Re: [Qemu-devel] [Qemu-riscv] [PATCH v1 10/28] target/riscv: Convert mie and mstatus to pointers
On Thu, Sep 19, 2019 at 9:59 AM Jonathan Behrens wrote:
>
> On Thu, Sep 19, 2019 at 10:50 AM Richard Henderson
> wrote:
> >
> > On 9/18/19 4:47 PM, Alistair Francis wrote:
> > > I'm not a fan of the pointer method that I'm using, but to me it seems
> > > the least worst in terms of handling future code, keeping everythign
> > > consistnent and avoiding complex access rules.
> >
> > FWIW, I prefer the "banked" register method used by ARM.
> >
> > enum {
> > M_REG_NS = 0,/* non-secure mode */
> > M_REG_S = 1, /* secure mode */
> > M_REG_NUM_BANKS = 2,
> > };
> >
> > ...
> >
> > uint32_t vecbase[M_REG_NUM_BANKS];
> > uint32_t basepri[M_REG_NUM_BANKS];
> > uint32_t control[M_REG_NUM_BANKS];
> >
> > The major difference that I see is that a pointer can only represent a
> > single
> > state at a single time. With an index, different parts of the code can ask
> > different questions that may have different states. E.g. "are we currently
> > in
> > secure mode" vs "will the exception return to secure mode".
>
> This makes a lot of sense to me. It means that any individual control register
> has an unambiguous name that doesn't change based on context. They aren't
> quite
> the same names as used in the architecture specification (mie & vsie
> vs. mie[NOVIRT] & mie[VIRT]), but they are reasonably close. It also means
> other
> parts of the code can't ignore that there are two different versions of the
> registers in play. Perhaps the biggest benefit though is that you can sidestep
> swapping on mode changes *and* avoid needing any super fancy logic in the
> access
> functions:
>
> int read_mstatus(...) {
> target_ulong novirt_mask = ...;
> *val = env->mstatus[NOVIRT] & novirt_mask | env->mstatus[virt_mode()];
> }
>
> int read_vsstatus(...) {
> *val = env->mstatus[VIRT];
> }
>
> int write_mstatus(...) {
> ...
> target_ulong novirt_mask = ...;
> env->mstatus[NOVIRT] = (env->mstatus[NOVIRT] & ~novirt_mask) |
>(newval & novirt_mask);
> env->mstatus[virt_mode()] = (env->mstatus[virt_mode()] & novirt_mask) |
> (newval & ~novirt_mask);
The part I don't like about this is that it then requires all of the
RISC-V implementation to be affected by the Hypervisor extension. The
current way means that if you aren't interested in the extension you
can just ignore it and not worry about breaking anything. For ARM this
isn't as big of an issue, but RISC-V is much more modular (there will
be lots of platforms without the H extension) so I don't want people
to have to worry about it.
PS: Sorry for the delay here, I have been looking into some other ways
of doing this, but I still think the current way is the least bad.
Alistair
> }
Re: [Qemu-devel] [Qemu-riscv] [PATCH v1 10/28] target/riscv: Convert mie and mstatus to pointers
On Thu, Sep 19, 2019 at 10:50 AM Richard Henderson
wrote:
>
> On 9/18/19 4:47 PM, Alistair Francis wrote:
> > I'm not a fan of the pointer method that I'm using, but to me it seems
> > the least worst in terms of handling future code, keeping everythign
> > consistnent and avoiding complex access rules.
>
> FWIW, I prefer the "banked" register method used by ARM.
>
> enum {
> M_REG_NS = 0,/* non-secure mode */
> M_REG_S = 1, /* secure mode */
> M_REG_NUM_BANKS = 2,
> };
>
> ...
>
> uint32_t vecbase[M_REG_NUM_BANKS];
> uint32_t basepri[M_REG_NUM_BANKS];
> uint32_t control[M_REG_NUM_BANKS];
>
> The major difference that I see is that a pointer can only represent a single
> state at a single time. With an index, different parts of the code can ask
> different questions that may have different states. E.g. "are we currently in
> secure mode" vs "will the exception return to secure mode".
This makes a lot of sense to me. It means that any individual control register
has an unambiguous name that doesn't change based on context. They aren't quite
the same names as used in the architecture specification (mie & vsie
vs. mie[NOVIRT] & mie[VIRT]), but they are reasonably close. It also means other
parts of the code can't ignore that there are two different versions of the
registers in play. Perhaps the biggest benefit though is that you can sidestep
swapping on mode changes *and* avoid needing any super fancy logic in the access
functions:
int read_mstatus(...) {
target_ulong novirt_mask = ...;
*val = env->mstatus[NOVIRT] & novirt_mask | env->mstatus[virt_mode()];
}
int read_vsstatus(...) {
*val = env->mstatus[VIRT];
}
int write_mstatus(...) {
...
target_ulong novirt_mask = ...;
env->mstatus[NOVIRT] = (env->mstatus[NOVIRT] & ~novirt_mask) |
(newval & novirt_mask);
env->mstatus[virt_mode()] = (env->mstatus[virt_mode()] & novirt_mask) |
(newval & ~novirt_mask);
}
Re: [Qemu-devel] [Qemu-riscv] [PATCH v1 10/28] target/riscv: Convert mie and mstatus to pointers
On 9/18/19 4:47 PM, Alistair Francis wrote:
> I'm not a fan of the pointer method that I'm using, but to me it seems
> the least worst in terms of handling future code, keeping everythign
> consistnent and avoiding complex access rules.
FWIW, I prefer the "banked" register method used by ARM.
enum {
M_REG_NS = 0,/* non-secure mode */
M_REG_S = 1, /* secure mode */
M_REG_NUM_BANKS = 2,
};
...
uint32_t vecbase[M_REG_NUM_BANKS];
uint32_t basepri[M_REG_NUM_BANKS];
uint32_t control[M_REG_NUM_BANKS];
The major difference that I see is that a pointer can only represent a single
state at a single time. With an index, different parts of the code can ask
different questions that may have different states. E.g. "are we currently in
secure mode" vs "will the exception return to secure mode".
r~
Re: [Qemu-devel] [Qemu-riscv] [PATCH v1 10/28] target/riscv: Convert mie and mstatus to pointers
On Tue, Sep 17, 2019 at 7:00 PM Jonathan Behrens wrote:
>
> I went through the uses of mie in the entire hypervisor patch series and it
> seems like it would be much simpler to just have two non-pointer fields in
> the CPU struct: mie and vsie. To if an interrupt is pending, you are either
> running with V=0 in which case the contents of vsie can be ignored, or you
> are running with V=1 and have to check both anyway. And the
> read_sie/write_sie would just need a single extra branch return proper
> results. The read_mie and write_mie function wouldn't need to be changed at
> all: if M-mode is running to access them, then V=0. (When queried from a
> debugger while V=1, I think the result would actually be more correct this
> way: the bits of mie are supposed to always reflect sie rather than vsie).
Hello Jonathan,
Pleas make sure you reply inline, otherwise it is difficult to track
the order of messages. Can you also please wrap your lines at 80
characters.
What about in the future when some other extension does something with
mie? I would rather not have conditionals around accessing core CSRs
(hence the pointer way).
The other problem is mstatus, which is more confusing. I am trying to
keep mie and mstatus (and eventually mip) all the same. Having
different styles for different CSRs also seems confusing. Granted it
is now different between the m/s and s only CSRs, but that seems
unavoidable.
I'm not a fan of the pointer method that I'm using, but to me it seems
the least worst in terms of handling future code, keeping everythign
consistnent and avoiding complex access rules.
Alistair
>
> Jonathan
>
> On Tue, Sep 17, 2019 at 7:37 PM Alistair Francis wrote:
>>
>> On Wed, Sep 11, 2019 at 7:55 AM Jonathan Behrens wrote:
>> >
>> > Version 0.4 of the hypervisor spec no longer talks about swapping
>> > registers. Instead when running in VS-mode some of the supervisor
>> > registers are "aliased" and actually refer to alternate versions.
>> > Implementations are of course still allowed to do swapping internally if
>> > desired, but it adds complexity compared to a more straightforward
>> > implementation and isn't obvious to me whether QEMU would get any benefit
>> > from it. At least, it is probably worth fleshing out the rest of the v0.4
>> > implementation before deciding on this patch.
>>
>> This patch is to handle the aliasing. The commit message isn't clear
>> (I'll fix that up) but this patch is required to handle the new alias
>> method instead of the previous swapping.
>>
>> Alistair
>>
>> > Jonathan
>> >
>> > On Wed, Sep 11, 2019 at 4:24 AM Palmer Dabbelt wrote:
>> >>
>> >> On Fri, 23 Aug 2019 16:38:15 PDT (-0700), Alistair Francis wrote:
>> >> > To handle the new Hypervisor CSR register swapping let's use pointers.
>> >> >
>> >> > We only need to convert the MIE and MSTATUS CSRs. With the exception of
>> >> > MIP all of the other CSRs that swap with virtulsation changes are S-Mode
>> >> > only, so we can just do a lazy switch. This because more challenging for
>> >> > the M-Mode registers so it ends up being easier to use pointers.
>> >> >
>> >> > As the MIP CSR is always accessed atomicly the pointer swap doesn't work
>> >> > so we leave that as is.
>> >> >
>> >> > Signed-off-by: Alistair Francis
>> >> > ---
>> >> > target/riscv/cpu.c| 16
>> >> > target/riscv/cpu.h| 12 ++--
>> >> > target/riscv/cpu_helper.c | 32
>> >> > target/riscv/csr.c| 28 ++--
>> >> > target/riscv/op_helper.c | 14 +++---
>> >> > 5 files changed, 59 insertions(+), 43 deletions(-)
>> >> >
>> >> > diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
>> >> > index be8f643fc2..371d5845af 100644
>> >> > --- a/target/riscv/cpu.c
>> >> > +++ b/target/riscv/cpu.c
>> >> > @@ -228,7 +228,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE
>> >> > *f, int flags)
>> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "pc ", env->pc);
>> >> > #ifndef CONFIG_USER_ONLY
>> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mhartid ",
>> >> > env->mhartid);
>> >> > -qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mstatus ",
>> >> > env->mstatus);
>> >> > +qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mstatus ",
>> >> > *env->mstatus);
>> >> > if (riscv_has_ext(env, RVH)) {
>> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "hstatus ",
>> >> > env->hstatus);
>> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "bstatus ",
>> >> > env->vsstatus);
>> >> > @@ -239,7 +239,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE
>> >> > *f, int flags)
>> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "vsip",
>> >> > (target_ulong)atomic_read(>vsip));
>> >> > }
>> >> > -qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mie ", env->mie);
>> >> > +qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mie ", *env->mie);
>> >>
Re: [Qemu-devel] [Qemu-riscv] [PATCH v1 10/28] target/riscv: Convert mie and mstatus to pointers
I went through the uses of mie in the entire hypervisor patch series and it
seems like it would be much simpler to just have two non-pointer fields in
the CPU struct: mie and vsie. To if an interrupt is pending, you are either
running with V=0 in which case the contents of vsie can be ignored, or you
are running with V=1 and have to check both anyway. And the
read_sie/write_sie would just need a single extra branch return proper
results. The read_mie and write_mie function wouldn't need to be changed at
all: if M-mode is running to access them, then V=0. (When queried from a
debugger while V=1, I think the result would actually be more correct this
way: the bits of mie are supposed to always reflect sie rather than vsie).
Jonathan
On Tue, Sep 17, 2019 at 7:37 PM Alistair Francis
wrote:
> On Wed, Sep 11, 2019 at 7:55 AM Jonathan Behrens
> wrote:
> >
> > Version 0.4 of the hypervisor spec no longer talks about swapping
> registers. Instead when running in VS-mode some of the supervisor registers
> are "aliased" and actually refer to alternate versions. Implementations are
> of course still allowed to do swapping internally if desired, but it adds
> complexity compared to a more straightforward implementation and isn't
> obvious to me whether QEMU would get any benefit from it. At least, it is
> probably worth fleshing out the rest of the v0.4 implementation before
> deciding on this patch.
>
> This patch is to handle the aliasing. The commit message isn't clear
> (I'll fix that up) but this patch is required to handle the new alias
> method instead of the previous swapping.
>
> Alistair
>
> > Jonathan
> >
> > On Wed, Sep 11, 2019 at 4:24 AM Palmer Dabbelt
> wrote:
> >>
> >> On Fri, 23 Aug 2019 16:38:15 PDT (-0700), Alistair Francis wrote:
> >> > To handle the new Hypervisor CSR register swapping let's use pointers.
> >> >
> >> > We only need to convert the MIE and MSTATUS CSRs. With the exception
> of
> >> > MIP all of the other CSRs that swap with virtulsation changes are
> S-Mode
> >> > only, so we can just do a lazy switch. This because more challenging
> for
> >> > the M-Mode registers so it ends up being easier to use pointers.
> >> >
> >> > As the MIP CSR is always accessed atomicly the pointer swap doesn't
> work
> >> > so we leave that as is.
> >> >
> >> > Signed-off-by: Alistair Francis
> >> > ---
> >> > target/riscv/cpu.c| 16
> >> > target/riscv/cpu.h| 12 ++--
> >> > target/riscv/cpu_helper.c | 32
> >> > target/riscv/csr.c| 28 ++--
> >> > target/riscv/op_helper.c | 14 +++---
> >> > 5 files changed, 59 insertions(+), 43 deletions(-)
> >> >
> >> > diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
> >> > index be8f643fc2..371d5845af 100644
> >> > --- a/target/riscv/cpu.c
> >> > +++ b/target/riscv/cpu.c
> >> > @@ -228,7 +228,7 @@ static void riscv_cpu_dump_state(CPUState *cs,
> FILE *f, int flags)
> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "pc ", env->pc);
> >> > #ifndef CONFIG_USER_ONLY
> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mhartid ",
> env->mhartid);
> >> > -qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mstatus ",
> env->mstatus);
> >> > +qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mstatus ",
> *env->mstatus);
> >> > if (riscv_has_ext(env, RVH)) {
> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "hstatus ",
> env->hstatus);
> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "bstatus ",
> env->vsstatus);
> >> > @@ -239,7 +239,7 @@ static void riscv_cpu_dump_state(CPUState *cs,
> FILE *f, int flags)
> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "vsip",
> >> > (target_ulong)atomic_read(>vsip));
> >> > }
> >> > -qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mie ", env->mie);
> >> > +qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mie ",
> *env->mie);
> >> > if (riscv_has_ext(env, RVH)) {
> >> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "vsie",
> env->vsie);
> >> > }
> >> > @@ -309,7 +309,7 @@ static bool riscv_cpu_has_work(CPUState *cs)
> >> > * Definition of the WFI instruction requires it to ignore the
> privilege
> >> > * mode and delegation registers, but respect individual enables
> >> > */
> >> > -return (atomic_read(>mip) & env->mie) != 0;
> >> > +return (atomic_read(>mip) & *env->mie) != 0;
> >> > #else
> >> > return true;
> >> > #endif
> >> > @@ -330,7 +330,7 @@ static void riscv_cpu_reset(CPUState *cs)
> >> > mcc->parent_reset(cs);
> >> > #ifndef CONFIG_USER_ONLY
> >> > env->priv = PRV_M;
> >> > -env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
> >> > +*env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
> >> > env->mcause = 0;
> >> > env->pc = env->resetvec;
> >> > #endif
> >> > @@ -459,8 +459,16 @@ static void riscv_cpu_realize(DeviceState *dev,
> Error **errp)
> >> >
Re: [Qemu-devel] [Qemu-riscv] [PATCH v1 10/28] target/riscv: Convert mie and mstatus to pointers
On Wed, Sep 11, 2019 at 7:55 AM Jonathan Behrens wrote:
>
> Version 0.4 of the hypervisor spec no longer talks about swapping registers.
> Instead when running in VS-mode some of the supervisor registers are
> "aliased" and actually refer to alternate versions. Implementations are of
> course still allowed to do swapping internally if desired, but it adds
> complexity compared to a more straightforward implementation and isn't
> obvious to me whether QEMU would get any benefit from it. At least, it is
> probably worth fleshing out the rest of the v0.4 implementation before
> deciding on this patch.
This patch is to handle the aliasing. The commit message isn't clear
(I'll fix that up) but this patch is required to handle the new alias
method instead of the previous swapping.
Alistair
> Jonathan
>
> On Wed, Sep 11, 2019 at 4:24 AM Palmer Dabbelt wrote:
>>
>> On Fri, 23 Aug 2019 16:38:15 PDT (-0700), Alistair Francis wrote:
>> > To handle the new Hypervisor CSR register swapping let's use pointers.
>> >
>> > We only need to convert the MIE and MSTATUS CSRs. With the exception of
>> > MIP all of the other CSRs that swap with virtulsation changes are S-Mode
>> > only, so we can just do a lazy switch. This because more challenging for
>> > the M-Mode registers so it ends up being easier to use pointers.
>> >
>> > As the MIP CSR is always accessed atomicly the pointer swap doesn't work
>> > so we leave that as is.
>> >
>> > Signed-off-by: Alistair Francis
>> > ---
>> > target/riscv/cpu.c| 16
>> > target/riscv/cpu.h| 12 ++--
>> > target/riscv/cpu_helper.c | 32
>> > target/riscv/csr.c| 28 ++--
>> > target/riscv/op_helper.c | 14 +++---
>> > 5 files changed, 59 insertions(+), 43 deletions(-)
>> >
>> > diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
>> > index be8f643fc2..371d5845af 100644
>> > --- a/target/riscv/cpu.c
>> > +++ b/target/riscv/cpu.c
>> > @@ -228,7 +228,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE
>> > *f, int flags)
>> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "pc ", env->pc);
>> > #ifndef CONFIG_USER_ONLY
>> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mhartid ", env->mhartid);
>> > -qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mstatus ", env->mstatus);
>> > +qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mstatus ", *env->mstatus);
>> > if (riscv_has_ext(env, RVH)) {
>> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "hstatus ",
>> > env->hstatus);
>> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "bstatus ",
>> > env->vsstatus);
>> > @@ -239,7 +239,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE
>> > *f, int flags)
>> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "vsip",
>> > (target_ulong)atomic_read(>vsip));
>> > }
>> > -qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mie ", env->mie);
>> > +qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mie ", *env->mie);
>> > if (riscv_has_ext(env, RVH)) {
>> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "vsie", env->vsie);
>> > }
>> > @@ -309,7 +309,7 @@ static bool riscv_cpu_has_work(CPUState *cs)
>> > * Definition of the WFI instruction requires it to ignore the
>> > privilege
>> > * mode and delegation registers, but respect individual enables
>> > */
>> > -return (atomic_read(>mip) & env->mie) != 0;
>> > +return (atomic_read(>mip) & *env->mie) != 0;
>> > #else
>> > return true;
>> > #endif
>> > @@ -330,7 +330,7 @@ static void riscv_cpu_reset(CPUState *cs)
>> > mcc->parent_reset(cs);
>> > #ifndef CONFIG_USER_ONLY
>> > env->priv = PRV_M;
>> > -env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
>> > +*env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
>> > env->mcause = 0;
>> > env->pc = env->resetvec;
>> > #endif
>> > @@ -459,8 +459,16 @@ static void riscv_cpu_realize(DeviceState *dev, Error
>> > **errp)
>> > static void riscv_cpu_init(Object *obj)
>> > {
>> > RISCVCPU *cpu = RISCV_CPU(obj);
>> > +#ifndef CONFIG_USER_ONLY
>> > +CPURISCVState *env = >env;
>> > +#endif
>> >
>> > cpu_set_cpustate_pointers(cpu);
>> > +
>> > +#ifndef CONFIG_USER_ONLY
>> > +env->mie = >mie_novirt;
>> > +env->mstatus = >mstatus_novirt;
>> > +#endif
>> > }
>> >
>> > static const VMStateDescription vmstate_riscv_cpu = {
>> > diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
>> > index 4c342e7a79..680592cb60 100644
>> > --- a/target/riscv/cpu.h
>> > +++ b/target/riscv/cpu.h
>> > @@ -122,7 +122,7 @@ struct CPURISCVState {
>> > target_ulong resetvec;
>> >
>> > target_ulong mhartid;
>> > -target_ulong mstatus;
>> > +target_ulong *mstatus;
>> >
>> > /*
>> > * CAUTION! Unlike the rest of this struct, mip is accessed
>> > asynchonously
>> > @@ -136,7 +136,7 @@ struct CPURISCVState {
>> > uint32_t mip;
Re: [Qemu-devel] [Qemu-riscv] [PATCH v1 10/28] target/riscv: Convert mie and mstatus to pointers
Version 0.4 of the hypervisor spec no longer talks about swapping
registers. Instead when running in VS-mode some of the supervisor registers
are "aliased" and actually refer to alternate versions. Implementations are
of course still allowed to do swapping internally if desired, but it adds
complexity compared to a more straightforward implementation and isn't
obvious to me whether QEMU would get any benefit from it. At least, it is
probably worth fleshing out the rest of the v0.4 implementation before
deciding on this patch.
Jonathan
On Wed, Sep 11, 2019 at 4:24 AM Palmer Dabbelt wrote:
> On Fri, 23 Aug 2019 16:38:15 PDT (-0700), Alistair Francis wrote:
> > To handle the new Hypervisor CSR register swapping let's use pointers.
> >
> > We only need to convert the MIE and MSTATUS CSRs. With the exception of
> > MIP all of the other CSRs that swap with virtulsation changes are S-Mode
> > only, so we can just do a lazy switch. This because more challenging for
> > the M-Mode registers so it ends up being easier to use pointers.
> >
> > As the MIP CSR is always accessed atomicly the pointer swap doesn't work
> > so we leave that as is.
> >
> > Signed-off-by: Alistair Francis
> > ---
> > target/riscv/cpu.c| 16
> > target/riscv/cpu.h| 12 ++--
> > target/riscv/cpu_helper.c | 32
> > target/riscv/csr.c| 28 ++--
> > target/riscv/op_helper.c | 14 +++---
> > 5 files changed, 59 insertions(+), 43 deletions(-)
> >
> > diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
> > index be8f643fc2..371d5845af 100644
> > --- a/target/riscv/cpu.c
> > +++ b/target/riscv/cpu.c
> > @@ -228,7 +228,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE
> *f, int flags)
> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "pc ", env->pc);
> > #ifndef CONFIG_USER_ONLY
> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mhartid ",
> env->mhartid);
> > -qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mstatus ",
> env->mstatus);
> > +qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mstatus ",
> *env->mstatus);
> > if (riscv_has_ext(env, RVH)) {
> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "hstatus ",
> env->hstatus);
> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "bstatus ",
> env->vsstatus);
> > @@ -239,7 +239,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE
> *f, int flags)
> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "vsip",
> > (target_ulong)atomic_read(>vsip));
> > }
> > -qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mie ", env->mie);
> > +qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "mie ", *env->mie);
> > if (riscv_has_ext(env, RVH)) {
> > qemu_fprintf(f, " %s " TARGET_FMT_lx "\n", "vsie",
> env->vsie);
> > }
> > @@ -309,7 +309,7 @@ static bool riscv_cpu_has_work(CPUState *cs)
> > * Definition of the WFI instruction requires it to ignore the
> privilege
> > * mode and delegation registers, but respect individual enables
> > */
> > -return (atomic_read(>mip) & env->mie) != 0;
> > +return (atomic_read(>mip) & *env->mie) != 0;
> > #else
> > return true;
> > #endif
> > @@ -330,7 +330,7 @@ static void riscv_cpu_reset(CPUState *cs)
> > mcc->parent_reset(cs);
> > #ifndef CONFIG_USER_ONLY
> > env->priv = PRV_M;
> > -env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
> > +*env->mstatus &= ~(MSTATUS_MIE | MSTATUS_MPRV);
> > env->mcause = 0;
> > env->pc = env->resetvec;
> > #endif
> > @@ -459,8 +459,16 @@ static void riscv_cpu_realize(DeviceState *dev,
> Error **errp)
> > static void riscv_cpu_init(Object *obj)
> > {
> > RISCVCPU *cpu = RISCV_CPU(obj);
> > +#ifndef CONFIG_USER_ONLY
> > +CPURISCVState *env = >env;
> > +#endif
> >
> > cpu_set_cpustate_pointers(cpu);
> > +
> > +#ifndef CONFIG_USER_ONLY
> > +env->mie = >mie_novirt;
> > +env->mstatus = >mstatus_novirt;
> > +#endif
> > }
> >
> > static const VMStateDescription vmstate_riscv_cpu = {
> > diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
> > index 4c342e7a79..680592cb60 100644
> > --- a/target/riscv/cpu.h
> > +++ b/target/riscv/cpu.h
> > @@ -122,7 +122,7 @@ struct CPURISCVState {
> > target_ulong resetvec;
> >
> > target_ulong mhartid;
> > -target_ulong mstatus;
> > +target_ulong *mstatus;
> >
> > /*
> > * CAUTION! Unlike the rest of this struct, mip is accessed
> asynchonously
> > @@ -136,7 +136,7 @@ struct CPURISCVState {
> > uint32_t mip;
> > uint32_t miclaim;
> >
> > -target_ulong mie;
> > +target_ulong *mie;
> > target_ulong mideleg;
> >
> > target_ulong sptbr; /* until: priv-1.9.1 */
> > @@ -154,6 +154,14 @@ struct CPURISCVState {
> > target_ulong mcause;
> > target_ulong mtval; /* since: priv-1.10.0 */
> >
> > +/* The following registers are the "real" versions that the pointer
>
