From: Frank Chang <frank.chang@sifive.com>

The effective privilege of explicit memory accesses made by
virtual-machine load/store instructions (HLV.* and HSV.*) is controlled
by hstatus.SPVP. mstatus.MPRV does not affect these virtual-machine
load/store instructions.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
---
 target/riscv/cpu_helper.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index acfc6c10607..bf747834dcc 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -261,16 +261,25 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
 RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env)
 {
 #ifndef CONFIG_USER_ONLY
-    int priv_mode = cpu_address_mode(env);
+    int priv_mode;
 
-    if (priv_mode == PRV_U) {
-        return get_field(env->hstatus, HSTATUS_HUPMM);
-    } else {
-        if (get_field(env->hstatus, HSTATUS_SPVP)) {
-            return get_field(env->henvcfg, HENVCFG_PMM);
-        } else {
-            return get_field(env->senvcfg, SENVCFG_PMM);
-        }
+    if (get_field(env->mstatus, MSTATUS_MXR) ||
+        !riscv_cpu_cfg(env)->ext_ssnpm) {
+        return PMM_FIELD_DISABLED;
+    }
+
+    priv_mode = get_field(env->hstatus, HSTATUS_SPVP);
+
+    switch (priv_mode) {
+    case PRV_S:
+        /* Effective privilege mode: VS */
+        return get_field(env->henvcfg, HENVCFG_PMM);
+    case PRV_U:
+        /* Effective privilege mode: VU */
+        return (env->priv == PRV_U) ? get_field(env->hstatus, HSTATUS_HUPMM) :
+                                      get_field(env->senvcfg, SENVCFG_PMM);
+    default:
+        return PMM_FIELD_DISABLED;
     }
 #else
     return PMM_FIELD_DISABLED;
-- 
2.43.0

2025-11-21T13:04:11+08:00, <frank.chang@sifive.com>:
> From: Frank Chang <frank.chang@sifive.com>
>
> The effective privilege of explicit memory accesses made by
> virtual-machine load/store instructions (HLV.* and HSV.*) is controlled
> by hstatus.SPVP. mstatus.MPRV does not affect these virtual-machine
> load/store instructions.
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> ---
> diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
> @@ -261,16 +261,25 @@ RISCVPmPmm riscv_pm_get_pmm(CPURISCVState *env)
>  RISCVPmPmm riscv_pm_get_virt_pmm(CPURISCVState *env)
>  {
>  #ifndef CONFIG_USER_ONLY
> -    int priv_mode = cpu_address_mode(env);
> +    int priv_mode;
>  
> -    if (priv_mode == PRV_U) {
> -        return get_field(env->hstatus, HSTATUS_HUPMM);
> -    } else {
> -        if (get_field(env->hstatus, HSTATUS_SPVP)) {
> -            return get_field(env->henvcfg, HENVCFG_PMM);
> -        } else {
> -            return get_field(env->senvcfg, SENVCFG_PMM);
> -        }
> +    if (get_field(env->mstatus, MSTATUS_MXR) ||
> +        !riscv_cpu_cfg(env)->ext_ssnpm) {
> +        return PMM_FIELD_DISABLED;
> +    }

The condition also needs to consider vsstatus.MXR.

Looks good otherwise, thanks.