Risc-V emulator U-Mode not running - riscv

Question

I'm implementing a Risc-V emulator, and I'm not able to run U-Mode instructions.
It has MMU SV32, CSR, PLIC, CLINT and VirtIO (disk and console).
I'm studying a lot to do it working, but I'm alone and having the error...
[ 1.943313] virtio_blk virtio1: 1/0/0 default/read/poll queues
[ 1.973432] virtio_blk virtio1: [vda] 20480 512-byte logical blocks (10.5 MB/10.0 MiB)
[ 2.030908] cpuidle-riscv-sbi: HSM suspend not available
[ 2.115550] EXT4-fs (vda): mounting ext2 file system using the ext4 subsystem
[ 2.204245] EXT4-fs (vda): mounted filesystem without journal. Quota mode: disabled.
[ 2.207929] VFS: Mounted root (ext2 filesystem) readonly on device 254:0.
[ 2.215999] devtmpfs: mounted
[ 2.224530] Freeing unused kernel image (initmem) memory: 96K
[ 2.226806] Kernel memory protection not selected by kernel config.
[ 2.229195] Run /sbin/init as init process
[ 2.230880] with arguments:
[ 2.232339] /sbin/init
[ 2.233718] with environment:
[ 2.235212] HOME=/
[ 2.236554] TERM=linux
[ 2.277966] Starting init: /sbin/init exists but couldn't execute it (error -13)
[ 2.280540] Run /etc/init as init process
[ 2.282216] with arguments:
[ 2.283675] /etc/init
[ 2.285044] with environment:
[ 2.286537] HOME=/
[ 2.287879] TERM=linux
[ 2.296848] Run /bin/init as init process
[ 2.298523] with arguments:
[ 2.299983] /bin/init
[ 2.301351] with environment:
[ 2.302845] HOME=/
[ 2.304187] TERM=linux
[ 2.313239] Run /bin/sh as init process
[ 2.314888] with arguments:
[ 2.316347] /bin/sh
[ 2.317690] with environment:
[ 2.319184] HOME=/
[ 2.320526] TERM=linux
[ 2.425304] sh[1]: unhandled signal 11 code 0x1 at 0x00000004 in ld-linux-riscv32-ilp32d.so.1[95b60000+21000]
[ 2.430274] CPU: 0 PID: 1 Comm: sh Not tainted 5.19.9 #1
[ 2.432913] Hardware name: ucbbar,riscvemu-bare (DT)
[ 2.434846] epc : 95b615e8 ra : 95b608d8 sp : 9d86bea0
[ 2.437381] gp : c023cb00 tp : 00000000 t0 : 00000000
[ 2.439729] t1 : 00000000 t2 : 00000000 s0 : 9d86bef0
[ 2.442077] s1 : 00000000 a0 : 9d86bef0 a1 : 00000000
[ 2.444424] a2 : 00000000 a3 : 00000000 a4 : 00000000
[ 2.446666] a5 : 00000000 a6 : 00000000 a7 : 00000000
[ 2.448909] s2 : 00000000 s3 : 00000000 s4 : 00000000
[ 2.451171] s5 : 00000000 s6 : 00000000 s7 : 95b83040
[ 2.453519] s8 : 95b60000 s9 : 00000000 s10: 00000000
[ 2.455844] s11: 00000000 t3 : 00000000 t4 : 00000000
[ 2.458086] t5 : 00000000 t6 : 00000000
[ 2.459911] status: 00004020 badaddr: 00000004 cause: 0000000d
[ 2.463676] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[ 2.466374] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---
void cpu_take_trap(const uint32_t cause, const uint32_t tval){
if(cpu.privilege <= SUPERVISOR
&& (((cause & (1 << 31)) && ((csr.mideleg >> (cause & 0x7FFFFFFF)) & 1)) || ((~cause & (1 << 31)) && ((csr.medeleg >> cause) & 1))) ) {
// printf("cpu_take_trap %d\n", cause & ~(1 << 31));
csr.sepc= cpu.pc;
if(cause & (1 << 31)){
/*This bit is set when the exception was triggered by an interrupt.*/
uint32_t vectored= csr.stvec & 3 ? (cause << 2) : 0;
cpu.pc= (csr.stvec & ~3) + vectored;
} else cpu.pc= csr.stvec & ~3;
csr.stval= tval;
csr.scause= cause;
csr.sstatus &= ~(1 << 5 /*SPIE*/); // clear SPIE
csr.sstatus |= ((csr.sstatus >> cpu.privilege) & 1) << 5; // copies SIE into SPIE
csr.sstatus &= ~(1 << cpu.privilege /*SIE*/); // clear SIE
csr.sstatus &= ~(1 << 8 /*SPP*/); // clear SPP
csr.sstatus |= (cpu.privilege << 8 /*SPP*/); // copies current privilege into SPP
cpu.privilege= SUPERVISOR;
} else {
csr.mepc= cpu.pc;
if(cause & (1 << 31)){
/*This bit is set when the exception was triggered by an interrupt.*/
uint32_t vectored= csr.mtvec & 1 ? (cause << 2) : 0;
cpu.pc= (csr.mtvec & ~3) + vectored;
} else cpu.pc= csr.mtvec & ~3;
csr.mtval= tval;
csr.mcause= cause;
csr.mstatus &= ~(1 << 7 /*MPIE*/); // clear MPIE
csr.mstatus |= ((csr.mstatus >> cpu.privilege) & 1) << 7; // copies MIE into MPIE
csr.mstatus &= ~(1 << cpu.privilege /*MIE*/); // clear MIE
csr.mstatus &= ~(3 << 11 /*MPP*/); // clear MPP
csr.mstatus |= (cpu.privilege << 11 /*MPP*/); // copies current privilege into MPP
cpu.privilege= MACHINE;
}
}