diff --git a/include/cpu/difftest.h b/include/cpu/difftest.h
index 74708d56b..601e25fb7 100644
--- a/include/cpu/difftest.h
+++ b/include/cpu/difftest.h
@@ -64,7 +64,7 @@ static inline bool difftest_check_vreg(const char *name, vaddr_t pc, rtlreg_t *r
 static inline bool difftest_check_store(vaddr_t pc) {
 #ifdef CONFIG_RVV
   size_t step = store_queue_size();
-  for (int i = 0; i < step ;i ++) {
+  for (size_t i = 0; i < step ;i ++) {
 #endif
     if (store_queue_empty()) return true;
     store_commit_t dut = store_queue_fornt();
diff --git a/src/isa/riscv64/include/isa-def.h b/src/isa/riscv64/include/isa-def.h
index f59a389bb..178c06e99 100644
--- a/src/isa/riscv64/include/isa-def.h
+++ b/src/isa/riscv64/include/isa-def.h
@@ -300,7 +300,7 @@ typedef struct {
   } instr;
 } riscv64_ISADecodeInfo;
 
-enum { MODE_U = 0, MODE_S, MODE_HS, MODE_M };
+enum { MODE_U = 0, MODE_S, MODE_RESERVED, MODE_M };
 
 int get_data_mmu_state();
 #ifdef CONFIG_RVH
diff --git a/src/isa/riscv64/system/priv.c b/src/isa/riscv64/system/priv.c
index 3c385b6b5..90099b372 100644
--- a/src/isa/riscv64/system/priv.c
+++ b/src/isa/riscv64/system/priv.c
@@ -192,6 +192,10 @@ static inline word_t* csr_decode(uint32_t addr) {
 // base mstatus wmask
 #define MSTATUS_WMASK_BASE (0x7e19aaUL)
 
+// mstatus.mpp mask
+#define MSTATUS_OFFSET_MPP 11
+#define MSTATUS_MASK_MPP (0x3UL << MSTATUS_OFFSET_MPP)
+
 // FS
 #if !defined(CONFIG_FPU_NONE) || defined(CONFIG_RV_MSTATUS_FS_WRITABLE)
 #define MSTATUS_WMASK_FS (0x3UL << 13)
@@ -1326,6 +1330,10 @@ static inline void csr_write(word_t *dest, word_t src) {
       }
     }
   #endif //CONFIG_RV_SSDBLTRP
+    // mstatus.MPP cannot hold 2
+    if (((mstatus_t *) &src)->mpp == MODE_RESERVED) {
+      mstatus_wmask &= ~MSTATUS_MASK_MPP;
+    }
     mstatus->val = mask_bitset(mstatus->val, mstatus_wmask, src);
     update_mmu_state(); // maybe this write update mprv, mpp or mpv
   #ifdef CONFIG_RV_SMDBLTRP
@@ -1355,7 +1363,7 @@ static inline void csr_write(word_t *dest, word_t src) {
     // by writing that mode to MPP then reading it back. If the machine
     // provides only U and M modes, then only a single hardware storage bit
     // is required to represent either 00 or 11 in MPP.
-    if (mstatus->mpp == MODE_HS) {
+    if (mstatus->mpp == MODE_RESERVED) {
       // MODE_H is not implemented. The write will not take effect.
       mstatus->mpp = prev_mpp;
     }