This series fixes five independent RISC-V CSR and trap-handling defects.

The patches cover:

 - making mnstatus.MNPELP writable when Zicfilp is implemented;
 - saving ELP in mstatus.MPELP for M-mode RNMI exceptions;
 - masking inactive senvcfg.SSE on readback;
 - gating envcfg CBO fields on Zicbom and Zicboz;
 - enforcing menvcfg.SSE precedence for ssp CSR access.

Each patch includes a corresponding GitLab Work Item and a Signed-off-by
line. The reports were found with an automated differential/emulation tool
and manually triaged against QEMU master eea8fe61b8be.

The witness families were rerun on the Linux x86_64 execution plane. The
patches apply cleanly and pass git diff --check and checkpatch.pl with zero
errors and zero warnings.

wangyang (5):
  target/riscv: make mnstatus.MNPELP writable with Zicfilp
  target/riscv: save ELP in MPELP for RNMI exceptions
  target/riscv: mask inactive senvcfg.SSE on read
  target/riscv: gate envcfg CBO fields on extensions
  target/riscv: enforce SSE precedence for ssp CSR access

 target/riscv/tcg/cpu_helper.c |  7 +---
 target/riscv/tcg/csr.c        | 79 +++++++++++++++++++++++++++++++----
 2 files changed, 71 insertions(+), 15 deletions(-)

-- 
2.55.0.windows.2