip64(CPURISCVState *env, int csrno,
3563                                  uint64_t *ret_val,
3564                                  uint64_t new_val, uint64_t wr_mask)
3565 {
3566     RISCVException ret;
3567     uint64_t old_hvip;
3568     uint64_t ret_mip;
3569 
3570     /*
3571      * For bits 10, 6 and 2, vsip[i] is an alias of hip[i]. These bits are
3572      * present in hip, hvip and mip. Where mip[i] is alias of hip[i] and hvip[i]
3573      * is OR'ed in hip[i] to inject virtual interrupts from hypervisor. These
3574      * bits are actually being maintained in mip so we read them from there.
3575      * This way we have a single source of truth and allows for easier
3576      * implementation.
3577      *
3578      * For bits 13:63 we have:
3579      *
3580      * hideleg[i]  hvien[i]
3581      *   0           0      No delegation. vsip[i] readonly zero.
3582      *   0           1      vsip[i] is alias of hvip[i], sip bypassed.
3583      *   1           X      vsip[i] is alias of sip[i], hvip bypassed.
3584      *
3585      *  alias_mask denotes the bits that come from sip (mip here given we
3586      *  maintain all bits there). nalias_mask denotes bits that come from
3587      *  hvip.
3588      */
3589     uint64_t alias_mask = (env->hideleg | ~env->hvien) | VS_MODE_INTERRUPTS;
3590     uint64_t nalias_mask = (~env->hideleg & env->hvien);
3591     uint64_t wr_mask_hvip;
3592     uint64_t wr_mask_mip;
3593 
3594     /*
3595      * Both alias and non-alias mask remain same for vsip except:
3596      *  1- For VS* bits if they are zero in hideleg.
3597      *  2- For 13:63 bits if they are zero in both hideleg and hvien.
3598      */
3599     if (csrno == CSR_VSIP) {
3600         /* zero-out VS* bits that are not delegated to VS mode. */
3601         alias_mask &= (env->hideleg | ~VS_MODE_INTERRUPTS);
3602 
3603         /*
3604          * zero-out 13:63 bits that are zero in both hideleg and hvien.
3605          * nalias_mask mask can not contain any VS* bits so only second
3606          * condition applies on it.
3607          */
3608         nalias_mask &= (env->hideleg | env->hvien);
3609         alias_mask &= (env->hideleg | env->hvien);
3610     }
3611 
3612     wr_mask_hvip = wr_mask & nalias_mask & hvip_writable_mask;
3613     wr_mask_mip = wr_mask & alias_mask & hvip_writable_mask;
3614 
3615     /* Aliased bits, bits 10, 6, 2 need to come from mip. */
3616     ret = rmw_mip64(env, csrno, &ret_mip, new_val, wr_mask_mip);
3617     if (ret != RISCV_EXCP_NONE) {
3618         return ret;
3619     }
3620 
3621     old_hvip = env->hvip;
3622 
3623     if (wr_mask_hvip) {
3624         env->hvip = (env->hvip & ~wr_mask_hvip) | (new_val & wr_mask_hvip);
3625 
3626         /*
3627          * Given hvip is separate source from mip, we need to trigger interrupt
3628          * from here separately. Normally this happen from riscv_cpu_update_mip.
3629          */
3630         riscv_cpu_interrupt(env);
3631     }
3632 
3633     if (ret_val) {
3634         /* Only take VS* bits from mip. */
3635         ret_mip &= alias_mask;
3636 
3637         /* Take in non-delegated 13:63 bits from hvip. */
3638         old_hvip &= nalias_mask;
3639 
3640         *ret_val = ret_mip | old_hvip;
3641     }
3642 
3643     return ret;
3644 }
3645 
3646 static RISCVException rmw_hvip(CPURISCVState *env, int csrno,
3647                                target_ulong *ret_val,
3648                                target_ulong new_val, target_ulong wr_mask)
3649 {
3650     uint64_t rval;
3651     RISCVException ret;
3652 
3653     ret = rmw_hvip64(env, csrno, &rval, new_val, wr_mask);
3654     if (ret_val) {
3655         *ret_val = rval;
3656     }
3657 
3658     return ret;
3659 }
3660 
3661 static RISCVException rmw_hviph(CPURISCVState *env, int csrno,
3662                                 target_ulong *ret_val,
3663                                 target_ulong new_val, target_ulong wr_mask)
3664 {
3665     uint64_t rval;
3666     RISCVException ret;
3667 
3668     ret = rmw_hvip64(env, csrno, &rval,
3669         ((uint64_t)new_val) << 32, ((uint64_t)wr_mask) << 32);
3670     if (ret_val) {
3671         *ret_val = rval >> 32;
3672     }
3673 
3674     return ret;
3675 }
3676 
3677 static RISCVException rmw_hip(CPURISCVState *env, int csrno,
3678                               target_ulong *ret_value,
3679                               target_ulong new_value, target_ulong write_mask)
3680 {
3681     int ret = rmw_mip(env, csrno, ret_value, new_value,
3682                       write_mask & hip_writable_mask);
3683 
3684     if (ret_value) {
3685         *ret_value &= HS_MODE_INTERRUPTS;
3686     }
3687     return ret;
3688 }
3689 
3690 static RISCVException rmw_hie(CPURISCVState *env, int csrno,
3691                               target_ulong *ret_val,
3692                               target_ulong new_val, target_ulong wr_mask)
3693 {
3694     uint64_t rval;
3695     RISCVException ret;
3696 
3697     ret = rmw_mie64(env, csrno, &rval, new_val, wr_mask & HS_MODE_INTERRUPTS);
3698     if (ret_val) {
3699         *ret_val = rval & HS_MODE_INTERRUPTS;
3700     }
3701 
3702     return ret;
3703 }
3704 
3705 static RISCVException read_hcounteren(CPURISCVState *env, int csrno,
3706                                       target_ulong *val)
3707 {
3708     *val = env->hcounteren;
3709     return RISCV_EXCP_NONE;
3710 }
3711 
3712 static RISCVException write_hcounteren(CPURISCVState *env, int csrno,
3713                                        target_ulong val)
3714 {
3715     env->hcounteren = val;
3716     return RISCV_EXCP_NONE;
3717 }
3718 
3719 static RISCVException read_hgeie(CPURISCVState *env, int csrno,
3720                                  target_ulong *val)
3721 {
3722     if (val) {
3723         *val = env->hgeie;
3724     }
3725     return RISCV_EXCP_NONE;
3726 }
3727 
3728 static RISCVException write_hgeie(CPURISCVState *env, int csrno,
3729                                   target_ulong val)
3730 {
3731     /* Only GEILEN:1 bits implemented and BIT0 is never implemented */
3732     val &= ((((target_ulong)1) << env->geilen) - 1) << 1;
3733     env->hgeie = val;
3734     /* Update mip.SGEIP bit */
3735     riscv_cpu_update_mip(env, MIP_SGEIP,
3736                          BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
3737     return RISCV_EXCP_NONE;
3738 }
3739 
3740 static RISCVException read_htval(CPURISCVState *env, int csrno,
3741                                  target_ulong *val)
3742 {
3743     *val = env->htval;
3744     return RISCV_EXCP_NONE;
3745 }
3746 
3747 static RISCVException write_htval(CPURISCVState *env, int csrno,
3748                                   target_ulong val)
3749 {
3750     env->htval = val;
3751     return RISCV_EXCP_NONE;
3752 }
3753 
3754 static RISCVException read_htinst(CPURISCVState *env, int csrno,
3755                                   target_ulong *val)
3756 {
3757     *val = env->htinst;
3758     return RISCV_EXCP_NONE;
3759 }
3760 
3761 static RISCVException write_htinst(CPURISCVState *env, int csrno,
3762                                    target_ulong val)
3763 {
3764     return RISCV_EXCP_NONE;
3765 }
3766 
3767 static RISCVException read_hgeip(CPURISCVState *env, int csrno,
3768                                  target_ulong *val)
3769 {
3770     if (val) {
3771         *val = env->hgeip;
3772     }
3773     return RISCV_EXCP_NONE;
3774 }
3775 
3776 static RISCVException read_hgatp(CPURISCVState *env, int csrno,
3777                                  target_ulong *val)
3778 {
3779     *val = env->hgatp;
3780     return RISCV_EXCP_NONE;
3781 }
3782 
3783 static RISCVException write_hgatp(CPURISCVState *env, int csrno,
3784                                   target_ulong val)
3785 {
3786     env->hgatp = legalize_xatp(env, env->hgatp, val);
3787     return RISCV_EXCP_NONE;
3788 }
3789 
3790 static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
3791                                       target_ulong *val)
3792 {
3793     if (!env->rdtime_fn) {
3794         return RISCV_EXCP_ILLEGAL_INST;
3795     }
3796 
3797     *val = env->htimedelta;
3798     return RISCV_EXCP_NONE;
3799 }
3800 
3801 static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
3802                                        target_ulong val)
3803 {
3804     if (!env->rdtime_fn) {
3805         return RISCV_EXCP_ILLEGAL_INST;
3806     }
3807 
3808     if (riscv_cpu_mxl(env) == MXL_RV32) {
3809         env->htimedelta = deposit64(env->htimedelta, 0, 32, (uint64_t)val);
3810     } else {
3811         env->htimedelta = val;
3812     }
3813 
3814     if (riscv_cpu_cfg(env)->ext_sstc && env->rdtime_fn) {
3815         riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
3816                                   env->htimedelta, MIP_VSTIP);
3817     }
3818 
3819     return RISCV_EXCP_NONE;
3820 }
3821 
3822 static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
3823                                        target_ulong *val)
3824 {
3825     if (!env->rdtime_fn) {
3826         return RISCV_EXCP_ILLEGAL_INST;
3827     }
3828 
3829     *val = env->htimedelta >> 32;
3830     return RISCV_EXCP_NONE;
3831 }
3832 
3833 static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
3834                                         target_ulong val)
3835 {
3836     if (!env->rdtime_fn) {
3837         return RISCV_EXCP_ILLEGAL_INST;
3838     }
3839 
3840     env->htimedelta = deposit64(env->htimedelta, 32, 32, (uint64_t)val);
3841 
3842     if (riscv_cpu_cfg(env)->ext_sstc && env->rdtime_fn) {
3843         riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
3844                                   env->htimedelta, MIP_VSTIP);
3845     }
3846 
3847     return RISCV_EXCP_NONE;
3848 }
3849 
3850 static RISCVException read_hvictl(CPURISCVState *env, int csrno,
3851                                   target_ulong *val)
3852 {
3853     *val = env->hvictl;
3854     return RISCV_EXCP_NONE;
3855 }
3856 
3857 static RISCVException write_hvictl(CPURISCVState *env, int csrno,
3858                                    target_ulong val)
3859 {
3860     env->hvictl = val & HVICTL_VALID_MASK;
3861     return RISCV_EXCP_NONE;
3862 }
3863 
3864 static RISCVException read_hvipriox(CPURISCVState *env, int first_index,
3865                          uint8_t *iprio, target_ulong *val)
3866 {
3867     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
3868 
3869     /* First index has to be a multiple of number of irqs per register */
3870     if (first_index % num_irqs) {
3871         return (env->virt_enabled) ?
3872                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
3873     }
3874 
3875     /* Fill-up return value */
3876     *val = 0;
3877     for (i = 0; i < num_irqs; i++) {
3878         if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
3879             continue;
3880         }
3881         if (rdzero) {
3882             continue;
3883         }
3884         *val |= ((target_ulong)iprio[irq]) << (i * 8);
3885     }
3886 
3887     return RISCV_EXCP_NONE;
3888 }
3889 
3890 static RISCVException write_hvipriox(CPURISCVState *env, int first_index,
3891                           uint8_t *iprio, target_ulong val)
3892 {
3893     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
3894 
3895     /* First index has to be a multiple of number of irqs per register */
3896     if (first_index % num_irqs) {
3897         return (env->virt_enabled) ?
3898                RISCV_EXCP_VIRT_INSTRUCTION_FAULT : RISCV_EXCP_ILLEGAL_INST;
3899     }
3900 
3901     /* Fill-up priority array */
3902     for (i = 0; i < num_irqs; i++) {
3903         if (riscv_cpu_hviprio_index2irq(first_index + i, &irq, &rdzero)) {
3904             continue;
3905         }
3906         if (rdzero) {
3907             iprio[irq] = 0;
3908         } else {
3909             iprio[irq] = (val >> (i * 8)) & 0xff;
3910         }
3911     }
3912 
3913     return RISCV_EXCP_NONE;
3914 }
3915 
3916 static RISCVException read_hviprio1(CPURISCVState *env, int csrno,
3917                                     target_ulong *val)
3918 {
3919     return read_hvipriox(env, 0, env->hviprio, val);
3920 }
3921 
3922 static RISCVException write_hviprio1(CPURISCVState *env, int csrno,
3923                                      target_ulong val)
3924 {
3925     return write_hvipriox(env, 0, env->hviprio, val);
3926 }
3927 
3928 static RISCVException read_hviprio1h(CPURISCVState *env, int csrno,
3929                                      target_ulong *val)
3930 {
3931     return read_hvipriox(env, 4, env->hviprio, val);
3932 }
3933 
3934 static RISCVException write_hviprio1h(CPURISCVState *env, int csrno,
3935                                       target_ulong val)
3936 {
3937     return write_hvipriox(env, 4, env->hviprio, val);
3938 }
3939 
3940 static RISCVException read_hviprio2(CPURISCVState *env, int csrno,
3941                                     target_ulong *val)
3942 {
3943     return read_hvipriox(env, 8, env->hviprio, val);
3944 }
3945 
3946 static RISCVException write_hviprio2(CPURISCVState *env, int csrno,
3947                                      target_ulong val)
3948 {
3949     return write_hvipriox(env, 8, env->hviprio, val);
3950 }
3951 
3952 static RISCVException read_hviprio2h(CPURISCVState *env, int csrno,
3953                                      target_ulong *val)
3954 {
3955     return read_hvipriox(env, 12, env->hviprio, val);
3956 }
3957 
3958 static RISCVException write_hviprio2h(CPURISCVState *env, int csrno,
3959                                       target_ulong val)
3960 {
3961     return write_hvipriox(env, 12, env->hviprio, val);
3962 }
3963 
3964 /* Virtual CSR Registers */
3965 static RISCVException read_vsstatus(CPURISCVState *env, int csrno,
3966                                     target_ulong *val)
3967 {
3968     *val = env->vsstatus;
3969     return RISCV_EXCP_NONE;
3970 }
3971 
3972 static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
3973                                      target_ulong val)
3974 {
3975     uint64_t mask = (target_ulong)-1;
3976     if ((val & VSSTATUS64_UXL) == 0) {
3977         mask &= ~VSSTATUS64_UXL;
3978     }
3979     env->vsstatus = (env->vsstatus & ~mask) | (uint64_t)val;
3980     return RISCV_EXCP_NONE;
3981 }
3982 
3983 static RISCVException read_vstvec(CPURISCVState *env, int csrno,
3984                                   target_ulong *val)
3985 {
3986     *val = env->vstvec;
3987     return RISCV_EXCP_NONE;
3988 }
3989 
3990 static RISCVException write_vstvec(CPURISCVState *env, int csrno,
3991                                    target_ulong val)
3992 {
3993     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
3994     if ((val & 3) < 2) {
3995         env->vstvec = val;
3996     } else {
3997         qemu_log_mask(LOG_UNIMP, "CSR_VSTVEC: reserved mode not supported\n");
3998     }
3999     return RISCV_EXCP_NONE;
4000 }
4001 
4002 static RISCVException read_vsscratch(CPURISCVState *env, int csrno,
4003                                      target_ulong *val)
4004 {
4005     *val = env->vsscratch;
4006     return RISCV_EXCP_NONE;
4007 }
4008 
4009 static RISCVException write_vsscratch(CPURISCVState *env, int csrno,
4010                                       target_ulong val)
4011 {
4012     env->vsscratch = val;
4013     return RISCV_EXCP_NONE;
4014 }
4015 
4016 static RISCVException read_vsepc(CPURISCVState *env, int csrno,
4017                                  target_ulong *val)
4018 {
4019     *val = env->vsepc;
4020     return RISCV_EXCP_NONE;
4021 }
4022 
4023 static RISCVException write_vsepc(CPURISCVState *env, int csrno,
4024                                   target_ulong val)
4025 {
4026     env->vsepc = val;
4027     return RISCV_EXCP_NONE;
4028 }
4029 
4030 static RISCVException read_vscause(CPURISCVState *env, int csrno,
4031                                    target_ulong *val)
4032 {
4033     *val = env->vscause;
4034     return RISCV_EXCP_NONE;
4035 }
4036 
4037 static RISCVException write_vscause(CPURISCVState *env, int csrno,
4038                                     target_ulong val)
4039 {
4040     env->vscause = val;
4041     return RISCV_EXCP_NONE;
4042 }
4043 
4044 static RISCVException read_vstval(CPURISCVState *env, int csrno,
4045                                   target_ulong *val)
4046 {
4047     *val = env->vstval;
4048     return RISCV_EXCP_NONE;
4049 }
4050 
4051 static RISCVException write_vstval(CPURISCVState *env, int csrno,
4052                                    target_ulong val)
4053 {
4054     env->vstval = val;
4055     return RISCV_EXCP_NONE;
4056 }
4057 
4058 static RISCVException read_vsatp(CPURISCVState *env, int csrno,
4059                                  target_ulong *val)
4060 {
4061     *val = env->vsatp;
4062     return RISCV_EXCP_NONE;
4063 }
4064 
4065 static RISCVException write_vsatp(CPURISCVState *env, int csrno,
4066                                   target_ulong val)
4067 {
4068     env->vsatp = legalize_xatp(env, env->vsatp, val);
4069     return RISCV_EXCP_NONE;
4070 }
4071 
4072 static RISCVException read_mtval2(CPURISCVState *env, int csrno,
4073                                   target_ulong *val)
4074 {
4075     *val = env->mtval2;
4076     return RISCV_EXCP_NONE;
4077 }
4078 
4079 static RISCVException write_mtval2(CPURISCVState *env, int csrno,
4080                                    target_ulong val)
4081 {
4082     env->mtval2 = val;
4083     return RISCV_EXCP_NONE;
4084 }
4085 
4086 static RISCVException read_mtinst(CPURISCVState *env, int csrno,
4087                                   target_ulong *val)
4088 {
4089     *val = env->mtinst;
4090     return RISCV_EXCP_NONE;
4091 }
4092 
4093 static RISCVException write_mtinst(CPURISCVState *env, int csrno,
4094                                    target_ulong val)
4095 {
4096     env->mtinst = val;
4097     return RISCV_EXCP_NONE;
4098 }
4099 
4100 /* Physical Memory Protection */
4101 static RISCVException read_mseccfg(CPURISCVState *env, int csrno,
4102                                    target_ulong *val)
4103 {
4104     *val = mseccfg_csr_read(env);
4105     return RISCV_EXCP_NONE;
4106 }
4107 
4108 static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
4109                                     target_ulong val)
4110 {
4111     mseccfg_csr_write(env, val);
4112     return RISCV_EXCP_NONE;
4113 }
4114 
4115 static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
4116                                   target_ulong *val)
4117 {
4118     uint32_t reg_index = csrno - CSR_PMPCFG0;
4119 
4120     *val = pmpcfg_csr_read(env, reg_index);
4121     return RISCV_EXCP_NONE;
4122 }
4123 
4124 static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
4125                                    target_ulong val)
4126 {
4127     uint32_t reg_index = csrno - CSR_PMPCFG0;
4128 
4129     pmpcfg_csr_write(env, reg_index, val);
4130     return RISCV_EXCP_NONE;
4131 }
4132 
4133 static RISCVException read_pmpaddr(CPURISCVState *env, int csrno,
4134                                    target_ulong *val)
4135 {
4136     *val = pmpaddr_csr_read(env, csrno - CSR_PMPADDR0);
4137     return RISCV_EXCP_NONE;
4138 }
4139 
4140 static RISCVException write_pmpaddr(CPURISCVState *env, int csrno,
4141                                     target_ulong val)
4142 {
4143     pmpaddr_csr_write(env, csrno - CSR_PMPADDR0, val);
4144     return RISCV_EXCP_NONE;
4145 }
4146 
4147 static RISCVException read_tselect(CPURISCVState *env, int csrno,
4148                                    target_ulong *val)
4149 {
4150     *val = tselect_csr_read(env);
4151     return RISCV_EXCP_NONE;
4152 }
4153 
4154 static RISCVException write_tselect(CPURISCVState *env, int csrno,
4155                                     target_ulong val)
4156 {
4157     tselect_csr_write(env, val);
4158     return RISCV_EXCP_NONE;
4159 }
4160 
4161 static RISCVException read_tdata(CPURISCVState *env, int csrno,
4162                                  target_ulong *val)
4163 {
4164     /* return 0 in tdata1 to end the trigger enumeration */
4165     if (env->trigger_cur >= RV_MAX_TRIGGERS && csrno == CSR_TDATA1) {
4166         *val = 0;
4167         return RISCV_EXCP_NONE;
4168     }
4169 
4170     if (!tdata_available(env, csrno - CSR_TDATA1)) {
4171         return RISCV_EXCP_ILLEGAL_INST;
4172     }
4173 
4174     *val = tdata_csr_read(env, csrno - CSR_TDATA1);
4175     return RISCV_EXCP_NONE;
4176 }
4177 
4178 static RISCVException write_tdata(CPURISCVState *env, int csrno,
4179                                   target_ulong val)
4180 {
4181     if (!tdata_available(env, csrno - CSR_TDATA1)) {
4182         return RISCV_EXCP_ILLEGAL_INST;
4183     }
4184 
4185     tdata_csr_write(env, csrno - CSR_TDATA1, val);
4186     return RISCV_EXCP_NONE;
4187 }
4188 
4189 static RISCVException read_tinfo(CPURISCVState *env, int csrno,
4190                                  target_ulong *val)
4191 {
4192     *val = tinfo_csr_read(env);
4193     return RISCV_EXCP_NONE;
4194 }
4195 
4196 static RISCVException read_mcontext(CPURISCVState *env, int csrno,
4197                                     target_ulong *val)
4198 {
4199     *val = env->mcontext;
4200     return RISCV_EXCP_NONE;
4201 }
4202 
4203 static RISCVException write_mcontext(CPURISCVState *env, int csrno,
4204                                      target_ulong val)
4205 {
4206     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
4207     int32_t mask;
4208 
4209     if (riscv_has_ext(env, RVH)) {
4210         /* Spec suggest 7-bit for RV32 and 14-bit for RV64 w/ H extension */
4211         mask = rv32 ? MCONTEXT32_HCONTEXT : MCONTEXT64_HCONTEXT;
4212     } else {
4213         /* Spec suggest 6-bit for RV32 and 13-bit for RV64 w/o H extension */
4214         mask = rv32 ? MCONTEXT32 : MCONTEXT64;
4215     }
4216 
4217     env->mcontext = val & mask;
4218     return RISCV_EXCP_NONE;
4219 }
4220 
4221 /*
4222  * Functions to access Pointer Masking feature registers
4223  * We have to check if current priv lvl could modify
4224  * csr in given mode
4225  */
4226 static bool check_pm_current_disabled(CPURISCVState *env, int csrno)
4227 {
4228     int csr_priv = get_field(csrno, 0x300);
4229     int pm_current;
4230 
4231     if (env->debugger) {
4232         return false;
4233     }
4234     /*
4235      * If priv lvls differ that means we're accessing csr from higher priv lvl,
4236      * so allow the access
4237      */
4238     if (env->priv != csr_priv) {
4239         return false;
4240     }
4241     switch (env->priv) {
4242     case PRV_M:
4243         pm_current = get_field(env->mmte, M_PM_CURRENT);
4244         break;
4245     case PRV_S:
4246         pm_current = get_field(env->mmte, S_PM_CURRENT);
4247         break;
4248     case PRV_U:
4249         pm_current = get_field(env->mmte, U_PM_CURRENT);
4250         break;
4251     default:
4252         g_assert_not_reached();
4253     }
4254     /* It's same priv lvl, so we allow to modify csr only if pm.current==1 */
4255     return !pm_current;
4256 }
4257 
4258 static RISCVException read_mmte(CPURISCVState *env, int csrno,
4259                                 target_ulong *val)
4260 {
4261     *val = env->mmte & MMTE_MASK;
4262     return RISCV_EXCP_NONE;
4263 }
4264 
4265 static RISCVException write_mmte(CPURISCVState *env, int csrno,
4266                                  target_ulong val)
4267 {
4268     uint64_t mstatus;
4269     target_ulong wpri_val = val & MMTE_MASK;
4270 
4271     if (val != wpri_val) {
4272         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
4273                       TARGET_FMT_lx "\n", "MMTE: WPRI violation written 0x",
4274                       val, "vs expected 0x", wpri_val);
4275     }
4276     /* for machine mode pm.current is hardwired to 1 */
4277     wpri_val |= MMTE_M_PM_CURRENT;
4278 
4279     /* hardwiring pm.instruction bit to 0, since it's not supported yet */
4280     wpri_val &= ~(MMTE_M_PM_INSN | MMTE_S_PM_INSN | MMTE_U_PM_INSN);
4281     env->mmte = wpri_val | EXT_STATUS_DIRTY;
4282     riscv_cpu_update_mask(env);
4283 
4284     /* Set XS and SD bits, since PM CSRs are dirty */
4285     mstatus = env->mstatus | MSTATUS_XS;
4286     write_mstatus(env, csrno, mstatus);
4287     return RISCV_EXCP_NONE;
4288 }
4289 
4290 static RISCVException read_smte(CPURISCVState *env, int csrno,
4291                                 target_ulong *val)
4292 {
4293     *val = env->mmte & SMTE_MASK;
4294     return RISCV_EXCP_NONE;
4295 }
4296 
4297 static RISCVException write_smte(CPURISCVState *env, int csrno,
4298                                  target_ulong val)
4299 {
4300     target_ulong wpri_val = val & SMTE_MASK;
4301 
4302     if (val != wpri_val) {
4303         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
4304                       TARGET_FMT_lx "\n", "SMTE: WPRI violation written 0x",
4305                       val, "vs expected 0x", wpri_val);
4306     }
4307 
4308     /* if pm.current==0 we can't modify current PM CSRs */
4309     if (check_pm_current_disabled(env, csrno)) {
4310         return RISCV_EXCP_NONE;
4311     }
4312 
4313     wpri_val |= (env->mmte & ~SMTE_MASK);
4314     write_mmte(env, csrno, wpri_val);
4315     return RISCV_EXCP_NONE;
4316 }
4317 
4318 static RISCVException read_umte(CPURISCVState *env, int csrno,
4319                                 target_ulong *val)
4320 {
4321     *val = env->mmte & UMTE_MASK;
4322     return RISCV_EXCP_NONE;
4323 }
4324 
4325 static RISCVException write_umte(CPURISCVState *env, int csrno,
4326                                  target_ulong val)
4327 {
4328     target_ulong wpri_val = val & UMTE_MASK;
4329 
4330     if (val != wpri_val) {
4331         qemu_log_mask(LOG_GUEST_ERROR, "%s" TARGET_FMT_lx " %s"
4332                       TARGET_FMT_lx "\n", "UMTE: WPRI violation written 0x",
4333                       val, "vs expected 0x", wpri_val);
4334     }
4335 
4336     if (check_pm_current_disabled(env, csrno)) {
4337         return RISCV_EXCP_NONE;
4338     }
4339 
4340     wpri_val |= (env->mmte & ~UMTE_MASK);
4341     write_mmte(env, csrno, wpri_val);
4342     return RISCV_EXCP_NONE;
4343 }
4344 
4345 static RISCVException read_mpmmask(CPURISCVState *env, int csrno,
4346                                    target_ulong *val)
4347 {
4348     *val = env->mpmmask;
4349     return RISCV_EXCP_NONE;
4350 }
4351 
4352 static RISCVException write_mpmmask(CPURISCVState *env, int csrno,
4353                                     target_ulong val)
4354 {
4355     uint64_t mstatus;
4356 
4357     env->mpmmask = val;
4358     if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
4359         env->cur_pmmask = val;
4360     }
4361     env->mmte |= EXT_STATUS_DIRTY;
4362 
4363     /* Set XS and SD bits, since PM CSRs are dirty */
4364     mstatus = env->mstatus | MSTATUS_XS;
4365     write_mstatus(env, csrno, mstatus);
4366     return RISCV_EXCP_NONE;
4367 }
4368 
4369 static RISCVException read_spmmask(CPURISCVState *env, int csrno,
4370                                    target_ulong *val)
4371 {
4372     *val = env->spmmask;
4373     return RISCV_EXCP_NONE;
4374 }
4375 
4376 static RISCVException write_spmmask(CPURISCVState *env, int csrno,
4377                                     target_ulong val)
4378 {
4379     uint64_t mstatus;
4380 
4381     /* if pm.current==0 we can't modify current PM CSRs */
4382     if (check_pm_current_disabled(env, csrno)) {
4383         return RISCV_EXCP_NONE;
4384     }
4385     env->spmmask = val;
4386     if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
4387         env->cur_pmmask = val;
4388         if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
4389             env->cur_pmmask &= UINT32_MAX;
4390         }
4391     }
4392     env->mmte |= EXT_STATUS_DIRTY;
4393 
4394     /* Set XS and SD bits, since PM CSRs are dirty */
4395     mstatus = env->mstatus | MSTATUS_XS;
4396     write_mstatus(env, csrno, mstatus);
4397     return RISCV_EXCP_NONE;
4398 }
4399 
4400 static RISCVException read_upmmask(CPURISCVState *env, int csrno,
4401                                    target_ulong *val)
4402 {
4403     *val = env->upmmask;
4404     return RISCV_EXCP_NONE;
4405 }
4406 
4407 static RISCVException write_upmmask(CPURISCVState *env, int csrno,
4408                                     target_ulong val)
4409 {
4410     uint64_t mstatus;
4411 
4412     /* if pm.current==0 we can't modify current PM CSRs */
4413     if (check_pm_current_disabled(env, csrno)) {
4414         return RISCV_EXCP_NONE;
4415     }
4416     env->upmmask = val;
4417     if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
4418         env->cur_pmmask = val;
4419         if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
4420             env->cur_pmmask &= UINT32_MAX;
4421         }
4422     }
4423     env->mmte |= EXT_STATUS_DIRTY;
4424 
4425     /* Set XS and SD bits, since PM CSRs are dirty */
4426     mstatus = env->mstatus | MSTATUS_XS;
4427     write_mstatus(env, csrno, mstatus);
4428     return RISCV_EXCP_NONE;
4429 }
4430 
4431 static RISCVException read_mpmbase(CPURISCVState *env, int csrno,
4432                                    target_ulong *val)
4433 {
4434     *val = env->mpmbase;
4435     return RISCV_EXCP_NONE;
4436 }
4437 
4438 static RISCVException write_mpmbase(CPURISCVState *env, int csrno,
4439                                     target_ulong val)
4440 {
4441     uint64_t mstatus;
4442 
4443     env->mpmbase = val;
4444     if ((cpu_address_mode(env) == PRV_M) && (env->mmte & M_PM_ENABLE)) {
4445         env->cur_pmbase = val;
4446     }
4447     env->mmte |= EXT_STATUS_DIRTY;
4448 
4449     /* Set XS and SD bits, since PM CSRs are dirty */
4450     mstatus = env->mstatus | MSTATUS_XS;
4451     write_mstatus(env, csrno, mstatus);
4452     return RISCV_EXCP_NONE;
4453 }
4454 
4455 static RISCVException read_spmbase(CPURISCVState *env, int csrno,
4456                                    target_ulong *val)
4457 {
4458     *val = env->spmbase;
4459     return RISCV_EXCP_NONE;
4460 }
4461 
4462 static RISCVException write_spmbase(CPURISCVState *env, int csrno,
4463                                     target_ulong val)
4464 {
4465     uint64_t mstatus;
4466 
4467     /* if pm.current==0 we can't modify current PM CSRs */
4468     if (check_pm_current_disabled(env, csrno)) {
4469         return RISCV_EXCP_NONE;
4470     }
4471     env->spmbase = val;
4472     if ((cpu_address_mode(env) == PRV_S) && (env->mmte & S_PM_ENABLE)) {
4473         env->cur_pmbase = val;
4474         if (cpu_get_xl(env, PRV_S) == MXL_RV32) {
4475             env->cur_pmbase &= UINT32_MAX;
4476         }
4477     }
4478     env->mmte |= EXT_STATUS_DIRTY;
4479 
4480     /* Set XS and SD bits, since PM CSRs are dirty */
4481     mstatus = env->mstatus | MSTATUS_XS;
4482     write_mstatus(env, csrno, mstatus);
4483     return RISCV_EXCP_NONE;
4484 }
4485 
4486 static RISCVException read_upmbase(CPURISCVState *env, int csrno,
4487                                    target_ulong *val)
4488 {
4489     *val = env->upmbase;
4490     return RISCV_EXCP_NONE;
4491 }
4492 
4493 static RISCVException write_upmbase(CPURISCVState *env, int csrno,
4494                                     target_ulong val)
4495 {
4496     uint64_t mstatus;
4497 
4498     /* if pm.current==0 we can't modify current PM CSRs */
4499     if (check_pm_current_disabled(env, csrno)) {
4500         return RISCV_EXCP_NONE;
4501     }
4502     env->upmbase = val;
4503     if ((cpu_address_mode(env) == PRV_U) && (env->mmte & U_PM_ENABLE)) {
4504         env->cur_pmbase = val;
4505         if (cpu_get_xl(env, PRV_U) == MXL_RV32) {
4506             env->cur_pmbase &= UINT32_MAX;
4507         }
4508     }
4509     env->mmte |= EXT_STATUS_DIRTY;
4510 
4511     /* Set XS and SD bits, since PM CSRs are dirty */
4512     mstatus = env->mstatus | MSTATUS_XS;
4513     write_mstatus(env, csrno, mstatus);
4514     return RISCV_EXCP_NONE;
4515 }
4516 
4517 #endif
4518 
4519 /* Crypto Extension */
4520 target_ulong riscv_new_csr_seed(target_ulong new_value,
4521                                 target_ulong write_mask)
4522 {
4523     uint16_t random_v;
4524     Error *random_e = NULL;
4525     int random_r;
4526     target_ulong rval;
4527 
4528     random_r = qemu_guest_getrandom(&random_v, 2, &random_e);
4529     if (unlikely(random_r < 0)) {
4530         /*
4531          * Failed, for unknown reasons in the crypto subsystem.
4532          * The best we can do is log the reason and return a
4533          * failure indication to the guest.  There is no reason
4534          * we know to expect the failure to be transitory, so
4535          * indicate DEAD to avoid having the guest spin on WAIT.
4536          */
4537         qemu_log_mask(LOG_UNIMP, "%s: Crypto failure: %s",
4538                       __func__, error_get_pretty(random_e));
4539         error_free(random_e);
4540         rval = SEED_OPST_DEAD;
4541     } else {
4542         rval = random_v | SEED_OPST_ES16;
4543     }
4544 
4545     return rval;
4546 }
4547 
4548 static RISCVException rmw_seed(CPURISCVState *env, int csrno,
4549                                target_ulong *ret_value,
4550                                target_ulong new_value,
4551                                target_ulong write_mask)
4552 {
4553     target_ulong rval;
4554 
4555     rval = riscv_new_csr_seed(new_value, write_mask);
4556 
4557     if (ret_value) {
4558         *ret_value = rval;
4559     }
4560 
4561     return RISCV_EXCP_NONE;
4562 }
4563 
4564 /*
4565  * riscv_csrrw - read and/or update control and status register
4566  *
4567  * csrr   <->  riscv_csrrw(env, csrno, ret_value, 0, 0);
4568  * csrrw  <->  riscv_csrrw(env, csrno, ret_value, value, -1);
4569  * csrrs  <->  riscv_csrrw(env, csrno, ret_value, -1, value);
4570  * csrrc  <->  riscv_csrrw(env, csrno, ret_value, 0, value);
4571  */
4572 
4573 static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
4574                                                int csrno,
4575                                                bool write_mask)
4576 {
4577     /* check privileges and return RISCV_EXCP_ILLEGAL_INST if check fails */
4578     bool read_only = get_field(csrno, 0xC00) == 3;
4579     int csr_min_priv = csr_ops[csrno].min_priv_ver;
4580 
4581     /* ensure the CSR extension is enabled */
4582     if (!riscv_cpu_cfg(env)->ext_zicsr) {
4583         return RISCV_EXCP_ILLEGAL_INST;
4584     }
4585 
4586     /* ensure CSR is implemented by checking predicate */
4587     if (!csr_ops[csrno].predicate) {
4588         return RISCV_EXCP_ILLEGAL_INST;
4589     }
4590 
4591     /* privileged spec version check */
4592     if (env->priv_ver < csr_min_priv) {
4593         return RISCV_EXCP_ILLEGAL_INST;
4594     }
4595 
4596     /* read / write check */
4597     if (write_mask && read_only) {
4598         return RISCV_EXCP_ILLEGAL_INST;
4599     }
4600 
4601     /*
4602      * The predicate() not only does existence check but also does some
4603      * access control check which triggers for example virtual instruction
4604      * exception in some cases. When writing read-only CSRs in those cases
4605      * illegal instruction exception should be triggered instead of virtual
4606      * instruction exception. Hence this comes after the read / write check.
4607      */
4608     RISCVException ret = csr_ops[csrno].predicate(env, csrno);
4609     if (ret != RISCV_EXCP_NONE) {
4610         return ret;
4611     }
4612 
4613 #if !defined(CONFIG_USER_ONLY)
4614     int csr_priv, effective_priv = env->priv;
4615 
4616     if (riscv_has_ext(env, RVH) && env->priv == PRV_S &&
4617         !env->virt_enabled) {
4618         /*
4619          * We are in HS mode. Add 1 to the effective privilege level to
4620          * allow us to access the Hypervisor CSRs.
4621          */
4622         effective_priv++;
4623     }
4624 
4625     csr_priv = get_field(csrno, 0x300);
4626     if (!env->debugger && (effective_priv < csr_priv)) {
4627         if (csr_priv == (PRV_S + 1) && env->virt_enabled) {
4628             return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
4629         }
4630         return RISCV_EXCP_ILLEGAL_INST;
4631     }
4632 #endif
4633     return RISCV_EXCP_NONE;
4634 }
4635 
4636 static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
4637                                        target_ulong *ret_value,
4638                                        target_ulong new_value,
4639                                        target_ulong write_mask)
4640 {
4641     RISCVException ret;
4642     target_ulong old_value = 0;
4643 
4644     /* execute combined read/write operation if it exists */
4645     if (csr_ops[csrno].op) {
4646         return csr_ops[csrno].op(env, csrno, ret_value, new_value, write_mask);
4647     }
4648 
4649     /*
4650      * ret_value == NULL means that rd=x0 and we're coming from helper_csrw()
4651      * and we can't throw side effects caused by CSR reads.
4652      */
4653     if (ret_value) {
4654         /* if no accessor exists then return failure */
4655         if (!csr_ops[csrno].read) {
4656             return RISCV_EXCP_ILLEGAL_INST;
4657         }
4658         /* read old value */
4659         ret = csr_ops[csrno].read(env, csrno, &old_value);
4660         if (ret != RISCV_EXCP_NONE) {
4661             return ret;
4662         }
4663     }
4664 
4665     /* write value if writable and write mask set, otherwise drop writes */
4666     if (write_mask) {
4667         new_value = (old_value & ~write_mask) | (new_value & write_mask);
4668         if (csr_ops[csrno].write) {
4669             ret = csr_ops[csrno].write(env, csrno, new_value);
4670             if (ret != RISCV_EXCP_NONE) {
4671                 return ret;
4672             }
4673         }
4674     }
4675 
4676     /* return old value */
4677     if (ret_value) {
4678         *ret_value = old_value;
4679     }
4680 
4681     return RISCV_EXCP_NONE;
4682 }
4683 
4684 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
4685                            target_ulong *ret_value,
4686                            target_ulong new_value, target_ulong write_mask)
4687 {
4688     RISCVException ret = riscv_csrrw_check(env, csrno, write_mask);
4689     if (ret != RISCV_EXCP_NONE) {
4690         return ret;
4691     }
4692 
4693     return riscv_csrrw_do64(env, csrno, ret_value, new_value, write_mask);
4694 }
4695 
4696 static RISCVException riscv_csrrw_do128(CPURISCVState *env, int csrno,
4697                                         Int128 *ret_value,
4698                                         Int128 new_value,
4699                                         Int128 write_mask)
4700 {
4701     RISCVException ret;
4702     Int128 old_value;
4703 
4704     /* read old value */
4705     ret = csr_ops[csrno].read128(env, csrno, &old_value);
4706     if (ret != RISCV_EXCP_NONE) {
4707         return ret;
4708     }
4709 
4710     /* write value if writable and write mask set, otherwise drop writes */
4711     if (int128_nz(write_mask)) {
4712         new_value = int128_or(int128_and(old_value, int128_not(write_mask)),
4713                               int128_and(new_value, write_mask));
4714         if (csr_ops[csrno].write128) {
4715             ret = csr_ops[csrno].write128(env, csrno, new_value);
4716             if (ret != RISCV_EXCP_NONE) {
4717                 return ret;
4718             }
4719         } else if (csr_ops[csrno].write) {
4720             /* avoids having to write wrappers for all registers */
4721             ret = csr_ops[csrno].write(env, csrno, int128_getlo(new_value));
4722             if (ret != RISCV_EXCP_NONE) {
4723                 return ret;
4724             }
4725         }
4726     }
4727 
4728     /* return old value */
4729     if (ret_value) {
4730         *ret_value = old_value;
4731     }
4732 
4733     return RISCV_EXCP_NONE;
4734 }
4735 
4736 RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
4737                                 Int128 *ret_value,
4738                                 Int128 new_value, Int128 write_mask)
4739 {
4740     RISCVException ret;
4741 
4742     ret = riscv_csrrw_check(env, csrno, int128_nz(write_mask));
4743     if (ret != RISCV_EXCP_NONE) {
4744         return ret;
4745     }
4746 
4747     if (csr_ops[csrno].read128) {
4748         return riscv_csrrw_do128(env, csrno, ret_value, new_value, write_mask);
4749     }
4750 
4751     /*
4752      * Fall back to 64-bit version for now, if the 128-bit alternative isn't
4753      * at all defined.
4754      * Note, some CSRs don't need to extend to MXLEN (64 upper bits non
4755      * significant), for those, this fallback is correctly handling the
4756      * accesses
4757      */
4758     target_ulong old_value;
4759     ret = riscv_csrrw_do64(env, csrno, &old_value,
4760                            int128_getlo(new_value),
4761                            int128_getlo(write_mask));
4762     if (ret == RISCV_EXCP_NONE && ret_value) {
4763         *ret_value = int128_make64(old_value);
4764     }
4765     return ret;
4766 }
4767 
4768 /*
4769  * Debugger support.  If not in user mode, set env->debugger before the
4770  * riscv_csrrw call and clear it after the call.
4771  */
4772 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
4773                                  target_ulong *ret_value,
4774                                  target_ulong new_value,
4775                                  target_ulong write_mask)
4776 {
4777     RISCVException ret;
4778 #if !defined(CONFIG_USER_ONLY)
4779     env->debugger = true;
4780 #endif
4781     ret = riscv_csrrw(env, csrno, ret_value, new_value, write_mask);
4782 #if !defined(CONFIG_USER_ONLY)
4783     env->debugger = false;
4784 #endif
4785     return ret;
4786 }
4787 
4788 static RISCVException read_jvt(CPURISCVState *env, int csrno,
4789                                target_ulong *val)
4790 {
4791     *val = env->jvt;
4792     return RISCV_EXCP_NONE;
4793 }
4794 
4795 static RISCVException write_jvt(CPURISCVState *env, int csrno,
4796                                 target_ulong val)
4797 {
4798     env->jvt = val;
4799     return RISCV_EXCP_NONE;
4800 }
4801 
4802 /*
4803  * Control and Status Register function table
4804  * riscv_csr_operations::predicate() must be provided for an implemented CSR
4805  */
4806 riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = {
4807     /* User Floating-Point CSRs */
4808     [CSR_FFLAGS]   = { "fflags",   fs,     read_fflags,  write_fflags },
4809     [CSR_FRM]      = { "frm",      fs,     read_frm,     write_frm    },
4810     [CSR_FCSR]     = { "fcsr",     fs,     read_fcsr,    write_fcsr   },
4811     /* Vector CSRs */
4812     [CSR_VSTART]   = { "vstart",   vs,     read_vstart,  write_vstart },
4813     [CSR_VXSAT]    = { "vxsat",    vs,     read_vxsat,   write_vxsat  },
4814     [CSR_VXRM]     = { "vxrm",     vs,     read_vxrm,    write_vxrm   },
4815     [CSR_VCSR]     = { "vcsr",     vs,     read_vcsr,    write_vcsr   },
4816     [CSR_VL]       = { "vl",       vs,     read_vl                    },
4817     [CSR_VTYPE]    = { "vtype",    vs,     read_vtype                 },
4818     [CSR_VLENB]    = { "vlenb",    vs,     read_vlenb                 },
4819     /* User Timers and Counters */
4820     [CSR_CYCLE]    = { "cycle",    ctr,    read_hpmcounter  },
4821     [CSR_INSTRET]  = { "instret",  ctr,    read_hpmcounter  },
4822     [CSR_CYCLEH]   = { "cycleh",   ctr32,  read_hpmcounterh },
4823     [CSR_INSTRETH] = { "instreth", ctr32,  read_hpmcounterh },
4824 
4825     /*
4826      * In privileged mode, the monitor will have to emulate TIME CSRs only if
4827      * rdtime callback is not provided by machine/platform emulation.
4828      */
4829     [CSR_TIME]  = { "time",  ctr,   read_time  },
4830     [CSR_TIMEH] = { "timeh", ctr32, read_timeh },
4831 
4832     /* Crypto Extension */
4833     [CSR_SEED] = { "seed", seed, NULL, NULL, rmw_seed },
4834 
4835     /* Zcmt Extension */
4836     [CSR_JVT] = {"jvt", zcmt, read_jvt, write_jvt},
4837 
4838 #if !defined(CONFIG_USER_ONLY)
4839     /* Machine Timers and Counters */
4840     [CSR_MCYCLE]    = { "mcycle",    any,   read_hpmcounter,
4841                         write_mhpmcounter                    },
4842     [CSR_MINSTRET]  = { "minstret",  any,   read_hpmcounter,
4843                         write_mhpmcounter                    },
4844     [CSR_MCYCLEH]   = { "mcycleh",   any32, read_hpmcounterh,
4845                         write_mhpmcounterh                   },
4846     [CSR_MINSTRETH] = { "minstreth", any32, read_hpmcounterh,
4847                         write_mhpmcounterh                   },
4848 
4849     /* Machine Information Registers */
4850     [CSR_MVENDORID] = { "mvendorid", any,   read_mvendorid },
4851     [CSR_MARCHID]   = { "marchid",   any,   read_marchid   },
4852     [CSR_MIMPID]    = { "mimpid",    any,   read_mimpid    },
4853     [CSR_MHARTID]   = { "mhartid",   any,   read_mhartid   },
4854 
4855     [CSR_MCONFIGPTR]  = { "mconfigptr", any,   read_zero,
4856                           .min_priv_ver = PRIV_VERSION_1_12_0 },
4857     /* Machine Trap Setup */
4858     [CSR_MSTATUS]     = { "mstatus",    any,   read_mstatus, write_mstatus,
4859                           NULL,                read_mstatus_i128           },
4860     [CSR_MISA]        = { "misa",       any,   read_misa,    write_misa,
4861                           NULL,                read_misa_i128              },
4862     [CSR_MIDELEG]     = { "mideleg",    any,   NULL, NULL,   rmw_mideleg   },
4863     [CSR_MEDELEG]     = { "medeleg",    any,   read_medeleg, write_medeleg },
4864     [CSR_MIE]         = { "mie",        any,   NULL, NULL,   rmw_mie       },
4865     [CSR_MTVEC]       = { "mtvec",      any,   read_mtvec,   write_mtvec   },
4866     [CSR_MCOUNTEREN]  = { "mcounteren", umode, read_mcounteren,
4867                           write_mcounteren                                 },
4868 
4869     [CSR_MSTATUSH]    = { "mstatush",   any32, read_mstatush,
4870                           write_mstatush                                   },
4871     [CSR_MEDELEGH]    = { "medelegh",   any32, read_zero, write_ignore,
4872                           .min_priv_ver = PRIV_VERSION_1_13_0              },
4873     [CSR_HEDELEGH]    = { "hedelegh",   hmode32, read_hedelegh, write_hedelegh,
4874                           .min_priv_ver = PRIV_VERSION_1_13_0              },
4875 
4876     /* Machine Trap Handling */
4877     [CSR_MSCRATCH] = { "mscratch", any,  read_mscratch, write_mscratch,
4878                        NULL, read_mscratch_i128, write_mscratch_i128   },
4879     [CSR_MEPC]     = { "mepc",     any,  read_mepc,     write_mepc     },
4880     [CSR_MCAUSE]   = { "mcause",   any,  read_mcause,   write_mcause   },
4881     [CSR_MTVAL]    = { "mtval",    any,  read_mtval,    write_mtval    },
4882     [CSR_MIP]      = { "mip",      any,  NULL,    NULL, rmw_mip        },
4883 
4884     /* Machine-Level Window to Indirectly Accessed Registers (AIA) */
4885     [CSR_MISELECT] = { "miselect", aia_any,   NULL, NULL,    rmw_xiselect },
4886     [CSR_MIREG]    = { "mireg",    aia_any,   NULL, NULL,    rmw_xireg },
4887 
4888     /* Machine-Level Interrupts (AIA) */
4889     [CSR_MTOPEI]   = { "mtopei",   aia_any, NULL, NULL, rmw_xtopei },
4890     [CSR_MTOPI]    = { "mtopi",    aia_any, read_mtopi },
4891 
4892     /* Virtual Interrupts for Supervisor Level (AIA) */
4893     [CSR_MVIEN]    = { "mvien",    aia_any, NULL, NULL, rmw_mvien   },
4894     [CSR_MVIP]     = { "mvip",     aia_any, NULL, NULL, rmw_mvip    },
4895 
4896     /* Machine-Level High-Half CSRs (AIA) */
4897     [CSR_MIDELEGH] = { "midelegh", aia_any32, NULL, NULL, rmw_midelegh },
4898     [CSR_MIEH]     = { "mieh",     aia_any32, NULL, NULL, rmw_mieh     },
4899     [CSR_MVIENH]   = { "mvienh",   aia_any32, NULL, NULL, rmw_mvienh   },
4900     [CSR_MVIPH]    = { "mviph",    aia_any32, NULL, NULL, rmw_mviph    },
4901     [CSR_MIPH]     = { "miph",     aia_any32, NULL, NULL, rmw_miph     },
4902 
4903     /* Execution environment configuration */
4904     [CSR_MENVCFG]  = { "menvcfg",  umode, read_menvcfg,  write_menvcfg,
4905                        .min_priv_ver = PRIV_VERSION_1_12_0              },
4906     [CSR_MENVCFGH] = { "menvcfgh", umode32, read_menvcfgh, write_menvcfgh,
4907                        .min_priv_ver = PRIV_VERSION_1_12_0              },
4908     [CSR_SENVCFG]  = { "senvcfg",  smode, read_senvcfg,  write_senvcfg,
4909                        .min_priv_ver = PRIV_VERSION_1_12_0              },
4910     [CSR_HENVCFG]  = { "henvcfg",  hmode, read_henvcfg, write_henvcfg,
4911                        .min_priv_ver = PRIV_VERSION_1_12_0              },
4912     [CSR_HENVCFGH] = { "henvcfgh", hmode32, read_henvcfgh, write_henvcfgh,
4913                        .min_priv_ver = PRIV_VERSION_1_12_0              },
4914 
4915     /* Smstateen extension CSRs */
4916     [CSR_MSTATEEN0] = { "mstateen0", mstateen, read_mstateen, write_mstateen0,
4917                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4918     [CSR_MSTATEEN0H] = { "mstateen0h", mstateen, read_mstateenh,
4919                           write_mstateen0h,
4920                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4921     [CSR_MSTATEEN1] = { "mstateen1", mstateen, read_mstateen,
4922                         write_mstateen_1_3,
4923                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4924     [CSR_MSTATEEN1H] = { "mstateen1h", mstateen, read_mstateenh,
4925                          write_mstateenh_1_3,
4926                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4927     [CSR_MSTATEEN2] = { "mstateen2", mstateen, read_mstateen,
4928                         write_mstateen_1_3,
4929                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4930     [CSR_MSTATEEN2H] = { "mstateen2h", mstateen, read_mstateenh,
4931                          write_mstateenh_1_3,
4932                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4933     [CSR_MSTATEEN3] = { "mstateen3", mstateen, read_mstateen,
4934                         write_mstateen_1_3,
4935                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4936     [CSR_MSTATEEN3H] = { "mstateen3h", mstateen, read_mstateenh,
4937                          write_mstateenh_1_3,
4938                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4939     [CSR_HSTATEEN0] = { "hstateen0", hstateen, read_hstateen, write_hstateen0,
4940                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4941     [CSR_HSTATEEN0H] = { "hstateen0h", hstateenh, read_hstateenh,
4942                          write_hstateen0h,
4943                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4944     [CSR_HSTATEEN1] = { "hstateen1", hstateen, read_hstateen,
4945                         write_hstateen_1_3,
4946                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4947     [CSR_HSTATEEN1H] = { "hstateen1h", hstateenh, read_hstateenh,
4948                          write_hstateenh_1_3,
4949                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4950     [CSR_HSTATEEN2] = { "hstateen2", hstateen, read_hstateen,
4951                         write_hstateen_1_3,
4952                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4953     [CSR_HSTATEEN2H] = { "hstateen2h", hstateenh, read_hstateenh,
4954                          write_hstateenh_1_3,
4955                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4956     [CSR_HSTATEEN3] = { "hstateen3", hstateen, read_hstateen,
4957                         write_hstateen_1_3,
4958                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4959     [CSR_HSTATEEN3H] = { "hstateen3h", hstateenh, read_hstateenh,
4960                          write_hstateenh_1_3,
4961                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4962     [CSR_SSTATEEN0] = { "sstateen0", sstateen, read_sstateen, write_sstateen0,
4963                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4964     [CSR_SSTATEEN1] = { "sstateen1", sstateen, read_sstateen,
4965                         write_sstateen_1_3,
4966                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4967     [CSR_SSTATEEN2] = { "sstateen2", sstateen, read_sstateen,
4968                         write_sstateen_1_3,
4969                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4970     [CSR_SSTATEEN3] = { "sstateen3", sstateen, read_sstateen,
4971                         write_sstateen_1_3,
4972                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4973 
4974     /* Supervisor Trap Setup */
4975     [CSR_SSTATUS]    = { "sstatus",    smode, read_sstatus,    write_sstatus,
4976                          NULL,                read_sstatus_i128              },
4977     [CSR_SIE]        = { "sie",        smode, NULL,   NULL,    rmw_sie       },
4978     [CSR_STVEC]      = { "stvec",      smode, read_stvec,      write_stvec   },
4979     [CSR_SCOUNTEREN] = { "scounteren", smode, read_scounteren,
4980                          write_scounteren                                    },
4981 
4982     /* Supervisor Trap Handling */
4983     [CSR_SSCRATCH] = { "sscratch", smode, read_sscratch, write_sscratch,
4984                        NULL, read_sscratch_i128, write_sscratch_i128    },
4985     [CSR_SEPC]     = { "sepc",     smode, read_sepc,     write_sepc     },
4986     [CSR_SCAUSE]   = { "scause",   smode, read_scause,   write_scause   },
4987     [CSR_STVAL]    = { "stval",    smode, read_stval,    write_stval    },
4988     [CSR_SIP]      = { "sip",      smode, NULL,    NULL, rmw_sip        },
4989     [CSR_STIMECMP] = { "stimecmp", sstc, read_stimecmp, write_stimecmp,
4990                        .min_priv_ver = PRIV_VERSION_1_12_0 },
4991     [CSR_STIMECMPH] = { "stimecmph", sstc_32, read_stimecmph, write_stimecmph,
4992                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4993     [CSR_VSTIMECMP] = { "vstimecmp", sstc, read_vstimecmp,
4994                         write_vstimecmp,
4995                         .min_priv_ver = PRIV_VERSION_1_12_0 },
4996     [CSR_VSTIMECMPH] = { "vstimecmph", sstc_32, read_vstimecmph,
4997                          write_vstimecmph,
4998                          .min_priv_ver = PRIV_VERSION_1_12_0 },
4999 
5000     /* Supervisor Protection and Translation */
5001     [CSR_SATP]     = { "satp",     satp, read_satp,     write_satp     },
5002 
5003     /* Supervisor-Level Window to Indirectly Accessed Registers (AIA) */
5004     [CSR_SISELECT]   = { "siselect",   aia_smode, NULL, NULL, rmw_xiselect },
5005     [CSR_SIREG]      = { "sireg",      aia_smode, NULL, NULL, rmw_xireg },
5006 
5007     /* Supervisor-Level Interrupts (AIA) */
5008     [CSR_STOPEI]     = { "stopei",     aia_smode, NULL, NULL, rmw_xtopei },
5009     [CSR_STOPI]      = { "stopi",      aia_smode, read_stopi },
5010 
5011     /* Supervisor-Level High-Half CSRs (AIA) */
5012     [CSR_SIEH]       = { "sieh",   aia_smode32, NULL, NULL, rmw_sieh },
5013     [CSR_SIPH]       = { "siph",   aia_smode32, NULL, NULL, rmw_siph },
5014 
5015     [CSR_HSTATUS]     = { "hstatus",     hmode,   read_hstatus, write_hstatus,
5016                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5017     [CSR_HEDELEG]     = { "hedeleg",     hmode,   read_hedeleg, write_hedeleg,
5018                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5019     [CSR_HIDELEG]     = { "hideleg",     hmode,   NULL,   NULL, rmw_hideleg,
5020                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5021     [CSR_HVIP]        = { "hvip",        hmode,   NULL,   NULL, rmw_hvip,
5022                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5023     [CSR_HIP]         = { "hip",         hmode,   NULL,   NULL, rmw_hip,
5024                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5025     [CSR_HIE]         = { "hie",         hmode,   NULL,   NULL, rmw_hie,
5026                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5027     [CSR_HCOUNTEREN]  = { "hcounteren",  hmode,   read_hcounteren,
5028                           write_hcounteren,
5029                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5030     [CSR_HGEIE]       = { "hgeie",       hmode,   read_hgeie,   write_hgeie,
5031                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5032     [CSR_HTVAL]       = { "htval",       hmode,   read_htval,   write_htval,
5033                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5034     [CSR_HTINST]      = { "htinst",      hmode,   read_htinst,  write_htinst,
5035                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5036     [CSR_HGEIP]       = { "hgeip",       hmode,   read_hgeip,
5037                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5038     [CSR_HGATP]       = { "hgatp",       hgatp,   read_hgatp,   write_hgatp,
5039                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5040     [CSR_HTIMEDELTA]  = { "htimedelta",  hmode,   read_htimedelta,
5041                           write_htimedelta,
5042                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5043     [CSR_HTIMEDELTAH] = { "htimedeltah", hmode32, read_htimedeltah,
5044                           write_htimedeltah,
5045                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5046 
5047     [CSR_VSSTATUS]    = { "vsstatus",    hmode,   read_vsstatus,
5048                           write_vsstatus,
5049                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5050     [CSR_VSIP]        = { "vsip",        hmode,   NULL,    NULL, rmw_vsip,
5051                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5052     [CSR_VSIE]        = { "vsie",        hmode,   NULL,    NULL, rmw_vsie ,
5053                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5054     [CSR_VSTVEC]      = { "vstvec",      hmode,   read_vstvec,   write_vstvec,
5055                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5056     [CSR_VSSCRATCH]   = { "vsscratch",   hmode,   read_vsscratch,
5057                           write_vsscratch,
5058                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5059     [CSR_VSEPC]       = { "vsepc",       hmode,   read_vsepc,    write_vsepc,
5060                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5061     [CSR_VSCAUSE]     = { "vscause",     hmode,   read_vscause,  write_vscause,
5062                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5063     [CSR_VSTVAL]      = { "vstval",      hmode,   read_vstval,   write_vstval,
5064                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5065     [CSR_VSATP]       = { "vsatp",       hmode,   read_vsatp,    write_vsatp,
5066                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5067 
5068     [CSR_MTVAL2]      = { "mtval2",      hmode,   read_mtval2,   write_mtval2,
5069                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5070     [CSR_MTINST]      = { "mtinst",      hmode,   read_mtinst,   write_mtinst,
5071                           .min_priv_ver = PRIV_VERSION_1_12_0                },
5072 
5073     /* Virtual Interrupts and Interrupt Priorities (H-extension with AIA) */
5074     [CSR_HVIEN]       = { "hvien",       aia_hmode, NULL, NULL, rmw_hvien },
5075     [CSR_HVICTL]      = { "hvictl",      aia_hmode, read_hvictl,
5076                           write_hvictl                                      },
5077     [CSR_HVIPRIO1]    = { "hviprio1",    aia_hmode, read_hviprio1,
5078                           write_hviprio1                                    },
5079     [CSR_HVIPRIO2]    = { "hviprio2",    aia_hmode, read_hviprio2,
5080                           write_hviprio2                                    },
5081     /*
5082      * VS-Level Window to Indirectly Accessed Registers (H-extension with AIA)
5083      */
5084     [CSR_VSISELECT]   = { "vsiselect",   aia_hmode, NULL, NULL,
5085                           rmw_xiselect                                     },
5086     [CSR_VSIREG]      = { "vsireg",      aia_hmode, NULL, NULL, rmw_xireg  },
5087 
5088     /* VS-Level Interrupts (H-extension with AIA) */
5089     [CSR_VSTOPEI]     = { "vstopei",     aia_hmode, NULL, NULL, rmw_xtopei },
5090     [CSR_VSTOPI]      = { "vstopi",      aia_hmode, read_vstopi },
5091 
5092     /* Hypervisor and VS-Level High-Half CSRs (H-extension with AIA) */
5093     [CSR_HIDELEGH]    = { "hidelegh",    aia_hmode32, NULL, NULL,
5094                           rmw_hidelegh                                      },
5095     [CSR_HVIENH]      = { "hvienh",      aia_hmode32, NULL, NULL, rmw_hvienh },
5096     [CSR_HVIPH]       = { "hviph",       aia_hmode32, NULL, NULL, rmw_hviph },
5097     [CSR_HVIPRIO1H]   = { "hviprio1h",   aia_hmode32, read_hviprio1h,
5098                           write_hviprio1h                                   },
5099     [CSR_HVIPRIO2H]   = { "hviprio2h",   aia_hmode32, read_hviprio2h,
5100                           write_hviprio2h                                   },
5101     [CSR_VSIEH]       = { "vsieh",       aia_hmode32, NULL, NULL, rmw_vsieh },
5102     [CSR_VSIPH]       = { "vsiph",       aia_hmode32, NULL, NULL, rmw_vsiph },
5103 
5104     /* Physical Memory Protection */
5105     [CSR_MSECCFG]    = { "mseccfg",   have_mseccfg, read_mseccfg, write_mseccfg,
5106                          .min_priv_ver = PRIV_VERSION_1_11_0           },
5107     [CSR_PMPCFG0]    = { "pmpcfg0",   pmp, read_pmpcfg,  write_pmpcfg  },
5108     [CSR_PMPCFG1]    = { "pmpcfg1",   pmp, read_pmpcfg,  write_pmpcfg  },
5109     [CSR_PMPCFG2]    = { "pmpcfg2",   pmp, read_pmpcfg,  write_pmpcfg  },
5110     [CSR_PMPCFG3]    = { "pmpcfg3",   pmp, read_pmpcfg,  write_pmpcfg  },
5111     [CSR_PMPADDR0]   = { "pmpaddr0",  pmp, read_pmpaddr, write_pmpaddr },
5112     [CSR_PMPADDR1]   = { "pmpaddr1",  pmp, read_pmpaddr, write_pmpaddr },
5113     [CSR_PMPADDR2]   = { "pmpaddr2",  pmp, read_pmpaddr, write_pmpaddr },
5114     [CSR_PMPADDR3]   = { "pmpaddr3",  pmp, read_pmpaddr, write_pmpaddr },
5115     [CSR_PMPADDR4]   = { "pmpaddr4",  pmp, read_pmpaddr, write_pmpaddr },
5116     [CSR_PMPADDR5]   = { "pmpaddr5",  pmp, read_pmpaddr, write_pmpaddr },
5117     [CSR_PMPADDR6]   = { "pmpaddr6",  pmp, read_pmpaddr, write_pmpaddr },
5118     [CSR_PMPADDR7]   = { "pmpaddr7",  pmp, read_pmpaddr, write_pmpaddr },
5119     [CSR_PMPADDR8]   = { "pmpaddr8",  pmp, read_pmpaddr, write_pmpaddr },
5120     [CSR_PMPADDR9]   = { "pmpaddr9",  pmp, read_pmpaddr, write_pmpaddr },
5121     [CSR_PMPADDR10]  = { "pmpaddr10", pmp, read_pmpaddr, write_pmpaddr },
5122     [CSR_PMPADDR11]  = { "pmpaddr11", pmp, read_pmpaddr, write_pmpaddr },
5123     [CSR_PMPADDR12]  = { "pmpaddr12", pmp, read_pmpaddr, write_pmpaddr },
5124     [CSR_PMPADDR13]  = { "pmpaddr13", pmp, read_pmpaddr, write_pmpaddr },
5125     [CSR_PMPADDR14] =  { "pmpaddr14", pmp, read_pmpaddr, write_pmpaddr },
5126     [CSR_PMPADDR15] =  { "pmpaddr15", pmp, read_pmpaddr, write_pmpaddr },
5127 
5128     /* Debug CSRs */
5129     [CSR_TSELECT]   =  { "tselect",  debug, read_tselect,  write_tselect  },
5130     [CSR_TDATA1]    =  { "tdata1",   debug, read_tdata,    write_tdata    },
5131     [CSR_TDATA2]    =  { "tdata2",   debug, read_tdata,    write_tdata    },
5132     [CSR_TDATA3]    =  { "tdata3",   debug, read_tdata,    write_tdata    },
5133     [CSR_TINFO]     =  { "tinfo",    debug, read_tinfo,    write_ignore   },
5134     [CSR_MCONTEXT]  =  { "mcontext", debug, read_mcontext, write_mcontext },
5135 
5136     /* User Pointer Masking */
5137     [CSR_UMTE]    =    { "umte",    pointer_masking, read_umte,  write_umte },
5138     [CSR_UPMMASK] =    { "upmmask", pointer_masking, read_upmmask,
5139                          write_upmmask                                      },
5140     [CSR_UPMBASE] =    { "upmbase", pointer_masking, read_upmbase,
5141                          write_upmbase                                      },
5142     /* Machine Pointer Masking */
5143     [CSR_MMTE]    =    { "mmte",    pointer_masking, read_mmte,  write_mmte },
5144     [CSR_MPMMASK] =    { "mpmmask", pointer_masking, read_mpmmask,
5145                          write_mpmmask                                      },
5146     [CSR_MPMBASE] =    { "mpmbase", pointer_masking, read_mpmbase,
5147                          write_mpmbase                                      },
5148     /* Supervisor Pointer Masking */
5149     [CSR_SMTE]    =    { "smte",    pointer_masking, read_smte,  write_smte },
5150     [CSR_SPMMASK] =    { "spmmask", pointer_masking, read_spmmask,
5151                          write_spmmask                                      },
5152     [CSR_SPMBASE] =    { "spmbase", pointer_masking, read_spmbase,
5153                          write_spmbase                                      },
5154 
5155     /* Performance Counters */
5156     [CSR_HPMCOUNTER3]    = { "hpmcounter3",    ctr,    read_hpmcounter },
5157     [CSR_HPMCOUNTER4]    = { "hpmcounter4",    ctr,    read_hpmcounter },
5158     [CSR_HPMCOUNTER5]    = { "hpmcounter5",    ctr,    read_hpmcounter },
5159     [CSR_HPMCOUNTER6]    = { "hpmcounter6",    ctr,    read_hpmcounter },
5160     [CSR_HPMCOUNTER7]    = { "hpmcounter7",    ctr,    read_hpmcounter },
5161     [CSR_HPMCOUNTER8]    = { "hpmcounter8",    ctr,    read_hpmcounter },
5162     [CSR_HPMCOUNTER9]    = { "hpmcounter9",    ctr,    read_hpmcounter },
5163     [CSR_HPMCOUNTER10]   = { "hpmcounter10",   ctr,    read_hpmcounter },
5164     [CSR_HPMCOUNTER11]   = { "hpmcounter11",   ctr,    read_hpmcounter },
5165     [CSR_HPMCOUNTER12]   = { "hpmcounter12",   ctr,    read_hpmcounter },
5166     [CSR_HPMCOUNTER13]   = { "hpmcounter13",   ctr,    read_hpmcounter },
5167     [CSR_HPMCOUNTER14]   = { "hpmcounter14",   ctr,    read_hpmcounter },
5168     [CSR_HPMCOUNTER15]   = { "hpmcounter15",   ctr,    read_hpmcounter },
5169     [CSR_HPMCOUNTER16]   = { "hpmcounter16",   ctr,    read_hpmcounter },
5170     [CSR_HPMCOUNTER17]   = { "hpmcounter17",   ctr,    read_hpmcounter },
5171     [CSR_HPMCOUNTER18]   = { "hpmcounter18",   ctr,    read_hpmcounter },
5172     [CSR_HPMCOUNTER19]   = { "hpmcounter19",   ctr,    read_hpmcounter },
5173     [CSR_HPMCOUNTER20]   = { "hpmcounter20",   ctr,    read_hpmcounter },
5174     [CSR_HPMCOUNTER21]   = { "hpmcounter21",   ctr,    read_hpmcounter },
5175     [CSR_HPMCOUNTER22]   = { "hpmcounter22",   ctr,    read_hpmcounter },
5176     [CSR_HPMCOUNTER23]   = { "hpmcounter23",   ctr,    read_hpmcounter },
5177     [CSR_HPMCOUNTER24]   = { "hpmcounter24",   ctr,    read_hpmcounter },
5178     [CSR_HPMCOUNTER25]   = { "hpmcounter25",   ctr,    read_hpmcounter },
5179     [CSR_HPMCOUNTER26]   = { "hpmcounter26",   ctr,    read_hpmcounter },
5180     [CSR_HPMCOUNTER27]   = { "hpmcounter27",   ctr,    read_hpmcounter },
5181     [CSR_HPMCOUNTER28]   = { "hpmcounter28",   ctr,    read_hpmcounter },
5182     [CSR_HPMCOUNTER29]   = { "hpmcounter29",   ctr,    read_hpmcounter },
5183     [CSR_HPMCOUNTER30]   = { "hpmcounter30",   ctr,    read_hpmcounter },
5184     [CSR_HPMCOUNTER31]   = { "hpmcounter31",   ctr,    read_hpmcounter },
5185 
5186     [CSR_MHPMCOUNTER3]   = { "mhpmcounter3",   mctr,    read_hpmcounter,
5187                              write_mhpmcounter                         },
5188     [CSR_MHPMCOUNTER4]   = { "mhpmcounter4",   mctr,    read_hpmcounter,
5189                              write_mhpmcounter                         },
5190     [CSR_MHPMCOUNTER5]   = { "mhpmcounter5",   mctr,    read_hpmcounter,
5191                              write_mhpmcounter                         },
5192     [CSR_MHPMCOUNTER6]   = { "mhpmcounter6",   mctr,    read_hpmcounter,
5193                              write_mhpmcounter                         },
5194     [CSR_MHPMCOUNTER7]   = { "mhpmcounter7",   mctr,    read_hpmcounter,
5195                              write_mhpmcounter                         },
5196     [CSR_MHPMCOUNTER8]   = { "mhpmcounter8",   mctr,    read_hpmcounter,
5197                              write_mhpmcounter                         },
5198     [CSR_MHPMCOUNTER9]   = { "mhpmcounter9",   mctr,    read_hpmcounter,
5199                              write_mhpmcounter                         },
5200     [CSR_MHPMCOUNTER10]  = { "mhpmcounter10",  mctr,    read_hpmcounter,
5201                              write_mhpmcounter                         },
5202     [CSR_MHPMCOUNTER11]  = { "mhpmcounter11",  mctr,    read_hpmcounter,
5203                              write_mhpmcounter                         },
5204     [CSR_MHPMCOUNTER12]  = { "mhpmcounter12",  mctr,    read_hpmcounter,
5205                              write_mhpmcounter                         },
5206     [CSR_MHPMCOUNTER13]  = { "mhpmcounter13",  mctr,    read_hpmcounter,
5207                              write_mhpmcounter                         },
5208     [CSR_MHPMCOUNTER14]  = { "mhpmcounter14",  mctr,    read_hpmcounter,
5209                              write_mhpmcounter                         },
5210     [CSR_MHPMCOUNTER15]  = { "mhpmcounter15",  mctr,    read_hpmcounter,
5211                              write_mhpmcounter                         },
5212     [CSR_MHPMCOUNTER16]  = { "mhpmcounter16",  mctr,    read_hpmcounter,
5213                              write_mhpmcounter                         },
5214     [CSR_MHPMCOUNTER17]  = { "mhpmcounter17",  mctr,    read_hpmcounter,
5215                              write_mhpmcounter                         },
5216     [CSR_MHPMCOUNTER18]  = { "mhpmcounter18",  mctr,    read_hpmcounter,
5217                              write_mhpmcounter                         },
5218     [CSR_MHPMCOUNTER19]  = { "mhpmcounter19",  mctr,    read_hpmcounter,
5219                              write_mhpmcounter                         },
5220     [CSR_MHPMCOUNTER20]  = { "mhpmcounter20",  mctr,    read_hpmcounter,
5221                              write_mhpmcounter                         },
5222     [CSR_MHPMCOUNTER21]  = { "mhpmcounter21",  mctr,    read_hpmcounter,
5223                              write_mhpmcounter                         },
5224     [CSR_MHPMCOUNTER22]  = { "mhpmcounter22",  mctr,    read_hpmcounter,
5225                              write_mhpmcounter                         },
5226     [CSR_MHPMCOUNTER23]  = { "mhpmcounter23",  mctr,    read_hpmcounter,
5227                              write_mhpmcounter                         },
5228     [CSR_MHPMCOUNTER24]  = { "mhpmcounter24",  mctr,    read_hpmcounter,
5229                              write_mhpmcounter                         },
5230     [CSR_MHPMCOUNTER25]  = { "mhpmcounter25",  mctr,    read_hpmcounter,
5231                              write_mhpmcounter                         },
5232     [CSR_MHPMCOUNTER26]  = { "mhpmcounter26",  mctr,    read_hpmcounter,
5233                              write_mhpmcounter                         },
5234     [CSR_MHPMCOUNTER27]  = { "mhpmcounter27",  mctr,    read_hpmcounter,
5235                              write_mhpmcounter                         },
5236     [CSR_MHPMCOUNTER28]  = { "mhpmcounter28",  mctr,    read_hpmcounter,
5237                              write_mhpmcounter                         },
5238     [CSR_MHPMCOUNTER29]  = { "mhpmcounter29",  mctr,    read_hpmcounter,
5239                              write_mhpmcounter                         },
5240     [CSR_MHPMCOUNTER30]  = { "mhpmcounter30",  mctr,    read_hpmcounter,
5241                              write_mhpmcounter                         },
5242     [CSR_MHPMCOUNTER31]  = { "mhpmcounter31",  mctr,    read_hpmcounter,
5243                              write_mhpmcounter                         },
5244 
5245     [CSR_MCOUNTINHIBIT]  = { "mcountinhibit",  any, read_mcountinhibit,
5246                              write_mcountinhibit,
5247                              .min_priv_ver = PRIV_VERSION_1_11_0       },
5248 
5249     [CSR_MCYCLECFG]      = { "mcyclecfg",   smcntrpmf, read_mcyclecfg,
5250                              write_mcyclecfg,
5251                              .min_priv_ver = PRIV_VERSION_1_12_0       },
5252     [CSR_MINSTRETCFG]    = { "minstretcfg", smcntrpmf, read_minstretcfg,
5253                              write_minstretcfg,
5254                              .min_priv_ver = PRIV_VERSION_1_12_0       },
5255 
5256     [CSR_MHPMEVENT3]     = { "mhpmevent3",     any,    read_mhpmevent,
5257                              write_mhpmevent                           },
5258     [CSR_MHPMEVENT4]     = { "mhpmevent4",     any,    read_mhpmevent,
5259                              write_mhpmevent                           },
5260     [CSR_MHPMEVENT5]     = { "mhpmevent5",     any,    read_mhpmevent,
5261                              write_mhpmevent                           },
5262     [CSR_MHPMEVENT6]     = { "mhpmevent6",     any,    read_mhpmevent,
5263                              write_mhpmevent                           },
5264     [CSR_MHPMEVENT7]     = { "mhpmevent7",     any,    read_mhpmevent,
5265                              write_mhpmevent                           },
5266     [CSR_MHPMEVENT8]     = { "mhpmevent8",     any,    read_mhpmevent,
5267                              write_mhpmevent                           },
5268     [CSR_MHPMEVENT9]     = { "mhpmevent9",     any,    read_mhpmevent,
5269                              write_mhpmevent                           },
5270     [CSR_MHPMEVENT10]    = { "mhpmevent10",    any,    read_mhpmevent,
5271                              write_mhpmevent                           },
5272     [CSR_MHPMEVENT11]    = { "mhpmevent11",    any,    read_mhpmevent,
5273                              write_mhpmevent                           },
5274     [CSR_MHPMEVENT12]    = { "mhpmevent12",    any,    read_mhpmevent,
5275                              write_mhpmevent                           },
5276     [CSR_MHPMEVENT13]    = { "mhpmevent13",    any,    read_mhpmevent,
5277                              write_mhpmevent                           },
5278     [CSR_MHPMEVENT14]    = { "mhpmevent14",    any,    read_mhpmevent,
5279                              write_mhpmevent                           },
5280     [CSR_MHPMEVENT15]    = { "mhpmevent15",    any,    read_mhpmevent,
5281                              write_mhpmevent                           },
5282     [CSR_MHPMEVENT16]    = { "mhpmevent16",    any,    read_mhpmevent,
5283                              write_mhpmevent                           },
5284     [CSR_MHPMEVENT17]    = { "mhpmevent17",    any,    read_mhpmevent,
5285                              write_mhpmevent                           },
5286     [CSR_MHPMEVENT18]    = { "mhpmevent18",    any,    read_mhpmevent,
5287                              write_mhpmevent                           },
5288     [CSR_MHPMEVENT19]    = { "mhpmevent19",    any,    read_mhpmevent,
5289                              write_mhpmevent                           },
5290     [CSR_MHPMEVENT20]    = { "mhpmevent20",    any,    read_mhpmevent,
5291                              write_mhpmevent                           },
5292     [CSR_MHPMEVENT21]    = { "mhpmevent21",    any,    read_mhpmevent,
5293                              write_mhpmevent                           },
5294     [CSR_MHPMEVENT22]    = { "mhpmevent22",    any,    read_mhpmevent,
5295                              write_mhpmevent                           },
5296     [CSR_MHPMEVENT23]    = { "mhpmevent23",    any,    read_mhpmevent,
5297                              write_mhpmevent                           },
5298     [CSR_MHPMEVENT24]    = { "mhpmevent24",    any,    read_mhpmevent,
5299                              write_mhpmevent                           },
5300     [CSR_MHPMEVENT25]    = { "mhpmevent25",    any,    read_mhpmevent,
5301                              write_mhpmevent                           },
5302     [CSR_MHPMEVENT26]    = { "mhpmevent26",    any,    read_mhpmevent,
5303                              write_mhpmevent                           },
5304     [CSR_MHPMEVENT27]    = { "mhpmevent27",    any,    read_mhpmevent,
5305                              write_mhpmevent                           },
5306     [CSR_MHPMEVENT28]    = { "mhpmevent28",    any,    read_mhpmevent,
5307                              write_mhpmevent                           },
5308     [CSR_MHPMEVENT29]    = { "mhpmevent29",    any,    read_mhpmevent,
5309                              write_mhpmevent                           },
5310     [CSR_MHPMEVENT30]    = { "mhpmevent30",    any,    read_mhpmevent,
5311                              write_mhpmevent                           },
5312     [CSR_MHPMEVENT31]    = { "mhpmevent31",    any,    read_mhpmevent,
5313                              write_mhpmevent                           },
5314 
5315     [CSR_MCYCLECFGH]     = { "mcyclecfgh",   smcntrpmf_32, read_mcyclecfgh,
5316                              write_mcyclecfgh,
5317                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5318     [CSR_MINSTRETCFGH]   = { "minstretcfgh", smcntrpmf_32, read_minstretcfgh,
5319                              write_minstretcfgh,
5320                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5321 
5322     [CSR_MHPMEVENT3H]    = { "mhpmevent3h",    sscofpmf_32,  read_mhpmeventh,
5323                              write_mhpmeventh,
5324                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5325     [CSR_MHPMEVENT4H]    = { "mhpmevent4h",    sscofpmf_32,  read_mhpmeventh,
5326                              write_mhpmeventh,
5327                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5328     [CSR_MHPMEVENT5H]    = { "mhpmevent5h",    sscofpmf_32,  read_mhpmeventh,
5329                              write_mhpmeventh,
5330                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5331     [CSR_MHPMEVENT6H]    = { "mhpmevent6h",    sscofpmf_32,  read_mhpmeventh,
5332                              write_mhpmeventh,
5333                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5334     [CSR_MHPMEVENT7H]    = { "mhpmevent7h",    sscofpmf_32,  read_mhpmeventh,
5335                              write_mhpmeventh,
5336                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5337     [CSR_MHPMEVENT8H]    = { "mhpmevent8h",    sscofpmf_32,  read_mhpmeventh,
5338                              write_mhpmeventh,
5339                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5340     [CSR_MHPMEVENT9H]    = { "mhpmevent9h",    sscofpmf_32,  read_mhpmeventh,
5341                              write_mhpmeventh,
5342                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5343     [CSR_MHPMEVENT10H]   = { "mhpmevent10h",    sscofpmf_32,  read_mhpmeventh,
5344                              write_mhpmeventh,
5345                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5346     [CSR_MHPMEVENT11H]   = { "mhpmevent11h",    sscofpmf_32,  read_mhpmeventh,
5347                              write_mhpmeventh,
5348                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5349     [CSR_MHPMEVENT12H]   = { "mhpmevent12h",    sscofpmf_32,  read_mhpmeventh,
5350                              write_mhpmeventh,
5351                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5352     [CSR_MHPMEVENT13H]   = { "mhpmevent13h",    sscofpmf_32,  read_mhpmeventh,
5353                              write_mhpmeventh,
5354                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5355     [CSR_MHPMEVENT14H]   = { "mhpmevent14h",    sscofpmf_32,  read_mhpmeventh,
5356                              write_mhpmeventh,
5357                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5358     [CSR_MHPMEVENT15H]   = { "mhpmevent15h",    sscofpmf_32,  read_mhpmeventh,
5359                              write_mhpmeventh,
5360                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5361     [CSR_MHPMEVENT16H]   = { "mhpmevent16h",    sscofpmf_32,  read_mhpmeventh,
5362                              write_mhpmeventh,
5363                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5364     [CSR_MHPMEVENT17H]   = { "mhpmevent17h",    sscofpmf_32,  read_mhpmeventh,
5365                              write_mhpmeventh,
5366                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5367     [CSR_MHPMEVENT18H]   = { "mhpmevent18h",    sscofpmf_32,  read_mhpmeventh,
5368                              write_mhpmeventh,
5369                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5370     [CSR_MHPMEVENT19H]   = { "mhpmevent19h",    sscofpmf_32,  read_mhpmeventh,
5371                              write_mhpmeventh,
5372                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5373     [CSR_MHPMEVENT20H]   = { "mhpmevent20h",    sscofpmf_32,  read_mhpmeventh,
5374                              write_mhpmeventh,
5375                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5376     [CSR_MHPMEVENT21H]   = { "mhpmevent21h",    sscofpmf_32,  read_mhpmeventh,
5377                              write_mhpmeventh,
5378                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5379     [CSR_MHPMEVENT22H]   = { "mhpmevent22h",    sscofpmf_32,  read_mhpmeventh,
5380                              write_mhpmeventh,
5381                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5382     [CSR_MHPMEVENT23H]   = { "mhpmevent23h",    sscofpmf_32,  read_mhpmeventh,
5383                              write_mhpmeventh,
5384                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5385     [CSR_MHPMEVENT24H]   = { "mhpmevent24h",    sscofpmf_32,  read_mhpmeventh,
5386                              write_mhpmeventh,
5387                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5388     [CSR_MHPMEVENT25H]   = { "mhpmevent25h",    sscofpmf_32,  read_mhpmeventh,
5389                              write_mhpmeventh,
5390                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5391     [CSR_MHPMEVENT26H]   = { "mhpmevent26h",    sscofpmf_32,  read_mhpmeventh,
5392                              write_mhpmeventh,
5393                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5394     [CSR_MHPMEVENT27H]   = { "mhpmevent27h",    sscofpmf_32,  read_mhpmeventh,
5395                              write_mhpmeventh,
5396                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5397     [CSR_MHPMEVENT28H]   = { "mhpmevent28h",    sscofpmf_32,  read_mhpmeventh,
5398                              write_mhpmeventh,
5399                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5400     [CSR_MHPMEVENT29H]   = { "mhpmevent29h",    sscofpmf_32,  read_mhpmeventh,
5401                              write_mhpmeventh,
5402                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5403     [CSR_MHPMEVENT30H]   = { "mhpmevent30h",    sscofpmf_32,  read_mhpmeventh,
5404                              write_mhpmeventh,
5405                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5406     [CSR_MHPMEVENT31H]   = { "mhpmevent31h",    sscofpmf_32,  read_mhpmeventh,
5407                              write_mhpmeventh,
5408                              .min_priv_ver = PRIV_VERSION_1_12_0        },
5409 
5410     [CSR_HPMCOUNTER3H]   = { "hpmcounter3h",   ctr32,  read_hpmcounterh },
5411     [CSR_HPMCOUNTER4H]   = { "hpmcounter4h",   ctr32,  read_hpmcounterh },
5412     [CSR_HPMCOUNTER5H]   = { "hpmcounter5h",   ctr32,  read_hpmcounterh },
5413     [CSR_HPMCOUNTER6H]   = { "hpmcounter6h",   ctr32,  read_hpmcounterh },
5414     [CSR_HPMCOUNTER7H]   = { "hpmcounter7h",   ctr32,  read_hpmcounterh },
5415     [CSR_HPMCOUNTER8H]   = { "hpmcounter8h",   ctr32,  read_hpmcounterh },
5416     [CSR_HPMCOUNTER9H]   = { "hpmcounter9h",   ctr32,  read_hpmcounterh },
5417     [CSR_HPMCOUNTER10H]  = { "hpmcounter10h",  ctr32,  read_hpmcounterh },
5418     [CSR_HPMCOUNTER11H]  = { "hpmcounter11h",  ctr32,  read_hpmcounterh },
5419     [CSR_HPMCOUNTER12H]  = { "hpmcounter12h",  ctr32,  read_hpmcounterh },
5420     [CSR_HPMCOUNTER13H]  = { "hpmcounter13h",  ctr32,  read_hpmcounterh },
5421     [CSR_HPMCOUNTER14H]  = { "hpmcounter14h",  ctr32,  read_hpmcounterh },
5422     [CSR_HPMCOUNTER15H]  = { "hpmcounter15h",  ctr32,  read_hpmcounterh },
5423     [CSR_HPMCOUNTER16H]  = { "hpmcounter16h",  ctr32,  read_hpmcounterh },
5424     [CSR_HPMCOUNTER17H]  = { "hpmcounter17h",  ctr32,  read_hpmcounterh },
5425     [CSR_HPMCOUNTER18H]  = { "hpmcounter18h",  ctr32,  read_hpmcounterh },
5426     [CSR_HPMCOUNTER19H]  = { "hpmcounter19h",  ctr32,  read_hpmcounterh },
5427     [CSR_HPMCOUNTER20H]  = { "hpmcounter20h",  ctr32,  read_hpmcounterh },
5428     [CSR_HPMCOUNTER21H]  = { "hpmcounter21h",  ctr32,  read_hpmcounterh },
5429     [CSR_HPMCOUNTER22H]  = { "hpmcounter22h",  ctr32,  read_hpmcounterh },
5430     [CSR_HPMCOUNTER23H]  = { "hpmcounter23h",  ctr32,  read_hpmcounterh },
5431     [CSR_HPMCOUNTER24H]  = { "hpmcounter24h",  ctr32,  read_hpmcounterh },
5432     [CSR_HPMCOUNTER25H]  = { "hpmcounter25h",  ctr32,  read_hpmcounterh },
5433     [CSR_HPMCOUNTER26H]  = { "hpmcounter26h",  ctr32,  read_hpmcounterh },
5434     [CSR_HPMCOUNTER27H]  = { "hpmcounter27h",  ctr32,  read_hpmcounterh },
5435     [CSR_HPMCOUNTER28H]  = { "hpmcounter28h",  ctr32,  read_hpmcounterh },
5436     [CSR_HPMCOUNTER29H]  = { "hpmcounter29h",  ctr32,  read_hpmcounterh },
5437     [CSR_HPMCOUNTER30H]  = { "hpmcounter30h",  ctr32,  read_hpmcounterh },
5438     [CSR_HPMCOUNTER31H]  = { "hpmcounter31h",  ctr32,  read_hpmcounterh },
5439 
5440     [CSR_MHPMCOUNTER3H]  = { "mhpmcounter3h",  mctr32,  read_hpmcounterh,
5441                              write_mhpmcounterh                         },
5442     [CSR_MHPMCOUNTER4H]  = { "mhpmcounter4h",  mctr32,  read_hpmcounterh,
5443                              write_mhpmcounterh                         },
5444     [CSR_MHPMCOUNTER5H]  = { "mhpmcounter5h",  mctr32,  read_hpmcounterh,
5445                              write_mhpmcounterh                         },
5446     [CSR_MHPMCOUNTER6H]  = { "mhpmcounter6h",  mctr32,  read_hpmcounterh,
5447                              write_mhpmcounterh                         },
5448     [CSR_MHPMCOUNTER7H]  = { "mhpmcounter7h",  mctr32,  read_hpmcounterh,
5449                              write_mhpmcounterh                         },
5450     [CSR_MHPMCOUNTER8H]  = { "mhpmcounter8h",  mctr32,  read_hpmcounterh,
5451                              write_mhpmcounterh                         },
5452     [CSR_MHPMCOUNTER9H]  = { "mhpmcounter9h",  mctr32,  read_hpmcounterh,
5453                              write_mhpmcounterh                         },
5454     [CSR_MHPMCOUNTER10H] = { "mhpmcounter10h", mctr32,  read_hpmcounterh,
5455                              write_mhpmcounterh                         },
5456     [CSR_MHPMCOUNTER11H] = { "mhpmcounter11h", mctr32,  read_hpmcounterh,
5457                              write_mhpmcounterh                         },
5458     [CSR_MHPMCOUNTER12H] = { "mhpmcounter12h", mctr32,  read_hpmcounterh,
5459                              write_mhpmcounterh                         },
5460     [CSR_MHPMCOUNTER13H] = { "mhpmcounter13h", mctr32,  read_hpmcounterh,
5461                              write_mhpmcounterh                         },
5462     [CSR_MHPMCOUNTER14H] = { "mhpmcounter14h", mctr32,  read_hpmcounterh,
5463                              write_mhpmcounterh                         },
5464     [CSR_MHPMCOUNTER15H] = { "mhpmcounter15h", mctr32,  read_hpmcounterh,
5465                              write_mhpmcounterh                         },
5466     [CSR_MHPMCOUNTER16H] = { "mhpmcounter16h", mctr32,  read_hpmcounterh,
5467                              write_mhpmcounterh                         },
5468     [CSR_MHPMCOUNTER17H] = { "mhpmcounter17h", mctr32,  read_hpmcounterh,
5469                              write_mhpmcounterh                         },
5470     [CSR_MHPMCOUNTER18H] = { "mhpmcounter18h", mctr32,  read_hpmcounterh,
5471                              write_mhpmcounterh                         },
5472     [CSR_MHPMCOUNTER19H] = { "mhpmcounter19h", mctr32,  read_hpmcounterh,
5473                              write_mhpmcounterh                         },
5474     [CSR_MHPMCOUNTER20H] = { "mhpmcounter20h", mctr32,  read_hpmcounterh,
5475                              write_mhpmcounterh                         },
5476     [CSR_MHPMCOUNTER21H] = { "mhpmcounter21h", mctr32,  read_hpmcounterh,
5477                              write_mhpmcounterh                         },
5478     [CSR_MHPMCOUNTER22H] = { "mhpmcounter22h", mctr32,  read_hpmcounterh,
5479                              write_mhpmcounterh                         },
5480     [CSR_MHPMCOUNTER23H] = { "mhpmcounter23h", mctr32,  read_hpmcounterh,
5481                              write_mhpmcounterh                         },
5482     [CSR_MHPMCOUNTER24H] = { "mhpmcounter24h", mctr32,  read_hpmcounterh,
5483                              write_mhpmcounterh                         },
5484     [CSR_MHPMCOUNTER25H] = { "mhpmcounter25h", mctr32,  read_hpmcounterh,
5485                              write_mhpmcounterh                         },
5486     [CSR_MHPMCOUNTER26H] = { "mhpmcounter26h", mctr32,  read_hpmcounterh,
5487                              write_mhpmcounterh                         },
5488     [CSR_MHPMCOUNTER27H] = { "mhpmcounter27h", mctr32,  read_hpmcounterh,
5489                              write_mhpmcounterh                         },
5490     [CSR_MHPMCOUNTER28H] = { "mhpmcounter28h", mctr32,  read_hpmcounterh,
5491                              write_mhpmcounterh                         },
5492     [CSR_MHPMCOUNTER29H] = { "mhpmcounter29h", mctr32,  read_hpmcounterh,
5493                              write_mhpmcounterh                         },
5494     [CSR_MHPMCOUNTER30H] = { "mhpmcounter30h", mctr32,  read_hpmcounterh,
5495                              write_mhpmcounterh                         },
5496     [CSR_MHPMCOUNTER31H] = { "mhpmcounter31h", mctr32,  read_hpmcounterh,
5497                              write_mhpmcounterh                         },
5498     [CSR_SCOUNTOVF]      = { "scountovf", sscofpmf,  read_scountovf,
5499                              .min_priv_ver = PRIV_VERSION_1_12_0 },
5500 
5501 #endif /* !CONFIG_USER_ONLY */
5502 };
5503