scounteren's effect on VU-mode is unclear.  VU-mode accesses to HPMn do not necessarily have "insufficient privilege" since hpmcountern is listed in table 2.2 as requiring user privilege.  Is scounteren considered a hypervisor CSR for purposes of determining whether an HS-qualified access raises a virtual instruction exception?  It is not listed under "Hypervisor and Virtual Supervisor CSRs" so I would assume not.

If scounteren is not a hypervisor CSR then a VU-mode access to HPMn when mcounteren[n]=1, hcounteren[n]=1, scounteren[n]=0 has underspecified behavior (since scounteren is defined to only cause exceptions in U-mode and, although we know from 5.2.5 that the counter is not readable in VU-mode, there is no description of what happens on an access to this unreadable counter).  If it is a hypervisor CSR then such an access should take a virtual instruction exception.  Yet access to the (user) hpmcountern CSR is not listed in any of the virtual instruction exception cases in the 5.6.1 bullet list.  It seems like it ought to be considered a hypervisor CSR but that should be made clear in the spec.

Also, the behavior of reads of HPMn in VS-mode/VU-mode when mcounteren[n]=0 and hcounteren[n]=1 is not completely clear in the hcounteren text.  The definition of mcounteren says that it causes an illegal instruction exception only for accesses in S-mode and U-mode.  The definition of hcounteren says that accesses in VS/VU-mode cause a virtual instruction exception "if the same bit in mcounteren is 1" but doesn't directly address what happens when mcounteren is 0.  Because a VS/VU-mode access to HPMn when mcounteren[n]=0 is not HS-qualified, it must take a virtual instruction exception (rendering "if the same bit in mcounteren is 1" unnecessary and potentially confusing).  The first bullet in 5.6.1 says that this case raises a virtual instruction exception.  I think that it would be helpful to state this directly in the hcounteren text, not just in the virtual instruction exception bullet list.

It would be simpler if there were a table of m/h/scounteren values and how they affect accesses in each mode.

Thanks,

-Paul