sptbr now a holds a PPN, not an address

riscv/mmu.cc

@@ -120,7 +120,7 @@ reg_t mmu_t::walk(reg_t addr, bool supervisor, access_type type)
   if (masked_msbs != 0 && masked_msbs != mask)
     return -1;
 
-  reg_t base = proc->get_state()->sptbr;
+  reg_t base = proc->get_state()->sptbr << PGSHIFT;
   int ptshift = (levels - 1) * ptidxbits;
   for (int i = 0; i < levels; i++, ptshift -= ptidxbits) {
     reg_t idx = (addr >> (PGSHIFT + ptshift)) & ((1 << ptidxbits) - 1);

riscv/processor.cc

@@ -372,7 +372,7 @@ void processor_t::set_csr(int which, reg_t val)
     }
     case CSR_SEPC: state.sepc = val; break;
     case CSR_STVEC: state.stvec = val >> 2 << 2; break;
-    case CSR_SPTBR: state.sptbr = val & -PGSIZE; break;
+    case CSR_SPTBR: state.sptbr = val; break;
     case CSR_SSCRATCH: state.sscratch = val; break;
     case CSR_SCAUSE: state.scause = val; break;
     case CSR_SBADADDR: state.sbadaddr = val; break;