target/riscv/cpu_helper.c

   1 /*
   2  * RISC-V CPU helpers for qemu.
   3  *
   4  * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
   5  * Copyright (c) 2017-2018 SiFive, Inc.
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms and conditions of the GNU General Public License,
   9  * version 2 or later, as published by the Free Software Foundation.
  10  *
  11  * This program is distributed in the hope it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  14  * more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along with
  17  * this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "qemu/osdep.h"
  21 #include "qemu/log.h"
  22 #include "cpu.h"
  23 #include "exec/exec-all.h"
  24 #include "tcg-op.h"
  25
  26 #define RISCV_DEBUG_INTERRUPT 0
  27
  28 int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch)
  29 {
  30 #ifdef CONFIG_USER_ONLY
  31     return 0;
  32 #else
  33     return env->priv;
  34 #endif
  35 }
  36
  37 #ifndef CONFIG_USER_ONLY
  38 static int riscv_cpu_local_irq_pending(CPURISCVState *env)
  39 {
  40     target_ulong mstatus_mie = get_field(env->mstatus, MSTATUS_MIE);
  41     target_ulong mstatus_sie = get_field(env->mstatus, MSTATUS_SIE);
  42     target_ulong pending = atomic_read(&env->mip) & env->mie;
  43     target_ulong mie = env->priv < PRV_M || (env->priv == PRV_M && mstatus_mie);
  44     target_ulong sie = env->priv < PRV_S || (env->priv == PRV_S && mstatus_sie);
  45     target_ulong irqs = (pending & ~env->mideleg & -mie) |
  46                         (pending &  env->mideleg & -sie);
  47
  48     if (irqs) {
  49         return ctz64(irqs); /* since non-zero */
  50     } else {
  51         return EXCP_NONE; /* indicates no pending interrupt */
  52     }
  53 }
  54 #endif
  55
  56 bool riscv_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
  57 {
  58 #if !defined(CONFIG_USER_ONLY)
  59     if (interrupt_request & CPU_INTERRUPT_HARD) {
  60         RISCVCPU *cpu = RISCV_CPU(cs);
  61         CPURISCVState *env = &cpu->env;
  62         int interruptno = riscv_cpu_local_irq_pending(env);
  63         if (interruptno >= 0) {
  64             cs->exception_index = RISCV_EXCP_INT_FLAG | interruptno;
  65             riscv_cpu_do_interrupt(cs);
  66             return true;
  67         }
  68     }
  69 #endif
  70     return false;
  71 }
  72
  73 #if !defined(CONFIG_USER_ONLY)
  74
  75 int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint32_t interrupts)
  76 {
  77     CPURISCVState *env = &cpu->env;
  78     if (env->miclaim & interrupts) {
  79         return -1;
  80     } else {
  81         env->miclaim |= interrupts;
  82         return 0;
  83     }
  84 }
  85
  86 /* iothread_mutex must be held */
  87 uint32_t riscv_cpu_update_mip(RISCVCPU *cpu, uint32_t mask, uint32_t value)
  88 {
  89     CPURISCVState *env = &cpu->env;
  90     uint32_t old, new, cmp = atomic_read(&env->mip);
  91
  92     do {
  93         old = cmp;
  94         new = (old & ~mask) | (value & mask);
  95         cmp = atomic_cmpxchg(&env->mip, old, new);
  96     } while (old != cmp);
  97
  98     if (new && !old) {
  99         cpu_interrupt(CPU(cpu), CPU_INTERRUPT_HARD);
 100     } else if (!new && old) {
 101         cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_HARD);
 102     }
 103
 104     return old;
 105 }
 106
 107 void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv)
 108 {
 109     if (newpriv > PRV_M) {
 110         g_assert_not_reached();
 111     }
 112     if (newpriv == PRV_H) {
 113         newpriv = PRV_U;
 114     }
 115     /* tlb_flush is unnecessary as mode is contained in mmu_idx */
 116     env->priv = newpriv;
 117 }
 118
 119 /* get_physical_address - get the physical address for this virtual address
 120  *
 121  * Do a page table walk to obtain the physical address corresponding to a
 122  * virtual address. Returns 0 if the translation was successful
 123  *
 124  * Adapted from Spike's mmu_t::translate and mmu_t::walk
 125  *
 126  */
 127 static int get_physical_address(CPURISCVState *env, hwaddr *physical,
 128                                 int *prot, target_ulong addr,
 129                                 int access_type, int mmu_idx)
 130 {
 131     /* NOTE: the env->pc value visible here will not be
 132      * correct, but the value visible to the exception handler
 133      * (riscv_cpu_do_interrupt) is correct */
 134
 135     int mode = mmu_idx;
 136
 137     if (mode == PRV_M && access_type != MMU_INST_FETCH) {
 138         if (get_field(env->mstatus, MSTATUS_MPRV)) {
 139             mode = get_field(env->mstatus, MSTATUS_MPP);
 140         }
 141     }
 142
 143     if (mode == PRV_M || !riscv_feature(env, RISCV_FEATURE_MMU)) {
 144         *physical = addr;
 145         *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 146         return TRANSLATE_SUCCESS;
 147     }
 148
 149     *prot = 0;
 150
 151     target_ulong base;
 152     int levels, ptidxbits, ptesize, vm, sum;
 153     int mxr = get_field(env->mstatus, MSTATUS_MXR);
 154
 155     if (env->priv_ver >= PRIV_VERSION_1_10_0) {
 156         base = get_field(env->satp, SATP_PPN) << PGSHIFT;
 157         sum = get_field(env->mstatus, MSTATUS_SUM);
 158         vm = get_field(env->satp, SATP_MODE);
 159         switch (vm) {
 160         case VM_1_10_SV32:
 161           levels = 2; ptidxbits = 10; ptesize = 4; break;
 162         case VM_1_10_SV39:
 163           levels = 3; ptidxbits = 9; ptesize = 8; break;
 164         case VM_1_10_SV48:
 165           levels = 4; ptidxbits = 9; ptesize = 8; break;
 166         case VM_1_10_SV57:
 167           levels = 5; ptidxbits = 9; ptesize = 8; break;
 168         case VM_1_10_MBARE:
 169             *physical = addr;
 170             *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 171             return TRANSLATE_SUCCESS;
 172         default:
 173           g_assert_not_reached();
 174         }
 175     } else {
 176         base = env->sptbr << PGSHIFT;
 177         sum = !get_field(env->mstatus, MSTATUS_PUM);
 178         vm = get_field(env->mstatus, MSTATUS_VM);
 179         switch (vm) {
 180         case VM_1_09_SV32:
 181           levels = 2; ptidxbits = 10; ptesize = 4; break;
 182         case VM_1_09_SV39:
 183           levels = 3; ptidxbits = 9; ptesize = 8; break;
 184         case VM_1_09_SV48:
 185           levels = 4; ptidxbits = 9; ptesize = 8; break;
 186         case VM_1_09_MBARE:
 187             *physical = addr;
 188             *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 189             return TRANSLATE_SUCCESS;
 190         default:
 191           g_assert_not_reached();
 192         }
 193     }
 194
 195     CPUState *cs = CPU(riscv_env_get_cpu(env));
 196     int va_bits = PGSHIFT + levels * ptidxbits;
 197     target_ulong mask = (1L << (TARGET_LONG_BITS - (va_bits - 1))) - 1;
 198     target_ulong masked_msbs = (addr >> (va_bits - 1)) & mask;
 199     if (masked_msbs != 0 && masked_msbs != mask) {
 200         return TRANSLATE_FAIL;
 201     }
 202
 203     int ptshift = (levels - 1) * ptidxbits;
 204     int i;
 205
 206 #if !TCG_OVERSIZED_GUEST
 207 restart:
 208 #endif
 209     for (i = 0; i < levels; i++, ptshift -= ptidxbits) {
 210         target_ulong idx = (addr >> (PGSHIFT + ptshift)) &
 211                            ((1 << ptidxbits) - 1);
 212
 213         /* check that physical address of PTE is legal */
 214         target_ulong pte_addr = base + idx * ptesize;
 215 #if defined(TARGET_RISCV32)
 216         target_ulong pte = ldl_phys(cs->as, pte_addr);
 217 #elif defined(TARGET_RISCV64)
 218         target_ulong pte = ldq_phys(cs->as, pte_addr);
 219 #endif
 220         target_ulong ppn = pte >> PTE_PPN_SHIFT;
 221
 222         if (!(pte & PTE_V)) {
 223             /* Invalid PTE */
 224             return TRANSLATE_FAIL;
 225         } else if (!(pte & (PTE_R | PTE_W | PTE_X))) {
 226             /* Inner PTE, continue walking */
 227             base = ppn << PGSHIFT;
 228         } else if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
 229             /* Reserved leaf PTE flags: PTE_W */
 230             return TRANSLATE_FAIL;
 231         } else if ((pte & (PTE_R | PTE_W | PTE_X)) == (PTE_W | PTE_X)) {
 232             /* Reserved leaf PTE flags: PTE_W + PTE_X */
 233             return TRANSLATE_FAIL;
 234         } else if ((pte & PTE_U) && ((mode != PRV_U) &&
 235                    (!sum || access_type == MMU_INST_FETCH))) {
 236             /* User PTE flags when not U mode and mstatus.SUM is not set,
 237                or the access type is an instruction fetch */
 238             return TRANSLATE_FAIL;
 239         } else if (!(pte & PTE_U) && (mode != PRV_S)) {
 240             /* Supervisor PTE flags when not S mode */
 241             return TRANSLATE_FAIL;
 242         } else if (ppn & ((1ULL << ptshift) - 1)) {
 243             /* Misaligned PPN */
 244             return TRANSLATE_FAIL;
 245         } else if (access_type == MMU_DATA_LOAD && !((pte & PTE_R) ||
 246                    ((pte & PTE_X) && mxr))) {
 247             /* Read access check failed */
 248             return TRANSLATE_FAIL;
 249         } else if (access_type == MMU_DATA_STORE && !(pte & PTE_W)) {
 250             /* Write access check failed */
 251             return TRANSLATE_FAIL;
 252         } else if (access_type == MMU_INST_FETCH && !(pte & PTE_X)) {
 253             /* Fetch access check failed */
 254             return TRANSLATE_FAIL;
 255         } else {
 256             /* if necessary, set accessed and dirty bits. */
 257             target_ulong updated_pte = pte | PTE_A |
 258                 (access_type == MMU_DATA_STORE ? PTE_D : 0);
 259
 260             /* Page table updates need to be atomic with MTTCG enabled */
 261             if (updated_pte != pte) {
 262                 /*
 263                  * - if accessed or dirty bits need updating, and the PTE is
 264                  *   in RAM, then we do so atomically with a compare and swap.
 265                  * - if the PTE is in IO space or ROM, then it can't be updated
 266                  *   and we return TRANSLATE_FAIL.
 267                  * - if the PTE changed by the time we went to update it, then
 268                  *   it is no longer valid and we must re-walk the page table.
 269                  */
 270                 MemoryRegion *mr;
 271                 hwaddr l = sizeof(target_ulong), addr1;
 272                 mr = address_space_translate(cs->as, pte_addr,
 273                     &addr1, &l, false, MEMTXATTRS_UNSPECIFIED);
 274                 if (memory_region_is_ram(mr)) {
 275                     target_ulong *pte_pa =
 276                         qemu_map_ram_ptr(mr->ram_block, addr1);
 277 #if TCG_OVERSIZED_GUEST
 278                     /* MTTCG is not enabled on oversized TCG guests so
 279                      * page table updates do not need to be atomic */
 280                     *pte_pa = pte = updated_pte;
 281 #else
 282                     target_ulong old_pte =
 283                         atomic_cmpxchg(pte_pa, pte, updated_pte);
 284                     if (old_pte != pte) {
 285                         goto restart;
 286                     } else {
 287                         pte = updated_pte;
 288                     }
 289 #endif
 290                 } else {
 291                     /* misconfigured PTE in ROM (AD bits are not preset) or
 292                      * PTE is in IO space and can't be updated atomically */
 293                     return TRANSLATE_FAIL;
 294                 }
 295             }
 296
 297             /* for superpage mappings, make a fake leaf PTE for the TLB's
 298                benefit. */
 299             target_ulong vpn = addr >> PGSHIFT;
 300             *physical = (ppn | (vpn & ((1L << ptshift) - 1))) << PGSHIFT;
 301
 302             /* set permissions on the TLB entry */
 303             if ((pte & PTE_R) || ((pte & PTE_X) && mxr)) {
 304                 *prot |= PAGE_READ;
 305             }
 306             if ((pte & PTE_X)) {
 307                 *prot |= PAGE_EXEC;
 308             }
 309             /* add write permission on stores or if the page is already dirty,
 310                so that we TLB miss on later writes to update the dirty bit */
 311             if ((pte & PTE_W) &&
 312                     (access_type == MMU_DATA_STORE || (pte & PTE_D))) {
 313                 *prot |= PAGE_WRITE;
 314             }
 315             return TRANSLATE_SUCCESS;
 316         }
 317     }
 318     return TRANSLATE_FAIL;
 319 }
 320
 321 static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
 322                                 MMUAccessType access_type)
 323 {
 324     CPUState *cs = CPU(riscv_env_get_cpu(env));
 325     int page_fault_exceptions =
 326         (env->priv_ver >= PRIV_VERSION_1_10_0) &&
 327         get_field(env->satp, SATP_MODE) != VM_1_10_MBARE;
 328     switch (access_type) {
 329     case MMU_INST_FETCH:
 330         cs->exception_index = page_fault_exceptions ?
 331             RISCV_EXCP_INST_PAGE_FAULT : RISCV_EXCP_INST_ACCESS_FAULT;
 332         break;
 333     case MMU_DATA_LOAD:
 334         cs->exception_index = page_fault_exceptions ?
 335             RISCV_EXCP_LOAD_PAGE_FAULT : RISCV_EXCP_LOAD_ACCESS_FAULT;
 336         break;
 337     case MMU_DATA_STORE:
 338         cs->exception_index = page_fault_exceptions ?
 339             RISCV_EXCP_STORE_PAGE_FAULT : RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
 340         break;
 341     default:
 342         g_assert_not_reached();
 343     }
 344     env->badaddr = address;
 345 }
 346
 347 hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 348 {
 349     RISCVCPU *cpu = RISCV_CPU(cs);
 350     hwaddr phys_addr;
 351     int prot;
 352     int mmu_idx = cpu_mmu_index(&cpu->env, false);
 353
 354     if (get_physical_address(&cpu->env, &phys_addr, &prot, addr, 0, mmu_idx)) {
 355         return -1;
 356     }
 357     return phys_addr;
 358 }
 359
 360 void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
 361                                    MMUAccessType access_type, int mmu_idx,
 362                                    uintptr_t retaddr)
 363 {
 364     RISCVCPU *cpu = RISCV_CPU(cs);
 365     CPURISCVState *env = &cpu->env;
 366     switch (access_type) {
 367     case MMU_INST_FETCH:
 368         cs->exception_index = RISCV_EXCP_INST_ADDR_MIS;
 369         break;
 370     case MMU_DATA_LOAD:
 371         cs->exception_index = RISCV_EXCP_LOAD_ADDR_MIS;
 372         break;
 373     case MMU_DATA_STORE:
 374         cs->exception_index = RISCV_EXCP_STORE_AMO_ADDR_MIS;
 375         break;
 376     default:
 377         g_assert_not_reached();
 378     }
 379     env->badaddr = addr;
 380     riscv_raise_exception(env, cs->exception_index, retaddr);
 381 }
 382
 383 /* called by qemu's softmmu to fill the qemu tlb */
 384 void tlb_fill(CPUState *cs, target_ulong addr, int size,
 385         MMUAccessType access_type, int mmu_idx, uintptr_t retaddr)
 386 {
 387     int ret;
 388     ret = riscv_cpu_handle_mmu_fault(cs, addr, size, access_type, mmu_idx);
 389     if (ret == TRANSLATE_FAIL) {
 390         RISCVCPU *cpu = RISCV_CPU(cs);
 391         CPURISCVState *env = &cpu->env;
 392         riscv_raise_exception(env, cs->exception_index, retaddr);
 393     }
 394 }
 395
 396 #endif
 397
 398 int riscv_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int size,
 399         int rw, int mmu_idx)
 400 {
 401     RISCVCPU *cpu = RISCV_CPU(cs);
 402     CPURISCVState *env = &cpu->env;
 403 #if !defined(CONFIG_USER_ONLY)
 404     hwaddr pa = 0;
 405     int prot;
 406 #endif
 407     int ret = TRANSLATE_FAIL;
 408
 409     qemu_log_mask(CPU_LOG_MMU,
 410             "%s pc " TARGET_FMT_lx " ad %" VADDR_PRIx " rw %d mmu_idx \
 411              %d\n", __func__, env->pc, address, rw, mmu_idx);
 412
 413 #if !defined(CONFIG_USER_ONLY)
 414     ret = get_physical_address(env, &pa, &prot, address, rw, mmu_idx);
 415     qemu_log_mask(CPU_LOG_MMU,
 416             "%s address=%" VADDR_PRIx " ret %d physical " TARGET_FMT_plx
 417              " prot %d\n", __func__, address, ret, pa, prot);
 418     if (riscv_feature(env, RISCV_FEATURE_PMP) &&
 419         !pmp_hart_has_privs(env, pa, TARGET_PAGE_SIZE, 1 << rw)) {
 420         ret = TRANSLATE_FAIL;
 421     }
 422     if (ret == TRANSLATE_SUCCESS) {
 423         tlb_set_page(cs, address & TARGET_PAGE_MASK, pa & TARGET_PAGE_MASK,
 424                      prot, mmu_idx, TARGET_PAGE_SIZE);
 425     } else if (ret == TRANSLATE_FAIL) {
 426         raise_mmu_exception(env, address, rw);
 427     }
 428 #else
 429     switch (rw) {
 430     case MMU_INST_FETCH:
 431         cs->exception_index = RISCV_EXCP_INST_PAGE_FAULT;
 432         break;
 433     case MMU_DATA_LOAD:
 434         cs->exception_index = RISCV_EXCP_LOAD_PAGE_FAULT;
 435         break;
 436     case MMU_DATA_STORE:
 437         cs->exception_index = RISCV_EXCP_STORE_PAGE_FAULT;
 438         break;
 439     }
 440 #endif
 441     return ret;
 442 }
 443
 444 /*
 445  * Handle Traps
 446  *
 447  * Adapted from Spike's processor_t::take_trap.
 448  *
 449  */
 450 void riscv_cpu_do_interrupt(CPUState *cs)
 451 {
 452 #if !defined(CONFIG_USER_ONLY)
 453
 454     RISCVCPU *cpu = RISCV_CPU(cs);
 455     CPURISCVState *env = &cpu->env;
 456
 457     if (RISCV_DEBUG_INTERRUPT) {
 458         int log_cause = cs->exception_index & RISCV_EXCP_INT_MASK;
 459         if (cs->exception_index & RISCV_EXCP_INT_FLAG) {
 460             qemu_log_mask(LOG_TRACE, "core "
 461                 TARGET_FMT_ld ": trap %s, epc 0x" TARGET_FMT_lx "\n",
 462                 env->mhartid, riscv_intr_names[log_cause], env->pc);
 463         } else {
 464             qemu_log_mask(LOG_TRACE, "core "
 465                 TARGET_FMT_ld ": intr %s, epc 0x" TARGET_FMT_lx "\n",
 466                 env->mhartid, riscv_excp_names[log_cause], env->pc);
 467         }
 468     }
 469
 470     target_ulong fixed_cause = 0;
 471     if (cs->exception_index & (RISCV_EXCP_INT_FLAG)) {
 472         /* hacky for now. the MSB (bit 63) indicates interrupt but cs->exception
 473            index is only 32 bits wide */
 474         fixed_cause = cs->exception_index & RISCV_EXCP_INT_MASK;
 475         fixed_cause |= ((target_ulong)1) << (TARGET_LONG_BITS - 1);
 476     } else {
 477         /* fixup User ECALL -> correct priv ECALL */
 478         if (cs->exception_index == RISCV_EXCP_U_ECALL) {
 479             switch (env->priv) {
 480             case PRV_U:
 481                 fixed_cause = RISCV_EXCP_U_ECALL;
 482                 break;
 483             case PRV_S:
 484                 fixed_cause = RISCV_EXCP_S_ECALL;
 485                 break;
 486             case PRV_H:
 487                 fixed_cause = RISCV_EXCP_H_ECALL;
 488                 break;
 489             case PRV_M:
 490                 fixed_cause = RISCV_EXCP_M_ECALL;
 491                 break;
 492             }
 493         } else {
 494             fixed_cause = cs->exception_index;
 495         }
 496     }
 497
 498     target_ulong backup_epc = env->pc;
 499
 500     target_ulong bit = fixed_cause;
 501     target_ulong deleg = env->medeleg;
 502
 503     int hasbadaddr =
 504         (fixed_cause == RISCV_EXCP_INST_ADDR_MIS) ||
 505         (fixed_cause == RISCV_EXCP_INST_ACCESS_FAULT) ||
 506         (fixed_cause == RISCV_EXCP_LOAD_ADDR_MIS) ||
 507         (fixed_cause == RISCV_EXCP_STORE_AMO_ADDR_MIS) ||
 508         (fixed_cause == RISCV_EXCP_LOAD_ACCESS_FAULT) ||
 509         (fixed_cause == RISCV_EXCP_STORE_AMO_ACCESS_FAULT) ||
 510         (fixed_cause == RISCV_EXCP_INST_PAGE_FAULT) ||
 511         (fixed_cause == RISCV_EXCP_LOAD_PAGE_FAULT) ||
 512         (fixed_cause == RISCV_EXCP_STORE_PAGE_FAULT);
 513
 514     if (bit & ((target_ulong)1 << (TARGET_LONG_BITS - 1))) {
 515         deleg = env->mideleg;
 516         bit &= ~((target_ulong)1 << (TARGET_LONG_BITS - 1));
 517     }
 518
 519     if (env->priv <= PRV_S && bit < 64 && ((deleg >> bit) & 1)) {
 520         /* handle the trap in S-mode */
 521         /* No need to check STVEC for misaligned - lower 2 bits cannot be set */
 522         env->pc = env->stvec;
 523         env->scause = fixed_cause;
 524         env->sepc = backup_epc;
 525
 526         if (hasbadaddr) {
 527             if (RISCV_DEBUG_INTERRUPT) {
 528                 qemu_log_mask(LOG_TRACE, "core " TARGET_FMT_ld ": badaddr 0x"
 529                     TARGET_FMT_lx "\n", env->mhartid, env->badaddr);
 530             }
 531             env->sbadaddr = env->badaddr;
 532         } else {
 533             /* otherwise we must clear sbadaddr/stval
 534              * todo: support populating stval on illegal instructions */
 535             env->sbadaddr = 0;
 536         }
 537
 538         target_ulong s = env->mstatus;
 539         s = set_field(s, MSTATUS_SPIE, env->priv_ver >= PRIV_VERSION_1_10_0 ?
 540             get_field(s, MSTATUS_SIE) : get_field(s, MSTATUS_UIE << env->priv));
 541         s = set_field(s, MSTATUS_SPP, env->priv);
 542         s = set_field(s, MSTATUS_SIE, 0);
 543         env->mstatus = s;
 544         riscv_cpu_set_mode(env, PRV_S);
 545     } else {
 546         /* No need to check MTVEC for misaligned - lower 2 bits cannot be set */
 547         env->pc = env->mtvec;
 548         env->mepc = backup_epc;
 549         env->mcause = fixed_cause;
 550
 551         if (hasbadaddr) {
 552             if (RISCV_DEBUG_INTERRUPT) {
 553                 qemu_log_mask(LOG_TRACE, "core " TARGET_FMT_ld ": badaddr 0x"
 554                     TARGET_FMT_lx "\n", env->mhartid, env->badaddr);
 555             }
 556             env->mbadaddr = env->badaddr;
 557         } else {
 558             /* otherwise we must clear mbadaddr/mtval
 559              * todo: support populating mtval on illegal instructions */
 560             env->mbadaddr = 0;
 561         }
 562
 563         target_ulong s = env->mstatus;
 564         s = set_field(s, MSTATUS_MPIE, env->priv_ver >= PRIV_VERSION_1_10_0 ?
 565             get_field(s, MSTATUS_MIE) : get_field(s, MSTATUS_UIE << env->priv));
 566         s = set_field(s, MSTATUS_MPP, env->priv);
 567         s = set_field(s, MSTATUS_MIE, 0);
 568         env->mstatus = s;
 569         riscv_cpu_set_mode(env, PRV_M);
 570     }
 571     /* TODO yield load reservation  */
 572 #endif
 573     cs->exception_index = EXCP_NONE; /* mark handled to qemu */
 574 }