diff --git a/lib/sbi/sbi_emulate_csr.c b/lib/sbi/sbi_emulate_csr.c
index 869c81f4..3adec78d 100644
--- a/lib/sbi/sbi_emulate_csr.c
+++ b/lib/sbi/sbi_emulate_csr.c
@@ -66,12 +66,11 @@ int sbi_emulate_csr_read(int csr_num, struct sbi_trap_regs *regs,
 		*csr_val = csr_read(CSR_MCYCLE);
 		break;
 	case CSR_TIME:
+		if (!hpm_allowed(csr_num - CSR_CYCLE, prev_mode, virt))
+			return SBI_ENOTSUPP;
 		/*
 		 * We emulate TIME CSR for both Host (HS/U-mode) and
 		 * Guest (VS/VU-mode).
-		 *
-		 * Faster TIME CSR reads are critical for good performance
-		 * in S-mode software so we don't check CSR permissions.
 		 */
 		*csr_val = (virt) ? sbi_timer_virt_value():
 				    sbi_timer_value();