xref: /openbmc/qemu/target/riscv/cpu.c (revision 64c6e744)
1 /*
2  * QEMU RISC-V CPU
3  *
4  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
5  * Copyright (c) 2017-2018 SiFive, Inc.
6  *
7  * This program is free software; you can redistribute it and/or modify it
8  * under the terms and conditions of the GNU General Public License,
9  * version 2 or later, as published by the Free Software Foundation.
10  *
11  * This program is distributed in the hope it will be useful, but WITHOUT
12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
14  * more details.
15  *
16  * You should have received a copy of the GNU General Public License along with
17  * this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qemu/qemu-print.h"
22 #include "qemu/ctype.h"
23 #include "qemu/log.h"
24 #include "cpu.h"
25 #include "cpu_vendorid.h"
26 #include "internals.h"
27 #include "exec/exec-all.h"
28 #include "qapi/error.h"
29 #include "qapi/visitor.h"
30 #include "qemu/error-report.h"
31 #include "hw/qdev-properties.h"
32 #include "hw/core/qdev-prop-internal.h"
33 #include "migration/vmstate.h"
34 #include "fpu/softfloat-helpers.h"
35 #include "sysemu/device_tree.h"
36 #include "sysemu/kvm.h"
37 #include "sysemu/tcg.h"
38 #include "kvm/kvm_riscv.h"
39 #include "tcg/tcg-cpu.h"
40 #include "tcg/tcg.h"
41 
42 /* RISC-V CPU definitions */
43 static const char riscv_single_letter_exts[] = "IEMAFDQCBPVH";
44 const uint32_t misa_bits[] = {RVI, RVE, RVM, RVA, RVF, RVD, RVV,
45                               RVC, RVS, RVU, RVH, RVJ, RVG, RVB, 0};
46 
47 /*
48  * From vector_helper.c
49  * Note that vector data is stored in host-endian 64-bit chunks,
50  * so addressing bytes needs a host-endian fixup.
51  */
52 #if HOST_BIG_ENDIAN
53 #define BYTE(x)   ((x) ^ 7)
54 #else
55 #define BYTE(x)   (x)
56 #endif
57 
58 bool riscv_cpu_is_32bit(RISCVCPU *cpu)
59 {
60     return riscv_cpu_mxl(&cpu->env) == MXL_RV32;
61 }
62 
63 /* Hash that stores general user set numeric options */
64 static GHashTable *general_user_opts;
65 
66 static void cpu_option_add_user_setting(const char *optname, uint32_t value)
67 {
68     g_hash_table_insert(general_user_opts, (gpointer)optname,
69                         GUINT_TO_POINTER(value));
70 }
71 
72 bool riscv_cpu_option_set(const char *optname)
73 {
74     return g_hash_table_contains(general_user_opts, optname);
75 }
76 
77 #define ISA_EXT_DATA_ENTRY(_name, _min_ver, _prop) \
78     {#_name, _min_ver, CPU_CFG_OFFSET(_prop)}
79 
80 /*
81  * Here are the ordering rules of extension naming defined by RISC-V
82  * specification :
83  * 1. All extensions should be separated from other multi-letter extensions
84  *    by an underscore.
85  * 2. The first letter following the 'Z' conventionally indicates the most
86  *    closely related alphabetical extension category, IMAFDQLCBKJTPVH.
87  *    If multiple 'Z' extensions are named, they should be ordered first
88  *    by category, then alphabetically within a category.
89  * 3. Standard supervisor-level extensions (starts with 'S') should be
90  *    listed after standard unprivileged extensions.  If multiple
91  *    supervisor-level extensions are listed, they should be ordered
92  *    alphabetically.
93  * 4. Non-standard extensions (starts with 'X') must be listed after all
94  *    standard extensions. They must be separated from other multi-letter
95  *    extensions by an underscore.
96  *
97  * Single letter extensions are checked in riscv_cpu_validate_misa_priv()
98  * instead.
99  */
100 const RISCVIsaExtData isa_edata_arr[] = {
101     ISA_EXT_DATA_ENTRY(zicbom, PRIV_VERSION_1_12_0, ext_zicbom),
102     ISA_EXT_DATA_ENTRY(zicbop, PRIV_VERSION_1_12_0, ext_zicbop),
103     ISA_EXT_DATA_ENTRY(zicboz, PRIV_VERSION_1_12_0, ext_zicboz),
104     ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond),
105     ISA_EXT_DATA_ENTRY(zicntr, PRIV_VERSION_1_12_0, ext_zicntr),
106     ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_zicsr),
107     ISA_EXT_DATA_ENTRY(zifencei, PRIV_VERSION_1_10_0, ext_zifencei),
108     ISA_EXT_DATA_ENTRY(zihintntl, PRIV_VERSION_1_10_0, ext_zihintntl),
109     ISA_EXT_DATA_ENTRY(zihintpause, PRIV_VERSION_1_10_0, ext_zihintpause),
110     ISA_EXT_DATA_ENTRY(zihpm, PRIV_VERSION_1_12_0, ext_zihpm),
111     ISA_EXT_DATA_ENTRY(zmmul, PRIV_VERSION_1_12_0, ext_zmmul),
112     ISA_EXT_DATA_ENTRY(zaamo, PRIV_VERSION_1_12_0, ext_zaamo),
113     ISA_EXT_DATA_ENTRY(zacas, PRIV_VERSION_1_12_0, ext_zacas),
114     ISA_EXT_DATA_ENTRY(zalrsc, PRIV_VERSION_1_12_0, ext_zalrsc),
115     ISA_EXT_DATA_ENTRY(zawrs, PRIV_VERSION_1_12_0, ext_zawrs),
116     ISA_EXT_DATA_ENTRY(zfa, PRIV_VERSION_1_12_0, ext_zfa),
117     ISA_EXT_DATA_ENTRY(zfbfmin, PRIV_VERSION_1_12_0, ext_zfbfmin),
118     ISA_EXT_DATA_ENTRY(zfh, PRIV_VERSION_1_11_0, ext_zfh),
119     ISA_EXT_DATA_ENTRY(zfhmin, PRIV_VERSION_1_11_0, ext_zfhmin),
120     ISA_EXT_DATA_ENTRY(zfinx, PRIV_VERSION_1_12_0, ext_zfinx),
121     ISA_EXT_DATA_ENTRY(zdinx, PRIV_VERSION_1_12_0, ext_zdinx),
122     ISA_EXT_DATA_ENTRY(zca, PRIV_VERSION_1_12_0, ext_zca),
123     ISA_EXT_DATA_ENTRY(zcb, PRIV_VERSION_1_12_0, ext_zcb),
124     ISA_EXT_DATA_ENTRY(zcf, PRIV_VERSION_1_12_0, ext_zcf),
125     ISA_EXT_DATA_ENTRY(zcd, PRIV_VERSION_1_12_0, ext_zcd),
126     ISA_EXT_DATA_ENTRY(zce, PRIV_VERSION_1_12_0, ext_zce),
127     ISA_EXT_DATA_ENTRY(zcmp, PRIV_VERSION_1_12_0, ext_zcmp),
128     ISA_EXT_DATA_ENTRY(zcmt, PRIV_VERSION_1_12_0, ext_zcmt),
129     ISA_EXT_DATA_ENTRY(zba, PRIV_VERSION_1_12_0, ext_zba),
130     ISA_EXT_DATA_ENTRY(zbb, PRIV_VERSION_1_12_0, ext_zbb),
131     ISA_EXT_DATA_ENTRY(zbc, PRIV_VERSION_1_12_0, ext_zbc),
132     ISA_EXT_DATA_ENTRY(zbkb, PRIV_VERSION_1_12_0, ext_zbkb),
133     ISA_EXT_DATA_ENTRY(zbkc, PRIV_VERSION_1_12_0, ext_zbkc),
134     ISA_EXT_DATA_ENTRY(zbkx, PRIV_VERSION_1_12_0, ext_zbkx),
135     ISA_EXT_DATA_ENTRY(zbs, PRIV_VERSION_1_12_0, ext_zbs),
136     ISA_EXT_DATA_ENTRY(zk, PRIV_VERSION_1_12_0, ext_zk),
137     ISA_EXT_DATA_ENTRY(zkn, PRIV_VERSION_1_12_0, ext_zkn),
138     ISA_EXT_DATA_ENTRY(zknd, PRIV_VERSION_1_12_0, ext_zknd),
139     ISA_EXT_DATA_ENTRY(zkne, PRIV_VERSION_1_12_0, ext_zkne),
140     ISA_EXT_DATA_ENTRY(zknh, PRIV_VERSION_1_12_0, ext_zknh),
141     ISA_EXT_DATA_ENTRY(zkr, PRIV_VERSION_1_12_0, ext_zkr),
142     ISA_EXT_DATA_ENTRY(zks, PRIV_VERSION_1_12_0, ext_zks),
143     ISA_EXT_DATA_ENTRY(zksed, PRIV_VERSION_1_12_0, ext_zksed),
144     ISA_EXT_DATA_ENTRY(zksh, PRIV_VERSION_1_12_0, ext_zksh),
145     ISA_EXT_DATA_ENTRY(zkt, PRIV_VERSION_1_12_0, ext_zkt),
146     ISA_EXT_DATA_ENTRY(zvbb, PRIV_VERSION_1_12_0, ext_zvbb),
147     ISA_EXT_DATA_ENTRY(zvbc, PRIV_VERSION_1_12_0, ext_zvbc),
148     ISA_EXT_DATA_ENTRY(zve32f, PRIV_VERSION_1_10_0, ext_zve32f),
149     ISA_EXT_DATA_ENTRY(zve64f, PRIV_VERSION_1_10_0, ext_zve64f),
150     ISA_EXT_DATA_ENTRY(zve64d, PRIV_VERSION_1_10_0, ext_zve64d),
151     ISA_EXT_DATA_ENTRY(zvfbfmin, PRIV_VERSION_1_12_0, ext_zvfbfmin),
152     ISA_EXT_DATA_ENTRY(zvfbfwma, PRIV_VERSION_1_12_0, ext_zvfbfwma),
153     ISA_EXT_DATA_ENTRY(zvfh, PRIV_VERSION_1_12_0, ext_zvfh),
154     ISA_EXT_DATA_ENTRY(zvfhmin, PRIV_VERSION_1_12_0, ext_zvfhmin),
155     ISA_EXT_DATA_ENTRY(zvkb, PRIV_VERSION_1_12_0, ext_zvkb),
156     ISA_EXT_DATA_ENTRY(zvkg, PRIV_VERSION_1_12_0, ext_zvkg),
157     ISA_EXT_DATA_ENTRY(zvkn, PRIV_VERSION_1_12_0, ext_zvkn),
158     ISA_EXT_DATA_ENTRY(zvknc, PRIV_VERSION_1_12_0, ext_zvknc),
159     ISA_EXT_DATA_ENTRY(zvkned, PRIV_VERSION_1_12_0, ext_zvkned),
160     ISA_EXT_DATA_ENTRY(zvkng, PRIV_VERSION_1_12_0, ext_zvkng),
161     ISA_EXT_DATA_ENTRY(zvknha, PRIV_VERSION_1_12_0, ext_zvknha),
162     ISA_EXT_DATA_ENTRY(zvknhb, PRIV_VERSION_1_12_0, ext_zvknhb),
163     ISA_EXT_DATA_ENTRY(zvks, PRIV_VERSION_1_12_0, ext_zvks),
164     ISA_EXT_DATA_ENTRY(zvksc, PRIV_VERSION_1_12_0, ext_zvksc),
165     ISA_EXT_DATA_ENTRY(zvksed, PRIV_VERSION_1_12_0, ext_zvksed),
166     ISA_EXT_DATA_ENTRY(zvksg, PRIV_VERSION_1_12_0, ext_zvksg),
167     ISA_EXT_DATA_ENTRY(zvksh, PRIV_VERSION_1_12_0, ext_zvksh),
168     ISA_EXT_DATA_ENTRY(zvkt, PRIV_VERSION_1_12_0, ext_zvkt),
169     ISA_EXT_DATA_ENTRY(zhinx, PRIV_VERSION_1_12_0, ext_zhinx),
170     ISA_EXT_DATA_ENTRY(zhinxmin, PRIV_VERSION_1_12_0, ext_zhinxmin),
171     ISA_EXT_DATA_ENTRY(smaia, PRIV_VERSION_1_12_0, ext_smaia),
172     ISA_EXT_DATA_ENTRY(smepmp, PRIV_VERSION_1_12_0, ext_smepmp),
173     ISA_EXT_DATA_ENTRY(smstateen, PRIV_VERSION_1_12_0, ext_smstateen),
174     ISA_EXT_DATA_ENTRY(ssaia, PRIV_VERSION_1_12_0, ext_ssaia),
175     ISA_EXT_DATA_ENTRY(sscofpmf, PRIV_VERSION_1_12_0, ext_sscofpmf),
176     ISA_EXT_DATA_ENTRY(sstc, PRIV_VERSION_1_12_0, ext_sstc),
177     ISA_EXT_DATA_ENTRY(svadu, PRIV_VERSION_1_12_0, ext_svadu),
178     ISA_EXT_DATA_ENTRY(svinval, PRIV_VERSION_1_12_0, ext_svinval),
179     ISA_EXT_DATA_ENTRY(svnapot, PRIV_VERSION_1_12_0, ext_svnapot),
180     ISA_EXT_DATA_ENTRY(svpbmt, PRIV_VERSION_1_12_0, ext_svpbmt),
181     ISA_EXT_DATA_ENTRY(xtheadba, PRIV_VERSION_1_11_0, ext_xtheadba),
182     ISA_EXT_DATA_ENTRY(xtheadbb, PRIV_VERSION_1_11_0, ext_xtheadbb),
183     ISA_EXT_DATA_ENTRY(xtheadbs, PRIV_VERSION_1_11_0, ext_xtheadbs),
184     ISA_EXT_DATA_ENTRY(xtheadcmo, PRIV_VERSION_1_11_0, ext_xtheadcmo),
185     ISA_EXT_DATA_ENTRY(xtheadcondmov, PRIV_VERSION_1_11_0, ext_xtheadcondmov),
186     ISA_EXT_DATA_ENTRY(xtheadfmemidx, PRIV_VERSION_1_11_0, ext_xtheadfmemidx),
187     ISA_EXT_DATA_ENTRY(xtheadfmv, PRIV_VERSION_1_11_0, ext_xtheadfmv),
188     ISA_EXT_DATA_ENTRY(xtheadmac, PRIV_VERSION_1_11_0, ext_xtheadmac),
189     ISA_EXT_DATA_ENTRY(xtheadmemidx, PRIV_VERSION_1_11_0, ext_xtheadmemidx),
190     ISA_EXT_DATA_ENTRY(xtheadmempair, PRIV_VERSION_1_11_0, ext_xtheadmempair),
191     ISA_EXT_DATA_ENTRY(xtheadsync, PRIV_VERSION_1_11_0, ext_xtheadsync),
192     ISA_EXT_DATA_ENTRY(xventanacondops, PRIV_VERSION_1_12_0, ext_XVentanaCondOps),
193 
194     DEFINE_PROP_END_OF_LIST(),
195 };
196 
197 bool isa_ext_is_enabled(RISCVCPU *cpu, uint32_t ext_offset)
198 {
199     bool *ext_enabled = (void *)&cpu->cfg + ext_offset;
200 
201     return *ext_enabled;
202 }
203 
204 void isa_ext_update_enabled(RISCVCPU *cpu, uint32_t ext_offset, bool en)
205 {
206     bool *ext_enabled = (void *)&cpu->cfg + ext_offset;
207 
208     *ext_enabled = en;
209 }
210 
211 bool riscv_cpu_is_vendor(Object *cpu_obj)
212 {
213     return object_dynamic_cast(cpu_obj, TYPE_RISCV_VENDOR_CPU) != NULL;
214 }
215 
216 const char * const riscv_int_regnames[] = {
217     "x0/zero", "x1/ra",  "x2/sp",  "x3/gp",  "x4/tp",  "x5/t0",   "x6/t1",
218     "x7/t2",   "x8/s0",  "x9/s1",  "x10/a0", "x11/a1", "x12/a2",  "x13/a3",
219     "x14/a4",  "x15/a5", "x16/a6", "x17/a7", "x18/s2", "x19/s3",  "x20/s4",
220     "x21/s5",  "x22/s6", "x23/s7", "x24/s8", "x25/s9", "x26/s10", "x27/s11",
221     "x28/t3",  "x29/t4", "x30/t5", "x31/t6"
222 };
223 
224 const char * const riscv_int_regnamesh[] = {
225     "x0h/zeroh", "x1h/rah",  "x2h/sph",   "x3h/gph",   "x4h/tph",  "x5h/t0h",
226     "x6h/t1h",   "x7h/t2h",  "x8h/s0h",   "x9h/s1h",   "x10h/a0h", "x11h/a1h",
227     "x12h/a2h",  "x13h/a3h", "x14h/a4h",  "x15h/a5h",  "x16h/a6h", "x17h/a7h",
228     "x18h/s2h",  "x19h/s3h", "x20h/s4h",  "x21h/s5h",  "x22h/s6h", "x23h/s7h",
229     "x24h/s8h",  "x25h/s9h", "x26h/s10h", "x27h/s11h", "x28h/t3h", "x29h/t4h",
230     "x30h/t5h",  "x31h/t6h"
231 };
232 
233 const char * const riscv_fpr_regnames[] = {
234     "f0/ft0",   "f1/ft1",  "f2/ft2",   "f3/ft3",   "f4/ft4",  "f5/ft5",
235     "f6/ft6",   "f7/ft7",  "f8/fs0",   "f9/fs1",   "f10/fa0", "f11/fa1",
236     "f12/fa2",  "f13/fa3", "f14/fa4",  "f15/fa5",  "f16/fa6", "f17/fa7",
237     "f18/fs2",  "f19/fs3", "f20/fs4",  "f21/fs5",  "f22/fs6", "f23/fs7",
238     "f24/fs8",  "f25/fs9", "f26/fs10", "f27/fs11", "f28/ft8", "f29/ft9",
239     "f30/ft10", "f31/ft11"
240 };
241 
242 const char * const riscv_rvv_regnames[] = {
243   "v0",  "v1",  "v2",  "v3",  "v4",  "v5",  "v6",
244   "v7",  "v8",  "v9",  "v10", "v11", "v12", "v13",
245   "v14", "v15", "v16", "v17", "v18", "v19", "v20",
246   "v21", "v22", "v23", "v24", "v25", "v26", "v27",
247   "v28", "v29", "v30", "v31"
248 };
249 
250 static const char * const riscv_excp_names[] = {
251     "misaligned_fetch",
252     "fault_fetch",
253     "illegal_instruction",
254     "breakpoint",
255     "misaligned_load",
256     "fault_load",
257     "misaligned_store",
258     "fault_store",
259     "user_ecall",
260     "supervisor_ecall",
261     "hypervisor_ecall",
262     "machine_ecall",
263     "exec_page_fault",
264     "load_page_fault",
265     "reserved",
266     "store_page_fault",
267     "reserved",
268     "reserved",
269     "reserved",
270     "reserved",
271     "guest_exec_page_fault",
272     "guest_load_page_fault",
273     "reserved",
274     "guest_store_page_fault",
275 };
276 
277 static const char * const riscv_intr_names[] = {
278     "u_software",
279     "s_software",
280     "vs_software",
281     "m_software",
282     "u_timer",
283     "s_timer",
284     "vs_timer",
285     "m_timer",
286     "u_external",
287     "s_external",
288     "vs_external",
289     "m_external",
290     "reserved",
291     "reserved",
292     "reserved",
293     "reserved"
294 };
295 
296 const char *riscv_cpu_get_trap_name(target_ulong cause, bool async)
297 {
298     if (async) {
299         return (cause < ARRAY_SIZE(riscv_intr_names)) ?
300                riscv_intr_names[cause] : "(unknown)";
301     } else {
302         return (cause < ARRAY_SIZE(riscv_excp_names)) ?
303                riscv_excp_names[cause] : "(unknown)";
304     }
305 }
306 
307 void riscv_cpu_set_misa_ext(CPURISCVState *env, uint32_t ext)
308 {
309     env->misa_ext_mask = env->misa_ext = ext;
310 }
311 
312 int riscv_cpu_max_xlen(RISCVCPUClass *mcc)
313 {
314     return 16 << mcc->misa_mxl_max;
315 }
316 
317 #ifndef CONFIG_USER_ONLY
318 static uint8_t satp_mode_from_str(const char *satp_mode_str)
319 {
320     if (!strncmp(satp_mode_str, "mbare", 5)) {
321         return VM_1_10_MBARE;
322     }
323 
324     if (!strncmp(satp_mode_str, "sv32", 4)) {
325         return VM_1_10_SV32;
326     }
327 
328     if (!strncmp(satp_mode_str, "sv39", 4)) {
329         return VM_1_10_SV39;
330     }
331 
332     if (!strncmp(satp_mode_str, "sv48", 4)) {
333         return VM_1_10_SV48;
334     }
335 
336     if (!strncmp(satp_mode_str, "sv57", 4)) {
337         return VM_1_10_SV57;
338     }
339 
340     if (!strncmp(satp_mode_str, "sv64", 4)) {
341         return VM_1_10_SV64;
342     }
343 
344     g_assert_not_reached();
345 }
346 
347 uint8_t satp_mode_max_from_map(uint32_t map)
348 {
349     /*
350      * 'map = 0' will make us return (31 - 32), which C will
351      * happily overflow to UINT_MAX. There's no good result to
352      * return if 'map = 0' (e.g. returning 0 will be ambiguous
353      * with the result for 'map = 1').
354      *
355      * Assert out if map = 0. Callers will have to deal with
356      * it outside of this function.
357      */
358     g_assert(map > 0);
359 
360     /* map here has at least one bit set, so no problem with clz */
361     return 31 - __builtin_clz(map);
362 }
363 
364 const char *satp_mode_str(uint8_t satp_mode, bool is_32_bit)
365 {
366     if (is_32_bit) {
367         switch (satp_mode) {
368         case VM_1_10_SV32:
369             return "sv32";
370         case VM_1_10_MBARE:
371             return "none";
372         }
373     } else {
374         switch (satp_mode) {
375         case VM_1_10_SV64:
376             return "sv64";
377         case VM_1_10_SV57:
378             return "sv57";
379         case VM_1_10_SV48:
380             return "sv48";
381         case VM_1_10_SV39:
382             return "sv39";
383         case VM_1_10_MBARE:
384             return "none";
385         }
386     }
387 
388     g_assert_not_reached();
389 }
390 
391 static void set_satp_mode_max_supported(RISCVCPU *cpu,
392                                         uint8_t satp_mode)
393 {
394     bool rv32 = riscv_cpu_mxl(&cpu->env) == MXL_RV32;
395     const bool *valid_vm = rv32 ? valid_vm_1_10_32 : valid_vm_1_10_64;
396 
397     for (int i = 0; i <= satp_mode; ++i) {
398         if (valid_vm[i]) {
399             cpu->cfg.satp_mode.supported |= (1 << i);
400         }
401     }
402 }
403 
404 /* Set the satp mode to the max supported */
405 static void set_satp_mode_default_map(RISCVCPU *cpu)
406 {
407     /*
408      * Bare CPUs do not default to the max available.
409      * Users must set a valid satp_mode in the command
410      * line.
411      */
412     if (object_dynamic_cast(OBJECT(cpu), TYPE_RISCV_BARE_CPU) != NULL) {
413         warn_report("No satp mode set. Defaulting to 'bare'");
414         cpu->cfg.satp_mode.map = (1 << VM_1_10_MBARE);
415         return;
416     }
417 
418     cpu->cfg.satp_mode.map = cpu->cfg.satp_mode.supported;
419 }
420 #endif
421 
422 static void riscv_any_cpu_init(Object *obj)
423 {
424     RISCVCPU *cpu = RISCV_CPU(obj);
425     CPURISCVState *env = &cpu->env;
426     riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVF | RVD | RVC | RVU);
427 
428 #ifndef CONFIG_USER_ONLY
429     set_satp_mode_max_supported(RISCV_CPU(obj),
430         riscv_cpu_mxl(&RISCV_CPU(obj)->env) == MXL_RV32 ?
431         VM_1_10_SV32 : VM_1_10_SV57);
432 #endif
433 
434     env->priv_ver = PRIV_VERSION_LATEST;
435 
436     /* inherited from parent obj via riscv_cpu_init() */
437     cpu->cfg.ext_zifencei = true;
438     cpu->cfg.ext_zicsr = true;
439     cpu->cfg.mmu = true;
440     cpu->cfg.pmp = true;
441 }
442 
443 static void riscv_max_cpu_init(Object *obj)
444 {
445     RISCVCPU *cpu = RISCV_CPU(obj);
446     CPURISCVState *env = &cpu->env;
447 
448     cpu->cfg.mmu = true;
449     cpu->cfg.pmp = true;
450 
451     env->priv_ver = PRIV_VERSION_LATEST;
452 #ifndef CONFIG_USER_ONLY
453 #ifdef TARGET_RISCV32
454     set_satp_mode_max_supported(cpu, VM_1_10_SV32);
455 #else
456     set_satp_mode_max_supported(cpu, VM_1_10_SV57);
457 #endif
458 #endif
459 }
460 
461 #if defined(TARGET_RISCV64)
462 static void rv64_base_cpu_init(Object *obj)
463 {
464     RISCVCPU *cpu = RISCV_CPU(obj);
465     CPURISCVState *env = &cpu->env;
466 
467     cpu->cfg.mmu = true;
468     cpu->cfg.pmp = true;
469 
470     /* Set latest version of privileged specification */
471     env->priv_ver = PRIV_VERSION_LATEST;
472 #ifndef CONFIG_USER_ONLY
473     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV57);
474 #endif
475 }
476 
477 static void rv64_sifive_u_cpu_init(Object *obj)
478 {
479     RISCVCPU *cpu = RISCV_CPU(obj);
480     CPURISCVState *env = &cpu->env;
481     riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
482     env->priv_ver = PRIV_VERSION_1_10_0;
483 #ifndef CONFIG_USER_ONLY
484     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV39);
485 #endif
486 
487     /* inherited from parent obj via riscv_cpu_init() */
488     cpu->cfg.ext_zifencei = true;
489     cpu->cfg.ext_zicsr = true;
490     cpu->cfg.mmu = true;
491     cpu->cfg.pmp = true;
492 }
493 
494 static void rv64_sifive_e_cpu_init(Object *obj)
495 {
496     CPURISCVState *env = &RISCV_CPU(obj)->env;
497     RISCVCPU *cpu = RISCV_CPU(obj);
498 
499     riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVC | RVU);
500     env->priv_ver = PRIV_VERSION_1_10_0;
501 #ifndef CONFIG_USER_ONLY
502     set_satp_mode_max_supported(cpu, VM_1_10_MBARE);
503 #endif
504 
505     /* inherited from parent obj via riscv_cpu_init() */
506     cpu->cfg.ext_zifencei = true;
507     cpu->cfg.ext_zicsr = true;
508     cpu->cfg.pmp = true;
509 }
510 
511 static void rv64_thead_c906_cpu_init(Object *obj)
512 {
513     CPURISCVState *env = &RISCV_CPU(obj)->env;
514     RISCVCPU *cpu = RISCV_CPU(obj);
515 
516     riscv_cpu_set_misa_ext(env, RVG | RVC | RVS | RVU);
517     env->priv_ver = PRIV_VERSION_1_11_0;
518 
519     cpu->cfg.ext_zfa = true;
520     cpu->cfg.ext_zfh = true;
521     cpu->cfg.mmu = true;
522     cpu->cfg.ext_xtheadba = true;
523     cpu->cfg.ext_xtheadbb = true;
524     cpu->cfg.ext_xtheadbs = true;
525     cpu->cfg.ext_xtheadcmo = true;
526     cpu->cfg.ext_xtheadcondmov = true;
527     cpu->cfg.ext_xtheadfmemidx = true;
528     cpu->cfg.ext_xtheadmac = true;
529     cpu->cfg.ext_xtheadmemidx = true;
530     cpu->cfg.ext_xtheadmempair = true;
531     cpu->cfg.ext_xtheadsync = true;
532 
533     cpu->cfg.mvendorid = THEAD_VENDOR_ID;
534 #ifndef CONFIG_USER_ONLY
535     set_satp_mode_max_supported(cpu, VM_1_10_SV39);
536 #endif
537 
538     /* inherited from parent obj via riscv_cpu_init() */
539     cpu->cfg.pmp = true;
540 }
541 
542 static void rv64_veyron_v1_cpu_init(Object *obj)
543 {
544     CPURISCVState *env = &RISCV_CPU(obj)->env;
545     RISCVCPU *cpu = RISCV_CPU(obj);
546 
547     riscv_cpu_set_misa_ext(env, RVG | RVC | RVS | RVU | RVH);
548     env->priv_ver = PRIV_VERSION_1_12_0;
549 
550     /* Enable ISA extensions */
551     cpu->cfg.mmu = true;
552     cpu->cfg.ext_zifencei = true;
553     cpu->cfg.ext_zicsr = true;
554     cpu->cfg.pmp = true;
555     cpu->cfg.ext_zicbom = true;
556     cpu->cfg.cbom_blocksize = 64;
557     cpu->cfg.cboz_blocksize = 64;
558     cpu->cfg.ext_zicboz = true;
559     cpu->cfg.ext_smaia = true;
560     cpu->cfg.ext_ssaia = true;
561     cpu->cfg.ext_sscofpmf = true;
562     cpu->cfg.ext_sstc = true;
563     cpu->cfg.ext_svinval = true;
564     cpu->cfg.ext_svnapot = true;
565     cpu->cfg.ext_svpbmt = true;
566     cpu->cfg.ext_smstateen = true;
567     cpu->cfg.ext_zba = true;
568     cpu->cfg.ext_zbb = true;
569     cpu->cfg.ext_zbc = true;
570     cpu->cfg.ext_zbs = true;
571     cpu->cfg.ext_XVentanaCondOps = true;
572 
573     cpu->cfg.mvendorid = VEYRON_V1_MVENDORID;
574     cpu->cfg.marchid = VEYRON_V1_MARCHID;
575     cpu->cfg.mimpid = VEYRON_V1_MIMPID;
576 
577 #ifndef CONFIG_USER_ONLY
578     set_satp_mode_max_supported(cpu, VM_1_10_SV48);
579 #endif
580 }
581 
582 static void rv128_base_cpu_init(Object *obj)
583 {
584     RISCVCPU *cpu = RISCV_CPU(obj);
585     CPURISCVState *env = &cpu->env;
586 
587     if (qemu_tcg_mttcg_enabled()) {
588         /* Missing 128-bit aligned atomics */
589         error_report("128-bit RISC-V currently does not work with Multi "
590                      "Threaded TCG. Please use: -accel tcg,thread=single");
591         exit(EXIT_FAILURE);
592     }
593 
594     cpu->cfg.mmu = true;
595     cpu->cfg.pmp = true;
596 
597     /* Set latest version of privileged specification */
598     env->priv_ver = PRIV_VERSION_LATEST;
599 #ifndef CONFIG_USER_ONLY
600     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV57);
601 #endif
602 }
603 
604 static void rv64i_bare_cpu_init(Object *obj)
605 {
606     CPURISCVState *env = &RISCV_CPU(obj)->env;
607     riscv_cpu_set_misa_ext(env, RVI);
608 }
609 
610 static void rv64e_bare_cpu_init(Object *obj)
611 {
612     CPURISCVState *env = &RISCV_CPU(obj)->env;
613     riscv_cpu_set_misa_ext(env, RVE);
614 }
615 #else
616 static void rv32_base_cpu_init(Object *obj)
617 {
618     RISCVCPU *cpu = RISCV_CPU(obj);
619     CPURISCVState *env = &cpu->env;
620 
621     cpu->cfg.mmu = true;
622     cpu->cfg.pmp = true;
623 
624     /* Set latest version of privileged specification */
625     env->priv_ver = PRIV_VERSION_LATEST;
626 #ifndef CONFIG_USER_ONLY
627     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV32);
628 #endif
629 }
630 
631 static void rv32_sifive_u_cpu_init(Object *obj)
632 {
633     RISCVCPU *cpu = RISCV_CPU(obj);
634     CPURISCVState *env = &cpu->env;
635     riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU);
636     env->priv_ver = PRIV_VERSION_1_10_0;
637 #ifndef CONFIG_USER_ONLY
638     set_satp_mode_max_supported(RISCV_CPU(obj), VM_1_10_SV32);
639 #endif
640 
641     /* inherited from parent obj via riscv_cpu_init() */
642     cpu->cfg.ext_zifencei = true;
643     cpu->cfg.ext_zicsr = true;
644     cpu->cfg.mmu = true;
645     cpu->cfg.pmp = true;
646 }
647 
648 static void rv32_sifive_e_cpu_init(Object *obj)
649 {
650     CPURISCVState *env = &RISCV_CPU(obj)->env;
651     RISCVCPU *cpu = RISCV_CPU(obj);
652 
653     riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVC | RVU);
654     env->priv_ver = PRIV_VERSION_1_10_0;
655 #ifndef CONFIG_USER_ONLY
656     set_satp_mode_max_supported(cpu, VM_1_10_MBARE);
657 #endif
658 
659     /* inherited from parent obj via riscv_cpu_init() */
660     cpu->cfg.ext_zifencei = true;
661     cpu->cfg.ext_zicsr = true;
662     cpu->cfg.pmp = true;
663 }
664 
665 static void rv32_ibex_cpu_init(Object *obj)
666 {
667     CPURISCVState *env = &RISCV_CPU(obj)->env;
668     RISCVCPU *cpu = RISCV_CPU(obj);
669 
670     riscv_cpu_set_misa_ext(env, RVI | RVM | RVC | RVU);
671     env->priv_ver = PRIV_VERSION_1_12_0;
672 #ifndef CONFIG_USER_ONLY
673     set_satp_mode_max_supported(cpu, VM_1_10_MBARE);
674 #endif
675     /* inherited from parent obj via riscv_cpu_init() */
676     cpu->cfg.ext_zifencei = true;
677     cpu->cfg.ext_zicsr = true;
678     cpu->cfg.pmp = true;
679     cpu->cfg.ext_smepmp = true;
680 }
681 
682 static void rv32_imafcu_nommu_cpu_init(Object *obj)
683 {
684     CPURISCVState *env = &RISCV_CPU(obj)->env;
685     RISCVCPU *cpu = RISCV_CPU(obj);
686 
687     riscv_cpu_set_misa_ext(env, RVI | RVM | RVA | RVF | RVC | RVU);
688     env->priv_ver = PRIV_VERSION_1_10_0;
689 #ifndef CONFIG_USER_ONLY
690     set_satp_mode_max_supported(cpu, VM_1_10_MBARE);
691 #endif
692 
693     /* inherited from parent obj via riscv_cpu_init() */
694     cpu->cfg.ext_zifencei = true;
695     cpu->cfg.ext_zicsr = true;
696     cpu->cfg.pmp = true;
697 }
698 
699 static void rv32i_bare_cpu_init(Object *obj)
700 {
701     CPURISCVState *env = &RISCV_CPU(obj)->env;
702     riscv_cpu_set_misa_ext(env, RVI);
703 }
704 
705 static void rv32e_bare_cpu_init(Object *obj)
706 {
707     CPURISCVState *env = &RISCV_CPU(obj)->env;
708     riscv_cpu_set_misa_ext(env, RVE);
709 }
710 #endif
711 
712 static ObjectClass *riscv_cpu_class_by_name(const char *cpu_model)
713 {
714     ObjectClass *oc;
715     char *typename;
716     char **cpuname;
717 
718     cpuname = g_strsplit(cpu_model, ",", 1);
719     typename = g_strdup_printf(RISCV_CPU_TYPE_NAME("%s"), cpuname[0]);
720     oc = object_class_by_name(typename);
721     g_strfreev(cpuname);
722     g_free(typename);
723 
724     return oc;
725 }
726 
727 char *riscv_cpu_get_name(RISCVCPU *cpu)
728 {
729     RISCVCPUClass *rcc = RISCV_CPU_GET_CLASS(cpu);
730     const char *typename = object_class_get_name(OBJECT_CLASS(rcc));
731 
732     g_assert(g_str_has_suffix(typename, RISCV_CPU_TYPE_SUFFIX));
733 
734     return cpu_model_from_type(typename);
735 }
736 
737 static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
738 {
739     RISCVCPU *cpu = RISCV_CPU(cs);
740     CPURISCVState *env = &cpu->env;
741     int i, j;
742     uint8_t *p;
743 
744 #if !defined(CONFIG_USER_ONLY)
745     if (riscv_has_ext(env, RVH)) {
746         qemu_fprintf(f, " %s %d\n", "V      =  ", env->virt_enabled);
747     }
748 #endif
749     qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "pc      ", env->pc);
750 #ifndef CONFIG_USER_ONLY
751     {
752         static const int dump_csrs[] = {
753             CSR_MHARTID,
754             CSR_MSTATUS,
755             CSR_MSTATUSH,
756             /*
757              * CSR_SSTATUS is intentionally omitted here as its value
758              * can be figured out by looking at CSR_MSTATUS
759              */
760             CSR_HSTATUS,
761             CSR_VSSTATUS,
762             CSR_MIP,
763             CSR_MIE,
764             CSR_MIDELEG,
765             CSR_HIDELEG,
766             CSR_MEDELEG,
767             CSR_HEDELEG,
768             CSR_MTVEC,
769             CSR_STVEC,
770             CSR_VSTVEC,
771             CSR_MEPC,
772             CSR_SEPC,
773             CSR_VSEPC,
774             CSR_MCAUSE,
775             CSR_SCAUSE,
776             CSR_VSCAUSE,
777             CSR_MTVAL,
778             CSR_STVAL,
779             CSR_HTVAL,
780             CSR_MTVAL2,
781             CSR_MSCRATCH,
782             CSR_SSCRATCH,
783             CSR_SATP,
784             CSR_MMTE,
785             CSR_UPMBASE,
786             CSR_UPMMASK,
787             CSR_SPMBASE,
788             CSR_SPMMASK,
789             CSR_MPMBASE,
790             CSR_MPMMASK,
791         };
792 
793         for (i = 0; i < ARRAY_SIZE(dump_csrs); ++i) {
794             int csrno = dump_csrs[i];
795             target_ulong val = 0;
796             RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
797 
798             /*
799              * Rely on the smode, hmode, etc, predicates within csr.c
800              * to do the filtering of the registers that are present.
801              */
802             if (res == RISCV_EXCP_NONE) {
803                 qemu_fprintf(f, " %-8s " TARGET_FMT_lx "\n",
804                              csr_ops[csrno].name, val);
805             }
806         }
807     }
808 #endif
809 
810     for (i = 0; i < 32; i++) {
811         qemu_fprintf(f, " %-8s " TARGET_FMT_lx,
812                      riscv_int_regnames[i], env->gpr[i]);
813         if ((i & 3) == 3) {
814             qemu_fprintf(f, "\n");
815         }
816     }
817     if (flags & CPU_DUMP_FPU) {
818         for (i = 0; i < 32; i++) {
819             qemu_fprintf(f, " %-8s %016" PRIx64,
820                          riscv_fpr_regnames[i], env->fpr[i]);
821             if ((i & 3) == 3) {
822                 qemu_fprintf(f, "\n");
823             }
824         }
825     }
826     if (riscv_has_ext(env, RVV) && (flags & CPU_DUMP_VPU)) {
827         static const int dump_rvv_csrs[] = {
828                     CSR_VSTART,
829                     CSR_VXSAT,
830                     CSR_VXRM,
831                     CSR_VCSR,
832                     CSR_VL,
833                     CSR_VTYPE,
834                     CSR_VLENB,
835                 };
836         for (i = 0; i < ARRAY_SIZE(dump_rvv_csrs); ++i) {
837             int csrno = dump_rvv_csrs[i];
838             target_ulong val = 0;
839             RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
840 
841             /*
842              * Rely on the smode, hmode, etc, predicates within csr.c
843              * to do the filtering of the registers that are present.
844              */
845             if (res == RISCV_EXCP_NONE) {
846                 qemu_fprintf(f, " %-8s " TARGET_FMT_lx "\n",
847                              csr_ops[csrno].name, val);
848             }
849         }
850         uint16_t vlenb = cpu->cfg.vlenb;
851 
852         for (i = 0; i < 32; i++) {
853             qemu_fprintf(f, " %-8s ", riscv_rvv_regnames[i]);
854             p = (uint8_t *)env->vreg;
855             for (j = vlenb - 1 ; j >= 0; j--) {
856                 qemu_fprintf(f, "%02x", *(p + i * vlenb + BYTE(j)));
857             }
858             qemu_fprintf(f, "\n");
859         }
860     }
861 }
862 
863 static void riscv_cpu_set_pc(CPUState *cs, vaddr value)
864 {
865     RISCVCPU *cpu = RISCV_CPU(cs);
866     CPURISCVState *env = &cpu->env;
867 
868     if (env->xl == MXL_RV32) {
869         env->pc = (int32_t)value;
870     } else {
871         env->pc = value;
872     }
873 }
874 
875 static vaddr riscv_cpu_get_pc(CPUState *cs)
876 {
877     RISCVCPU *cpu = RISCV_CPU(cs);
878     CPURISCVState *env = &cpu->env;
879 
880     /* Match cpu_get_tb_cpu_state. */
881     if (env->xl == MXL_RV32) {
882         return env->pc & UINT32_MAX;
883     }
884     return env->pc;
885 }
886 
887 static bool riscv_cpu_has_work(CPUState *cs)
888 {
889 #ifndef CONFIG_USER_ONLY
890     RISCVCPU *cpu = RISCV_CPU(cs);
891     CPURISCVState *env = &cpu->env;
892     /*
893      * Definition of the WFI instruction requires it to ignore the privilege
894      * mode and delegation registers, but respect individual enables
895      */
896     return riscv_cpu_all_pending(env) != 0 ||
897         riscv_cpu_sirq_pending(env) != RISCV_EXCP_NONE ||
898         riscv_cpu_vsirq_pending(env) != RISCV_EXCP_NONE;
899 #else
900     return true;
901 #endif
902 }
903 
904 static int riscv_cpu_mmu_index(CPUState *cs, bool ifetch)
905 {
906     return riscv_env_mmu_index(cpu_env(cs), ifetch);
907 }
908 
909 static void riscv_cpu_reset_hold(Object *obj)
910 {
911 #ifndef CONFIG_USER_ONLY
912     uint8_t iprio;
913     int i, irq, rdzero;
914 #endif
915     CPUState *cs = CPU(obj);
916     RISCVCPU *cpu = RISCV_CPU(cs);
917     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(cpu);
918     CPURISCVState *env = &cpu->env;
919 
920     if (mcc->parent_phases.hold) {
921         mcc->parent_phases.hold(obj);
922     }
923 #ifndef CONFIG_USER_ONLY
924     env->misa_mxl = mcc->misa_mxl_max;
925     env->priv = PRV_M;
926     env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
927     if (env->misa_mxl > MXL_RV32) {
928         /*
929          * The reset status of SXL/UXL is undefined, but mstatus is WARL
930          * and we must ensure that the value after init is valid for read.
931          */
932         env->mstatus = set_field(env->mstatus, MSTATUS64_SXL, env->misa_mxl);
933         env->mstatus = set_field(env->mstatus, MSTATUS64_UXL, env->misa_mxl);
934         if (riscv_has_ext(env, RVH)) {
935             env->vsstatus = set_field(env->vsstatus,
936                                       MSTATUS64_SXL, env->misa_mxl);
937             env->vsstatus = set_field(env->vsstatus,
938                                       MSTATUS64_UXL, env->misa_mxl);
939             env->mstatus_hs = set_field(env->mstatus_hs,
940                                         MSTATUS64_SXL, env->misa_mxl);
941             env->mstatus_hs = set_field(env->mstatus_hs,
942                                         MSTATUS64_UXL, env->misa_mxl);
943         }
944     }
945     env->mcause = 0;
946     env->miclaim = MIP_SGEIP;
947     env->pc = env->resetvec;
948     env->bins = 0;
949     env->two_stage_lookup = false;
950 
951     env->menvcfg = (cpu->cfg.ext_svpbmt ? MENVCFG_PBMTE : 0) |
952                    (cpu->cfg.ext_svadu ? MENVCFG_ADUE : 0);
953     env->henvcfg = (cpu->cfg.ext_svpbmt ? HENVCFG_PBMTE : 0) |
954                    (cpu->cfg.ext_svadu ? HENVCFG_ADUE : 0);
955 
956     /* Initialized default priorities of local interrupts. */
957     for (i = 0; i < ARRAY_SIZE(env->miprio); i++) {
958         iprio = riscv_cpu_default_priority(i);
959         env->miprio[i] = (i == IRQ_M_EXT) ? 0 : iprio;
960         env->siprio[i] = (i == IRQ_S_EXT) ? 0 : iprio;
961         env->hviprio[i] = 0;
962     }
963     i = 0;
964     while (!riscv_cpu_hviprio_index2irq(i, &irq, &rdzero)) {
965         if (!rdzero) {
966             env->hviprio[irq] = env->miprio[irq];
967         }
968         i++;
969     }
970     /* mmte is supposed to have pm.current hardwired to 1 */
971     env->mmte |= (EXT_STATUS_INITIAL | MMTE_M_PM_CURRENT);
972 
973     /*
974      * Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor
975      * extension is enabled.
976      */
977     if (riscv_has_ext(env, RVH)) {
978         env->mideleg |= HS_MODE_INTERRUPTS;
979     }
980 
981     /*
982      * Clear mseccfg and unlock all the PMP entries upon reset.
983      * This is allowed as per the priv and smepmp specifications
984      * and is needed to clear stale entries across reboots.
985      */
986     if (riscv_cpu_cfg(env)->ext_smepmp) {
987         env->mseccfg = 0;
988     }
989 
990     pmp_unlock_entries(env);
991 #endif
992     env->xl = riscv_cpu_mxl(env);
993     riscv_cpu_update_mask(env);
994     cs->exception_index = RISCV_EXCP_NONE;
995     env->load_res = -1;
996     set_default_nan_mode(1, &env->fp_status);
997 
998 #ifndef CONFIG_USER_ONLY
999     if (cpu->cfg.debug) {
1000         riscv_trigger_reset_hold(env);
1001     }
1002 
1003     if (kvm_enabled()) {
1004         kvm_riscv_reset_vcpu(cpu);
1005     }
1006 #endif
1007 }
1008 
1009 static void riscv_cpu_disas_set_info(CPUState *s, disassemble_info *info)
1010 {
1011     RISCVCPU *cpu = RISCV_CPU(s);
1012     CPURISCVState *env = &cpu->env;
1013     info->target_info = &cpu->cfg;
1014 
1015     switch (env->xl) {
1016     case MXL_RV32:
1017         info->print_insn = print_insn_riscv32;
1018         break;
1019     case MXL_RV64:
1020         info->print_insn = print_insn_riscv64;
1021         break;
1022     case MXL_RV128:
1023         info->print_insn = print_insn_riscv128;
1024         break;
1025     default:
1026         g_assert_not_reached();
1027     }
1028 }
1029 
1030 #ifndef CONFIG_USER_ONLY
1031 static void riscv_cpu_satp_mode_finalize(RISCVCPU *cpu, Error **errp)
1032 {
1033     bool rv32 = riscv_cpu_is_32bit(cpu);
1034     uint8_t satp_mode_map_max, satp_mode_supported_max;
1035 
1036     /* The CPU wants the OS to decide which satp mode to use */
1037     if (cpu->cfg.satp_mode.supported == 0) {
1038         return;
1039     }
1040 
1041     satp_mode_supported_max =
1042                     satp_mode_max_from_map(cpu->cfg.satp_mode.supported);
1043 
1044     if (cpu->cfg.satp_mode.map == 0) {
1045         if (cpu->cfg.satp_mode.init == 0) {
1046             /* If unset by the user, we fallback to the default satp mode. */
1047             set_satp_mode_default_map(cpu);
1048         } else {
1049             /*
1050              * Find the lowest level that was disabled and then enable the
1051              * first valid level below which can be found in
1052              * valid_vm_1_10_32/64.
1053              */
1054             for (int i = 1; i < 16; ++i) {
1055                 if ((cpu->cfg.satp_mode.init & (1 << i)) &&
1056                     (cpu->cfg.satp_mode.supported & (1 << i))) {
1057                     for (int j = i - 1; j >= 0; --j) {
1058                         if (cpu->cfg.satp_mode.supported & (1 << j)) {
1059                             cpu->cfg.satp_mode.map |= (1 << j);
1060                             break;
1061                         }
1062                     }
1063                     break;
1064                 }
1065             }
1066         }
1067     }
1068 
1069     satp_mode_map_max = satp_mode_max_from_map(cpu->cfg.satp_mode.map);
1070 
1071     /* Make sure the user asked for a supported configuration (HW and qemu) */
1072     if (satp_mode_map_max > satp_mode_supported_max) {
1073         error_setg(errp, "satp_mode %s is higher than hw max capability %s",
1074                    satp_mode_str(satp_mode_map_max, rv32),
1075                    satp_mode_str(satp_mode_supported_max, rv32));
1076         return;
1077     }
1078 
1079     /*
1080      * Make sure the user did not ask for an invalid configuration as per
1081      * the specification.
1082      */
1083     if (!rv32) {
1084         for (int i = satp_mode_map_max - 1; i >= 0; --i) {
1085             if (!(cpu->cfg.satp_mode.map & (1 << i)) &&
1086                 (cpu->cfg.satp_mode.init & (1 << i)) &&
1087                 (cpu->cfg.satp_mode.supported & (1 << i))) {
1088                 error_setg(errp, "cannot disable %s satp mode if %s "
1089                            "is enabled", satp_mode_str(i, false),
1090                            satp_mode_str(satp_mode_map_max, false));
1091                 return;
1092             }
1093         }
1094     }
1095 
1096     /* Finally expand the map so that all valid modes are set */
1097     for (int i = satp_mode_map_max - 1; i >= 0; --i) {
1098         if (cpu->cfg.satp_mode.supported & (1 << i)) {
1099             cpu->cfg.satp_mode.map |= (1 << i);
1100         }
1101     }
1102 }
1103 #endif
1104 
1105 void riscv_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
1106 {
1107     Error *local_err = NULL;
1108 
1109 #ifndef CONFIG_USER_ONLY
1110     riscv_cpu_satp_mode_finalize(cpu, &local_err);
1111     if (local_err != NULL) {
1112         error_propagate(errp, local_err);
1113         return;
1114     }
1115 #endif
1116 
1117     if (tcg_enabled()) {
1118         riscv_tcg_cpu_finalize_features(cpu, &local_err);
1119         if (local_err != NULL) {
1120             error_propagate(errp, local_err);
1121             return;
1122         }
1123     } else if (kvm_enabled()) {
1124         riscv_kvm_cpu_finalize_features(cpu, &local_err);
1125         if (local_err != NULL) {
1126             error_propagate(errp, local_err);
1127             return;
1128         }
1129     }
1130 }
1131 
1132 static void riscv_cpu_realize(DeviceState *dev, Error **errp)
1133 {
1134     CPUState *cs = CPU(dev);
1135     RISCVCPU *cpu = RISCV_CPU(dev);
1136     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(dev);
1137     Error *local_err = NULL;
1138 
1139     if (object_dynamic_cast(OBJECT(dev), TYPE_RISCV_CPU_ANY) != NULL) {
1140         warn_report("The 'any' CPU is deprecated and will be "
1141                     "removed in the future.");
1142     }
1143 
1144     cpu_exec_realizefn(cs, &local_err);
1145     if (local_err != NULL) {
1146         error_propagate(errp, local_err);
1147         return;
1148     }
1149 
1150     riscv_cpu_finalize_features(cpu, &local_err);
1151     if (local_err != NULL) {
1152         error_propagate(errp, local_err);
1153         return;
1154     }
1155 
1156     riscv_cpu_register_gdb_regs_for_features(cs);
1157 
1158 #ifndef CONFIG_USER_ONLY
1159     if (cpu->cfg.debug) {
1160         riscv_trigger_realize(&cpu->env);
1161     }
1162 #endif
1163 
1164     qemu_init_vcpu(cs);
1165     cpu_reset(cs);
1166 
1167     mcc->parent_realize(dev, errp);
1168 }
1169 
1170 bool riscv_cpu_accelerator_compatible(RISCVCPU *cpu)
1171 {
1172     if (tcg_enabled()) {
1173         return riscv_cpu_tcg_compatible(cpu);
1174     }
1175 
1176     return true;
1177 }
1178 
1179 #ifndef CONFIG_USER_ONLY
1180 static void cpu_riscv_get_satp(Object *obj, Visitor *v, const char *name,
1181                                void *opaque, Error **errp)
1182 {
1183     RISCVSATPMap *satp_map = opaque;
1184     uint8_t satp = satp_mode_from_str(name);
1185     bool value;
1186 
1187     value = satp_map->map & (1 << satp);
1188 
1189     visit_type_bool(v, name, &value, errp);
1190 }
1191 
1192 static void cpu_riscv_set_satp(Object *obj, Visitor *v, const char *name,
1193                                void *opaque, Error **errp)
1194 {
1195     RISCVSATPMap *satp_map = opaque;
1196     uint8_t satp = satp_mode_from_str(name);
1197     bool value;
1198 
1199     if (!visit_type_bool(v, name, &value, errp)) {
1200         return;
1201     }
1202 
1203     satp_map->map = deposit32(satp_map->map, satp, 1, value);
1204     satp_map->init |= 1 << satp;
1205 }
1206 
1207 void riscv_add_satp_mode_properties(Object *obj)
1208 {
1209     RISCVCPU *cpu = RISCV_CPU(obj);
1210 
1211     if (cpu->env.misa_mxl == MXL_RV32) {
1212         object_property_add(obj, "sv32", "bool", cpu_riscv_get_satp,
1213                             cpu_riscv_set_satp, NULL, &cpu->cfg.satp_mode);
1214     } else {
1215         object_property_add(obj, "sv39", "bool", cpu_riscv_get_satp,
1216                             cpu_riscv_set_satp, NULL, &cpu->cfg.satp_mode);
1217         object_property_add(obj, "sv48", "bool", cpu_riscv_get_satp,
1218                             cpu_riscv_set_satp, NULL, &cpu->cfg.satp_mode);
1219         object_property_add(obj, "sv57", "bool", cpu_riscv_get_satp,
1220                             cpu_riscv_set_satp, NULL, &cpu->cfg.satp_mode);
1221         object_property_add(obj, "sv64", "bool", cpu_riscv_get_satp,
1222                             cpu_riscv_set_satp, NULL, &cpu->cfg.satp_mode);
1223     }
1224 }
1225 
1226 static void riscv_cpu_set_irq(void *opaque, int irq, int level)
1227 {
1228     RISCVCPU *cpu = RISCV_CPU(opaque);
1229     CPURISCVState *env = &cpu->env;
1230 
1231     if (irq < IRQ_LOCAL_MAX) {
1232         switch (irq) {
1233         case IRQ_U_SOFT:
1234         case IRQ_S_SOFT:
1235         case IRQ_VS_SOFT:
1236         case IRQ_M_SOFT:
1237         case IRQ_U_TIMER:
1238         case IRQ_S_TIMER:
1239         case IRQ_VS_TIMER:
1240         case IRQ_M_TIMER:
1241         case IRQ_U_EXT:
1242         case IRQ_VS_EXT:
1243         case IRQ_M_EXT:
1244             if (kvm_enabled()) {
1245                 kvm_riscv_set_irq(cpu, irq, level);
1246             } else {
1247                 riscv_cpu_update_mip(env, 1 << irq, BOOL_TO_MASK(level));
1248             }
1249              break;
1250         case IRQ_S_EXT:
1251             if (kvm_enabled()) {
1252                 kvm_riscv_set_irq(cpu, irq, level);
1253             } else {
1254                 env->external_seip = level;
1255                 riscv_cpu_update_mip(env, 1 << irq,
1256                                      BOOL_TO_MASK(level | env->software_seip));
1257             }
1258             break;
1259         default:
1260             g_assert_not_reached();
1261         }
1262     } else if (irq < (IRQ_LOCAL_MAX + IRQ_LOCAL_GUEST_MAX)) {
1263         /* Require H-extension for handling guest local interrupts */
1264         if (!riscv_has_ext(env, RVH)) {
1265             g_assert_not_reached();
1266         }
1267 
1268         /* Compute bit position in HGEIP CSR */
1269         irq = irq - IRQ_LOCAL_MAX + 1;
1270         if (env->geilen < irq) {
1271             g_assert_not_reached();
1272         }
1273 
1274         /* Update HGEIP CSR */
1275         env->hgeip &= ~((target_ulong)1 << irq);
1276         if (level) {
1277             env->hgeip |= (target_ulong)1 << irq;
1278         }
1279 
1280         /* Update mip.SGEIP bit */
1281         riscv_cpu_update_mip(env, MIP_SGEIP,
1282                              BOOL_TO_MASK(!!(env->hgeie & env->hgeip)));
1283     } else {
1284         g_assert_not_reached();
1285     }
1286 }
1287 #endif /* CONFIG_USER_ONLY */
1288 
1289 static bool riscv_cpu_is_dynamic(Object *cpu_obj)
1290 {
1291     return object_dynamic_cast(cpu_obj, TYPE_RISCV_DYNAMIC_CPU) != NULL;
1292 }
1293 
1294 static void riscv_cpu_post_init(Object *obj)
1295 {
1296     accel_cpu_instance_init(CPU(obj));
1297 }
1298 
1299 static void riscv_cpu_init(Object *obj)
1300 {
1301     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(obj);
1302     RISCVCPU *cpu = RISCV_CPU(obj);
1303     CPURISCVState *env = &cpu->env;
1304 
1305     env->misa_mxl = mcc->misa_mxl_max;
1306 
1307 #ifndef CONFIG_USER_ONLY
1308     qdev_init_gpio_in(DEVICE(obj), riscv_cpu_set_irq,
1309                       IRQ_LOCAL_MAX + IRQ_LOCAL_GUEST_MAX);
1310 #endif /* CONFIG_USER_ONLY */
1311 
1312     general_user_opts = g_hash_table_new(g_str_hash, g_str_equal);
1313 
1314     /*
1315      * The timer and performance counters extensions were supported
1316      * in QEMU before they were added as discrete extensions in the
1317      * ISA. To keep compatibility we'll always default them to 'true'
1318      * for all CPUs. Each accelerator will decide what to do when
1319      * users disable them.
1320      */
1321     RISCV_CPU(obj)->cfg.ext_zicntr = true;
1322     RISCV_CPU(obj)->cfg.ext_zihpm = true;
1323 
1324     /* Default values for non-bool cpu properties */
1325     cpu->cfg.pmu_mask = MAKE_64BIT_MASK(3, 16);
1326     cpu->cfg.vlenb = 128 >> 3;
1327     cpu->cfg.elen = 64;
1328     cpu->cfg.cbom_blocksize = 64;
1329     cpu->cfg.cbop_blocksize = 64;
1330     cpu->cfg.cboz_blocksize = 64;
1331     cpu->env.vext_ver = VEXT_VERSION_1_00_0;
1332 }
1333 
1334 static void riscv_bare_cpu_init(Object *obj)
1335 {
1336     RISCVCPU *cpu = RISCV_CPU(obj);
1337 
1338     /*
1339      * Bare CPUs do not inherit the timer and performance
1340      * counters from the parent class (see riscv_cpu_init()
1341      * for info on why the parent enables them).
1342      *
1343      * Users have to explicitly enable these counters for
1344      * bare CPUs.
1345      */
1346     cpu->cfg.ext_zicntr = false;
1347     cpu->cfg.ext_zihpm = false;
1348 
1349     /* Set to QEMU's first supported priv version */
1350     cpu->env.priv_ver = PRIV_VERSION_1_10_0;
1351 
1352     /*
1353      * Support all available satp_mode settings. The default
1354      * value will be set to MBARE if the user doesn't set
1355      * satp_mode manually (see set_satp_mode_default()).
1356      */
1357 #ifndef CONFIG_USER_ONLY
1358     set_satp_mode_max_supported(cpu, VM_1_10_SV64);
1359 #endif
1360 }
1361 
1362 typedef struct misa_ext_info {
1363     const char *name;
1364     const char *description;
1365 } MISAExtInfo;
1366 
1367 #define MISA_INFO_IDX(_bit) \
1368     __builtin_ctz(_bit)
1369 
1370 #define MISA_EXT_INFO(_bit, _propname, _descr) \
1371     [MISA_INFO_IDX(_bit)] = {.name = _propname, .description = _descr}
1372 
1373 static const MISAExtInfo misa_ext_info_arr[] = {
1374     MISA_EXT_INFO(RVA, "a", "Atomic instructions"),
1375     MISA_EXT_INFO(RVC, "c", "Compressed instructions"),
1376     MISA_EXT_INFO(RVD, "d", "Double-precision float point"),
1377     MISA_EXT_INFO(RVF, "f", "Single-precision float point"),
1378     MISA_EXT_INFO(RVI, "i", "Base integer instruction set"),
1379     MISA_EXT_INFO(RVE, "e", "Base integer instruction set (embedded)"),
1380     MISA_EXT_INFO(RVM, "m", "Integer multiplication and division"),
1381     MISA_EXT_INFO(RVS, "s", "Supervisor-level instructions"),
1382     MISA_EXT_INFO(RVU, "u", "User-level instructions"),
1383     MISA_EXT_INFO(RVH, "h", "Hypervisor"),
1384     MISA_EXT_INFO(RVJ, "x-j", "Dynamic translated languages"),
1385     MISA_EXT_INFO(RVV, "v", "Vector operations"),
1386     MISA_EXT_INFO(RVG, "g", "General purpose (IMAFD_Zicsr_Zifencei)"),
1387     MISA_EXT_INFO(RVB, "x-b", "Bit manipulation (Zba_Zbb_Zbs)")
1388 };
1389 
1390 static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
1391 {
1392     CPUClass *cc = CPU_CLASS(mcc);
1393 
1394     /* Validate that MISA_MXL is set properly. */
1395     switch (mcc->misa_mxl_max) {
1396 #ifdef TARGET_RISCV64
1397     case MXL_RV64:
1398     case MXL_RV128:
1399         cc->gdb_core_xml_file = "riscv-64bit-cpu.xml";
1400         break;
1401 #endif
1402     case MXL_RV32:
1403         cc->gdb_core_xml_file = "riscv-32bit-cpu.xml";
1404         break;
1405     default:
1406         g_assert_not_reached();
1407     }
1408 }
1409 
1410 static int riscv_validate_misa_info_idx(uint32_t bit)
1411 {
1412     int idx;
1413 
1414     /*
1415      * Our lowest valid input (RVA) is 1 and
1416      * __builtin_ctz() is UB with zero.
1417      */
1418     g_assert(bit != 0);
1419     idx = MISA_INFO_IDX(bit);
1420 
1421     g_assert(idx < ARRAY_SIZE(misa_ext_info_arr));
1422     return idx;
1423 }
1424 
1425 const char *riscv_get_misa_ext_name(uint32_t bit)
1426 {
1427     int idx = riscv_validate_misa_info_idx(bit);
1428     const char *val = misa_ext_info_arr[idx].name;
1429 
1430     g_assert(val != NULL);
1431     return val;
1432 }
1433 
1434 const char *riscv_get_misa_ext_description(uint32_t bit)
1435 {
1436     int idx = riscv_validate_misa_info_idx(bit);
1437     const char *val = misa_ext_info_arr[idx].description;
1438 
1439     g_assert(val != NULL);
1440     return val;
1441 }
1442 
1443 #define MULTI_EXT_CFG_BOOL(_name, _prop, _defval) \
1444     {.name = _name, .offset = CPU_CFG_OFFSET(_prop), \
1445      .enabled = _defval}
1446 
1447 const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = {
1448     /* Defaults for standard extensions */
1449     MULTI_EXT_CFG_BOOL("sscofpmf", ext_sscofpmf, false),
1450     MULTI_EXT_CFG_BOOL("zifencei", ext_zifencei, true),
1451     MULTI_EXT_CFG_BOOL("zicsr", ext_zicsr, true),
1452     MULTI_EXT_CFG_BOOL("zihintntl", ext_zihintntl, true),
1453     MULTI_EXT_CFG_BOOL("zihintpause", ext_zihintpause, true),
1454     MULTI_EXT_CFG_BOOL("zacas", ext_zacas, false),
1455     MULTI_EXT_CFG_BOOL("zawrs", ext_zawrs, true),
1456     MULTI_EXT_CFG_BOOL("zfa", ext_zfa, true),
1457     MULTI_EXT_CFG_BOOL("zfh", ext_zfh, false),
1458     MULTI_EXT_CFG_BOOL("zfhmin", ext_zfhmin, false),
1459     MULTI_EXT_CFG_BOOL("zve32f", ext_zve32f, false),
1460     MULTI_EXT_CFG_BOOL("zve64f", ext_zve64f, false),
1461     MULTI_EXT_CFG_BOOL("zve64d", ext_zve64d, false),
1462     MULTI_EXT_CFG_BOOL("sstc", ext_sstc, true),
1463 
1464     MULTI_EXT_CFG_BOOL("smepmp", ext_smepmp, false),
1465     MULTI_EXT_CFG_BOOL("smstateen", ext_smstateen, false),
1466     MULTI_EXT_CFG_BOOL("svadu", ext_svadu, true),
1467     MULTI_EXT_CFG_BOOL("svinval", ext_svinval, false),
1468     MULTI_EXT_CFG_BOOL("svnapot", ext_svnapot, false),
1469     MULTI_EXT_CFG_BOOL("svpbmt", ext_svpbmt, false),
1470 
1471     MULTI_EXT_CFG_BOOL("zicntr", ext_zicntr, true),
1472     MULTI_EXT_CFG_BOOL("zihpm", ext_zihpm, true),
1473 
1474     MULTI_EXT_CFG_BOOL("zba", ext_zba, true),
1475     MULTI_EXT_CFG_BOOL("zbb", ext_zbb, true),
1476     MULTI_EXT_CFG_BOOL("zbc", ext_zbc, true),
1477     MULTI_EXT_CFG_BOOL("zbkb", ext_zbkb, false),
1478     MULTI_EXT_CFG_BOOL("zbkc", ext_zbkc, false),
1479     MULTI_EXT_CFG_BOOL("zbkx", ext_zbkx, false),
1480     MULTI_EXT_CFG_BOOL("zbs", ext_zbs, true),
1481     MULTI_EXT_CFG_BOOL("zk", ext_zk, false),
1482     MULTI_EXT_CFG_BOOL("zkn", ext_zkn, false),
1483     MULTI_EXT_CFG_BOOL("zknd", ext_zknd, false),
1484     MULTI_EXT_CFG_BOOL("zkne", ext_zkne, false),
1485     MULTI_EXT_CFG_BOOL("zknh", ext_zknh, false),
1486     MULTI_EXT_CFG_BOOL("zkr", ext_zkr, false),
1487     MULTI_EXT_CFG_BOOL("zks", ext_zks, false),
1488     MULTI_EXT_CFG_BOOL("zksed", ext_zksed, false),
1489     MULTI_EXT_CFG_BOOL("zksh", ext_zksh, false),
1490     MULTI_EXT_CFG_BOOL("zkt", ext_zkt, false),
1491 
1492     MULTI_EXT_CFG_BOOL("zdinx", ext_zdinx, false),
1493     MULTI_EXT_CFG_BOOL("zfinx", ext_zfinx, false),
1494     MULTI_EXT_CFG_BOOL("zhinx", ext_zhinx, false),
1495     MULTI_EXT_CFG_BOOL("zhinxmin", ext_zhinxmin, false),
1496 
1497     MULTI_EXT_CFG_BOOL("zicbom", ext_zicbom, true),
1498     MULTI_EXT_CFG_BOOL("zicbop", ext_zicbop, true),
1499     MULTI_EXT_CFG_BOOL("zicboz", ext_zicboz, true),
1500 
1501     MULTI_EXT_CFG_BOOL("zmmul", ext_zmmul, false),
1502 
1503     MULTI_EXT_CFG_BOOL("zca", ext_zca, false),
1504     MULTI_EXT_CFG_BOOL("zcb", ext_zcb, false),
1505     MULTI_EXT_CFG_BOOL("zcd", ext_zcd, false),
1506     MULTI_EXT_CFG_BOOL("zce", ext_zce, false),
1507     MULTI_EXT_CFG_BOOL("zcf", ext_zcf, false),
1508     MULTI_EXT_CFG_BOOL("zcmp", ext_zcmp, false),
1509     MULTI_EXT_CFG_BOOL("zcmt", ext_zcmt, false),
1510     MULTI_EXT_CFG_BOOL("zicond", ext_zicond, false),
1511 
1512     /* Vector cryptography extensions */
1513     MULTI_EXT_CFG_BOOL("zvbb", ext_zvbb, false),
1514     MULTI_EXT_CFG_BOOL("zvbc", ext_zvbc, false),
1515     MULTI_EXT_CFG_BOOL("zvkb", ext_zvkg, false),
1516     MULTI_EXT_CFG_BOOL("zvkg", ext_zvkg, false),
1517     MULTI_EXT_CFG_BOOL("zvkned", ext_zvkned, false),
1518     MULTI_EXT_CFG_BOOL("zvknha", ext_zvknha, false),
1519     MULTI_EXT_CFG_BOOL("zvknhb", ext_zvknhb, false),
1520     MULTI_EXT_CFG_BOOL("zvksed", ext_zvksed, false),
1521     MULTI_EXT_CFG_BOOL("zvksh", ext_zvksh, false),
1522     MULTI_EXT_CFG_BOOL("zvkt", ext_zvkt, false),
1523     MULTI_EXT_CFG_BOOL("zvkn", ext_zvkn, false),
1524     MULTI_EXT_CFG_BOOL("zvknc", ext_zvknc, false),
1525     MULTI_EXT_CFG_BOOL("zvkng", ext_zvkng, false),
1526     MULTI_EXT_CFG_BOOL("zvks", ext_zvks, false),
1527     MULTI_EXT_CFG_BOOL("zvksc", ext_zvksc, false),
1528     MULTI_EXT_CFG_BOOL("zvksg", ext_zvksg, false),
1529 
1530     DEFINE_PROP_END_OF_LIST(),
1531 };
1532 
1533 const RISCVCPUMultiExtConfig riscv_cpu_vendor_exts[] = {
1534     MULTI_EXT_CFG_BOOL("xtheadba", ext_xtheadba, false),
1535     MULTI_EXT_CFG_BOOL("xtheadbb", ext_xtheadbb, false),
1536     MULTI_EXT_CFG_BOOL("xtheadbs", ext_xtheadbs, false),
1537     MULTI_EXT_CFG_BOOL("xtheadcmo", ext_xtheadcmo, false),
1538     MULTI_EXT_CFG_BOOL("xtheadcondmov", ext_xtheadcondmov, false),
1539     MULTI_EXT_CFG_BOOL("xtheadfmemidx", ext_xtheadfmemidx, false),
1540     MULTI_EXT_CFG_BOOL("xtheadfmv", ext_xtheadfmv, false),
1541     MULTI_EXT_CFG_BOOL("xtheadmac", ext_xtheadmac, false),
1542     MULTI_EXT_CFG_BOOL("xtheadmemidx", ext_xtheadmemidx, false),
1543     MULTI_EXT_CFG_BOOL("xtheadmempair", ext_xtheadmempair, false),
1544     MULTI_EXT_CFG_BOOL("xtheadsync", ext_xtheadsync, false),
1545     MULTI_EXT_CFG_BOOL("xventanacondops", ext_XVentanaCondOps, false),
1546 
1547     DEFINE_PROP_END_OF_LIST(),
1548 };
1549 
1550 /* These are experimental so mark with 'x-' */
1551 const RISCVCPUMultiExtConfig riscv_cpu_experimental_exts[] = {
1552     MULTI_EXT_CFG_BOOL("x-smaia", ext_smaia, false),
1553     MULTI_EXT_CFG_BOOL("x-ssaia", ext_ssaia, false),
1554 
1555     MULTI_EXT_CFG_BOOL("x-zaamo", ext_zaamo, false),
1556     MULTI_EXT_CFG_BOOL("x-zalrsc", ext_zalrsc, false),
1557 
1558     MULTI_EXT_CFG_BOOL("x-zvfh", ext_zvfh, false),
1559     MULTI_EXT_CFG_BOOL("x-zvfhmin", ext_zvfhmin, false),
1560 
1561     MULTI_EXT_CFG_BOOL("x-zfbfmin", ext_zfbfmin, false),
1562     MULTI_EXT_CFG_BOOL("x-zvfbfmin", ext_zvfbfmin, false),
1563     MULTI_EXT_CFG_BOOL("x-zvfbfwma", ext_zvfbfwma, false),
1564 
1565     DEFINE_PROP_END_OF_LIST(),
1566 };
1567 
1568 const RISCVCPUMultiExtConfig riscv_cpu_named_features[] = {
1569     MULTI_EXT_CFG_BOOL("svade", svade, true),
1570     MULTI_EXT_CFG_BOOL("zic64b", zic64b, true),
1571 
1572     DEFINE_PROP_END_OF_LIST(),
1573 };
1574 
1575 /* Deprecated entries marked for future removal */
1576 const RISCVCPUMultiExtConfig riscv_cpu_deprecated_exts[] = {
1577     MULTI_EXT_CFG_BOOL("Zifencei", ext_zifencei, true),
1578     MULTI_EXT_CFG_BOOL("Zicsr", ext_zicsr, true),
1579     MULTI_EXT_CFG_BOOL("Zihintntl", ext_zihintntl, true),
1580     MULTI_EXT_CFG_BOOL("Zihintpause", ext_zihintpause, true),
1581     MULTI_EXT_CFG_BOOL("Zawrs", ext_zawrs, true),
1582     MULTI_EXT_CFG_BOOL("Zfa", ext_zfa, true),
1583     MULTI_EXT_CFG_BOOL("Zfh", ext_zfh, false),
1584     MULTI_EXT_CFG_BOOL("Zfhmin", ext_zfhmin, false),
1585     MULTI_EXT_CFG_BOOL("Zve32f", ext_zve32f, false),
1586     MULTI_EXT_CFG_BOOL("Zve64f", ext_zve64f, false),
1587     MULTI_EXT_CFG_BOOL("Zve64d", ext_zve64d, false),
1588 
1589     DEFINE_PROP_END_OF_LIST(),
1590 };
1591 
1592 static void cpu_set_prop_err(RISCVCPU *cpu, const char *propname,
1593                              Error **errp)
1594 {
1595     g_autofree char *cpuname = riscv_cpu_get_name(cpu);
1596     error_setg(errp, "CPU '%s' does not allow changing the value of '%s'",
1597                cpuname, propname);
1598 }
1599 
1600 static void prop_pmu_num_set(Object *obj, Visitor *v, const char *name,
1601                              void *opaque, Error **errp)
1602 {
1603     RISCVCPU *cpu = RISCV_CPU(obj);
1604     uint8_t pmu_num, curr_pmu_num;
1605     uint32_t pmu_mask;
1606 
1607     visit_type_uint8(v, name, &pmu_num, errp);
1608 
1609     curr_pmu_num = ctpop32(cpu->cfg.pmu_mask);
1610 
1611     if (pmu_num != curr_pmu_num && riscv_cpu_is_vendor(obj)) {
1612         cpu_set_prop_err(cpu, name, errp);
1613         error_append_hint(errp, "Current '%s' val: %u\n",
1614                           name, curr_pmu_num);
1615         return;
1616     }
1617 
1618     if (pmu_num > (RV_MAX_MHPMCOUNTERS - 3)) {
1619         error_setg(errp, "Number of counters exceeds maximum available");
1620         return;
1621     }
1622 
1623     if (pmu_num == 0) {
1624         pmu_mask = 0;
1625     } else {
1626         pmu_mask = MAKE_64BIT_MASK(3, pmu_num);
1627     }
1628 
1629     warn_report("\"pmu-num\" property is deprecated; use \"pmu-mask\"");
1630     cpu->cfg.pmu_mask = pmu_mask;
1631     cpu_option_add_user_setting("pmu-mask", pmu_mask);
1632 }
1633 
1634 static void prop_pmu_num_get(Object *obj, Visitor *v, const char *name,
1635                              void *opaque, Error **errp)
1636 {
1637     RISCVCPU *cpu = RISCV_CPU(obj);
1638     uint8_t pmu_num = ctpop32(cpu->cfg.pmu_mask);
1639 
1640     visit_type_uint8(v, name, &pmu_num, errp);
1641 }
1642 
1643 static const PropertyInfo prop_pmu_num = {
1644     .name = "pmu-num",
1645     .get = prop_pmu_num_get,
1646     .set = prop_pmu_num_set,
1647 };
1648 
1649 static void prop_pmu_mask_set(Object *obj, Visitor *v, const char *name,
1650                              void *opaque, Error **errp)
1651 {
1652     RISCVCPU *cpu = RISCV_CPU(obj);
1653     uint32_t value;
1654     uint8_t pmu_num;
1655 
1656     visit_type_uint32(v, name, &value, errp);
1657 
1658     if (value != cpu->cfg.pmu_mask && riscv_cpu_is_vendor(obj)) {
1659         cpu_set_prop_err(cpu, name, errp);
1660         error_append_hint(errp, "Current '%s' val: %x\n",
1661                           name, cpu->cfg.pmu_mask);
1662         return;
1663     }
1664 
1665     pmu_num = ctpop32(value);
1666 
1667     if (pmu_num > (RV_MAX_MHPMCOUNTERS - 3)) {
1668         error_setg(errp, "Number of counters exceeds maximum available");
1669         return;
1670     }
1671 
1672     cpu_option_add_user_setting(name, value);
1673     cpu->cfg.pmu_mask = value;
1674 }
1675 
1676 static void prop_pmu_mask_get(Object *obj, Visitor *v, const char *name,
1677                              void *opaque, Error **errp)
1678 {
1679     uint8_t pmu_mask = RISCV_CPU(obj)->cfg.pmu_mask;
1680 
1681     visit_type_uint8(v, name, &pmu_mask, errp);
1682 }
1683 
1684 static const PropertyInfo prop_pmu_mask = {
1685     .name = "pmu-mask",
1686     .get = prop_pmu_mask_get,
1687     .set = prop_pmu_mask_set,
1688 };
1689 
1690 static void prop_mmu_set(Object *obj, Visitor *v, const char *name,
1691                          void *opaque, Error **errp)
1692 {
1693     RISCVCPU *cpu = RISCV_CPU(obj);
1694     bool value;
1695 
1696     visit_type_bool(v, name, &value, errp);
1697 
1698     if (cpu->cfg.mmu != value && riscv_cpu_is_vendor(obj)) {
1699         cpu_set_prop_err(cpu, "mmu", errp);
1700         return;
1701     }
1702 
1703     cpu_option_add_user_setting(name, value);
1704     cpu->cfg.mmu = value;
1705 }
1706 
1707 static void prop_mmu_get(Object *obj, Visitor *v, const char *name,
1708                          void *opaque, Error **errp)
1709 {
1710     bool value = RISCV_CPU(obj)->cfg.mmu;
1711 
1712     visit_type_bool(v, name, &value, errp);
1713 }
1714 
1715 static const PropertyInfo prop_mmu = {
1716     .name = "mmu",
1717     .get = prop_mmu_get,
1718     .set = prop_mmu_set,
1719 };
1720 
1721 static void prop_pmp_set(Object *obj, Visitor *v, const char *name,
1722                          void *opaque, Error **errp)
1723 {
1724     RISCVCPU *cpu = RISCV_CPU(obj);
1725     bool value;
1726 
1727     visit_type_bool(v, name, &value, errp);
1728 
1729     if (cpu->cfg.pmp != value && riscv_cpu_is_vendor(obj)) {
1730         cpu_set_prop_err(cpu, name, errp);
1731         return;
1732     }
1733 
1734     cpu_option_add_user_setting(name, value);
1735     cpu->cfg.pmp = value;
1736 }
1737 
1738 static void prop_pmp_get(Object *obj, Visitor *v, const char *name,
1739                          void *opaque, Error **errp)
1740 {
1741     bool value = RISCV_CPU(obj)->cfg.pmp;
1742 
1743     visit_type_bool(v, name, &value, errp);
1744 }
1745 
1746 static const PropertyInfo prop_pmp = {
1747     .name = "pmp",
1748     .get = prop_pmp_get,
1749     .set = prop_pmp_set,
1750 };
1751 
1752 static int priv_spec_from_str(const char *priv_spec_str)
1753 {
1754     int priv_version = -1;
1755 
1756     if (!g_strcmp0(priv_spec_str, PRIV_VER_1_12_0_STR)) {
1757         priv_version = PRIV_VERSION_1_12_0;
1758     } else if (!g_strcmp0(priv_spec_str, PRIV_VER_1_11_0_STR)) {
1759         priv_version = PRIV_VERSION_1_11_0;
1760     } else if (!g_strcmp0(priv_spec_str, PRIV_VER_1_10_0_STR)) {
1761         priv_version = PRIV_VERSION_1_10_0;
1762     }
1763 
1764     return priv_version;
1765 }
1766 
1767 static const char *priv_spec_to_str(int priv_version)
1768 {
1769     switch (priv_version) {
1770     case PRIV_VERSION_1_10_0:
1771         return PRIV_VER_1_10_0_STR;
1772     case PRIV_VERSION_1_11_0:
1773         return PRIV_VER_1_11_0_STR;
1774     case PRIV_VERSION_1_12_0:
1775         return PRIV_VER_1_12_0_STR;
1776     default:
1777         return NULL;
1778     }
1779 }
1780 
1781 static void prop_priv_spec_set(Object *obj, Visitor *v, const char *name,
1782                                void *opaque, Error **errp)
1783 {
1784     RISCVCPU *cpu = RISCV_CPU(obj);
1785     g_autofree char *value = NULL;
1786     int priv_version = -1;
1787 
1788     visit_type_str(v, name, &value, errp);
1789 
1790     priv_version = priv_spec_from_str(value);
1791     if (priv_version < 0) {
1792         error_setg(errp, "Unsupported privilege spec version '%s'", value);
1793         return;
1794     }
1795 
1796     if (priv_version != cpu->env.priv_ver && riscv_cpu_is_vendor(obj)) {
1797         cpu_set_prop_err(cpu, name, errp);
1798         error_append_hint(errp, "Current '%s' val: %s\n", name,
1799                           object_property_get_str(obj, name, NULL));
1800         return;
1801     }
1802 
1803     cpu_option_add_user_setting(name, priv_version);
1804     cpu->env.priv_ver = priv_version;
1805 }
1806 
1807 static void prop_priv_spec_get(Object *obj, Visitor *v, const char *name,
1808                                void *opaque, Error **errp)
1809 {
1810     RISCVCPU *cpu = RISCV_CPU(obj);
1811     const char *value = priv_spec_to_str(cpu->env.priv_ver);
1812 
1813     visit_type_str(v, name, (char **)&value, errp);
1814 }
1815 
1816 static const PropertyInfo prop_priv_spec = {
1817     .name = "priv_spec",
1818     .get = prop_priv_spec_get,
1819     .set = prop_priv_spec_set,
1820 };
1821 
1822 static void prop_vext_spec_set(Object *obj, Visitor *v, const char *name,
1823                                void *opaque, Error **errp)
1824 {
1825     RISCVCPU *cpu = RISCV_CPU(obj);
1826     g_autofree char *value = NULL;
1827 
1828     visit_type_str(v, name, &value, errp);
1829 
1830     if (g_strcmp0(value, VEXT_VER_1_00_0_STR) != 0) {
1831         error_setg(errp, "Unsupported vector spec version '%s'", value);
1832         return;
1833     }
1834 
1835     cpu_option_add_user_setting(name, VEXT_VERSION_1_00_0);
1836     cpu->env.vext_ver = VEXT_VERSION_1_00_0;
1837 }
1838 
1839 static void prop_vext_spec_get(Object *obj, Visitor *v, const char *name,
1840                                void *opaque, Error **errp)
1841 {
1842     const char *value = VEXT_VER_1_00_0_STR;
1843 
1844     visit_type_str(v, name, (char **)&value, errp);
1845 }
1846 
1847 static const PropertyInfo prop_vext_spec = {
1848     .name = "vext_spec",
1849     .get = prop_vext_spec_get,
1850     .set = prop_vext_spec_set,
1851 };
1852 
1853 static void prop_vlen_set(Object *obj, Visitor *v, const char *name,
1854                          void *opaque, Error **errp)
1855 {
1856     RISCVCPU *cpu = RISCV_CPU(obj);
1857     uint16_t value;
1858 
1859     if (!visit_type_uint16(v, name, &value, errp)) {
1860         return;
1861     }
1862 
1863     if (!is_power_of_2(value)) {
1864         error_setg(errp, "Vector extension VLEN must be power of 2");
1865         return;
1866     }
1867 
1868     if (value != cpu->cfg.vlenb && riscv_cpu_is_vendor(obj)) {
1869         cpu_set_prop_err(cpu, name, errp);
1870         error_append_hint(errp, "Current '%s' val: %u\n",
1871                           name, cpu->cfg.vlenb << 3);
1872         return;
1873     }
1874 
1875     cpu_option_add_user_setting(name, value);
1876     cpu->cfg.vlenb = value >> 3;
1877 }
1878 
1879 static void prop_vlen_get(Object *obj, Visitor *v, const char *name,
1880                          void *opaque, Error **errp)
1881 {
1882     uint16_t value = RISCV_CPU(obj)->cfg.vlenb << 3;
1883 
1884     visit_type_uint16(v, name, &value, errp);
1885 }
1886 
1887 static const PropertyInfo prop_vlen = {
1888     .name = "vlen",
1889     .get = prop_vlen_get,
1890     .set = prop_vlen_set,
1891 };
1892 
1893 static void prop_elen_set(Object *obj, Visitor *v, const char *name,
1894                          void *opaque, Error **errp)
1895 {
1896     RISCVCPU *cpu = RISCV_CPU(obj);
1897     uint16_t value;
1898 
1899     if (!visit_type_uint16(v, name, &value, errp)) {
1900         return;
1901     }
1902 
1903     if (!is_power_of_2(value)) {
1904         error_setg(errp, "Vector extension ELEN must be power of 2");
1905         return;
1906     }
1907 
1908     if (value != cpu->cfg.elen && riscv_cpu_is_vendor(obj)) {
1909         cpu_set_prop_err(cpu, name, errp);
1910         error_append_hint(errp, "Current '%s' val: %u\n",
1911                           name, cpu->cfg.elen);
1912         return;
1913     }
1914 
1915     cpu_option_add_user_setting(name, value);
1916     cpu->cfg.elen = value;
1917 }
1918 
1919 static void prop_elen_get(Object *obj, Visitor *v, const char *name,
1920                          void *opaque, Error **errp)
1921 {
1922     uint16_t value = RISCV_CPU(obj)->cfg.elen;
1923 
1924     visit_type_uint16(v, name, &value, errp);
1925 }
1926 
1927 static const PropertyInfo prop_elen = {
1928     .name = "elen",
1929     .get = prop_elen_get,
1930     .set = prop_elen_set,
1931 };
1932 
1933 static void prop_cbom_blksize_set(Object *obj, Visitor *v, const char *name,
1934                                   void *opaque, Error **errp)
1935 {
1936     RISCVCPU *cpu = RISCV_CPU(obj);
1937     uint16_t value;
1938 
1939     if (!visit_type_uint16(v, name, &value, errp)) {
1940         return;
1941     }
1942 
1943     if (value != cpu->cfg.cbom_blocksize && riscv_cpu_is_vendor(obj)) {
1944         cpu_set_prop_err(cpu, name, errp);
1945         error_append_hint(errp, "Current '%s' val: %u\n",
1946                           name, cpu->cfg.cbom_blocksize);
1947         return;
1948     }
1949 
1950     cpu_option_add_user_setting(name, value);
1951     cpu->cfg.cbom_blocksize = value;
1952 }
1953 
1954 static void prop_cbom_blksize_get(Object *obj, Visitor *v, const char *name,
1955                          void *opaque, Error **errp)
1956 {
1957     uint16_t value = RISCV_CPU(obj)->cfg.cbom_blocksize;
1958 
1959     visit_type_uint16(v, name, &value, errp);
1960 }
1961 
1962 static const PropertyInfo prop_cbom_blksize = {
1963     .name = "cbom_blocksize",
1964     .get = prop_cbom_blksize_get,
1965     .set = prop_cbom_blksize_set,
1966 };
1967 
1968 static void prop_cbop_blksize_set(Object *obj, Visitor *v, const char *name,
1969                                   void *opaque, Error **errp)
1970 {
1971     RISCVCPU *cpu = RISCV_CPU(obj);
1972     uint16_t value;
1973 
1974     if (!visit_type_uint16(v, name, &value, errp)) {
1975         return;
1976     }
1977 
1978     if (value != cpu->cfg.cbop_blocksize && riscv_cpu_is_vendor(obj)) {
1979         cpu_set_prop_err(cpu, name, errp);
1980         error_append_hint(errp, "Current '%s' val: %u\n",
1981                           name, cpu->cfg.cbop_blocksize);
1982         return;
1983     }
1984 
1985     cpu_option_add_user_setting(name, value);
1986     cpu->cfg.cbop_blocksize = value;
1987 }
1988 
1989 static void prop_cbop_blksize_get(Object *obj, Visitor *v, const char *name,
1990                          void *opaque, Error **errp)
1991 {
1992     uint16_t value = RISCV_CPU(obj)->cfg.cbop_blocksize;
1993 
1994     visit_type_uint16(v, name, &value, errp);
1995 }
1996 
1997 static const PropertyInfo prop_cbop_blksize = {
1998     .name = "cbop_blocksize",
1999     .get = prop_cbop_blksize_get,
2000     .set = prop_cbop_blksize_set,
2001 };
2002 
2003 static void prop_cboz_blksize_set(Object *obj, Visitor *v, const char *name,
2004                                   void *opaque, Error **errp)
2005 {
2006     RISCVCPU *cpu = RISCV_CPU(obj);
2007     uint16_t value;
2008 
2009     if (!visit_type_uint16(v, name, &value, errp)) {
2010         return;
2011     }
2012 
2013     if (value != cpu->cfg.cboz_blocksize && riscv_cpu_is_vendor(obj)) {
2014         cpu_set_prop_err(cpu, name, errp);
2015         error_append_hint(errp, "Current '%s' val: %u\n",
2016                           name, cpu->cfg.cboz_blocksize);
2017         return;
2018     }
2019 
2020     cpu_option_add_user_setting(name, value);
2021     cpu->cfg.cboz_blocksize = value;
2022 }
2023 
2024 static void prop_cboz_blksize_get(Object *obj, Visitor *v, const char *name,
2025                          void *opaque, Error **errp)
2026 {
2027     uint16_t value = RISCV_CPU(obj)->cfg.cboz_blocksize;
2028 
2029     visit_type_uint16(v, name, &value, errp);
2030 }
2031 
2032 static const PropertyInfo prop_cboz_blksize = {
2033     .name = "cboz_blocksize",
2034     .get = prop_cboz_blksize_get,
2035     .set = prop_cboz_blksize_set,
2036 };
2037 
2038 static void prop_mvendorid_set(Object *obj, Visitor *v, const char *name,
2039                                void *opaque, Error **errp)
2040 {
2041     bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
2042     RISCVCPU *cpu = RISCV_CPU(obj);
2043     uint32_t prev_val = cpu->cfg.mvendorid;
2044     uint32_t value;
2045 
2046     if (!visit_type_uint32(v, name, &value, errp)) {
2047         return;
2048     }
2049 
2050     if (!dynamic_cpu && prev_val != value) {
2051         error_setg(errp, "Unable to change %s mvendorid (0x%x)",
2052                    object_get_typename(obj), prev_val);
2053         return;
2054     }
2055 
2056     cpu->cfg.mvendorid = value;
2057 }
2058 
2059 static void prop_mvendorid_get(Object *obj, Visitor *v, const char *name,
2060                                void *opaque, Error **errp)
2061 {
2062     uint32_t value = RISCV_CPU(obj)->cfg.mvendorid;
2063 
2064     visit_type_uint32(v, name, &value, errp);
2065 }
2066 
2067 static const PropertyInfo prop_mvendorid = {
2068     .name = "mvendorid",
2069     .get = prop_mvendorid_get,
2070     .set = prop_mvendorid_set,
2071 };
2072 
2073 static void prop_mimpid_set(Object *obj, Visitor *v, const char *name,
2074                             void *opaque, Error **errp)
2075 {
2076     bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
2077     RISCVCPU *cpu = RISCV_CPU(obj);
2078     uint64_t prev_val = cpu->cfg.mimpid;
2079     uint64_t value;
2080 
2081     if (!visit_type_uint64(v, name, &value, errp)) {
2082         return;
2083     }
2084 
2085     if (!dynamic_cpu && prev_val != value) {
2086         error_setg(errp, "Unable to change %s mimpid (0x%" PRIu64 ")",
2087                    object_get_typename(obj), prev_val);
2088         return;
2089     }
2090 
2091     cpu->cfg.mimpid = value;
2092 }
2093 
2094 static void prop_mimpid_get(Object *obj, Visitor *v, const char *name,
2095                             void *opaque, Error **errp)
2096 {
2097     uint64_t value = RISCV_CPU(obj)->cfg.mimpid;
2098 
2099     visit_type_uint64(v, name, &value, errp);
2100 }
2101 
2102 static const PropertyInfo prop_mimpid = {
2103     .name = "mimpid",
2104     .get = prop_mimpid_get,
2105     .set = prop_mimpid_set,
2106 };
2107 
2108 static void prop_marchid_set(Object *obj, Visitor *v, const char *name,
2109                              void *opaque, Error **errp)
2110 {
2111     bool dynamic_cpu = riscv_cpu_is_dynamic(obj);
2112     RISCVCPU *cpu = RISCV_CPU(obj);
2113     uint64_t prev_val = cpu->cfg.marchid;
2114     uint64_t value, invalid_val;
2115     uint32_t mxlen = 0;
2116 
2117     if (!visit_type_uint64(v, name, &value, errp)) {
2118         return;
2119     }
2120 
2121     if (!dynamic_cpu && prev_val != value) {
2122         error_setg(errp, "Unable to change %s marchid (0x%" PRIu64 ")",
2123                    object_get_typename(obj), prev_val);
2124         return;
2125     }
2126 
2127     switch (riscv_cpu_mxl(&cpu->env)) {
2128     case MXL_RV32:
2129         mxlen = 32;
2130         break;
2131     case MXL_RV64:
2132     case MXL_RV128:
2133         mxlen = 64;
2134         break;
2135     default:
2136         g_assert_not_reached();
2137     }
2138 
2139     invalid_val = 1LL << (mxlen - 1);
2140 
2141     if (value == invalid_val) {
2142         error_setg(errp, "Unable to set marchid with MSB (%u) bit set "
2143                          "and the remaining bits zero", mxlen);
2144         return;
2145     }
2146 
2147     cpu->cfg.marchid = value;
2148 }
2149 
2150 static void prop_marchid_get(Object *obj, Visitor *v, const char *name,
2151                              void *opaque, Error **errp)
2152 {
2153     uint64_t value = RISCV_CPU(obj)->cfg.marchid;
2154 
2155     visit_type_uint64(v, name, &value, errp);
2156 }
2157 
2158 static const PropertyInfo prop_marchid = {
2159     .name = "marchid",
2160     .get = prop_marchid_get,
2161     .set = prop_marchid_set,
2162 };
2163 
2164 /*
2165  * RVA22U64 defines some 'named features' or 'synthetic extensions'
2166  * that are cache related: Za64rs, Zic64b, Ziccif, Ziccrse, Ziccamoa
2167  * and Zicclsm. We do not implement caching in QEMU so we'll consider
2168  * all these named features as always enabled.
2169  *
2170  * There's no riscv,isa update for them (nor for zic64b, despite it
2171  * having a cfg offset) at this moment.
2172  */
2173 static RISCVCPUProfile RVA22U64 = {
2174     .parent = NULL,
2175     .name = "rva22u64",
2176     .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVU,
2177     .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
2178     .satp_mode = RISCV_PROFILE_ATTR_UNUSED,
2179     .ext_offsets = {
2180         CPU_CFG_OFFSET(ext_zicsr), CPU_CFG_OFFSET(ext_zihintpause),
2181         CPU_CFG_OFFSET(ext_zba), CPU_CFG_OFFSET(ext_zbb),
2182         CPU_CFG_OFFSET(ext_zbs), CPU_CFG_OFFSET(ext_zfhmin),
2183         CPU_CFG_OFFSET(ext_zkt), CPU_CFG_OFFSET(ext_zicntr),
2184         CPU_CFG_OFFSET(ext_zihpm), CPU_CFG_OFFSET(ext_zicbom),
2185         CPU_CFG_OFFSET(ext_zicbop), CPU_CFG_OFFSET(ext_zicboz),
2186 
2187         /* mandatory named features for this profile */
2188         CPU_CFG_OFFSET(zic64b),
2189 
2190         RISCV_PROFILE_EXT_LIST_END
2191     }
2192 };
2193 
2194 /*
2195  * As with RVA22U64, RVA22S64 also defines 'named features'.
2196  *
2197  * Cache related features that we consider enabled since we don't
2198  * implement cache: Ssccptr
2199  *
2200  * Other named features that we already implement: Sstvecd, Sstvala,
2201  * Sscounterenw
2202  *
2203  * Named features that we need to enable: svade
2204  *
2205  * The remaining features/extensions comes from RVA22U64.
2206  */
2207 static RISCVCPUProfile RVA22S64 = {
2208     .parent = &RVA22U64,
2209     .name = "rva22s64",
2210     .misa_ext = RVS,
2211     .priv_spec = PRIV_VERSION_1_12_0,
2212     .satp_mode = VM_1_10_SV39,
2213     .ext_offsets = {
2214         /* rva22s64 exts */
2215         CPU_CFG_OFFSET(ext_zifencei), CPU_CFG_OFFSET(ext_svpbmt),
2216         CPU_CFG_OFFSET(ext_svinval),
2217 
2218         /* rva22s64 named features */
2219         CPU_CFG_OFFSET(svade),
2220 
2221         RISCV_PROFILE_EXT_LIST_END
2222     }
2223 };
2224 
2225 RISCVCPUProfile *riscv_profiles[] = {
2226     &RVA22U64,
2227     &RVA22S64,
2228     NULL,
2229 };
2230 
2231 static Property riscv_cpu_properties[] = {
2232     DEFINE_PROP_BOOL("debug", RISCVCPU, cfg.debug, true),
2233 
2234     {.name = "pmu-mask", .info = &prop_pmu_mask},
2235     {.name = "pmu-num", .info = &prop_pmu_num}, /* Deprecated */
2236 
2237     {.name = "mmu", .info = &prop_mmu},
2238     {.name = "pmp", .info = &prop_pmp},
2239 
2240     {.name = "priv_spec", .info = &prop_priv_spec},
2241     {.name = "vext_spec", .info = &prop_vext_spec},
2242 
2243     {.name = "vlen", .info = &prop_vlen},
2244     {.name = "elen", .info = &prop_elen},
2245 
2246     {.name = "cbom_blocksize", .info = &prop_cbom_blksize},
2247     {.name = "cbop_blocksize", .info = &prop_cbop_blksize},
2248     {.name = "cboz_blocksize", .info = &prop_cboz_blksize},
2249 
2250      {.name = "mvendorid", .info = &prop_mvendorid},
2251      {.name = "mimpid", .info = &prop_mimpid},
2252      {.name = "marchid", .info = &prop_marchid},
2253 
2254 #ifndef CONFIG_USER_ONLY
2255     DEFINE_PROP_UINT64("resetvec", RISCVCPU, env.resetvec, DEFAULT_RSTVEC),
2256 #endif
2257 
2258     DEFINE_PROP_BOOL("short-isa-string", RISCVCPU, cfg.short_isa_string, false),
2259 
2260     DEFINE_PROP_BOOL("rvv_ta_all_1s", RISCVCPU, cfg.rvv_ta_all_1s, false),
2261     DEFINE_PROP_BOOL("rvv_ma_all_1s", RISCVCPU, cfg.rvv_ma_all_1s, false),
2262 
2263     /*
2264      * write_misa() is marked as experimental for now so mark
2265      * it with -x and default to 'false'.
2266      */
2267     DEFINE_PROP_BOOL("x-misa-w", RISCVCPU, cfg.misa_w, false),
2268     DEFINE_PROP_END_OF_LIST(),
2269 };
2270 
2271 #if defined(TARGET_RISCV64)
2272 static void rva22u64_profile_cpu_init(Object *obj)
2273 {
2274     rv64i_bare_cpu_init(obj);
2275 
2276     RVA22U64.enabled = true;
2277 }
2278 
2279 static void rva22s64_profile_cpu_init(Object *obj)
2280 {
2281     rv64i_bare_cpu_init(obj);
2282 
2283     RVA22S64.enabled = true;
2284 }
2285 #endif
2286 
2287 static const gchar *riscv_gdb_arch_name(CPUState *cs)
2288 {
2289     RISCVCPU *cpu = RISCV_CPU(cs);
2290     CPURISCVState *env = &cpu->env;
2291 
2292     switch (riscv_cpu_mxl(env)) {
2293     case MXL_RV32:
2294         return "riscv:rv32";
2295     case MXL_RV64:
2296     case MXL_RV128:
2297         return "riscv:rv64";
2298     default:
2299         g_assert_not_reached();
2300     }
2301 }
2302 
2303 static const char *riscv_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
2304 {
2305     RISCVCPU *cpu = RISCV_CPU(cs);
2306 
2307     if (strcmp(xmlname, "riscv-csr.xml") == 0) {
2308         return cpu->dyn_csr_xml;
2309     } else if (strcmp(xmlname, "riscv-vector.xml") == 0) {
2310         return cpu->dyn_vreg_xml;
2311     }
2312 
2313     return NULL;
2314 }
2315 
2316 #ifndef CONFIG_USER_ONLY
2317 static int64_t riscv_get_arch_id(CPUState *cs)
2318 {
2319     RISCVCPU *cpu = RISCV_CPU(cs);
2320 
2321     return cpu->env.mhartid;
2322 }
2323 
2324 #include "hw/core/sysemu-cpu-ops.h"
2325 
2326 static const struct SysemuCPUOps riscv_sysemu_ops = {
2327     .get_phys_page_debug = riscv_cpu_get_phys_page_debug,
2328     .write_elf64_note = riscv_cpu_write_elf64_note,
2329     .write_elf32_note = riscv_cpu_write_elf32_note,
2330     .legacy_vmsd = &vmstate_riscv_cpu,
2331 };
2332 #endif
2333 
2334 static void riscv_cpu_common_class_init(ObjectClass *c, void *data)
2335 {
2336     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
2337     CPUClass *cc = CPU_CLASS(c);
2338     DeviceClass *dc = DEVICE_CLASS(c);
2339     ResettableClass *rc = RESETTABLE_CLASS(c);
2340 
2341     device_class_set_parent_realize(dc, riscv_cpu_realize,
2342                                     &mcc->parent_realize);
2343 
2344     resettable_class_set_parent_phases(rc, NULL, riscv_cpu_reset_hold, NULL,
2345                                        &mcc->parent_phases);
2346 
2347     cc->class_by_name = riscv_cpu_class_by_name;
2348     cc->has_work = riscv_cpu_has_work;
2349     cc->mmu_index = riscv_cpu_mmu_index;
2350     cc->dump_state = riscv_cpu_dump_state;
2351     cc->set_pc = riscv_cpu_set_pc;
2352     cc->get_pc = riscv_cpu_get_pc;
2353     cc->gdb_read_register = riscv_cpu_gdb_read_register;
2354     cc->gdb_write_register = riscv_cpu_gdb_write_register;
2355     cc->gdb_num_core_regs = 33;
2356     cc->gdb_stop_before_watchpoint = true;
2357     cc->disas_set_info = riscv_cpu_disas_set_info;
2358 #ifndef CONFIG_USER_ONLY
2359     cc->sysemu_ops = &riscv_sysemu_ops;
2360     cc->get_arch_id = riscv_get_arch_id;
2361 #endif
2362     cc->gdb_arch_name = riscv_gdb_arch_name;
2363     cc->gdb_get_dynamic_xml = riscv_gdb_get_dynamic_xml;
2364 
2365     device_class_set_props(dc, riscv_cpu_properties);
2366 }
2367 
2368 static void riscv_cpu_class_init(ObjectClass *c, void *data)
2369 {
2370     RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
2371 
2372     mcc->misa_mxl_max = (uint32_t)(uintptr_t)data;
2373     riscv_cpu_validate_misa_mxl(mcc);
2374 }
2375 
2376 static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
2377                                  int max_str_len)
2378 {
2379     const RISCVIsaExtData *edata;
2380     char *old = *isa_str;
2381     char *new = *isa_str;
2382 
2383     for (edata = isa_edata_arr; edata && edata->name; edata++) {
2384         if (isa_ext_is_enabled(cpu, edata->ext_enable_offset)) {
2385             new = g_strconcat(old, "_", edata->name, NULL);
2386             g_free(old);
2387             old = new;
2388         }
2389     }
2390 
2391     *isa_str = new;
2392 }
2393 
2394 char *riscv_isa_string(RISCVCPU *cpu)
2395 {
2396     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(cpu);
2397     int i;
2398     const size_t maxlen = sizeof("rv128") + sizeof(riscv_single_letter_exts);
2399     char *isa_str = g_new(char, maxlen);
2400     int xlen = riscv_cpu_max_xlen(mcc);
2401     char *p = isa_str + snprintf(isa_str, maxlen, "rv%d", xlen);
2402 
2403     for (i = 0; i < sizeof(riscv_single_letter_exts) - 1; i++) {
2404         if (cpu->env.misa_ext & RV(riscv_single_letter_exts[i])) {
2405             *p++ = qemu_tolower(riscv_single_letter_exts[i]);
2406         }
2407     }
2408     *p = '\0';
2409     if (!cpu->cfg.short_isa_string) {
2410         riscv_isa_string_ext(cpu, &isa_str, maxlen);
2411     }
2412     return isa_str;
2413 }
2414 
2415 #ifndef CONFIG_USER_ONLY
2416 static char **riscv_isa_extensions_list(RISCVCPU *cpu, int *count)
2417 {
2418     int maxlen = ARRAY_SIZE(riscv_single_letter_exts) + ARRAY_SIZE(isa_edata_arr);
2419     char **extensions = g_new(char *, maxlen);
2420 
2421     for (int i = 0; i < sizeof(riscv_single_letter_exts) - 1; i++) {
2422         if (cpu->env.misa_ext & RV(riscv_single_letter_exts[i])) {
2423             extensions[*count] = g_new(char, 2);
2424             snprintf(extensions[*count], 2, "%c",
2425                      qemu_tolower(riscv_single_letter_exts[i]));
2426             (*count)++;
2427         }
2428     }
2429 
2430     for (const RISCVIsaExtData *edata = isa_edata_arr; edata->name; edata++) {
2431         if (isa_ext_is_enabled(cpu, edata->ext_enable_offset)) {
2432             extensions[*count] = g_strdup(edata->name);
2433             (*count)++;
2434         }
2435     }
2436 
2437     return extensions;
2438 }
2439 
2440 void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
2441 {
2442     RISCVCPUClass *mcc = RISCV_CPU_GET_CLASS(cpu);
2443     const size_t maxlen = sizeof("rv128i");
2444     g_autofree char *isa_base = g_new(char, maxlen);
2445     g_autofree char *riscv_isa;
2446     char **isa_extensions;
2447     int count = 0;
2448     int xlen = riscv_cpu_max_xlen(mcc);
2449 
2450     riscv_isa = riscv_isa_string(cpu);
2451     qemu_fdt_setprop_string(fdt, nodename, "riscv,isa", riscv_isa);
2452 
2453     snprintf(isa_base, maxlen, "rv%di", xlen);
2454     qemu_fdt_setprop_string(fdt, nodename, "riscv,isa-base", isa_base);
2455 
2456     isa_extensions = riscv_isa_extensions_list(cpu, &count);
2457     qemu_fdt_setprop_string_array(fdt, nodename, "riscv,isa-extensions",
2458                                   isa_extensions, count);
2459 
2460     for (int i = 0; i < count; i++) {
2461         g_free(isa_extensions[i]);
2462     }
2463 
2464     g_free(isa_extensions);
2465 }
2466 #endif
2467 
2468 #define DEFINE_CPU(type_name, misa_mxl_max, initfn)         \
2469     {                                                       \
2470         .name = (type_name),                                \
2471         .parent = TYPE_RISCV_CPU,                           \
2472         .instance_init = (initfn),                          \
2473         .class_init = riscv_cpu_class_init,                 \
2474         .class_data = (void *)(misa_mxl_max)                \
2475     }
2476 
2477 #define DEFINE_DYNAMIC_CPU(type_name, misa_mxl_max, initfn) \
2478     {                                                       \
2479         .name = (type_name),                                \
2480         .parent = TYPE_RISCV_DYNAMIC_CPU,                   \
2481         .instance_init = (initfn),                          \
2482         .class_init = riscv_cpu_class_init,                 \
2483         .class_data = (void *)(misa_mxl_max)                \
2484     }
2485 
2486 #define DEFINE_VENDOR_CPU(type_name, misa_mxl_max, initfn)  \
2487     {                                                       \
2488         .name = (type_name),                                \
2489         .parent = TYPE_RISCV_VENDOR_CPU,                    \
2490         .instance_init = (initfn),                          \
2491         .class_init = riscv_cpu_class_init,                 \
2492         .class_data = (void *)(misa_mxl_max)                \
2493     }
2494 
2495 #define DEFINE_BARE_CPU(type_name, misa_mxl_max, initfn)    \
2496     {                                                       \
2497         .name = (type_name),                                \
2498         .parent = TYPE_RISCV_BARE_CPU,                      \
2499         .instance_init = (initfn),                          \
2500         .class_init = riscv_cpu_class_init,                 \
2501         .class_data = (void *)(misa_mxl_max)                \
2502     }
2503 
2504 #define DEFINE_PROFILE_CPU(type_name, misa_mxl_max, initfn) \
2505     {                                                       \
2506         .name = (type_name),                                \
2507         .parent = TYPE_RISCV_BARE_CPU,                      \
2508         .instance_init = (initfn),                          \
2509         .class_init = riscv_cpu_class_init,                 \
2510         .class_data = (void *)(misa_mxl_max)                \
2511     }
2512 
2513 static const TypeInfo riscv_cpu_type_infos[] = {
2514     {
2515         .name = TYPE_RISCV_CPU,
2516         .parent = TYPE_CPU,
2517         .instance_size = sizeof(RISCVCPU),
2518         .instance_align = __alignof(RISCVCPU),
2519         .instance_init = riscv_cpu_init,
2520         .instance_post_init = riscv_cpu_post_init,
2521         .abstract = true,
2522         .class_size = sizeof(RISCVCPUClass),
2523         .class_init = riscv_cpu_common_class_init,
2524     },
2525     {
2526         .name = TYPE_RISCV_DYNAMIC_CPU,
2527         .parent = TYPE_RISCV_CPU,
2528         .abstract = true,
2529     },
2530     {
2531         .name = TYPE_RISCV_VENDOR_CPU,
2532         .parent = TYPE_RISCV_CPU,
2533         .abstract = true,
2534     },
2535     {
2536         .name = TYPE_RISCV_BARE_CPU,
2537         .parent = TYPE_RISCV_CPU,
2538         .instance_init = riscv_bare_cpu_init,
2539         .abstract = true,
2540     },
2541 #if defined(TARGET_RISCV32)
2542     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,       MXL_RV32,  riscv_any_cpu_init),
2543     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,       MXL_RV32,  riscv_max_cpu_init),
2544     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE32,    MXL_RV32,  rv32_base_cpu_init),
2545     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_IBEX,       MXL_RV32,  rv32_ibex_cpu_init),
2546     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E31, MXL_RV32,  rv32_sifive_e_cpu_init),
2547     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E34, MXL_RV32,  rv32_imafcu_nommu_cpu_init),
2548     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U34, MXL_RV32,  rv32_sifive_u_cpu_init),
2549     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV32I,        MXL_RV32,  rv32i_bare_cpu_init),
2550     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV32E,        MXL_RV32,  rv32e_bare_cpu_init),
2551 #elif defined(TARGET_RISCV64)
2552     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_ANY,       MXL_RV64,  riscv_any_cpu_init),
2553     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_MAX,       MXL_RV64,  riscv_max_cpu_init),
2554     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE64,    MXL_RV64,  rv64_base_cpu_init),
2555     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_E51, MXL_RV64,  rv64_sifive_e_cpu_init),
2556     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SIFIVE_U54, MXL_RV64,  rv64_sifive_u_cpu_init),
2557     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_SHAKTI_C,   MXL_RV64,  rv64_sifive_u_cpu_init),
2558     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_THEAD_C906, MXL_RV64,  rv64_thead_c906_cpu_init),
2559     DEFINE_VENDOR_CPU(TYPE_RISCV_CPU_VEYRON_V1,  MXL_RV64,  rv64_veyron_v1_cpu_init),
2560     DEFINE_DYNAMIC_CPU(TYPE_RISCV_CPU_BASE128,   MXL_RV128, rv128_base_cpu_init),
2561     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64I,        MXL_RV64,  rv64i_bare_cpu_init),
2562     DEFINE_BARE_CPU(TYPE_RISCV_CPU_RV64E,        MXL_RV64,  rv64e_bare_cpu_init),
2563     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  MXL_RV64,  rva22u64_profile_cpu_init),
2564     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  MXL_RV64,  rva22s64_profile_cpu_init),
2565 #endif
2566 };
2567 
2568 DEFINE_TYPES(riscv_cpu_type_infos)
2569