diff --git a/arch/csr/H/hgeie.yaml b/arch/csr/H/hgeie.yaml
new file mode 100644
index 000000000..e2ee89ee2
--- /dev/null
+++ b/arch/csr/H/hgeie.yaml
@@ -0,0 +1,68 @@
+# yaml-language-server: $schema=../../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: hgeie
+long_name: Hypervisor Guest External Interrupt Enable Register
+description:
+  - id: csr-hgeie-purpose
+    normative: true
+    text: |
+      The hgeie register is an HSXLEN-bit read/write register that contains enable bits for the guest external interrupts at this hart.
+  - id: csr-hgeie-bits
+    normative: true
+    text: Guest external interrupt number i corresponds with bit i in hgeie.
+  - id: csr-hgeie-interrupts
+    normative: true
+    text: |
+      Guest external interrupts represent interrupts directed to individual virtual machines
+      at VS-level.
+      If a RISC-V platform supports placing a physical device under the direct control of a
+      guest OS with minimal hypervisor intervention (known as pass-through or direct assignment
+      between a virtual machine and the physical device), then, in such circumstance,
+      interrupts from the device are intended for a specific virtual machine.
+  - id: csr-hgeie-controller-req
+    normative: false
+    text: |
+      Support for guest external interrupts requires an interrupt controller that can collect
+      virtual-machine-directed interrupts separately from other interrupts.
+  - id: csr-hgeie-geilen
+    normative: true
+    text: |
+      The number of bits implemented in hgeie for guest external interrupts is UNSPECIFIED and
+      may be zero.
+      This number is known as `GEILEN`.
+  - id: csr-hgeie-bitorder
+    normative: true
+    text: |
+      The least-significant bits are implemented first, apart from bit 0.
+  - id: csr-hgeie-nonzero-geilen
+    normative: true
+    text: |
+      Hence, if GEILEN is nonzero, bits `GEILEN`:1 shall be writable in hgeie, and all other
+      bit positions shall be read-only zeros.
+  - id: csr-hgeie-select
+    normative: true
+    text: |
+      Register hgeie selects the subset of guest external interrupts that cause a
+      supervisor-level (HS-level) guest external interrupt.
+  - id: csr-hgeie-hgeip
+    normative: true
+    text: |
+      The enable bits in hgeie do not affect the VS-level external interrupt signal selected
+      from hgeip by hstatus.VGEIN.address: 0x607
+priv_mode: S
+definedBy: H
+length: SXLEN
+fields:
+  GEI_ENABLE:
+    long_name: Guest external interrupt enable bits
+    location_rv32: 31-1
+    location_rv64: 63-1
+    type(): |
+      return NUM_EXTERNAL_GUEST_INTERRUPTS > 0 ? CsrFieldType::RW : CsrFieldType::RO;
+    reset_value: UNDEFINED_LEGAL
+    sw_write(csr_value): |
+      return ((MXLEN'1 << NUM_EXTERNAL_GUEST_INTERRUPTS) - 1) & csr_value.GEI_ENABLE;
+    description: |
+      Enable bits; see description of hgeie
diff --git a/arch/csr/H/hgeip.yaml b/arch/csr/H/hgeip.yaml
new file mode 100644
index 000000000..25d77a6ca
--- /dev/null
+++ b/arch/csr/H/hgeip.yaml
@@ -0,0 +1,59 @@
+# yaml-language-server: $schema=../../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: hgeip
+long_name: Hypervisor Guest External Interrupt Pending Register
+description:
+  - id: csr-hgeip-purpose
+    normative: true
+    text: |
+      The hgeip register is an HSXLEN-bit read-only register that indicates pending guest external interrupts for this hart.
+
+  - id: csr-hgeip-interrupts
+    normative: true
+    text: |
+      Guest external interrupts represent interrupts directed to individual virtual machines at VS-level.
+
+  - id: csr-hgeip-pass-through
+    normative: true
+    text: |
+      If a RISC-V platform supports placing a physical device under the direct control of a guest OS with minimal hypervisor intervention (known as pass-through or direct assignment between a virtual machine and the physical device), then, in such circumstance, interrupts from the device are intended for a specific virtual machine.
+
+  - id: csr-hgeip-summary
+    normative: true
+    text: |
+      Each bit of hgeip summarizes all pending interrupts directed to one virtual hart, as collected and reported by an interrupt controller.
+
+  - id: csr-hgeip-controller-query
+    normative: true
+    text: |
+      To distinguish specific pending interrupts from multiple devices, software must query the interrupt controller.
+
+  - id: csr-hgeip-geilen
+    normative: true
+    text: |
+      The number of bits implemented in hgeip and hgeie for guest external interrupts is UNSPECIFIED and may be zero. This number is known as `GEILEN`.
+
+  - id: csr-hgeip-bitorder
+    normative: true
+    text: |
+      The least-significant bits are implemented first, apart from bit 0.
+
+  - id: csr-hgeip-readonly-bits
+    normative: true
+    text: |
+      Hence, if GEILEN is nonzero, bits `GEILEN`:1 shall be writable in hgeie, and all other bit positions shall be read-only zeros in both hgeip and hgeie.
+address: 0xE12
+priv_mode: S
+definedBy: H
+length: SXLEN
+fields:
+  GEI_PENDING:
+    long_name: Guest External Interrupts Pending
+    location_rv32: 31-1
+    location_rv64: 63-1
+    type: RO
+    reset_value: UNDEFINED_LEGAL
+    description: |
+      Pending bits; see description of hgeip
diff --git a/arch/csr/H/hideleg.yaml b/arch/csr/H/hideleg.yaml
new file mode 100644
index 000000000..88b8bb8f7
--- /dev/null
+++ b/arch/csr/H/hideleg.yaml
@@ -0,0 +1,89 @@
+# yaml-language-server: $schema=../../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: hideleg
+long_name: Hypervisor Interrupt Delegation Register
+description:
+  - id: csr-hideleg-purpose
+    normative: true
+    text: |
+      Register hideleg is an HSXLEN-bit read/write register. By default, all traps at any privilege level are handled in M-mode, though M-mode usually uses the medeleg and mideleg CSRs to delegate some traps to HS-mode.
+
+  - id: csr-hideleg-delegation-to-vs
+    normative: true
+    text: |
+      The hedeleg and hideleg CSRs allow these traps to be further delegated to a VS-mode guest; their layout is the same as medeleg and mideleg.
+
+  - id: csr-hideleg-interrupt-forwarding
+    normative: true
+    text: |
+      An interrupt that has been delegated to HS-mode (using mideleg) is further delegated to VS-mode if the corresponding hideleg bit is set.
+
+  - id: csr-hideleg-bit-accessibility
+    normative: true
+    text: |
+      Among bits 15:0 of hideleg, bits 10, 6, and 2 (corresponding to the standard VS-level interrupts) are writable, and bits 12, 9, 5, and 1 (corresponding to the standard S-level interrupts) are read-only zeros.
+address: 0x603
+priv_mode: S
+definedBy: H
+length: SXLEN
+fields:
+  SSI:
+    location: 1
+    type: RO
+    reset_value: 0
+    long_name: Supervisor Software Interrupt
+    description: Supervisor Software Interrupt
+
+  VSSI:
+    location: 2
+    type: RW
+    reset_value: UNDEFINED_LEGAL
+    long_name: Virtual Supervisor Software Interrupt
+    description: Delegates the Virtual Supervisor Software Interrupt to VS-mode
+
+  STI:
+    location: 5
+    type: RO
+    reset_value: 0
+    long_name: Supervisor Timer Interrupt
+    description: Supervisor Timer Interrupt
+
+  VSTI:
+    location: 6
+    type: RW
+    reset_value: UNDEFINED_LEGAL
+    long_name: Virtual Supervisor Timer Interrupt
+    description: Delegates the Virtual Supervisor Timer Interrupt to VS-mode
+
+  SEI:
+    location: 9
+    type: RO
+    reset_value: 0
+    long_name: Supervisor External Interrupt
+    description: Supervisor External Interrupt
+
+  VSEI:
+    location: 10
+    type: RW
+    reset_value: UNDEFINED_LEGAL
+    long_name: Virtual Supervisor External Interrupt
+    description: Delegates the Virtual Supervisor External Interrupt to VS-mode
+
+  SGEI:
+    location: 12
+    type: RW
+    reset_value: 0
+    long_name: Supervisor Guest External Interrupt
+    description: Supervisor Guest External Interrupt
+
+  LCOFI:
+    location: 13
+    definedBy: Sscofpmf
+    long_name: Local Counter Overflow Interrupt
+    description: Delegate Local Counter Overflow Interrupts to VS-mode.
+    type(): |
+      return HIDELEG_LCOFI_MUTABLE ? CsrFieldType::RW : CsrFieldType::RO;
+    reset_value(): |
+      return HIDELEG_LCOFI_MUTABLE ? UNDEFINED_LEGAL : 0;
diff --git a/arch/csr/H/hie.yaml b/arch/csr/H/hie.yaml
new file mode 100644
index 000000000..cc594f257
--- /dev/null
+++ b/arch/csr/H/hie.yaml
@@ -0,0 +1,60 @@
+# yaml-language-server: $schema=../../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: hie
+long_name: Hypervisor Interrupt Enable Register
+description:
+  - id: csr-hie-purpose
+    normative: true
+    text: |
+      The `hie` register is a read/write register in HS-mode that enables interrupts.
+      It corresponds to the enable bits for VS-level and hypervisor-specific interrupts, and supplements
+      the HS-level `sie` register.
+address: 0x604
+priv_mode: S
+definedBy: H
+length: SXLEN
+fields:
+  SGEIE:
+    location: 12
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    description: |
+      Hypervisor guest external interrupt enable bit. When set, allows external interrupts to be delivered
+      to VS-mode based on the `hgeie` setting.
+
+  VSEIE:
+    location: 10
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    description: |
+      VS-level external interrupt enable bit. When set, allows external interrupts directed to VS-level
+      to be processed based on the configuration in `hvip` and other platform-specific sources.
+
+  VSTIE:
+    location: 6
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    description: |
+      VS-level timer interrupt enable bit. When set, allows VS-level timer interrupts to be processed
+      based on the `hvip` configuration and any platform-specific timer interrupts.
+
+  VSSIE:
+    location: 2
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    description: |
+      VS-level software interrupt enable bit. When set, allows software interrupts directed to VS-level
+      to be processed, based on the configuration in `hvip`.
+
+  LCOFIE:
+    location: 13
+    definedBy: Sscofpmf
+    long_name: Local Counter Overflow Interrupt Enable
+    description: |
+      Enable Local Counter Overflow Interrupts in VS-mode.
+    type(): |
+      return HIE_LCOFIE_MUTABLE ? CsrFieldType::RW : CsrFieldType::RO;
+    reset_value(): |
+      return HIE_LCOFIE_MUTABLE ? UNDEFINED_LEGAL : 0;
diff --git a/arch/csr/H/hip.yaml b/arch/csr/H/hip.yaml
new file mode 100644
index 000000000..83ee74125
--- /dev/null
+++ b/arch/csr/H/hip.yaml
@@ -0,0 +1,61 @@
+# yaml-language-server: $schema=../../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: hip
+long_name: Hypervisor Interrupt Pending Register
+description:
+  - id: csr-hip-purpose
+    normative: true
+    text: |
+      The `hip` register is an HSXLEN-bit read/write register that indicates pending interrupts at the hypervisor level.
+      It contains interrupt-pending bits for both VS-level and hypervisor-specific interrupts.
+address: 0x608
+priv_mode: S
+definedBy: H
+length: SXLEN
+fields:
+  SGEIP:
+    location: 12
+    type: RO
+    reset_value: 0
+    description: |
+      Pending interrupt bit for supervisor guest external interrupts (SGEI).
+      This bit is 1 if and only if the logical AND of `hgeip` and `hgeie` is nonzero.
+
+  VSEIP:
+    location: 10
+    type: RO
+    reset_value: 0
+    description: |
+      Pending interrupt bit for VS-level external interrupts (VSEI).
+      This bit is the logical OR of `vseip` from `hvip`, the interrupt from `hgeip` selected by `hstatus.VGEIN`,
+      and any other external interrupt signal directed to VS-level.
+
+  VSTIP:
+    location: 6
+    type: RO-H
+    reset_value: 0
+    description: |
+      Pending interrupt bit for VS-level timer interrupts (VSTI).
+      This bit is the logical OR of `vstip` from `hvip` and any other timer interrupt directed to VS-level.
+
+  VSSIP:
+    location: 2
+    alias: hvip.VSSIP
+    sw_write(csr_value): CSR[hvip].VSSIP = csr_value.VSSIP;
+    type: RW
+    reset_value: 0
+    description: |
+      Pending interrupt bit for VS-level software interrupts (VSSI).
+      This bit is an alias of the `vssip` bit in `hvip`.
+
+  LCOFI:
+    location: 13
+    definedBy: Sscofpmf
+    long_name: Local Counter Overflow Interrupt
+    description: Delegate Local Counter Overflow Interrupts to VS-mode.
+    type(): |
+      return HIDELEG_LCOFI_MUTABLE ? CsrFieldType::RW : CsrFieldType::RO;
+    reset_value(): |
+      return HIDELEG_LCOFI_MUTABLE ? UNDEFINED_LEGAL : 0;
diff --git a/arch/csr/H/hvip.yaml b/arch/csr/H/hvip.yaml
new file mode 100644
index 000000000..6965f8d9e
--- /dev/null
+++ b/arch/csr/H/hvip.yaml
@@ -0,0 +1,40 @@
+# yaml-language-server: $schema=../../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: hvip
+long_name: Hypervisor Virtual Interrupt Pending Register
+description:
+  - id: csr-hvip-purpose
+    normative: true
+    text: |
+      The `hvip` register is an HSXLEN-bit read/write register that a hypervisor can write to indicate virtual interrupts intended for VS-mode.
+      It contains interrupt-pending bits for virtual interrupts such as VS-level external interrupts, timer interrupts, and software interrupts.
+address: 0x645
+priv_mode: S
+definedBy: H
+length: SXLEN
+fields:
+  VSEIP:
+    location: 10
+    type: RW
+    reset_value: 0
+    description: |
+      Pending interrupt bit for VS-level external interrupts. This bit is writable and
+      is set to 1 to assert a VS-level external interrupt.
+
+  VSTIP:
+    location: 6
+    type: RW
+    reset_value: 0
+    description: |
+      Pending interrupt bit for VS-level timer interrupts. This bit is writable and
+      is set to 1 to assert a VS-level timer interrupt.
+
+  VSSIP:
+    location: 2
+    type: RW
+    reset_value: 0
+    description: |
+      Pending interrupt bit for VS-level software interrupts. This bit is writable and
+      is set to 1 to assert a VS-level software interrupt.
diff --git a/arch/csr/H/vsie.yaml b/arch/csr/H/vsie.yaml
new file mode 100644
index 000000000..ee9d8d594
--- /dev/null
+++ b/arch/csr/H/vsie.yaml
@@ -0,0 +1,104 @@
+# yaml-language-server: $schema=../../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: vsie
+address: 0x204
+virtual_address: 0x144
+long_name: Virtual Supervisor Interrupt Enable
+description:
+  - id: csr-vsie-purpose
+    normative: true
+    text: |
+      The vsie register is a VSXLEN-bit read/write register that is VS-mode’s version of
+      supervisor CSR sie. When V=1, vsie substitutes for the usual sie, so instructions that
+      normally read or modify sie actually access vsie instead. However, interrupts directed to
+      HS-level continue to be indicated in the HS-level sip register, not in vsip, when V=1.
+
+  - id: csr-vsie-lcofie-aliasing
+    normative: true
+    text: |
+      When bit 13 of hideleg is zero, vsie.LCOFIE is read-only zero. Else, vsie.LCOFIE is an alias of sie.LCOFIE.
+
+  - id: csr-vsie-seie-aliasing
+    normative: true
+    text: |
+      When bit 10 of hideleg is zero, vsie.SEIE is read-only zero. Else, vsie.SEIE is an alias of hie.VSEIE.
+
+  - id: csr-vsie-stie-aliasing
+    normative: true
+    text: |
+      When bit 6 of hideleg is zero, vsie.STIE is read-only zero. Else, vsie.STIE is an alias of hie.VSTIE.
+
+  - id: csr-vsie-ssie-aliasing
+    normative: true
+    text: |
+      When bit 2 of hideleg is zero, vsie.SSIE is read-only zero. Else, vsie.SSIE is an alias of hie.VSSIE.
+priv_mode: VS
+definedBy: H
+length: VSXLEN
+
+sw_read(): |
+  Bits<64> value = 0;
+  if (CSR[hideleg][2]) {
+      value |= (CSR[hie].VSSIE[0] << 1);
+  }
+  if (CSR[hideleg][6]) {
+      value |= (CSR[hie].VSTIE[0] << 5);
+  }
+  if (CSR[hideleg][10]) {
+      value |= (CSR[hie].VSEIE[0] << 9);
+  }
+  if (CSR[hideleg][13]) {
+      value |= (CSR[sie].LCOFIE[0] << 13);
+  }
+  return value;
+
+fields:
+  SSIE:
+    location: 1
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    alias: hie.VSSIE[0]
+    description: |
+      SSIE. Read-only zero when hideleg[2] is 0. Else, alias of hie.VSSIE.
+    sw_write(csr_value): |
+      if (CSR[hideleg][2]) {
+          CSR[hie].VSSIE[0] = (csr_value >> 1) & 1;
+      }
+
+  STIE:
+    location: 5
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    alias: hie.VSTIE[0]
+    description: |
+      STIE. Read-only zero when hideleg[6] is 0. Else, alias of hie.VSTIE.
+    sw_write(csr_value): |
+      if (CSR[hideleg][6]) {
+          CSR[hie].VSTIE[0] = (csr_value >> 5) & 1;
+      }
+
+  SEIE:
+    location: 9
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    alias: hie.VSEIE[0]
+    description: |
+      SEIE. Read-only zero when hideleg[10] is 0. Else, alias of hie.VSEIE.
+    sw_write(csr_value): |
+      if (CSR[hideleg][10]) {
+          CSR[hie].VSEIE[0] = (csr_value >> 9) & 1;
+      }
+
+  LCOFIE:
+    location: 13
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    alias: sie.LCOFIE[0]
+    description: |
+      LCOFIE. Read-only zero when hideleg[13] is 0. Else, alias of sie.LCOFIE.
+    sw_write(csr_value): |
+      if (CSR[hideleg][13]) {
+          CSR[sie].LCOFIE[0] = (csr_value >> 13) & 1;
+      }
diff --git a/arch/csr/H/vsip.yaml b/arch/csr/H/vsip.yaml
new file mode 100644
index 000000000..d13165d4e
--- /dev/null
+++ b/arch/csr/H/vsip.yaml
@@ -0,0 +1,101 @@
+# yaml-language-server: $schema=../../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: vsip
+address: 0x244
+virtual_address: 0x144
+long_name: Virtual Supervisor Interrupt Pending
+description:
+  - id: csr-vsip-purpose
+    normative: true
+    text: |
+      The `vsip` register is a VSXLEN-bit read/write register that is VS-mode’s version of the `sip` CSR.
+      When V=1, instructions that normally access `sip` instead access `vsip`. It holds the pending
+      interrupt status for supervisor-level traps in a virtualized environment.
+
+  - id: csr-vsip-hs-level-interrupts
+    normative: true
+    text: |
+      However, interrupts directed to HS-level continue to be indicated in the HS-level `sip` register,
+      not in `vsip`, when V=1.
+
+  - id: csr-vsip-standard-bits
+    normative: true
+    text: |
+      The standard portion (bits 15:0) includes individual interrupt-pending bits.
+priv_mode: VS
+definedBy: H
+length: VSXLEN
+sw_read(): |
+  val = 0;
+  if (CSR[hideleg].S == 1) {
+    val |= (CSR[hip].VSSIP[0] << 1);
+  }
+  if (CSR[hideleg].ST == 1) {
+    val |= (CSR[hip].VSTIP[0] << 5);
+  }
+  if (CSR[hideleg].SE == 1) {
+    val |= (CSR[hip].VSEIP[0] << 9);
+  }
+  if (CSR[hideleg].LCOF == 1) {
+    val |= (CSR[sip].LCOFIP[0] << 13);
+  }
+  return val;
+
+fields:
+  SSIP:
+    location: 1
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    alias: hip.VSSIP[0]
+    description: |
+      *Supervisor Software Interrupt Pending*
+      Indicates a pending software interrupt at the supervisor level.
+      Read-only zero when `hideleg[2] == 0`, else aliased to `hip.VSSIP[0]`.
+    sw_write(csr_value): |
+      if (CSR[hideleg].S == 1) {
+        CSR[hip].VSSIP[0] = (csr_value >> 1) & ((1 << NUM_VSSI) - 1);
+      }
+
+  STIP:
+    location: 5
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    alias: hip.VSTIP[0]
+    description: |
+      *Supervisor Timer Interrupt Pending*
+      Indicates a pending timer interrupt at the supervisor level.
+      Read-only zero when `hideleg[6] == 0`, else aliased to `hip.VSTIP[0]`.
+    sw_write(csr_value): |
+      if (CSR[hideleg].ST == 1) {
+        CSR[hip].VSTIP[0] = (csr_value >> 5) & ((1 << NUM_VSTI) - 1);
+      }
+
+  SEIP:
+    location: 9
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    alias: hip.VSEIP[0]
+    description: |
+      *Supervisor External Interrupt Pending*
+      Indicates a pending external interrupt at the supervisor level.
+      Read-only zero when `hideleg[10] == 0`, else aliased to `hip.VSEIP[0]`.
+    sw_write(csr_value): |
+      if (CSR[hideleg].SE == 1) {
+        CSR[hip].VSEIP[0] = (csr_value >> 9) & ((1 << NUM_VSEI) - 1);
+      }
+
+  LCOFIP:
+    location: 13
+    type: RW-H
+    reset_value: UNDEFINED_LEGAL
+    alias: sip.LCOFIP[0]
+    description: |
+      *Local Counter Overflow Interrupt Pending*
+      Indicates an overflow of a local counter.
+      Read-only zero when `hideleg[13] == 0`, else aliased to `sip.LCOFIP[0]`.
+    sw_write(csr_value): |
+      if (CSR[hideleg].LCOF == 1) {
+        CSR[sip].LCOFIP[0] = (csr_value >> 13) & 0x1;
+      }
diff --git a/arch/csr/H/vsscratch.yaml b/arch/csr/H/vsscratch.yaml
new file mode 100644
index 000000000..3a278e2bb
--- /dev/null
+++ b/arch/csr/H/vsscratch.yaml
@@ -0,0 +1,31 @@
+# yaml-language-server: $schema=../../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: vsscratch
+address: 0x240
+virtual_address: 0x140
+long_name: Virtual Supervisor Scratch Register
+description:
+  - id: csr-vsscratch-purpose
+    normative: true
+    text: |
+      The vsscratch register is a VSXLEN-bit read/write register that is VS-mode’s version of
+      supervisor register sscratch. When V=1, vsscratch substitutes for the usual sscratch,
+      so instructions that normally read or modify sscratch actually access vsscratch instead.
+
+  - id: csr-vsscratch-effect
+    normative: true
+    text: |
+      The contents of vsscratch never directly affect the behavior of the machine.
+priv_mode: VS
+length: VSXLEN
+definedBy: H
+fields:
+  SCRATCH:
+    type: RW
+    reset_value: 0
+    location_rv32: 31-0
+    location_rv64: 63-0
+    description: |
+      Virtual supervisor scratch register.
diff --git a/arch/csr/stimecmp.yaml b/arch/csr/stimecmp.yaml
new file mode 100644
index 000000000..9bf96014f
--- /dev/null
+++ b/arch/csr/stimecmp.yaml
@@ -0,0 +1,58 @@
+# yaml-language-server: $schema=../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: stimecmp
+long_name: Supervisor Timer Compare Register
+virtual_address: 0x14D
+address: 0x14D
+priv_mode: S
+definedBy: Sstc
+length: 64
+
+description:
+  - id: csr-stimecmp-purpose
+    normative: true
+    text: |
+      The stimecmp CSR is a 64-bit register and provides 64-bit precision on all RV32 and RV64 systems.
+      On RV32, accesses to the stimecmp CSR access the low 32 bits, while accesses to the stimecmph CSR
+      access the high 32 bits of stimecmp.
+      The CSR numbers for stimecmp and stimecmph are 0x14D and 0x15D, respectively, within the Supervisor Trap Setup block.
+
+  - id: csr-stimecmp-interrupt
+    normative: true
+    text: |
+      A supervisor timer interrupt becomes pending, as reflected in the STIP bit in the mip and sip registers,
+      whenever the time register contains a value greater than or equal to stimecmp, treating the values as unsigned integers.
+      If the result of this comparison changes, it is guaranteed to be reflected in STIP eventually,
+      but not necessarily immediately.
+      The interrupt remains posted until stimecmp becomes greater than time, typically due to writing a new value to stimecmp.
+      The interrupt is taken based on standard interrupt enable and delegation rules.
+
+  - id: csr-stimecmp-spurious
+    normative: false
+    text: |
+      A spurious timer interrupt might occur if an interrupt handler advances stimecmp and immediately returns,
+      because STIP might not yet have fallen. All software should be written to account for this possibility,
+      although it is generally rare. It is usually more efficient to tolerate occasional spurious timer interrupts
+      than to poll STIP until it clears.
+
+  - id: csr-stimecmp-sbi
+    normative: false
+    text: |
+      In systems where a Supervisor Execution Environment (SEE) provides timer services via an SBI call,
+      the SBI will continue to support scheduling timer interrupts. The SEE updates stimecmp as needed.
+      This ensures compatibility with existing S-mode software, while newer software can interact with stimecmp directly.
+
+fields:
+  STIMECMP:
+    long_name: Supervisor timer compare value
+    location_rv32: 31-0
+    location_rv64: 63-0
+    type: RW
+    reset_value: 0
+    sw_write(csr_value): |
+      return csr_value.STIMECMP;
+    description: |
+      The value in stimecmp is compared against the current value of the time CSR.
+      If time is greater than or equal to stimecmp, a supervisor timer interrupt (STIP) is posted.
diff --git a/arch/csr/vstimecmp.yaml b/arch/csr/vstimecmp.yaml
new file mode 100644
index 000000000..4383ccb87
--- /dev/null
+++ b/arch/csr/vstimecmp.yaml
@@ -0,0 +1,56 @@
+# yaml-language-server: $schema=../../schemas/csr_schema.json
+
+$schema: "csr_schema.json#"
+kind: csr
+name: vstimecmp
+long_name: Virtual Supervisor Timer Register
+virtual_address: 0x24D
+address: 0x24D
+priv_mode: VS
+definedBy: H
+length: SXLEN
+
+description:
+  - id: csr-vstimecmp-purpose
+    normative: true
+    text: |
+      The vstimecmp CSR is a 64-bit register and has 64-bit precision on all RV32 and RV64 systems.
+      In RV32 only, accesses to the vstimecmp CSR access the low 32 bits, while accesses to the vstimecmph CSR
+      access the high 32 bits of vstimecmp.
+
+  - id: csr-vstimecmp-csr-numbers
+    normative: true
+    text: |
+      The proposed CSR numbers for vstimecmp / vstimecmph are 0x24D / 0x25D (within the Virtual Supervisor
+      Registers block of CSRs, and mirroring the CSR numbers for stimecmp/stimecmph).
+
+  - id: csr-vstimecmp-interrupt
+    normative: true
+    text: |
+      A virtual supervisor timer interrupt becomes pending, as reflected in the VSTIP bit in the hip register,
+      whenever (time + htimedelta), truncated to 64 bits, contains a value greater than or equal to vstimecmp,
+      treating the values as unsigned integers.
+      If the result of this comparison changes, it is guaranteed to be reflected in VSTIP eventually, but not necessarily immediately.
+      The interrupt remains posted until vstimecmp becomes greater than (time + htimedelta), typically as a result of writing vstimecmp.
+      The interrupt will be taken based on the standard interrupt enable and delegation rules while V=1.
+
+  - id: csr-vstimecmp-compat
+    normative: false
+    text: |
+      In systems in which a supervisor execution environment (SEE) implemented by an
+      HS-mode hypervisor provides timer facilities via an SBI function call, this SBI call will
+      continue to support requests to schedule a timer interrupt. The SEE will simply make
+      use of vstimecmp, changing its value as appropriate. This ensures compatibility with
+      existing guest VS-mode software that uses this SEE facility, while new VS-mode
+      software takes advantage of vstimecmp directly.
+
+fields:
+  VSTIMECMP:
+    long_name: Virtual supervisor timer compare value
+    location_rv32: 31-0
+    location_rv64: 63-0
+    type: RW
+    reset_value: UNDEFINED_LEGAL
+    description: |
+      The value in vstimecmp is compared with (time + htimedelta), truncated to 64 bits,
+      to determine whether a virtual supervisor timer interrupt should be posted in VSTIP.
diff --git a/arch/ext/H.yaml b/arch/ext/H.yaml
index a2d409ee3..4fd304fa3 100644
--- a/arch/ext/H.yaml
+++ b/arch/ext/H.yaml
@@ -660,3 +660,18 @@ params:
     schema:
       type: boolean
     extra_validation: assert STVEC_MODE_DIRECT || STVEC_MODE_VECTORED
+
+  HIDELEG_LCOFI_MUTABLE:
+    schema:
+      type: boolean
+    description: When true, `hideleg`[13] is writable, and Local Counter Overflow Interrupts can be delegated to VS-mode.
+
+  HIE_LCOFIE_MUTABLE:
+    schema:
+      type: boolean
+    description: When true, `hie`[13] is writable and enables Local Counter Overflow Interrupts for VS-mode.
+
+  HIP_LCOFI_MUTABLE:
+    schema:
+      type: boolean
+    description: When true, `hip`[13] is writable, and Local Counter Overflow Interrupts can be delegated to VS-mode.