Access to a counter in U-mode is permitted only if the corresponding bit is set in both mcounteren and scounteren. The current code ignores mcounteren and checks scounteren only for U-mode access.
Signed-off-by: Xi Wang <xi.w...@gmail.com> --- target/riscv/csr.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/target/riscv/csr.c b/target/riscv/csr.c index 5e7e7d16b8..133f2ff7e2 100644 --- a/target/riscv/csr.c +++ b/target/riscv/csr.c @@ -56,9 +56,15 @@ static int fs(CPURISCVState *env, int csrno) static int ctr(CPURISCVState *env, int csrno) { #if !defined(CONFIG_USER_ONLY) - target_ulong ctr_en = env->priv == PRV_U ? env->scounteren : - env->priv == PRV_S ? env->mcounteren : -1U; - if (!(ctr_en & (1 << (csrno & 31)))) { + uint32_t ctr_en = ~0u; + + if (env->priv < PRV_M) { + ctr_en &= env->mcounteren; + } + if (env->priv < PRV_S) { + ctr_en &= env->scounteren; + } + if (!(ctr_en & (1u << (csrno & 31)))) { return -1; } #endif -- 2.19.1