PMP CSR read returns upper bits set incorrectly in QEMU RISC-V
## **Host environment**
**Operating system:** Linux
**OS/kernel version:** Linux chips.eng.hmc.edu 5.14.0-611.30.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Feb 11 06:42:00 EST 2026 x86_64 x86_64 x86_64 GNU/Linux
**Architecture:** x86_64
**QEMU flavor:** qemu-system-riscv64
**QEMU version:** QEMU emulator version 10.2.2 (v10.2.2)
**QEMU command line:** qemu-system-riscv64 -nographic -semihosting -icount shift=1 \
-machine virt -cpu max,pmu-mask=0xfffffff8 \
-bios none \
-kernel /pmpsm_csr_walk.elf \
-d in_asm,cpu \> pmpsm_csr_walk.log 2\>&1
## Emulated/Virtualized environment
**Operating system:** Bare-metal RISC-V test program (no guest OS)\
**OS/kernel version:** N/A\
**Architecture:** riscv64
## Description of problem
When writing to `pmpaddr0` and reading it back using CSR instructions, QEMU does not correctly mask the upper bits of the register as required by the RISC-V PMP specification.
For example when we write all 1s in pmpaddr0 reg and read it back using the csr read instruction, we read back the exact same value, instead of reading back the correct masked value.
Expected value to be read back: 0x003fffffffffffff
Actual value being read back: 0xffffffffffffffff
According to riscv priv spec, "_For RV64, each PMP address register encodes bits 55-2 of a 56-bit physical address_"
{width=366 height=56}
So upper 10 bits should be cleared when we read it back. This is clearly a spec violation.
## Steps to reproduce
1\. Use the attached ELF file (pmpsm_csr_walk.elf).
2\. Run the following command:\
\
qemu-system-riscv64 -nographic -semihosting -icount shift=1 \\\
-machine virt -cpu max,pmu-mask=0xfffffff8 \\\
-bios none \\\
-kernel pmpsm_csr_walk.elf \\\
-d in_asm,cpu
3\. Inspect the trace output and observe incorrect values when reading pmpaddr0.(Inspect around instruction fff00393)
[pmpsm_csr_walk.elf](/uploads/96182041157392ed3edd4fee0c2956f3/pmpsm_csr_walk.elf)
## Additional Information
Here are snippets of the trace following the same problem.
```log
0x8000bd50: 00810113 addi sp,sp,8
0x8000bd54: fff00393 addi t2,zero,-1
0x8000bd58: 3b039073 csrrw zero,pmpaddr0,t2
...
0x8000bd5c: 00000013 nop
0x8000bd60: 3b0023f3 csrrs t2,pmpaddr0,zero
...
x0/zero 0000000000000000 x1/ra feedbeadfeedbead x2/sp 0000000080018c48 x3/gp 0000000080015360
x4/tp 0020000000000000 x5/t0 ffffffffffffffff x6/t1 6f5ca309e7d4b281 x7/t2 ffffffffffffffff
```
issue