[PATCH 00/18] single-binary: target/riscv, compile subset of compilation units once

[PATCH 00/18] single-binary: target/riscv, compile subset of compilation units once

[Anton Johansson via qemu development]

All compilation units which do not pull in helper definitions are
compiled once for system mode by widening target_ulong to
uint64_t.

This series is motivated by the fact that riscv64 already handles
XLEN == 32 as a subset of the 64-bit ISA.  As such we can reduce
duplicate compilation units by moving towards riscv64 as default.

If anyone more familiar with riscv is aware of differences between XLEN
== 32 on riscv64 vs riscv32, please do let me know. No behaviour change
is intended compared to riscv32.

Based on: 20260916-hw-riscv-cpu-int-v4-0-babc367b60f5@rev.ng

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
Anton Johansson (18):
      target/riscv: Make internals.h target agnostic
      target/riscv: meson, add user and common system source sets
      target/riscv: Move pmu CSR read to csr.h
      target/riscv: Make debug.c target agnostic
      target/riscv: Widen CSR ops to 64-bit and compile once for system-mode
      target/riscv: Runtime CPU registration
      target/riscv: Runtime register MAX and BARE CPUs
      target/riscv: cpu.c unconditionally check larger MXL
      target/riscv: Stub KVM functions for machines.c/cpu.c
      target/riscv: Compile cpu.c once for system-mode
      target/riscv: Compile cpu_helper.c once for system-mode
      target/riscv: Compile tcg-cpu.c once for system-mode
      target/riscv: Compile riscv-qmp-cmds.c once
      target/riscv: Compile pmp.c once
      target/riscv: Compile arch_dump.c once
      target/riscv: Compile machine.c once
      target/riscv: Compile time_helper.c once
      target/riscv: Compile monitor.c once

 target/riscv/cpu.h                  |   1 +
 target/riscv/internals.h            |  31 +-
 target/riscv/tcg/csr.h              |  37 +-
 target/riscv/tcg/debug.h            |  11 +-
 target/riscv/tcg/pmu.h              |   3 -
 target/riscv/tcg/vector_internals.h |   5 +-
 target/riscv/arch_dump.c            |  13 +-
 target/riscv/cpu.c                  | 259 ++++++++-----
 target/riscv/gdbstub.c              |   2 +-
 target/riscv/kvm/kvm-stub.c         |  21 +
 target/riscv/machine.c              |  10 +-
 target/riscv/monitor.c              |  45 +--
 target/riscv/tcg/cpu_helper.c       |  79 ++--
 target/riscv/tcg/csr.c              | 736 ++++++++++++++++++------------------
 target/riscv/tcg/debug.c            | 150 ++++----
 target/riscv/tcg/mips_csr.c         |  12 +-
 target/riscv/tcg/op_helper.c        |   6 +-
 target/riscv/tcg/pmp.c              |  19 +-
 target/riscv/tcg/pmu.c              |   9 +-
 target/riscv/tcg/tcg-cpu.c          |   8 +-
 target/riscv/tcg/th_csr.c           |   6 +-
 target/riscv/tcg/vector_helper.c    |  64 ++--
 target/riscv/meson.build            |  18 +-
 target/riscv/tcg/meson.build        |  21 +-
 24 files changed, 826 insertions(+), 740 deletions(-)

[PATCH 00/18] single-binary: target/riscv, compile subset of compilation units once

[Anton Johansson via]

All compilation units which do not pull in helper definitions are
compiled once for system mode by widening target_ulong to
uint64_t.

This series is motivated by the fact that riscv64 already handles
XLEN == 32 as a subset of the 64-bit ISA.  As such we can reduce
duplicate compilation units by moving towards riscv64 as default.

If anyone more familiar with riscv is aware of differences between XLEN
== 32 on riscv64 vs riscv32, please do let me know. No behaviour change
is intended compared to riscv32.

Based on: 20260916-hw-riscv-cpu-int-v4-0-babc367b60f5@rev.ng

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
Anton Johansson (18):
      target/riscv: Make internals.h target agnostic
      target/riscv: meson, add user and common system source sets
      target/riscv: Move pmu CSR read to csr.h
      target/riscv: Make debug.c target agnostic
      target/riscv: Widen CSR ops to 64-bit and compile once for system-mode
      target/riscv: Runtime CPU registration
      target/riscv: Runtime register MAX and BARE CPUs
      target/riscv: cpu.c unconditionally check larger MXL
      target/riscv: Stub KVM functions for machines.c/cpu.c
      target/riscv: Compile cpu.c once for system-mode
      target/riscv: Compile cpu_helper.c once for system-mode
      target/riscv: Compile tcg-cpu.c once for system-mode
      target/riscv: Compile riscv-qmp-cmds.c once
      target/riscv: Compile pmp.c once
      target/riscv: Compile arch_dump.c once
      target/riscv: Compile machine.c once
      target/riscv: Compile time_helper.c once
      target/riscv: Compile monitor.c once

 target/riscv/cpu.h                  |   1 +
 target/riscv/internals.h            |  31 +-
 target/riscv/tcg/csr.h              |  37 +-
 target/riscv/tcg/debug.h            |  11 +-
 target/riscv/tcg/pmu.h              |   3 -
 target/riscv/tcg/vector_internals.h |   5 +-
 target/riscv/arch_dump.c            |  13 +-
 target/riscv/cpu.c                  | 259 ++++++++-----
 target/riscv/gdbstub.c              |   2 +-
 target/riscv/kvm/kvm-stub.c         |  21 +
 target/riscv/machine.c              |  10 +-
 target/riscv/monitor.c              |  45 +--
 target/riscv/tcg/cpu_helper.c       |  79 ++--
 target/riscv/tcg/csr.c              | 736 ++++++++++++++++++------------------
 target/riscv/tcg/debug.c            | 150 ++++----
 target/riscv/tcg/mips_csr.c         |  12 +-
 target/riscv/tcg/op_helper.c        |   6 +-
 target/riscv/tcg/pmp.c              |  19 +-
 target/riscv/tcg/pmu.c              |   9 +-
 target/riscv/tcg/tcg-cpu.c          |   8 +-
 target/riscv/tcg/th_csr.c           |   6 +-
 target/riscv/tcg/vector_helper.c    |  64 ++--
 target/riscv/meson.build            |  18 +-
 target/riscv/tcg/meson.build        |  21 +-
 24 files changed, 826 insertions(+), 740 deletions(-)

[PATCH 01/18] target/riscv: Make internals.h target agnostic

[Anton Johansson via qemu development]

Replaces uses of target_ulong with fixed-size integers, this is a
prerequisite step to compiling cpu.c once for system-mode.

Note: the widening of target_long to int64_t in adjust_addr_body() is
safe as rv32 is ruled out earlier in the function via the check

  /* do nothing for rv32 mode */
  if (riscv_cpu_mxl(env) == MXL_RV32) {
      return addr;
  }

meaning target_long must be equal to int64_t anyway.

Duplicate includes between vector_helper.c and vector_internals.h are
removed.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/internals.h            | 31 +++++++++---------
 target/riscv/tcg/vector_internals.h |  5 +--
 target/riscv/tcg/vector_helper.c    | 64 +++++++++++++++++--------------------
 3 files changed, 47 insertions(+), 53 deletions(-)

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 1ee7e99e98..c963fae321 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -20,7 +20,6 @@
 #define RISCV_CPU_INTERNALS_H
 
 #include "exec/cpu-common.h"
-#include "exec/target_long.h"
 #include "hw/core/registerfields.h"
 #include "fpu/softfloat-types.h"
 #include "target/riscv/cpu_bits.h"
@@ -98,10 +97,10 @@ FIELD(VDATA, NF, 7, 4)
 FIELD(VDATA, WD, 7, 1)
 
 /* float point classify helpers */
-target_ulong fclass_h_bf16(uint64_t frs1);
-target_ulong fclass_h(uint64_t frs1);
-target_ulong fclass_s(uint64_t frs1);
-target_ulong fclass_d(uint64_t frs1);
+uint16_t fclass_h_bf16(bfloat16 frs1);
+uint16_t fclass_h(float16 frs1);
+uint16_t fclass_s(float32 frs1);
+uint16_t fclass_d(float64 frs1);
 
 #ifndef CONFIG_USER_ONLY
 extern const VMStateDescription vmstate_riscv_cpu;
@@ -185,7 +184,7 @@ static inline float16 check_nanbox_bf16(CPURISCVState *env, uint64_t f)
     }
 }
 
-static inline target_ulong get_xepc_mask(CPURISCVState *env)
+static inline uint64_t get_xepc_mask(CPURISCVState *env)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -196,9 +195,9 @@ static inline target_ulong get_xepc_mask(CPURISCVState *env)
     if (riscv_has_ext(env, RVC) || cpu->cfg.ext_zca ||
         cpu->cfg.ext_zcb || cpu->cfg.ext_zcd || cpu->cfg.ext_zce ||
         cpu->cfg.ext_zcf || cpu->cfg.ext_zcmp || cpu->cfg.ext_zcmt) {
-        return ~(target_ulong)1;
+        return ~1ull;
     } else {
-        return ~(target_ulong)3;
+        return ~3ull;
     }
 }
 
@@ -208,9 +207,9 @@ bool riscv_cpu_has_work(CPUState *cs);
 #endif
 
 /* Zjpm addr masking routine */
-static inline target_ulong adjust_addr_body(CPURISCVState *env,
-                                            target_ulong addr,
-                                            bool is_virt_addr)
+static inline uint64_t adjust_addr_body(CPURISCVState *env,
+                                        uint64_t addr,
+                                        bool is_virt_addr)
 {
     RISCVPmPmm pmm = PMM_FIELD_DISABLED;
     uint32_t pmlen = 0;
@@ -239,7 +238,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
 
     /* sign/zero extend masked address by N-1 bit */
     if (signext) {
-        addr = (target_long)addr >> pmlen;
+        addr = (int64_t)addr >> pmlen;
     } else {
         addr = addr >> pmlen;
     }
@@ -247,14 +246,14 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
     return addr;
 }
 
-static inline target_ulong adjust_addr(CPURISCVState *env,
-                                       target_ulong addr)
+static inline uint64_t adjust_addr(CPURISCVState *env,
+                                   uint64_t addr)
 {
     return adjust_addr_body(env, addr, false);
 }
 
-static inline target_ulong adjust_addr_virt(CPURISCVState *env,
-                                            target_ulong addr)
+static inline uint64_t adjust_addr_virt(CPURISCVState *env,
+                                        uint64_t addr)
 {
     return adjust_addr_body(env, addr, true);
 }
diff --git a/target/riscv/tcg/vector_internals.h b/target/riscv/tcg/vector_internals.h
index 5681b81815..7e186add2d 100644
--- a/target/riscv/tcg/vector_internals.h
+++ b/target/riscv/tcg/vector_internals.h
@@ -20,10 +20,11 @@
 #define TARGET_RISCV_VECTOR_INTERNALS_H
 
 #include "qemu/bitops.h"
+#include "exec/target_long.h"
 #include "hw/core/registerfields.h"
-#include "cpu.h"
+#include "target/riscv/cpu.h"
+#include "target/riscv/internals.h"
 #include "tcg/tcg-gvec-desc.h"
-#include "internals.h"
 
 #define VSTART_CHECK_EARLY_EXIT(env, vl) do { \
     if (env->vstart >= vl) {                  \
diff --git a/target/riscv/tcg/vector_helper.c b/target/riscv/tcg/vector_helper.c
index 0d1e4e0964..b4a07dbe13 100644
--- a/target/riscv/tcg/vector_helper.c
+++ b/target/riscv/tcg/vector_helper.c
@@ -19,7 +19,7 @@
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
 #include "qemu/bitops.h"
-#include "cpu.h"
+#include "target/riscv/tcg/vector_internals.h"
 #include "exec/memop.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
@@ -29,8 +29,6 @@
 #include "exec/target_page.h"
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
-#include "internals.h"
-#include "vector_internals.h"
 #include <math.h>
 
 static target_ulong vtype_reserved(CPURISCVState *env, target_ulong vtype)
@@ -4852,77 +4850,73 @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
 GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
 
 /* Vector Floating-Point Classify Instruction */
-target_ulong fclass_h_bf16(uint64_t frs1)
+uint16_t fclass_h_bf16(bfloat16 frs1)
 {
-    bfloat16 f = frs1;
-    bool sign = bfloat16_is_neg(f);
+    bool sign = bfloat16_is_neg(frs1);
 
-    if (bfloat16_is_infinity(f)) {
+    if (bfloat16_is_infinity(frs1)) {
         return sign ? 1 << 0 : 1 << 7;
-    } else if (bfloat16_is_zero(f)) {
+    } else if (bfloat16_is_zero(frs1)) {
         return sign ? 1 << 3 : 1 << 4;
-    } else if (bfloat16_is_zero_or_denormal(f)) {
+    } else if (bfloat16_is_zero_or_denormal(frs1)) {
         return sign ? 1 << 2 : 1 << 5;
-    } else if (bfloat16_is_any_nan(f)) {
+    } else if (bfloat16_is_any_nan(frs1)) {
         float_status s = { }; /* for snan_bit_is_one */
-        return bfloat16_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
+        return bfloat16_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
     } else {
         return sign ? 1 << 1 : 1 << 6;
     }
 }
 
-target_ulong fclass_h(uint64_t frs1)
+uint16_t fclass_h(float16 frs1)
 {
-    float16 f = frs1;
-    bool sign = float16_is_neg(f);
+    bool sign = float16_is_neg(frs1);
 
-    if (float16_is_infinity(f)) {
+    if (float16_is_infinity(frs1)) {
         return sign ? 1 << 0 : 1 << 7;
-    } else if (float16_is_zero(f)) {
+    } else if (float16_is_zero(frs1)) {
         return sign ? 1 << 3 : 1 << 4;
-    } else if (float16_is_zero_or_denormal(f)) {
+    } else if (float16_is_zero_or_denormal(frs1)) {
         return sign ? 1 << 2 : 1 << 5;
-    } else if (float16_is_any_nan(f)) {
+    } else if (float16_is_any_nan(frs1)) {
         float_status s = { }; /* for snan_bit_is_one */
-        return float16_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
+        return float16_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
     } else {
         return sign ? 1 << 1 : 1 << 6;
     }
 }
 
-target_ulong fclass_s(uint64_t frs1)
+uint16_t fclass_s(float32 frs1)
 {
-    float32 f = frs1;
-    bool sign = float32_is_neg(f);
+    bool sign = float32_is_neg(frs1);
 
-    if (float32_is_infinity(f)) {
+    if (float32_is_infinity(frs1)) {
         return sign ? 1 << 0 : 1 << 7;
-    } else if (float32_is_zero(f)) {
+    } else if (float32_is_zero(frs1)) {
         return sign ? 1 << 3 : 1 << 4;
-    } else if (float32_is_zero_or_denormal(f)) {
+    } else if (float32_is_zero_or_denormal(frs1)) {
         return sign ? 1 << 2 : 1 << 5;
-    } else if (float32_is_any_nan(f)) {
+    } else if (float32_is_any_nan(frs1)) {
         float_status s = { }; /* for snan_bit_is_one */
-        return float32_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
+        return float32_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
     } else {
         return sign ? 1 << 1 : 1 << 6;
     }
 }
 
-target_ulong fclass_d(uint64_t frs1)
+uint16_t fclass_d(float64 frs1)
 {
-    float64 f = frs1;
-    bool sign = float64_is_neg(f);
+    bool sign = float64_is_neg(frs1);
 
-    if (float64_is_infinity(f)) {
+    if (float64_is_infinity(frs1)) {
         return sign ? 1 << 0 : 1 << 7;
-    } else if (float64_is_zero(f)) {
+    } else if (float64_is_zero(frs1)) {
         return sign ? 1 << 3 : 1 << 4;
-    } else if (float64_is_zero_or_denormal(f)) {
+    } else if (float64_is_zero_or_denormal(frs1)) {
         return sign ? 1 << 2 : 1 << 5;
-    } else if (float64_is_any_nan(f)) {
+    } else if (float64_is_any_nan(frs1)) {
         float_status s = { }; /* for snan_bit_is_one */
-        return float64_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
+        return float64_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
     } else {
         return sign ? 1 << 1 : 1 << 6;
     }

-- 
2.52.0

[PATCH 01/18] target/riscv: Make internals.h target agnostic

[Anton Johansson via]

Replaces uses of target_ulong with fixed-size integers, this is a
prerequisite step to compiling cpu.c once for system-mode.

Note: the widening of target_long to int64_t in adjust_addr_body() is
safe as rv32 is ruled out earlier in the function via the check

  /* do nothing for rv32 mode */
  if (riscv_cpu_mxl(env) == MXL_RV32) {
      return addr;
  }

meaning target_long must be equal to int64_t anyway.

Duplicate includes between vector_helper.c and vector_internals.h are
removed.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/internals.h            | 31 +++++++++---------
 target/riscv/tcg/vector_internals.h |  5 +--
 target/riscv/tcg/vector_helper.c    | 64 +++++++++++++++++--------------------
 3 files changed, 47 insertions(+), 53 deletions(-)

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 1ee7e99e98..c963fae321 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -20,7 +20,6 @@
 #define RISCV_CPU_INTERNALS_H
 
 #include "exec/cpu-common.h"
-#include "exec/target_long.h"
 #include "hw/core/registerfields.h"
 #include "fpu/softfloat-types.h"
 #include "target/riscv/cpu_bits.h"
@@ -98,10 +97,10 @@ FIELD(VDATA, NF, 7, 4)
 FIELD(VDATA, WD, 7, 1)
 
 /* float point classify helpers */
-target_ulong fclass_h_bf16(uint64_t frs1);
-target_ulong fclass_h(uint64_t frs1);
-target_ulong fclass_s(uint64_t frs1);
-target_ulong fclass_d(uint64_t frs1);
+uint16_t fclass_h_bf16(bfloat16 frs1);
+uint16_t fclass_h(float16 frs1);
+uint16_t fclass_s(float32 frs1);
+uint16_t fclass_d(float64 frs1);
 
 #ifndef CONFIG_USER_ONLY
 extern const VMStateDescription vmstate_riscv_cpu;
@@ -185,7 +184,7 @@ static inline float16 check_nanbox_bf16(CPURISCVState *env, uint64_t f)
     }
 }
 
-static inline target_ulong get_xepc_mask(CPURISCVState *env)
+static inline uint64_t get_xepc_mask(CPURISCVState *env)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -196,9 +195,9 @@ static inline target_ulong get_xepc_mask(CPURISCVState *env)
     if (riscv_has_ext(env, RVC) || cpu->cfg.ext_zca ||
         cpu->cfg.ext_zcb || cpu->cfg.ext_zcd || cpu->cfg.ext_zce ||
         cpu->cfg.ext_zcf || cpu->cfg.ext_zcmp || cpu->cfg.ext_zcmt) {
-        return ~(target_ulong)1;
+        return ~1ull;
     } else {
-        return ~(target_ulong)3;
+        return ~3ull;
     }
 }
 
@@ -208,9 +207,9 @@ bool riscv_cpu_has_work(CPUState *cs);
 #endif
 
 /* Zjpm addr masking routine */
-static inline target_ulong adjust_addr_body(CPURISCVState *env,
-                                            target_ulong addr,
-                                            bool is_virt_addr)
+static inline uint64_t adjust_addr_body(CPURISCVState *env,
+                                        uint64_t addr,
+                                        bool is_virt_addr)
 {
     RISCVPmPmm pmm = PMM_FIELD_DISABLED;
     uint32_t pmlen = 0;
@@ -239,7 +238,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
 
     /* sign/zero extend masked address by N-1 bit */
     if (signext) {
-        addr = (target_long)addr >> pmlen;
+        addr = (int64_t)addr >> pmlen;
     } else {
         addr = addr >> pmlen;
     }
@@ -247,14 +246,14 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
     return addr;
 }
 
-static inline target_ulong adjust_addr(CPURISCVState *env,
-                                       target_ulong addr)
+static inline uint64_t adjust_addr(CPURISCVState *env,
+                                   uint64_t addr)
 {
     return adjust_addr_body(env, addr, false);
 }
 
-static inline target_ulong adjust_addr_virt(CPURISCVState *env,
-                                            target_ulong addr)
+static inline uint64_t adjust_addr_virt(CPURISCVState *env,
+                                        uint64_t addr)
 {
     return adjust_addr_body(env, addr, true);
 }
diff --git a/target/riscv/tcg/vector_internals.h b/target/riscv/tcg/vector_internals.h
index 5681b81815..7e186add2d 100644
--- a/target/riscv/tcg/vector_internals.h
+++ b/target/riscv/tcg/vector_internals.h
@@ -20,10 +20,11 @@
 #define TARGET_RISCV_VECTOR_INTERNALS_H
 
 #include "qemu/bitops.h"
+#include "exec/target_long.h"
 #include "hw/core/registerfields.h"
-#include "cpu.h"
+#include "target/riscv/cpu.h"
+#include "target/riscv/internals.h"
 #include "tcg/tcg-gvec-desc.h"
-#include "internals.h"
 
 #define VSTART_CHECK_EARLY_EXIT(env, vl) do { \
     if (env->vstart >= vl) {                  \
diff --git a/target/riscv/tcg/vector_helper.c b/target/riscv/tcg/vector_helper.c
index 0d1e4e0964..b4a07dbe13 100644
--- a/target/riscv/tcg/vector_helper.c
+++ b/target/riscv/tcg/vector_helper.c
@@ -19,7 +19,7 @@
 #include "qemu/osdep.h"
 #include "qemu/host-utils.h"
 #include "qemu/bitops.h"
-#include "cpu.h"
+#include "target/riscv/tcg/vector_internals.h"
 #include "exec/memop.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"
@@ -29,8 +29,6 @@
 #include "exec/target_page.h"
 #include "fpu/softfloat.h"
 #include "tcg/tcg-gvec-desc.h"
-#include "internals.h"
-#include "vector_internals.h"
 #include <math.h>
 
 static target_ulong vtype_reserved(CPURISCVState *env, target_ulong vtype)
@@ -4852,77 +4850,73 @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
 GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
 
 /* Vector Floating-Point Classify Instruction */
-target_ulong fclass_h_bf16(uint64_t frs1)
+uint16_t fclass_h_bf16(bfloat16 frs1)
 {
-    bfloat16 f = frs1;
-    bool sign = bfloat16_is_neg(f);
+    bool sign = bfloat16_is_neg(frs1);
 
-    if (bfloat16_is_infinity(f)) {
+    if (bfloat16_is_infinity(frs1)) {
         return sign ? 1 << 0 : 1 << 7;
-    } else if (bfloat16_is_zero(f)) {
+    } else if (bfloat16_is_zero(frs1)) {
         return sign ? 1 << 3 : 1 << 4;
-    } else if (bfloat16_is_zero_or_denormal(f)) {
+    } else if (bfloat16_is_zero_or_denormal(frs1)) {
         return sign ? 1 << 2 : 1 << 5;
-    } else if (bfloat16_is_any_nan(f)) {
+    } else if (bfloat16_is_any_nan(frs1)) {
         float_status s = { }; /* for snan_bit_is_one */
-        return bfloat16_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
+        return bfloat16_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
     } else {
         return sign ? 1 << 1 : 1 << 6;
     }
 }
 
-target_ulong fclass_h(uint64_t frs1)
+uint16_t fclass_h(float16 frs1)
 {
-    float16 f = frs1;
-    bool sign = float16_is_neg(f);
+    bool sign = float16_is_neg(frs1);
 
-    if (float16_is_infinity(f)) {
+    if (float16_is_infinity(frs1)) {
         return sign ? 1 << 0 : 1 << 7;
-    } else if (float16_is_zero(f)) {
+    } else if (float16_is_zero(frs1)) {
         return sign ? 1 << 3 : 1 << 4;
-    } else if (float16_is_zero_or_denormal(f)) {
+    } else if (float16_is_zero_or_denormal(frs1)) {
         return sign ? 1 << 2 : 1 << 5;
-    } else if (float16_is_any_nan(f)) {
+    } else if (float16_is_any_nan(frs1)) {
         float_status s = { }; /* for snan_bit_is_one */
-        return float16_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
+        return float16_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
     } else {
         return sign ? 1 << 1 : 1 << 6;
     }
 }
 
-target_ulong fclass_s(uint64_t frs1)
+uint16_t fclass_s(float32 frs1)
 {
-    float32 f = frs1;
-    bool sign = float32_is_neg(f);
+    bool sign = float32_is_neg(frs1);
 
-    if (float32_is_infinity(f)) {
+    if (float32_is_infinity(frs1)) {
         return sign ? 1 << 0 : 1 << 7;
-    } else if (float32_is_zero(f)) {
+    } else if (float32_is_zero(frs1)) {
         return sign ? 1 << 3 : 1 << 4;
-    } else if (float32_is_zero_or_denormal(f)) {
+    } else if (float32_is_zero_or_denormal(frs1)) {
         return sign ? 1 << 2 : 1 << 5;
-    } else if (float32_is_any_nan(f)) {
+    } else if (float32_is_any_nan(frs1)) {
         float_status s = { }; /* for snan_bit_is_one */
-        return float32_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
+        return float32_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
     } else {
         return sign ? 1 << 1 : 1 << 6;
     }
 }
 
-target_ulong fclass_d(uint64_t frs1)
+uint16_t fclass_d(float64 frs1)
 {
-    float64 f = frs1;
-    bool sign = float64_is_neg(f);
+    bool sign = float64_is_neg(frs1);
 
-    if (float64_is_infinity(f)) {
+    if (float64_is_infinity(frs1)) {
         return sign ? 1 << 0 : 1 << 7;
-    } else if (float64_is_zero(f)) {
+    } else if (float64_is_zero(frs1)) {
         return sign ? 1 << 3 : 1 << 4;
-    } else if (float64_is_zero_or_denormal(f)) {
+    } else if (float64_is_zero_or_denormal(frs1)) {
         return sign ? 1 << 2 : 1 << 5;
-    } else if (float64_is_any_nan(f)) {
+    } else if (float64_is_any_nan(frs1)) {
         float_status s = { }; /* for snan_bit_is_one */
-        return float64_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
+        return float64_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
     } else {
         return sign ? 1 << 1 : 1 << 6;
     }

-- 
2.52.0

Re: [PATCH 01/18] target/riscv: Make internals.h target agnostic

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> Replaces uses of target_ulong with fixed-size integers, this is a
> prerequisite step to compiling cpu.c once for system-mode.
> 
> Note: the widening of target_long to int64_t in adjust_addr_body() is
> safe as rv32 is ruled out earlier in the function via the check
> 
>   /* do nothing for rv32 mode */
>   if (riscv_cpu_mxl(env) == MXL_RV32) {
>       return addr;
>   }
> 
> meaning target_long must be equal to int64_t anyway.
> 
> Duplicate includes between vector_helper.c and vector_internals.h are
> removed.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/internals.h            | 31 +++++++++---------
>  target/riscv/tcg/vector_internals.h |  5 +--
>  target/riscv/tcg/vector_helper.c    | 64 +++++++++++++++++--------------------
>  3 files changed, 47 insertions(+), 53 deletions(-)
> 

...

>  /* Zjpm addr masking routine */
> -static inline target_ulong adjust_addr_body(CPURISCVState *env,
> -                                            target_ulong addr,
> -                                            bool is_virt_addr)
> +static inline uint64_t adjust_addr_body(CPURISCVState *env,
> +                                        uint64_t addr,
> +                                        bool is_virt_addr)
>  {
>      RISCVPmPmm pmm = PMM_FIELD_DISABLED;
>      uint32_t pmlen = 0;
> @@ -239,7 +238,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
>  
>      /* sign/zero extend masked address by N-1 bit */
>      if (signext) {
> -        addr = (target_long)addr >> pmlen;
> +        addr = (int64_t)addr >> pmlen;
>      } else {
>          addr = addr >> pmlen;
>      }

I think this one is incorrect, since for a 32-bit addr, value will not
get sign extended, so shift will be unsigned.

```
#include <stdio.h>
#include <stdint.h>
#include <inttypes.h>

uint64_t out64(uint64_t in)
{
    return (int64_t) in >> 1;
}

uint32_t out32(uint32_t in)
{
    return (int32_t) in >> 1;
}

int main()
{
    printf("32: %"PRIx32"\n", out32(0xffffffff));
    printf("64: %"PRIx64"\n", out64(0xffffffff));
}
```

Output is:
32: ffffffff
64: 7fffffff

We need to add a:
if (target_long_bits() == 32) {
  addr = (int32_t)addr >> pmlen;
else {
  addr = (int64_t)addr >> pmlen;
}

Regards,
Pierrick

Re: [PATCH 01/18] target/riscv: Make internals.h target agnostic

[Pierrick Bouvier]

On 10/1/2026 2:25 PM, Pierrick Bouvier wrote:
> On 10/1/2026 8:59 AM, Anton Johansson wrote:
>> Replaces uses of target_ulong with fixed-size integers, this is a
>> prerequisite step to compiling cpu.c once for system-mode.
>>
>> Note: the widening of target_long to int64_t in adjust_addr_body() is
>> safe as rv32 is ruled out earlier in the function via the check
>>
>>   /* do nothing for rv32 mode */
>>   if (riscv_cpu_mxl(env) == MXL_RV32) {
>>       return addr;
>>   }
>>
>> meaning target_long must be equal to int64_t anyway.
>>
>> Duplicate includes between vector_helper.c and vector_internals.h are
>> removed.
>>
>> Signed-off-by: Anton Johansson <anjo@rev.ng>
>> ---
>>  target/riscv/internals.h            | 31 +++++++++---------
>>  target/riscv/tcg/vector_internals.h |  5 +--
>>  target/riscv/tcg/vector_helper.c    | 64 +++++++++++++++++--------------------
>>  3 files changed, 47 insertions(+), 53 deletions(-)
>>
> 
> ...
> 
>>  /* Zjpm addr masking routine */
>> -static inline target_ulong adjust_addr_body(CPURISCVState *env,
>> -                                            target_ulong addr,
>> -                                            bool is_virt_addr)
>> +static inline uint64_t adjust_addr_body(CPURISCVState *env,
>> +                                        uint64_t addr,
>> +                                        bool is_virt_addr)
>>  {
>>      RISCVPmPmm pmm = PMM_FIELD_DISABLED;
>>      uint32_t pmlen = 0;
>> @@ -239,7 +238,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
>>  
>>      /* sign/zero extend masked address by N-1 bit */
>>      if (signext) {
>> -        addr = (target_long)addr >> pmlen;
>> +        addr = (int64_t)addr >> pmlen;
>>      } else {
>>          addr = addr >> pmlen;
>>      }
> 
> I think this one is incorrect, since for a 32-bit addr, value will not
> get sign extended, so shift will be unsigned.
> 
> ```
> #include <stdio.h>
> #include <stdint.h>
> #include <inttypes.h>
> 
> uint64_t out64(uint64_t in)
> {
>     return (int64_t) in >> 1;
> }
> 
> uint32_t out32(uint32_t in)
> {
>     return (int32_t) in >> 1;
> }
> 
> int main()
> {
>     printf("32: %"PRIx32"\n", out32(0xffffffff));
>     printf("64: %"PRIx64"\n", out64(0xffffffff));
> }
> ```
> 
> Output is:
> 32: ffffffff
> 64: 7fffffff
> 
> We need to add a:
> if (target_long_bits() == 32) {
>   addr = (int32_t)addr >> pmlen;
> else {
>   addr = (int64_t)addr >> pmlen;
> }
>

s/target_long_bits/riscv_cpu_mxl/
but you get the idea :)

> Regards,
> Pierrick

Re: [PATCH 01/18] target/riscv: Make internals.h target agnostic

[Anton Johansson via qemu development]

On 01/10/26, Pierrick Bouvier wrote:
> On 10/1/2026 8:59 AM, Anton Johansson wrote:
> > Replaces uses of target_ulong with fixed-size integers, this is a
> > prerequisite step to compiling cpu.c once for system-mode.
> > 
> > Note: the widening of target_long to int64_t in adjust_addr_body() is
> > safe as rv32 is ruled out earlier in the function via the check
> > 
> >   /* do nothing for rv32 mode */
> >   if (riscv_cpu_mxl(env) == MXL_RV32) {
> >       return addr;
> >   }
> > 
> > meaning target_long must be equal to int64_t anyway.
> > 
> > Duplicate includes between vector_helper.c and vector_internals.h are
> > removed.
> > 
> > Signed-off-by: Anton Johansson <anjo@rev.ng>
> > ---
> >  target/riscv/internals.h            | 31 +++++++++---------
> >  target/riscv/tcg/vector_internals.h |  5 +--
> >  target/riscv/tcg/vector_helper.c    | 64 +++++++++++++++++--------------------
> >  3 files changed, 47 insertions(+), 53 deletions(-)
> > 
> 
> ...
> 
> >  /* Zjpm addr masking routine */
> > -static inline target_ulong adjust_addr_body(CPURISCVState *env,
> > -                                            target_ulong addr,
> > -                                            bool is_virt_addr)
> > +static inline uint64_t adjust_addr_body(CPURISCVState *env,
> > +                                        uint64_t addr,
> > +                                        bool is_virt_addr)
> >  {
> >      RISCVPmPmm pmm = PMM_FIELD_DISABLED;
> >      uint32_t pmlen = 0;
> > @@ -239,7 +238,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
> >  
> >      /* sign/zero extend masked address by N-1 bit */
> >      if (signext) {
> > -        addr = (target_long)addr >> pmlen;
> > +        addr = (int64_t)addr >> pmlen;
> >      } else {
> >          addr = addr >> pmlen;
> >      }
> 
> I think this one is incorrect, since for a 32-bit addr, value will not
> get sign extended, so shift will be unsigned.
> 
> ```
> #include <stdio.h>
> #include <stdint.h>
> #include <inttypes.h>
> 
> uint64_t out64(uint64_t in)
> {
>     return (int64_t) in >> 1;
> }
> 
> uint32_t out32(uint32_t in)
> {
>     return (int32_t) in >> 1;
> }
> 
> int main()
> {
>     printf("32: %"PRIx32"\n", out32(0xffffffff));
>     printf("64: %"PRIx64"\n", out64(0xffffffff));
> }
> ```
> 
> Output is:
> 32: ffffffff
> 64: 7fffffff
> 
> We need to add a:
> if (target_long_bits() == 32) {
>   addr = (int32_t)addr >> pmlen;
> else {
>   addr = (int64_t)addr >> pmlen;
> }
> 
> Regards,
> Pierrick

No this is not necessary unless I'm missing something, see commit comment.
MXL_RV32 is ruled out earlier in the function

  static inline uint64_t adjust_addr_body(CPURISCVState *env,
                                          uint64_t addr,
                                          bool is_virt_addr)
  {
      ...
  
      /* do nothing for rv32 mode */
      if (riscv_cpu_mxl(env) == MXL_RV32) {
          return addr;
      }

      ...

      /* sign/zero extend masked address by N-1 bit */
      if (signext) {
	  addr = (int64_t)addr >> pmlen;
      } else {
          addr = addr >> pmlen;
      }

      return addr;
  }

-- 
Anton Johansson
rev.ng Labs Srl.

Re: [PATCH 01/18] target/riscv: Make internals.h target agnostic

[Anton Johansson via]

On 01/10/26, Pierrick Bouvier wrote:
> On 10/1/2026 8:59 AM, Anton Johansson wrote:
> > Replaces uses of target_ulong with fixed-size integers, this is a
> > prerequisite step to compiling cpu.c once for system-mode.
> > 
> > Note: the widening of target_long to int64_t in adjust_addr_body() is
> > safe as rv32 is ruled out earlier in the function via the check
> > 
> >   /* do nothing for rv32 mode */
> >   if (riscv_cpu_mxl(env) == MXL_RV32) {
> >       return addr;
> >   }
> > 
> > meaning target_long must be equal to int64_t anyway.
> > 
> > Duplicate includes between vector_helper.c and vector_internals.h are
> > removed.
> > 
> > Signed-off-by: Anton Johansson <anjo@rev.ng>
> > ---
> >  target/riscv/internals.h            | 31 +++++++++---------
> >  target/riscv/tcg/vector_internals.h |  5 +--
> >  target/riscv/tcg/vector_helper.c    | 64 +++++++++++++++++--------------------
> >  3 files changed, 47 insertions(+), 53 deletions(-)
> > 
> 
> ...
> 
> >  /* Zjpm addr masking routine */
> > -static inline target_ulong adjust_addr_body(CPURISCVState *env,
> > -                                            target_ulong addr,
> > -                                            bool is_virt_addr)
> > +static inline uint64_t adjust_addr_body(CPURISCVState *env,
> > +                                        uint64_t addr,
> > +                                        bool is_virt_addr)
> >  {
> >      RISCVPmPmm pmm = PMM_FIELD_DISABLED;
> >      uint32_t pmlen = 0;
> > @@ -239,7 +238,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
> >  
> >      /* sign/zero extend masked address by N-1 bit */
> >      if (signext) {
> > -        addr = (target_long)addr >> pmlen;
> > +        addr = (int64_t)addr >> pmlen;
> >      } else {
> >          addr = addr >> pmlen;
> >      }
> 
> I think this one is incorrect, since for a 32-bit addr, value will not
> get sign extended, so shift will be unsigned.
> 
> ```
> #include <stdio.h>
> #include <stdint.h>
> #include <inttypes.h>
> 
> uint64_t out64(uint64_t in)
> {
>     return (int64_t) in >> 1;
> }
> 
> uint32_t out32(uint32_t in)
> {
>     return (int32_t) in >> 1;
> }
> 
> int main()
> {
>     printf("32: %"PRIx32"\n", out32(0xffffffff));
>     printf("64: %"PRIx64"\n", out64(0xffffffff));
> }
> ```
> 
> Output is:
> 32: ffffffff
> 64: 7fffffff
> 
> We need to add a:
> if (target_long_bits() == 32) {
>   addr = (int32_t)addr >> pmlen;
> else {
>   addr = (int64_t)addr >> pmlen;
> }
> 
> Regards,
> Pierrick

No this is not necessary unless I'm missing something, see commit comment.
MXL_RV32 is ruled out earlier in the function

  static inline uint64_t adjust_addr_body(CPURISCVState *env,
                                          uint64_t addr,
                                          bool is_virt_addr)
  {
      ...
  
      /* do nothing for rv32 mode */
      if (riscv_cpu_mxl(env) == MXL_RV32) {
          return addr;
      }

      ...

      /* sign/zero extend masked address by N-1 bit */
      if (signext) {
	  addr = (int64_t)addr >> pmlen;
      } else {
          addr = addr >> pmlen;
      }

      return addr;
  }

-- 
Anton Johansson
rev.ng Labs Srl.

Re: [PATCH 01/18] target/riscv: Make internals.h target agnostic

[Pierrick Bouvier]

On 10/6/2026 4:14 PM, Anton Johansson wrote:
> On 01/10/26, Pierrick Bouvier wrote:
>> On 10/1/2026 8:59 AM, Anton Johansson wrote:
>>> Replaces uses of target_ulong with fixed-size integers, this is a
>>> prerequisite step to compiling cpu.c once for system-mode.
>>>
>>> Note: the widening of target_long to int64_t in adjust_addr_body() is
>>> safe as rv32 is ruled out earlier in the function via the check
>>>
>>>   /* do nothing for rv32 mode */
>>>   if (riscv_cpu_mxl(env) == MXL_RV32) {
>>>       return addr;
>>>   }
>>>
>>> meaning target_long must be equal to int64_t anyway.
>>>
>>> Duplicate includes between vector_helper.c and vector_internals.h are
>>> removed.
>>>
>>> Signed-off-by: Anton Johansson <anjo@rev.ng>
>>> ---
>>>  target/riscv/internals.h            | 31 +++++++++---------
>>>  target/riscv/tcg/vector_internals.h |  5 +--
>>>  target/riscv/tcg/vector_helper.c    | 64 +++++++++++++++++--------------------
>>>  3 files changed, 47 insertions(+), 53 deletions(-)
>>>
>>
>> ...
>>
>>>  /* Zjpm addr masking routine */
>>> -static inline target_ulong adjust_addr_body(CPURISCVState *env,
>>> -                                            target_ulong addr,
>>> -                                            bool is_virt_addr)
>>> +static inline uint64_t adjust_addr_body(CPURISCVState *env,
>>> +                                        uint64_t addr,
>>> +                                        bool is_virt_addr)
>>>  {
>>>      RISCVPmPmm pmm = PMM_FIELD_DISABLED;
>>>      uint32_t pmlen = 0;
>>> @@ -239,7 +238,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
>>>  
>>>      /* sign/zero extend masked address by N-1 bit */
>>>      if (signext) {
>>> -        addr = (target_long)addr >> pmlen;
>>> +        addr = (int64_t)addr >> pmlen;
>>>      } else {
>>>          addr = addr >> pmlen;
>>>      }
>>
>> I think this one is incorrect, since for a 32-bit addr, value will not
>> get sign extended, so shift will be unsigned.
>>
>> ```
>> #include <stdio.h>
>> #include <stdint.h>
>> #include <inttypes.h>
>>
>> uint64_t out64(uint64_t in)
>> {
>>     return (int64_t) in >> 1;
>> }
>>
>> uint32_t out32(uint32_t in)
>> {
>>     return (int32_t) in >> 1;
>> }
>>
>> int main()
>> {
>>     printf("32: %"PRIx32"\n", out32(0xffffffff));
>>     printf("64: %"PRIx64"\n", out64(0xffffffff));
>> }
>> ```
>>
>> Output is:
>> 32: ffffffff
>> 64: 7fffffff
>>
>> We need to add a:
>> if (target_long_bits() == 32) {
>>   addr = (int32_t)addr >> pmlen;
>> else {
>>   addr = (int64_t)addr >> pmlen;
>> }
>>
>> Regards,
>> Pierrick
> 
> No this is not necessary unless I'm missing something, see commit comment.
> MXL_RV32 is ruled out earlier in the function
> 
>   static inline uint64_t adjust_addr_body(CPURISCVState *env,
>                                           uint64_t addr,
>                                           bool is_virt_addr)
>   {
>       ...
>   
>       /* do nothing for rv32 mode */
>       if (riscv_cpu_mxl(env) == MXL_RV32) {
>           return addr;
>       }
> 
>       ...
> 
>       /* sign/zero extend masked address by N-1 bit */
>       if (signext) {
> 	  addr = (int64_t)addr >> pmlen;
>       } else {
>           addr = addr >> pmlen;
>       }
> 
>       return addr;
>   }
>

I have to confess I didn't open the full body in my editor to double
check that. In this case, that's correct.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Regards,
Pierrick

Re: [PATCH 01/18] target/riscv: Make internals.h target agnostic

[Philippe Mathieu-Daudé]

On 1/10/26 17:59, Anton Johansson via qemu development wrote:
> Replaces uses of target_ulong with fixed-size integers, this is a
> prerequisite step to compiling cpu.c once for system-mode.
> 
> Note: the widening of target_long to int64_t in adjust_addr_body() is
> safe as rv32 is ruled out earlier in the function via the check
> 
>    /* do nothing for rv32 mode */
>    if (riscv_cpu_mxl(env) == MXL_RV32) {
>        return addr;
>    }
> 
> meaning target_long must be equal to int64_t anyway.
> 
> Duplicate includes between vector_helper.c and vector_internals.h are
> removed.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>   target/riscv/internals.h            | 31 +++++++++---------
>   target/riscv/tcg/vector_internals.h |  5 +--
>   target/riscv/tcg/vector_helper.c    | 64 +++++++++++++++++--------------------
>   3 files changed, 47 insertions(+), 53 deletions(-)


>   /* Zjpm addr masking routine */
> -static inline target_ulong adjust_addr_body(CPURISCVState *env,
> -                                            target_ulong addr,
> -                                            bool is_virt_addr)
> +static inline uint64_t adjust_addr_body(CPURISCVState *env,
> +                                        uint64_t addr,
> +                                        bool is_virt_addr)
>   {
>       RISCVPmPmm pmm = PMM_FIELD_DISABLED;
>       uint32_t pmlen = 0;
> @@ -239,7 +238,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
>   
>       /* sign/zero extend masked address by N-1 bit */
>       if (signext) {
> -        addr = (target_long)addr >> pmlen;
> +        addr = (int64_t)addr >> pmlen;
>       } else {
>           addr = addr >> pmlen;
>       }
Maybe safer as (untested):

         addr = (sign ? sextract64 : extract64)
                (addr, 0, (riscv_cpu_mxl_bits(env) - pmlen);

Re: [PATCH 01/18] target/riscv: Make internals.h target agnostic

[Yonggang Luo]

[-- Attachment #1: Type: text/plain, Size: 9989 bytes --]

This is what I did, It's in branch

https://gitlab.com/lygstate-qemu/qemu/-/tree/combined-binary-multi-targets?ref_type=heads

On Thu, Oct 1, 2026 at 11:57 PM Anton Johansson via qemu development
<qemu-devel@nongnu.org> wrote:
>
> Replaces uses of target_ulong with fixed-size integers, this is a
> prerequisite step to compiling cpu.c once for system-mode.
>
> Note: the widening of target_long to int64_t in adjust_addr_body() is
> safe as rv32 is ruled out earlier in the function via the check
>
>   /* do nothing for rv32 mode */
>   if (riscv_cpu_mxl(env) == MXL_RV32) {
>       return addr;
>   }
>
> meaning target_long must be equal to int64_t anyway.
>
> Duplicate includes between vector_helper.c and vector_internals.h are
> removed.
>
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/internals.h            | 31 +++++++++---------
>  target/riscv/tcg/vector_internals.h |  5 +--
>  target/riscv/tcg/vector_helper.c    | 64 +++++++++++++++++--------------------
>  3 files changed, 47 insertions(+), 53 deletions(-)
>
> diff --git a/target/riscv/internals.h b/target/riscv/internals.h
> index 1ee7e99e98..c963fae321 100644
> --- a/target/riscv/internals.h
> +++ b/target/riscv/internals.h
> @@ -20,7 +20,6 @@
>  #define RISCV_CPU_INTERNALS_H
>
>  #include "exec/cpu-common.h"
> -#include "exec/target_long.h"
>  #include "hw/core/registerfields.h"
>  #include "fpu/softfloat-types.h"
>  #include "target/riscv/cpu_bits.h"
> @@ -98,10 +97,10 @@ FIELD(VDATA, NF, 7, 4)
>  FIELD(VDATA, WD, 7, 1)
>
>  /* float point classify helpers */
> -target_ulong fclass_h_bf16(uint64_t frs1);
> -target_ulong fclass_h(uint64_t frs1);
> -target_ulong fclass_s(uint64_t frs1);
> -target_ulong fclass_d(uint64_t frs1);
> +uint16_t fclass_h_bf16(bfloat16 frs1);
> +uint16_t fclass_h(float16 frs1);
> +uint16_t fclass_s(float32 frs1);
> +uint16_t fclass_d(float64 frs1);
>
>  #ifndef CONFIG_USER_ONLY
>  extern const VMStateDescription vmstate_riscv_cpu;
> @@ -185,7 +184,7 @@ static inline float16 check_nanbox_bf16(CPURISCVState *env, uint64_t f)
>      }
>  }
>
> -static inline target_ulong get_xepc_mask(CPURISCVState *env)
> +static inline uint64_t get_xepc_mask(CPURISCVState *env)
>  {
>      RISCVCPU *cpu = env_archcpu(env);
>
> @@ -196,9 +195,9 @@ static inline target_ulong get_xepc_mask(CPURISCVState *env)
>      if (riscv_has_ext(env, RVC) || cpu->cfg.ext_zca ||
>          cpu->cfg.ext_zcb || cpu->cfg.ext_zcd || cpu->cfg.ext_zce ||
>          cpu->cfg.ext_zcf || cpu->cfg.ext_zcmp || cpu->cfg.ext_zcmt) {
> -        return ~(target_ulong)1;
> +        return ~1ull;
>      } else {
> -        return ~(target_ulong)3;
> +        return ~3ull;
>      }
>  }
>
> @@ -208,9 +207,9 @@ bool riscv_cpu_has_work(CPUState *cs);
>  #endif
>
>  /* Zjpm addr masking routine */
> -static inline target_ulong adjust_addr_body(CPURISCVState *env,
> -                                            target_ulong addr,
> -                                            bool is_virt_addr)
> +static inline uint64_t adjust_addr_body(CPURISCVState *env,
> +                                        uint64_t addr,
> +                                        bool is_virt_addr)
>  {
>      RISCVPmPmm pmm = PMM_FIELD_DISABLED;
>      uint32_t pmlen = 0;
> @@ -239,7 +238,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
>
>      /* sign/zero extend masked address by N-1 bit */
>      if (signext) {
> -        addr = (target_long)addr >> pmlen;
> +        addr = (int64_t)addr >> pmlen;
>      } else {
>          addr = addr >> pmlen;
>      }
> @@ -247,14 +246,14 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
>      return addr;
>  }
>
> -static inline target_ulong adjust_addr(CPURISCVState *env,
> -                                       target_ulong addr)
> +static inline uint64_t adjust_addr(CPURISCVState *env,
> +                                   uint64_t addr)
>  {
>      return adjust_addr_body(env, addr, false);
>  }
>
> -static inline target_ulong adjust_addr_virt(CPURISCVState *env,
> -                                            target_ulong addr)
> +static inline uint64_t adjust_addr_virt(CPURISCVState *env,
> +                                        uint64_t addr)
>  {
>      return adjust_addr_body(env, addr, true);
>  }
> diff --git a/target/riscv/tcg/vector_internals.h b/target/riscv/tcg/vector_internals.h
> index 5681b81815..7e186add2d 100644
> --- a/target/riscv/tcg/vector_internals.h
> +++ b/target/riscv/tcg/vector_internals.h
> @@ -20,10 +20,11 @@
>  #define TARGET_RISCV_VECTOR_INTERNALS_H
>
>  #include "qemu/bitops.h"
> +#include "exec/target_long.h"
>  #include "hw/core/registerfields.h"
> -#include "cpu.h"
> +#include "target/riscv/cpu.h"
> +#include "target/riscv/internals.h"
>  #include "tcg/tcg-gvec-desc.h"
> -#include "internals.h"
>
>  #define VSTART_CHECK_EARLY_EXIT(env, vl) do { \
>      if (env->vstart >= vl) {                  \
> diff --git a/target/riscv/tcg/vector_helper.c b/target/riscv/tcg/vector_helper.c
> index 0d1e4e0964..b4a07dbe13 100644
> --- a/target/riscv/tcg/vector_helper.c
> +++ b/target/riscv/tcg/vector_helper.c
> @@ -19,7 +19,7 @@
>  #include "qemu/osdep.h"
>  #include "qemu/host-utils.h"
>  #include "qemu/bitops.h"
> -#include "cpu.h"
> +#include "target/riscv/tcg/vector_internals.h"
>  #include "exec/memop.h"
>  #include "accel/tcg/cpu-ldst.h"
>  #include "accel/tcg/probe.h"
> @@ -29,8 +29,6 @@
>  #include "exec/target_page.h"
>  #include "fpu/softfloat.h"
>  #include "tcg/tcg-gvec-desc.h"
> -#include "internals.h"
> -#include "vector_internals.h"
>  #include <math.h>
>
>  static target_ulong vtype_reserved(CPURISCVState *env, target_ulong vtype)
> @@ -4852,77 +4850,73 @@ GEN_VEXT_CMP_VF(vmfge_vf_w, uint32_t, H4, vmfge32)
>  GEN_VEXT_CMP_VF(vmfge_vf_d, uint64_t, H8, vmfge64)
>
>  /* Vector Floating-Point Classify Instruction */
> -target_ulong fclass_h_bf16(uint64_t frs1)
> +uint16_t fclass_h_bf16(bfloat16 frs1)
>  {
> -    bfloat16 f = frs1;
> -    bool sign = bfloat16_is_neg(f);
> +    bool sign = bfloat16_is_neg(frs1);
>
> -    if (bfloat16_is_infinity(f)) {
> +    if (bfloat16_is_infinity(frs1)) {
>          return sign ? 1 << 0 : 1 << 7;
> -    } else if (bfloat16_is_zero(f)) {
> +    } else if (bfloat16_is_zero(frs1)) {
>          return sign ? 1 << 3 : 1 << 4;
> -    } else if (bfloat16_is_zero_or_denormal(f)) {
> +    } else if (bfloat16_is_zero_or_denormal(frs1)) {
>          return sign ? 1 << 2 : 1 << 5;
> -    } else if (bfloat16_is_any_nan(f)) {
> +    } else if (bfloat16_is_any_nan(frs1)) {
>          float_status s = { }; /* for snan_bit_is_one */
> -        return bfloat16_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
> +        return bfloat16_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
>      } else {
>          return sign ? 1 << 1 : 1 << 6;
>      }
>  }
>
> -target_ulong fclass_h(uint64_t frs1)
> +uint16_t fclass_h(float16 frs1)
>  {
> -    float16 f = frs1;
> -    bool sign = float16_is_neg(f);
> +    bool sign = float16_is_neg(frs1);
>
> -    if (float16_is_infinity(f)) {
> +    if (float16_is_infinity(frs1)) {
>          return sign ? 1 << 0 : 1 << 7;
> -    } else if (float16_is_zero(f)) {
> +    } else if (float16_is_zero(frs1)) {
>          return sign ? 1 << 3 : 1 << 4;
> -    } else if (float16_is_zero_or_denormal(f)) {
> +    } else if (float16_is_zero_or_denormal(frs1)) {
>          return sign ? 1 << 2 : 1 << 5;
> -    } else if (float16_is_any_nan(f)) {
> +    } else if (float16_is_any_nan(frs1)) {
>          float_status s = { }; /* for snan_bit_is_one */
> -        return float16_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
> +        return float16_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
>      } else {
>          return sign ? 1 << 1 : 1 << 6;
>      }
>  }
>
> -target_ulong fclass_s(uint64_t frs1)
> +uint16_t fclass_s(float32 frs1)
>  {
> -    float32 f = frs1;
> -    bool sign = float32_is_neg(f);
> +    bool sign = float32_is_neg(frs1);
>
> -    if (float32_is_infinity(f)) {
> +    if (float32_is_infinity(frs1)) {
>          return sign ? 1 << 0 : 1 << 7;
> -    } else if (float32_is_zero(f)) {
> +    } else if (float32_is_zero(frs1)) {
>          return sign ? 1 << 3 : 1 << 4;
> -    } else if (float32_is_zero_or_denormal(f)) {
> +    } else if (float32_is_zero_or_denormal(frs1)) {
>          return sign ? 1 << 2 : 1 << 5;
> -    } else if (float32_is_any_nan(f)) {
> +    } else if (float32_is_any_nan(frs1)) {
>          float_status s = { }; /* for snan_bit_is_one */
> -        return float32_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
> +        return float32_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
>      } else {
>          return sign ? 1 << 1 : 1 << 6;
>      }
>  }
>
> -target_ulong fclass_d(uint64_t frs1)
> +uint16_t fclass_d(float64 frs1)
>  {
> -    float64 f = frs1;
> -    bool sign = float64_is_neg(f);
> +    bool sign = float64_is_neg(frs1);
>
> -    if (float64_is_infinity(f)) {
> +    if (float64_is_infinity(frs1)) {
>          return sign ? 1 << 0 : 1 << 7;
> -    } else if (float64_is_zero(f)) {
> +    } else if (float64_is_zero(frs1)) {
>          return sign ? 1 << 3 : 1 << 4;
> -    } else if (float64_is_zero_or_denormal(f)) {
> +    } else if (float64_is_zero_or_denormal(frs1)) {
>          return sign ? 1 << 2 : 1 << 5;
> -    } else if (float64_is_any_nan(f)) {
> +    } else if (float64_is_any_nan(frs1)) {
>          float_status s = { }; /* for snan_bit_is_one */
> -        return float64_is_quiet_nan(f, &s) ? 1 << 9 : 1 << 8;
> +        return float64_is_quiet_nan(frs1, &s) ? 1 << 9 : 1 << 8;
>      } else {
>          return sign ? 1 << 1 : 1 << 6;
>      }
>
> --
> 2.52.0
>
>


-- 
         此致
礼
罗勇刚
Yours
    sincerely,
Yonggang Luo

[-- Attachment #2: 0001-target-riscv-preserve-signed-XLEN-semantics-without-.patch --]
[-- Type: text/plain, Size: 12206 bytes --]

From 3910e4b6ffbccbff6f63985fbab8c298cf39ccee Mon Sep 17 00:00:00 2001
From: Yonggang Luo <luoyonggang@gmail.com>
Date: Sat, 12 Sep 2026 00:16:28 +0800
Subject: [PATCH] target/riscv: preserve signed XLEN semantics without
 target_long

Mask pointer-masked addresses with extract64/sextract64 at runtime
XLEN instead of a target_long arithmetic shift. Pass vector vx
scalars as int64_t after sextract64 from the helper tl slot so
RV32 keeps bit 31 as the sign bit. Leave every target_ulong helper
argument unchanged.

Signed-off-by: Yonggang Luo <luoyonggang@gmail.com>
---
 target/riscv/internals.h            | 12 ++++++++----
 target/riscv/tcg/vector_helper.c    | 30 ++++++++++++++++-------------
 target/riscv/tcg/vector_internals.c |  2 +-
 target/riscv/tcg/vector_internals.h |  9 +++++----
 4 files changed, 31 insertions(+), 22 deletions(-)

diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 1ee7e99e98..0844867246 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -214,6 +214,7 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
 {
     RISCVPmPmm pmm = PMM_FIELD_DISABLED;
     uint32_t pmlen = 0;
+    unsigned kept;
     bool signext = false;
 
     /* do nothing for rv32 mode */
@@ -235,13 +236,16 @@ static inline target_ulong adjust_addr_body(CPURISCVState *env,
 
     signext = riscv_cpu_virt_mem_enabled(env, is_virt_addr);
     pmlen = riscv_pm_get_pmlen(pmm);
-    addr = addr << pmlen;
 
-    /* sign/zero extend masked address by N-1 bit */
+    /*
+     * Drop the top pmlen bits of XLEN. Do not rely on target_ulong
+     * shift wrap; common-system target_ulong is always 64 bits.
+     */
+    kept = target_long_bits() - pmlen;
     if (signext) {
-        addr = (target_long)addr >> pmlen;
+        addr = sextract64(addr, 0, kept);
     } else {
-        addr = addr >> pmlen;
+        addr = extract64(addr, 0, kept);
     }
 
     return addr;
diff --git a/target/riscv/tcg/vector_helper.c b/target/riscv/tcg/vector_helper.c
index 0d1e4e0964..3a2661b381 100644
--- a/target/riscv/tcg/vector_helper.c
+++ b/target/riscv/tcg/vector_helper.c
@@ -1240,6 +1240,7 @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,        \
     uint32_t esz = sizeof(ETYPE);                                        \
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);         \
     uint32_t vta = vext_vta(desc);                                       \
+    ETYPE scalar = (ETYPE)sextract64(s1, 0, target_long_bits());         \
     uint32_t i;                                                          \
                                                                          \
     VSTART_CHECK_EARLY_EXIT(env, vl);                                    \
@@ -1248,7 +1249,7 @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,        \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                               \
         ETYPE carry = vext_elem_mask(v0, i);                             \
                                                                          \
-        *((ETYPE *)vd + H(i)) = DO_OP(s2, (ETYPE)(target_long)s1, carry);\
+        *((ETYPE *)vd + H(i)) = DO_OP(s2, scalar, carry);                \
     }                                                                    \
     env->vstart = 0;                                                     \
     /* set tail elements to 1s */                                        \
@@ -1317,15 +1318,16 @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,          \
     uint32_t vm = vext_vm(desc);                                \
     uint32_t total_elems = riscv_cpu_cfg(env)->vlenb << 3;      \
     uint32_t vta_all_1s = vext_vta_all_1s(desc);                \
+    ETYPE scalar;                                               \
     uint32_t i;                                                 \
                                                                 \
     VSTART_CHECK_EARLY_EXIT(env, vl);                           \
                                                                 \
+    scalar = (ETYPE)sextract64(s1, 0, target_long_bits());      \
     for (i = env->vstart; i < vl; i++) {                        \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                      \
         ETYPE carry = !vm && vext_elem_mask(v0, i);             \
-        vext_set_elem_mask(vd, i,                               \
-                DO_OP(s2, (ETYPE)(target_long)s1, carry));      \
+        vext_set_elem_mask(vd, i, DO_OP(s2, scalar, carry));    \
     }                                                           \
     env->vstart = 0;                                            \
     /*
@@ -1595,6 +1597,7 @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,   \
     uint32_t total_elems = riscv_cpu_cfg(env)->vlenb << 3;          \
     uint32_t vta_all_1s = vext_vta_all_1s(desc);                    \
     uint32_t vma = vext_vma(desc);                                  \
+    ETYPE scalar = (ETYPE)sextract64(s1, 0, target_long_bits());    \
     uint32_t i;                                                     \
                                                                     \
     VSTART_CHECK_EARLY_EXIT(env, vl);                               \
@@ -1608,8 +1611,7 @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2,   \
             }                                                       \
             continue;                                               \
         }                                                           \
-        vext_set_elem_mask(vd, i,                                   \
-                DO_OP(s2, (ETYPE)(target_long)s1));                 \
+        vext_set_elem_mask(vd, i, DO_OP(s2, scalar));               \
     }                                                               \
     env->vstart = 0;                                                \
     /*
@@ -2050,7 +2052,7 @@ GEN_VEXT_VV(vnmsub_vv_w, 4)
 GEN_VEXT_VV(vnmsub_vv_d, 8)
 
 #define OPIVX3(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
-static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
+static void do_##NAME(void *vd, int64_t s1, void *vs2, int i)       \
 {                                                                   \
     TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
     TD d = *((TD *)vd + HD(i));                                     \
@@ -2239,14 +2241,14 @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,               \
     uint32_t esz = sizeof(ETYPE);                                    \
     uint32_t total_elems = vext_get_total_elems(env, desc, esz);     \
     uint32_t vta = vext_vta(desc);                                   \
+    ETYPE scalar = (ETYPE)sextract64(s1, 0, target_long_bits());     \
     uint32_t i;                                                      \
                                                                      \
     VSTART_CHECK_EARLY_EXIT(env, vl);                                \
                                                                      \
     for (i = env->vstart; i < vl; i++) {                             \
         ETYPE s2 = *((ETYPE *)vs2 + H(i));                           \
-        ETYPE d = (!vext_elem_mask(v0, i) ? s2 :                     \
-                   (ETYPE)(target_long)s1);                          \
+        ETYPE d = (!vext_elem_mask(v0, i) ? s2 : scalar);            \
         *((ETYPE *)vd + H(i)) = d;                                   \
     }                                                                \
     env->vstart = 0;                                                 \
@@ -2397,12 +2399,12 @@ GEN_VEXT_VV_RM(vsaddu_vv_h, 2)
 GEN_VEXT_VV_RM(vsaddu_vv_w, 4)
 GEN_VEXT_VV_RM(vsaddu_vv_d, 8)
 
-typedef void opivx2_rm_fn(void *vd, target_long s1, void *vs2, int i,
+typedef void opivx2_rm_fn(void *vd, int64_t s1, void *vs2, int i,
                           CPURISCVState *env, uint8_t vxrm);
 
 #define OPIVX2_RM(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)          \
 static inline void                                                  \
-do_##NAME(void *vd, target_long s1, void *vs2, int i,               \
+do_##NAME(void *vd, int64_t s1, void *vs2, int i,                   \
           CPURISCVState *env, uint8_t vxrm)                         \
 {                                                                   \
     TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
@@ -2410,7 +2412,7 @@ do_##NAME(void *vd, target_long s1, void *vs2, int i,               \
 }
 
 static inline void
-vext_vx_rm_1(void *vd, void *v0, target_long s1, void *vs2,
+vext_vx_rm_1(void *vd, void *v0, int64_t s1, void *vs2,
              CPURISCVState *env,
              uint32_t vl, uint32_t vm, uint8_t vxrm,
              opivx2_rm_fn *fn, uint32_t vma, uint32_t esz)
@@ -2427,7 +2429,7 @@ vext_vx_rm_1(void *vd, void *v0, target_long s1, void *vs2,
 }
 
 static inline void
-vext_vx_rm_2(void *vd, void *v0, target_long s1, void *vs2,
+vext_vx_rm_2(void *vd, void *v0, int64_t s1, void *vs2,
              CPURISCVState *env,
              uint32_t desc,
              opivx2_rm_fn *fn, uint32_t esz)
@@ -2468,7 +2470,9 @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
                   void *vs2, CPURISCVState *env,          \
                   uint32_t desc)                          \
 {                                                         \
-    vext_vx_rm_2(vd, v0, s1, vs2, env, desc,              \
+    int64_t scalar;                                       \
+    scalar = sextract64(s1, 0, target_long_bits());       \
+    vext_vx_rm_2(vd, v0, scalar, vs2, env, desc,          \
                  do_##NAME, ESZ);                         \
 }
 
diff --git a/target/riscv/tcg/vector_internals.c b/target/riscv/tcg/vector_internals.c
index b490b1d398..9532705266 100644
--- a/target/riscv/tcg/vector_internals.c
+++ b/target/riscv/tcg/vector_internals.c
@@ -81,7 +81,7 @@ void do_vext_vv(void *vd, void *v0, void *vs1, void *vs2,
     vext_set_elems_1s(vd, vta, vl * esz, total_elems * esz);
 }
 
-void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+void do_vext_vx(void *vd, void *v0, int64_t s1, void *vs2,
                 CPURISCVState *env, uint32_t desc,
                 opivx2_fn fn, uint32_t esz)
 {
diff --git a/target/riscv/tcg/vector_internals.h b/target/riscv/tcg/vector_internals.h
index 5681b81815..da093d561e 100644
--- a/target/riscv/tcg/vector_internals.h
+++ b/target/riscv/tcg/vector_internals.h
@@ -201,20 +201,20 @@ void HELPER(NAME)(void *vd, void *v0, void *vs1,          \
                do_##NAME, ESZ);                           \
 }
 
-typedef void opivx2_fn(void *vd, target_long s1, void *vs2, int i);
+typedef void opivx2_fn(void *vd, int64_t s1, void *vs2, int i);
 
 /*
  * (T1)s1 gives the real operator type.
  * (TX1)(T1)s1 expands the operator type of widen or narrow operations.
  */
 #define OPIVX2(NAME, TD, T1, T2, TX1, TX2, HD, HS2, OP)             \
-static void do_##NAME(void *vd, target_long s1, void *vs2, int i)   \
+static void do_##NAME(void *vd, int64_t s1, void *vs2, int i)       \
 {                                                                   \
     TX2 s2 = *((T2 *)vs2 + HS2(i));                                 \
     *((TD *)vd + HD(i)) = OP(s2, (TX1)(T1)s1);                      \
 }
 
-void do_vext_vx(void *vd, void *v0, target_long s1, void *vs2,
+void do_vext_vx(void *vd, void *v0, int64_t s1, void *vs2,
                 CPURISCVState *env, uint32_t desc,
                 opivx2_fn fn, uint32_t esz);
 
@@ -224,7 +224,8 @@ void HELPER(NAME)(void *vd, void *v0, target_ulong s1,    \
                   void *vs2, CPURISCVState *env,          \
                   uint32_t desc)                          \
 {                                                         \
-    do_vext_vx(vd, v0, s1, vs2, env, desc,                \
+    do_vext_vx(vd, v0, sextract64(s1, 0, target_long_bits()), \
+               vs2, env, desc,                            \
                do_##NAME, ESZ);                           \
 }
 
-- 
2.55.0.windows.3

[PATCH 02/18] target/riscv: meson, add user and common system source sets

[Anton Johansson via qemu development]

This allows us to, in future commits, handle compilation units which
need to be compiled once for system-, but twice for user-mode.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/meson.build | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index e1b51d2bd4..3cdff11f75 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -30,9 +30,14 @@ riscv_system_ss.add(files(
   'riscv-qmp-cmds.c',
 ))
 
+riscv_user_ss = ss.source_set()
+riscv_common_system_ss = ss.source_set()
+
 subdir('tcg')
 subdir('kvm')
 
 target_arch += {'riscv': riscv_ss}
 target_system_arch += {'riscv': riscv_system_ss}
 target_stubs_arch += {'riscv': riscv_stubs_ss}
+target_user_arch += {'riscv': riscv_user_ss}
+target_common_system_arch += {'riscv': riscv_common_system_ss}

-- 
2.52.0

[PATCH 02/18] target/riscv: meson, add user and common system source sets

[Anton Johansson via]

This allows us to, in future commits, handle compilation units which
need to be compiled once for system-, but twice for user-mode.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/meson.build | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index e1b51d2bd4..3cdff11f75 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -30,9 +30,14 @@ riscv_system_ss.add(files(
   'riscv-qmp-cmds.c',
 ))
 
+riscv_user_ss = ss.source_set()
+riscv_common_system_ss = ss.source_set()
+
 subdir('tcg')
 subdir('kvm')
 
 target_arch += {'riscv': riscv_ss}
 target_system_arch += {'riscv': riscv_system_ss}
 target_stubs_arch += {'riscv': riscv_stubs_ss}
+target_user_arch += {'riscv': riscv_user_ss}
+target_common_system_arch += {'riscv': riscv_common_system_ss}

-- 
2.52.0

Re: [PATCH 02/18] target/riscv: meson, add user and common system source sets

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> This allows us to, in future commits, handle compilation units which
> need to be compiled once for system-, but twice for user-mode.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/meson.build | 5 +++++
>  1 file changed, 5 insertions(+)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 03/18] target/riscv: Move pmu CSR read to csr.h

[Anton Johansson via qemu development]

pmu.c can then be compiled once for system-mode alongside csr.c/csr.h
in a follow up commit, since it's otherwise target agnostic.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/csr.h       | 4 ++++
 target/riscv/tcg/pmu.h       | 3 ---
 target/riscv/tcg/pmu.c       | 5 +++--
 target/riscv/tcg/meson.build | 2 --
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/riscv/tcg/csr.h b/target/riscv/tcg/csr.h
index 53ba3b4a4d..03f96cce04 100644
--- a/target/riscv/tcg/csr.h
+++ b/target/riscv/tcg/csr.h
@@ -99,4 +99,8 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
                        target_ulong val);
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
 
+/* Used in pmu.c */
+RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
+                                  bool upper_half, uint32_t ctr_idx);
+
 #endif /* RISCV_CSR_H */
diff --git a/target/riscv/tcg/pmu.h b/target/riscv/tcg/pmu.h
index fbdbfe7600..7e42359f87 100644
--- a/target/riscv/tcg/pmu.h
+++ b/target/riscv/tcg/pmu.h
@@ -21,7 +21,6 @@
 
 #include "cpu.h"
 #include "qapi/error.h"
-#include "exec/target_long.h"
 
 bool riscv_pmu_ctr_monitor_instructions(CPURISCVState *env,
                                         uint32_t target_ctr);
@@ -38,7 +37,5 @@ int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value,
 void riscv_pmu_update_fixed_ctrs(CPURISCVState *env, privilege_mode_t newpriv,
                                  bool new_virt);
 void riscv_pmu_decr_instret(CPURISCVState *env);
-RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
-                                  bool upper_half, uint32_t ctr_idx);
 
 #endif /* RISCV_PMU_H */
diff --git a/target/riscv/tcg/pmu.c b/target/riscv/tcg/pmu.c
index 1a4658319b..c8acb85df4 100644
--- a/target/riscv/tcg/pmu.c
+++ b/target/riscv/tcg/pmu.c
@@ -20,8 +20,9 @@
 #include "qemu/log.h"
 #include "qemu/error-report.h"
 #include "qemu/timer.h"
-#include "cpu.h"
-#include "pmu.h"
+#include "target/riscv/cpu.h"
+#include "target/riscv/tcg/pmu.h"
+#include "target/riscv/tcg/csr.h"
 #include "exec/icount.h"
 #include "system/device_tree.h"
 
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index a05ab642f4..954dfc10e0 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -25,5 +25,3 @@ riscv_system_ss.add(files(
   'pmu.c',
   'th_csr.c',
 ))
-
-

-- 
2.52.0

[PATCH 03/18] target/riscv: Move pmu CSR read to csr.h

[Anton Johansson via]

pmu.c can then be compiled once for system-mode alongside csr.c/csr.h
in a follow up commit, since it's otherwise target agnostic.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/csr.h       | 4 ++++
 target/riscv/tcg/pmu.h       | 3 ---
 target/riscv/tcg/pmu.c       | 5 +++--
 target/riscv/tcg/meson.build | 2 --
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/riscv/tcg/csr.h b/target/riscv/tcg/csr.h
index 53ba3b4a4d..03f96cce04 100644
--- a/target/riscv/tcg/csr.h
+++ b/target/riscv/tcg/csr.h
@@ -99,4 +99,8 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
                        target_ulong val);
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
 
+/* Used in pmu.c */
+RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
+                                  bool upper_half, uint32_t ctr_idx);
+
 #endif /* RISCV_CSR_H */
diff --git a/target/riscv/tcg/pmu.h b/target/riscv/tcg/pmu.h
index fbdbfe7600..7e42359f87 100644
--- a/target/riscv/tcg/pmu.h
+++ b/target/riscv/tcg/pmu.h
@@ -21,7 +21,6 @@
 
 #include "cpu.h"
 #include "qapi/error.h"
-#include "exec/target_long.h"
 
 bool riscv_pmu_ctr_monitor_instructions(CPURISCVState *env,
                                         uint32_t target_ctr);
@@ -38,7 +37,5 @@ int riscv_pmu_setup_timer(CPURISCVState *env, uint64_t value,
 void riscv_pmu_update_fixed_ctrs(CPURISCVState *env, privilege_mode_t newpriv,
                                  bool new_virt);
 void riscv_pmu_decr_instret(CPURISCVState *env);
-RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
-                                  bool upper_half, uint32_t ctr_idx);
 
 #endif /* RISCV_PMU_H */
diff --git a/target/riscv/tcg/pmu.c b/target/riscv/tcg/pmu.c
index 1a4658319b..c8acb85df4 100644
--- a/target/riscv/tcg/pmu.c
+++ b/target/riscv/tcg/pmu.c
@@ -20,8 +20,9 @@
 #include "qemu/log.h"
 #include "qemu/error-report.h"
 #include "qemu/timer.h"
-#include "cpu.h"
-#include "pmu.h"
+#include "target/riscv/cpu.h"
+#include "target/riscv/tcg/pmu.h"
+#include "target/riscv/tcg/csr.h"
 #include "exec/icount.h"
 #include "system/device_tree.h"
 
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index a05ab642f4..954dfc10e0 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -25,5 +25,3 @@ riscv_system_ss.add(files(
   'pmu.c',
   'th_csr.c',
 ))
-
-

-- 
2.52.0

Re: [PATCH 03/18] target/riscv: Move pmu CSR read to csr.h

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> pmu.c can then be compiled once for system-mode alongside csr.c/csr.h
> in a follow up commit, since it's otherwise target agnostic.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/tcg/csr.h       | 4 ++++
>  target/riscv/tcg/pmu.h       | 3 ---
>  target/riscv/tcg/pmu.c       | 5 +++--
>  target/riscv/tcg/meson.build | 2 --
>  4 files changed, 7 insertions(+), 7 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 04/18] target/riscv: Make debug.c target agnostic

[Anton Johansson via qemu development]

This is not enough to compile debug.c once for system-mode, since it
pulls in helper function prototypes which depend on target_long.
Inclusion of "exec/target_long.h" from debug.h is removed in a follow up
commit once the CSR functions have been made agnostic.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/debug.c | 140 +++++++++++++++++++++++------------------------
 1 file changed, 70 insertions(+), 70 deletions(-)

diff --git a/target/riscv/tcg/debug.c b/target/riscv/tcg/debug.c
index e4d719a1da..90172298ce 100644
--- a/target/riscv/tcg/debug.c
+++ b/target/riscv/tcg/debug.c
@@ -82,8 +82,8 @@ static bool debug_trigger_version_1_0(CPURISCVState *env)
     return riscv_cpu_cfg(env)->ext_sdtrig;
 }
 
-static inline target_ulong extract_trigger_type(CPURISCVState *env,
-                                                target_ulong tdata1)
+static inline uint64_t extract_trigger_type(CPURISCVState *env,
+                                            uint64_t tdata1)
 {
     switch (riscv_cpu_mxl(env)) {
     case MXL_RV32:
@@ -96,16 +96,16 @@ static inline target_ulong extract_trigger_type(CPURISCVState *env,
     }
 }
 
-static inline target_ulong get_trigger_type(CPURISCVState *env,
-                                            target_ulong trigger_index)
+static inline uint64_t get_trigger_type(CPURISCVState *env,
+                                        uint8_t trigger_index)
 {
     return extract_trigger_type(env, env->tdata1[trigger_index]);
 }
 
 static trigger_action_t get_trigger_action(CPURISCVState *env,
-                                           target_ulong trigger_index)
+                                           uint8_t trigger_index)
 {
-    target_ulong tdata1 = env->tdata1[trigger_index];
+    uint64_t tdata1 = env->tdata1[trigger_index];
     int trigger_type = get_trigger_type(env, trigger_index);
     trigger_action_t action = DBG_ACTION_NONE;
 
@@ -135,11 +135,11 @@ static trigger_action_t get_trigger_action(CPURISCVState *env,
     return action;
 }
 
-static inline target_ulong build_tdata1(CPURISCVState *env,
-                                        trigger_type_t type,
-                                        bool dmode, target_ulong data)
+static inline uint64_t build_tdata1(CPURISCVState *env,
+                                    trigger_type_t type,
+                                    bool dmode, uint64_t data)
 {
-    target_ulong tdata1;
+    uint64_t tdata1;
 
     switch (riscv_cpu_mxl(env)) {
     case MXL_RV32:
@@ -183,11 +183,11 @@ void tselect_csr_write(CPURISCVState *env, target_ulong val)
     }
 }
 
-static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
-                                    trigger_type_t t)
+static uint64_t tdata1_validate(CPURISCVState *env, uint64_t val,
+                                trigger_type_t t)
 {
     uint32_t type, dmode;
-    target_ulong tdata1;
+    uint64_t tdata1;
 
     switch (riscv_cpu_mxl(env)) {
     case MXL_RV32:
@@ -217,7 +217,7 @@ static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
     return tdata1;
 }
 
-static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
+static inline void warn_always_zero_bit(uint64_t val, uint64_t mask,
                                         const char *msg)
 {
     if (val & mask) {
@@ -225,11 +225,11 @@ static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
     }
 }
 
-static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
+static uint64_t textra_validate(CPURISCVState *env, uint64_t tdata3)
 {
-    target_ulong mhvalue, mhselect;
-    target_ulong mhselect_new;
-    target_ulong textra;
+    uint64_t mhvalue, mhselect;
+    uint32_t mhselect_new;
+    uint64_t textra;
     const uint32_t mhselect_no_rvh[8] = { 0, 0, 0, 0, 4, 4, 4, 4 };
 
     switch (riscv_cpu_mxl(env)) {
@@ -237,11 +237,11 @@ static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
         mhvalue  = get_field(tdata3, TEXTRA32_MHVALUE);
         mhselect = get_field(tdata3, TEXTRA32_MHSELECT);
         /* Validate unimplemented (always zero) bits */
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SBYTEMASK,
+        warn_always_zero_bit(tdata3, (uint32_t)TEXTRA32_SBYTEMASK,
                              "sbytemask");
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SVALUE,
+        warn_always_zero_bit(tdata3, (uint32_t)TEXTRA32_SVALUE,
                              "svalue");
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SSELECT,
+        warn_always_zero_bit(tdata3, (uint32_t)TEXTRA32_SSELECT,
                              "sselect");
         break;
     case MXL_RV64:
@@ -249,11 +249,11 @@ static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
         mhvalue  = get_field(tdata3, TEXTRA64_MHVALUE);
         mhselect = get_field(tdata3, TEXTRA64_MHSELECT);
         /* Validate unimplemented (always zero) bits */
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SBYTEMASK,
+        warn_always_zero_bit(tdata3, TEXTRA64_SBYTEMASK,
                              "sbytemask");
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SVALUE,
+        warn_always_zero_bit(tdata3, TEXTRA64_SVALUE,
                              "svalue");
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SSELECT,
+        warn_always_zero_bit(tdata3, TEXTRA64_SSELECT,
                              "sselect");
         break;
     default:
@@ -285,7 +285,7 @@ static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
     return textra;
 }
 
-static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
+static void do_trigger_action(CPURISCVState *env, uint8_t trigger_index)
 {
     trigger_action_t action = get_trigger_action(env, trigger_index);
 
@@ -314,9 +314,9 @@ static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
  * level.
  */
 static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type,
-                               int trigger_index)
+                               uint8_t trigger_index)
 {
-    target_ulong ctrl = env->tdata1[trigger_index];
+    uint64_t ctrl = env->tdata1[trigger_index];
 
     switch (type) {
     case TRIGGER_TYPE_AD_MATCH:
@@ -373,10 +373,10 @@ static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type,
 }
 
 static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type,
-                                 int trigger_index)
+                                 uint8_t trigger_index)
 {
-    target_ulong textra = env->tdata3[trigger_index];
-    target_ulong mhvalue, mhselect;
+    uint64_t textra = env->tdata3[trigger_index];
+    uint64_t mhvalue, mhselect;
 
     if (type < TRIGGER_TYPE_AD_MATCH || type > TRIGGER_TYPE_AD_MATCH6) {
         /* textra checking is only applicable when type is 2, 3, 4, 5, or 6 */
@@ -416,7 +416,7 @@ static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type,
 
 /* Common matching conditions for all types of the triggers. */
 static bool trigger_common_match(CPURISCVState *env, trigger_type_t type,
-                                 int trigger_index)
+                                 uint8_t trigger_index)
 {
     return trigger_priv_match(env, type, trigger_index) &&
            trigger_textra_match(env, type, trigger_index);
@@ -424,7 +424,7 @@ static bool trigger_common_match(CPURISCVState *env, trigger_type_t type,
 
 /* type 2 trigger */
 
-static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
+static uint32_t type2_breakpoint_size(CPURISCVState *env, uint32_t ctrl)
 {
     uint32_t sizelo, sizehi = 0;
 
@@ -435,7 +435,7 @@ static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
     return (sizehi << 2) | sizelo;
 }
 
-static inline bool type2_breakpoint_enabled(target_ulong ctrl)
+static inline bool type2_breakpoint_enabled(uint64_t ctrl)
 {
     bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M));
     bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
@@ -443,10 +443,10 @@ static inline bool type2_breakpoint_enabled(target_ulong ctrl)
     return mode && rwx;
 }
 
-static target_ulong type2_mcontrol_validate(CPURISCVState *env,
-                                            target_ulong ctrl)
+static uint64_t type2_mcontrol_validate(CPURISCVState *env,
+                                        uint64_t ctrl)
 {
-    target_ulong val;
+    uint64_t val;
     uint32_t size;
 
     /* validate the generic part first */
@@ -479,10 +479,10 @@ static target_ulong type2_mcontrol_validate(CPURISCVState *env,
     return val;
 }
 
-static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
+static void type2_breakpoint_insert(CPURISCVState *env, uint8_t index)
 {
-    target_ulong ctrl = env->tdata1[index];
-    target_ulong addr = env->tdata2[index];
+    uint64_t ctrl = env->tdata1[index];
+    vaddr addr = env->tdata2[index];
     bool enabled = type2_breakpoint_enabled(ctrl);
     CPUState *cs = env_cpu(env);
     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
@@ -517,7 +517,7 @@ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
     }
 }
 
-static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
+static void type2_breakpoint_remove(CPURISCVState *env, uint8_t index)
 {
     CPUState *cs = env_cpu(env);
 
@@ -532,10 +532,10 @@ static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
     }
 }
 
-static void type2_reg_write(CPURISCVState *env, target_ulong index,
-                            int tdata_index, target_ulong val)
+static void type2_reg_write(CPURISCVState *env, uint8_t index,
+                            int tdata_index, uint64_t val)
 {
-    target_ulong new_val;
+    uint64_t new_val;
 
     switch (tdata_index) {
     case TDATA1:
@@ -563,7 +563,7 @@ static void type2_reg_write(CPURISCVState *env, target_ulong index,
 
 /* type 6 trigger */
 
-static inline bool type6_breakpoint_enabled(target_ulong ctrl)
+static inline bool type6_breakpoint_enabled(uint64_t ctrl)
 {
     bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
     bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
@@ -571,10 +571,10 @@ static inline bool type6_breakpoint_enabled(target_ulong ctrl)
     return mode && rwx;
 }
 
-static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
-                                             target_ulong ctrl)
+static uint64_t type6_mcontrol6_validate(CPURISCVState *env,
+                                         uint64_t ctrl)
 {
-    target_ulong val;
+    uint64_t val;
     uint32_t size;
 
     /* validate the generic part first */
@@ -609,10 +609,10 @@ static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
     return val;
 }
 
-static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
+static void type6_breakpoint_insert(CPURISCVState *env, uint8_t index)
 {
-    target_ulong ctrl = env->tdata1[index];
-    target_ulong addr = env->tdata2[index];
+    uint64_t ctrl = env->tdata1[index];
+    vaddr addr = env->tdata2[index];
     bool enabled = type6_breakpoint_enabled(ctrl);
     CPUState *cs = env_cpu(env);
     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
@@ -646,15 +646,15 @@ static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
     }
 }
 
-static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
+static void type6_breakpoint_remove(CPURISCVState *env, uint8_t index)
 {
     type2_breakpoint_remove(env, index);
 }
 
-static void type6_reg_write(CPURISCVState *env, target_ulong index,
-                            int tdata_index, target_ulong val)
+static void type6_reg_write(CPURISCVState *env, uint8_t index,
+                            int tdata_index, uint64_t val)
 {
-    target_ulong new_val;
+    uint64_t new_val;
 
     switch (tdata_index) {
     case TDATA1:
@@ -682,20 +682,20 @@ static void type6_reg_write(CPURISCVState *env, target_ulong index,
 
 /* icount trigger type */
 static inline int
-itrigger_get_count(CPURISCVState *env, int index)
+itrigger_get_count(CPURISCVState *env, uint8_t index)
 {
     return get_field(env->tdata1[index], ITRIGGER_COUNT);
 }
 
 static inline void
-itrigger_set_count(CPURISCVState *env, int index, int value)
+itrigger_set_count(CPURISCVState *env, uint8_t index, int value)
 {
     env->tdata1[index] = set_field(env->tdata1[index],
                                    ITRIGGER_COUNT, value);
 }
 
 static inline void
-itrigger_set_pending(CPURISCVState *env, int index, int val)
+itrigger_set_pending(CPURISCVState *env, uint8_t index, int val)
 {
     if (!debug_trigger_version_1_0(env)) {
         return;
@@ -705,9 +705,9 @@ itrigger_set_pending(CPURISCVState *env, int index, int val)
                                    ITRIGGER_PENDING, val);
 }
 
-static bool check_itrigger_priv(CPURISCVState *env, int index)
+static bool check_itrigger_priv(CPURISCVState *env, uint8_t index)
 {
-    target_ulong tdata1 = env->tdata1[index];
+    uint64_t tdata1 = env->tdata1[index];
     if (env->virt_enabled) {
         /* check VU/VS bit against current privilege level */
         return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
@@ -835,10 +835,10 @@ void riscv_itrigger_update_priv(CPURISCVState *env)
     riscv_itrigger_update_count(env);
 }
 
-static target_ulong itrigger_validate(CPURISCVState *env,
-                                      target_ulong ctrl)
+static uint64_t itrigger_validate(CPURISCVState *env,
+                                  uint64_t ctrl)
 {
-    target_ulong val;
+    uint64_t val;
 
     /* validate the generic part first */
     val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT);
@@ -855,10 +855,10 @@ static target_ulong itrigger_validate(CPURISCVState *env,
     return val;
 }
 
-static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
-                               int tdata_index, target_ulong val)
+static void itrigger_reg_write(CPURISCVState *env, uint8_t index,
+                               int tdata_index, uint64_t val)
 {
-    target_ulong new_val;
+    uint64_t new_val;
 
     switch (tdata_index) {
     case TDATA1:
@@ -989,8 +989,8 @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
     CPUBreakpoint *bp;
-    target_ulong ctrl;
-    target_ulong pc;
+    uint64_t ctrl;
+    vaddr pc;
     int trigger_type;
     int i;
 
@@ -1035,8 +1035,8 @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
-    target_ulong ctrl;
-    target_ulong addr;
+    uint64_t ctrl;
+    vaddr addr;
     int trigger_type;
     int flags;
     int i;
@@ -1131,7 +1131,7 @@ void riscv_trigger_unrealize(CPURISCVState *env)
 
 void riscv_trigger_reset_hold(CPURISCVState *env)
 {
-    target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
+    uint64_t tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
     int i;
 
     /* init to type 2 triggers */

-- 
2.52.0

[PATCH 04/18] target/riscv: Make debug.c target agnostic

[Anton Johansson via]

This is not enough to compile debug.c once for system-mode, since it
pulls in helper function prototypes which depend on target_long.
Inclusion of "exec/target_long.h" from debug.h is removed in a follow up
commit once the CSR functions have been made agnostic.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/debug.c | 140 +++++++++++++++++++++++------------------------
 1 file changed, 70 insertions(+), 70 deletions(-)

diff --git a/target/riscv/tcg/debug.c b/target/riscv/tcg/debug.c
index e4d719a1da..90172298ce 100644
--- a/target/riscv/tcg/debug.c
+++ b/target/riscv/tcg/debug.c
@@ -82,8 +82,8 @@ static bool debug_trigger_version_1_0(CPURISCVState *env)
     return riscv_cpu_cfg(env)->ext_sdtrig;
 }
 
-static inline target_ulong extract_trigger_type(CPURISCVState *env,
-                                                target_ulong tdata1)
+static inline uint64_t extract_trigger_type(CPURISCVState *env,
+                                            uint64_t tdata1)
 {
     switch (riscv_cpu_mxl(env)) {
     case MXL_RV32:
@@ -96,16 +96,16 @@ static inline target_ulong extract_trigger_type(CPURISCVState *env,
     }
 }
 
-static inline target_ulong get_trigger_type(CPURISCVState *env,
-                                            target_ulong trigger_index)
+static inline uint64_t get_trigger_type(CPURISCVState *env,
+                                        uint8_t trigger_index)
 {
     return extract_trigger_type(env, env->tdata1[trigger_index]);
 }
 
 static trigger_action_t get_trigger_action(CPURISCVState *env,
-                                           target_ulong trigger_index)
+                                           uint8_t trigger_index)
 {
-    target_ulong tdata1 = env->tdata1[trigger_index];
+    uint64_t tdata1 = env->tdata1[trigger_index];
     int trigger_type = get_trigger_type(env, trigger_index);
     trigger_action_t action = DBG_ACTION_NONE;
 
@@ -135,11 +135,11 @@ static trigger_action_t get_trigger_action(CPURISCVState *env,
     return action;
 }
 
-static inline target_ulong build_tdata1(CPURISCVState *env,
-                                        trigger_type_t type,
-                                        bool dmode, target_ulong data)
+static inline uint64_t build_tdata1(CPURISCVState *env,
+                                    trigger_type_t type,
+                                    bool dmode, uint64_t data)
 {
-    target_ulong tdata1;
+    uint64_t tdata1;
 
     switch (riscv_cpu_mxl(env)) {
     case MXL_RV32:
@@ -183,11 +183,11 @@ void tselect_csr_write(CPURISCVState *env, target_ulong val)
     }
 }
 
-static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
-                                    trigger_type_t t)
+static uint64_t tdata1_validate(CPURISCVState *env, uint64_t val,
+                                trigger_type_t t)
 {
     uint32_t type, dmode;
-    target_ulong tdata1;
+    uint64_t tdata1;
 
     switch (riscv_cpu_mxl(env)) {
     case MXL_RV32:
@@ -217,7 +217,7 @@ static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
     return tdata1;
 }
 
-static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
+static inline void warn_always_zero_bit(uint64_t val, uint64_t mask,
                                         const char *msg)
 {
     if (val & mask) {
@@ -225,11 +225,11 @@ static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
     }
 }
 
-static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
+static uint64_t textra_validate(CPURISCVState *env, uint64_t tdata3)
 {
-    target_ulong mhvalue, mhselect;
-    target_ulong mhselect_new;
-    target_ulong textra;
+    uint64_t mhvalue, mhselect;
+    uint32_t mhselect_new;
+    uint64_t textra;
     const uint32_t mhselect_no_rvh[8] = { 0, 0, 0, 0, 4, 4, 4, 4 };
 
     switch (riscv_cpu_mxl(env)) {
@@ -237,11 +237,11 @@ static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
         mhvalue  = get_field(tdata3, TEXTRA32_MHVALUE);
         mhselect = get_field(tdata3, TEXTRA32_MHSELECT);
         /* Validate unimplemented (always zero) bits */
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SBYTEMASK,
+        warn_always_zero_bit(tdata3, (uint32_t)TEXTRA32_SBYTEMASK,
                              "sbytemask");
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SVALUE,
+        warn_always_zero_bit(tdata3, (uint32_t)TEXTRA32_SVALUE,
                              "svalue");
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA32_SSELECT,
+        warn_always_zero_bit(tdata3, (uint32_t)TEXTRA32_SSELECT,
                              "sselect");
         break;
     case MXL_RV64:
@@ -249,11 +249,11 @@ static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
         mhvalue  = get_field(tdata3, TEXTRA64_MHVALUE);
         mhselect = get_field(tdata3, TEXTRA64_MHSELECT);
         /* Validate unimplemented (always zero) bits */
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SBYTEMASK,
+        warn_always_zero_bit(tdata3, TEXTRA64_SBYTEMASK,
                              "sbytemask");
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SVALUE,
+        warn_always_zero_bit(tdata3, TEXTRA64_SVALUE,
                              "svalue");
-        warn_always_zero_bit(tdata3, (target_ulong)TEXTRA64_SSELECT,
+        warn_always_zero_bit(tdata3, TEXTRA64_SSELECT,
                              "sselect");
         break;
     default:
@@ -285,7 +285,7 @@ static target_ulong textra_validate(CPURISCVState *env, target_ulong tdata3)
     return textra;
 }
 
-static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
+static void do_trigger_action(CPURISCVState *env, uint8_t trigger_index)
 {
     trigger_action_t action = get_trigger_action(env, trigger_index);
 
@@ -314,9 +314,9 @@ static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
  * level.
  */
 static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type,
-                               int trigger_index)
+                               uint8_t trigger_index)
 {
-    target_ulong ctrl = env->tdata1[trigger_index];
+    uint64_t ctrl = env->tdata1[trigger_index];
 
     switch (type) {
     case TRIGGER_TYPE_AD_MATCH:
@@ -373,10 +373,10 @@ static bool trigger_priv_match(CPURISCVState *env, trigger_type_t type,
 }
 
 static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type,
-                                 int trigger_index)
+                                 uint8_t trigger_index)
 {
-    target_ulong textra = env->tdata3[trigger_index];
-    target_ulong mhvalue, mhselect;
+    uint64_t textra = env->tdata3[trigger_index];
+    uint64_t mhvalue, mhselect;
 
     if (type < TRIGGER_TYPE_AD_MATCH || type > TRIGGER_TYPE_AD_MATCH6) {
         /* textra checking is only applicable when type is 2, 3, 4, 5, or 6 */
@@ -416,7 +416,7 @@ static bool trigger_textra_match(CPURISCVState *env, trigger_type_t type,
 
 /* Common matching conditions for all types of the triggers. */
 static bool trigger_common_match(CPURISCVState *env, trigger_type_t type,
-                                 int trigger_index)
+                                 uint8_t trigger_index)
 {
     return trigger_priv_match(env, type, trigger_index) &&
            trigger_textra_match(env, type, trigger_index);
@@ -424,7 +424,7 @@ static bool trigger_common_match(CPURISCVState *env, trigger_type_t type,
 
 /* type 2 trigger */
 
-static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
+static uint32_t type2_breakpoint_size(CPURISCVState *env, uint32_t ctrl)
 {
     uint32_t sizelo, sizehi = 0;
 
@@ -435,7 +435,7 @@ static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
     return (sizehi << 2) | sizelo;
 }
 
-static inline bool type2_breakpoint_enabled(target_ulong ctrl)
+static inline bool type2_breakpoint_enabled(uint64_t ctrl)
 {
     bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M));
     bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
@@ -443,10 +443,10 @@ static inline bool type2_breakpoint_enabled(target_ulong ctrl)
     return mode && rwx;
 }
 
-static target_ulong type2_mcontrol_validate(CPURISCVState *env,
-                                            target_ulong ctrl)
+static uint64_t type2_mcontrol_validate(CPURISCVState *env,
+                                        uint64_t ctrl)
 {
-    target_ulong val;
+    uint64_t val;
     uint32_t size;
 
     /* validate the generic part first */
@@ -479,10 +479,10 @@ static target_ulong type2_mcontrol_validate(CPURISCVState *env,
     return val;
 }
 
-static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
+static void type2_breakpoint_insert(CPURISCVState *env, uint8_t index)
 {
-    target_ulong ctrl = env->tdata1[index];
-    target_ulong addr = env->tdata2[index];
+    uint64_t ctrl = env->tdata1[index];
+    vaddr addr = env->tdata2[index];
     bool enabled = type2_breakpoint_enabled(ctrl);
     CPUState *cs = env_cpu(env);
     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
@@ -517,7 +517,7 @@ static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
     }
 }
 
-static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
+static void type2_breakpoint_remove(CPURISCVState *env, uint8_t index)
 {
     CPUState *cs = env_cpu(env);
 
@@ -532,10 +532,10 @@ static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
     }
 }
 
-static void type2_reg_write(CPURISCVState *env, target_ulong index,
-                            int tdata_index, target_ulong val)
+static void type2_reg_write(CPURISCVState *env, uint8_t index,
+                            int tdata_index, uint64_t val)
 {
-    target_ulong new_val;
+    uint64_t new_val;
 
     switch (tdata_index) {
     case TDATA1:
@@ -563,7 +563,7 @@ static void type2_reg_write(CPURISCVState *env, target_ulong index,
 
 /* type 6 trigger */
 
-static inline bool type6_breakpoint_enabled(target_ulong ctrl)
+static inline bool type6_breakpoint_enabled(uint64_t ctrl)
 {
     bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
     bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
@@ -571,10 +571,10 @@ static inline bool type6_breakpoint_enabled(target_ulong ctrl)
     return mode && rwx;
 }
 
-static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
-                                             target_ulong ctrl)
+static uint64_t type6_mcontrol6_validate(CPURISCVState *env,
+                                         uint64_t ctrl)
 {
-    target_ulong val;
+    uint64_t val;
     uint32_t size;
 
     /* validate the generic part first */
@@ -609,10 +609,10 @@ static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
     return val;
 }
 
-static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
+static void type6_breakpoint_insert(CPURISCVState *env, uint8_t index)
 {
-    target_ulong ctrl = env->tdata1[index];
-    target_ulong addr = env->tdata2[index];
+    uint64_t ctrl = env->tdata1[index];
+    vaddr addr = env->tdata2[index];
     bool enabled = type6_breakpoint_enabled(ctrl);
     CPUState *cs = env_cpu(env);
     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
@@ -646,15 +646,15 @@ static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
     }
 }
 
-static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
+static void type6_breakpoint_remove(CPURISCVState *env, uint8_t index)
 {
     type2_breakpoint_remove(env, index);
 }
 
-static void type6_reg_write(CPURISCVState *env, target_ulong index,
-                            int tdata_index, target_ulong val)
+static void type6_reg_write(CPURISCVState *env, uint8_t index,
+                            int tdata_index, uint64_t val)
 {
-    target_ulong new_val;
+    uint64_t new_val;
 
     switch (tdata_index) {
     case TDATA1:
@@ -682,20 +682,20 @@ static void type6_reg_write(CPURISCVState *env, target_ulong index,
 
 /* icount trigger type */
 static inline int
-itrigger_get_count(CPURISCVState *env, int index)
+itrigger_get_count(CPURISCVState *env, uint8_t index)
 {
     return get_field(env->tdata1[index], ITRIGGER_COUNT);
 }
 
 static inline void
-itrigger_set_count(CPURISCVState *env, int index, int value)
+itrigger_set_count(CPURISCVState *env, uint8_t index, int value)
 {
     env->tdata1[index] = set_field(env->tdata1[index],
                                    ITRIGGER_COUNT, value);
 }
 
 static inline void
-itrigger_set_pending(CPURISCVState *env, int index, int val)
+itrigger_set_pending(CPURISCVState *env, uint8_t index, int val)
 {
     if (!debug_trigger_version_1_0(env)) {
         return;
@@ -705,9 +705,9 @@ itrigger_set_pending(CPURISCVState *env, int index, int val)
                                    ITRIGGER_PENDING, val);
 }
 
-static bool check_itrigger_priv(CPURISCVState *env, int index)
+static bool check_itrigger_priv(CPURISCVState *env, uint8_t index)
 {
-    target_ulong tdata1 = env->tdata1[index];
+    uint64_t tdata1 = env->tdata1[index];
     if (env->virt_enabled) {
         /* check VU/VS bit against current privilege level */
         return (get_field(tdata1, ITRIGGER_VS) == env->priv) ||
@@ -835,10 +835,10 @@ void riscv_itrigger_update_priv(CPURISCVState *env)
     riscv_itrigger_update_count(env);
 }
 
-static target_ulong itrigger_validate(CPURISCVState *env,
-                                      target_ulong ctrl)
+static uint64_t itrigger_validate(CPURISCVState *env,
+                                  uint64_t ctrl)
 {
-    target_ulong val;
+    uint64_t val;
 
     /* validate the generic part first */
     val = tdata1_validate(env, ctrl, TRIGGER_TYPE_INST_CNT);
@@ -855,10 +855,10 @@ static target_ulong itrigger_validate(CPURISCVState *env,
     return val;
 }
 
-static void itrigger_reg_write(CPURISCVState *env, target_ulong index,
-                               int tdata_index, target_ulong val)
+static void itrigger_reg_write(CPURISCVState *env, uint8_t index,
+                               int tdata_index, uint64_t val)
 {
-    target_ulong new_val;
+    uint64_t new_val;
 
     switch (tdata_index) {
     case TDATA1:
@@ -989,8 +989,8 @@ bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
     CPUBreakpoint *bp;
-    target_ulong ctrl;
-    target_ulong pc;
+    uint64_t ctrl;
+    vaddr pc;
     int trigger_type;
     int i;
 
@@ -1035,8 +1035,8 @@ bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
-    target_ulong ctrl;
-    target_ulong addr;
+    uint64_t ctrl;
+    vaddr addr;
     int trigger_type;
     int flags;
     int i;
@@ -1131,7 +1131,7 @@ void riscv_trigger_unrealize(CPURISCVState *env)
 
 void riscv_trigger_reset_hold(CPURISCVState *env)
 {
-    target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
+    uint64_t tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
     int i;
 
     /* init to type 2 triggers */

-- 
2.52.0

Re: [PATCH 04/18] target/riscv: Make debug.c target agnostic

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> This is not enough to compile debug.c once for system-mode, since it
> pulls in helper function prototypes which depend on target_long.
> Inclusion of "exec/target_long.h" from debug.h is removed in a follow up
> commit once the CSR functions have been made agnostic.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/tcg/debug.c | 140 +++++++++++++++++++++++------------------------
>  1 file changed, 70 insertions(+), 70 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 05/18] target/riscv: Widen CSR ops to 64-bit and compile once for system-mode

[Anton Johansson via qemu development]

Mostly mechanical change of target_ulong to uint64_t, motivated by the
fact that csr.c compiled with a 64-bit target_ulong already can handle
rv32 CPUs just fine.  If there's any discrepancy between rv32 on
qemu-riscv32 and rv32 on qemu-riscv64 I've failed to take into account
please do let me know.

Aside from minor formatting fixes, masks are sometimes replaced with
~0ULL, such as for write_vsstatus()

-    uint64_t mask = (target_ulong)-1;
+    uint64_t mask = ~0ULL;

this assumes that the behaviour for rv32 on qemu-riscv64 is correct.

Functions in other files containing CSR relevant behaviour are
also updated.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/csr.h       |  35 +-
 target/riscv/tcg/debug.h     |  11 +-
 target/riscv/cpu.c           |  11 +-
 target/riscv/gdbstub.c       |   2 +-
 target/riscv/monitor.c       |   5 +-
 target/riscv/tcg/csr.c       | 736 +++++++++++++++++++++----------------------
 target/riscv/tcg/debug.c     |  10 +-
 target/riscv/tcg/mips_csr.c  |  12 +-
 target/riscv/tcg/op_helper.c |   6 +-
 target/riscv/tcg/pmp.c       |  14 +-
 target/riscv/tcg/pmu.c       |   4 +-
 target/riscv/tcg/th_csr.c    |   6 +-
 target/riscv/tcg/meson.build |  13 +-
 13 files changed, 434 insertions(+), 431 deletions(-)

diff --git a/target/riscv/tcg/csr.h b/target/riscv/tcg/csr.h
index 03f96cce04..c6af3ebe50 100644
--- a/target/riscv/tcg/csr.h
+++ b/target/riscv/tcg/csr.h
@@ -9,31 +9,28 @@
 #ifndef RISCV_CSR_H
 #define RISCV_CSR_H
 
-#include "exec/target_long.h"
-#include "cpu_bits.h"
-
 RISCVException riscv_csrr(CPURISCVState *env, int csrno,
-                          target_ulong *ret_value);
+                          uint64_t *ret_value);
 
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
-                           target_ulong *ret_value, target_ulong new_value,
-                           target_ulong write_mask, uintptr_t ra);
+                           uint64_t *ret_value, uint64_t new_value,
+                           uint64_t write_mask, uintptr_t ra);
 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
-                                 target_ulong *ret_value,
-                                 target_ulong new_value,
-                                 target_ulong write_mask);
+                                 uint64_t *ret_value,
+                                 uint64_t new_value,
+                                 uint64_t write_mask);
 
 typedef RISCVException (*riscv_csr_predicate_fn)(CPURISCVState *env,
                                                  int csrno);
 typedef RISCVException (*riscv_csr_read_fn)(CPURISCVState *env, int csrno,
-                                            target_ulong *ret_value);
+                                            uint64_t *ret_value);
 typedef RISCVException (*riscv_csr_write_fn)(CPURISCVState *env, int csrno,
-                                             target_ulong new_value,
+                                             uint64_t new_value,
                                              uintptr_t ra);
 typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
-                                          target_ulong *ret_value,
-                                          target_ulong new_value,
-                                          target_ulong write_mask);
+                                          uint64_t *ret_value,
+                                          uint64_t new_value,
+                                          uint64_t write_mask);
 
 RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
                                Int128 *ret_value);
@@ -89,18 +86,18 @@ extern const RISCVCSR mips_csr_list[];
 
 /* PMP CSRs, defined in pmp.c */
 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
-                      target_ulong val);
-target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index);
+                      uint64_t val);
+uint64_t pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index);
 
 void mseccfg_csr_write(CPURISCVState *env, uint64_t val);
 uint64_t mseccfg_csr_read(CPURISCVState *env);
 
 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
-                       target_ulong val);
-target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
+                       uint64_t val);
+uint64_t pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
 
 /* Used in pmu.c */
-RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
+RISCVException riscv_pmu_read_ctr(CPURISCVState *env, uint64_t *val,
                                   bool upper_half, uint32_t ctr_idx);
 
 #endif /* RISCV_CSR_H */
diff --git a/target/riscv/tcg/debug.h b/target/riscv/tcg/debug.h
index fcd92b768c..5383905b01 100644
--- a/target/riscv/tcg/debug.h
+++ b/target/riscv/tcg/debug.h
@@ -23,7 +23,6 @@
 #define RISCV_DEBUG_H
 
 #include "exec/breakpoint.h"
-#include "exec/target_long.h"
 
 /* register index of tdata CSRs */
 enum {
@@ -139,13 +138,13 @@ enum {
 
 bool tdata_available(CPURISCVState *env, int tdata_index);
 
-target_ulong tselect_csr_read(CPURISCVState *env);
-void tselect_csr_write(CPURISCVState *env, target_ulong val);
+uint64_t tselect_csr_read(CPURISCVState *env);
+void tselect_csr_write(CPURISCVState *env, uint64_t val);
 
-target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index);
-void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val);
+uint64_t tdata_csr_read(CPURISCVState *env, int tdata_index);
+void tdata_csr_write(CPURISCVState *env, int tdata_index, uint64_t val);
 
-target_ulong tinfo_csr_read(CPURISCVState *env);
+uint64_t tinfo_csr_read(CPURISCVState *env);
 
 void riscv_cpu_debug_excp_handler(CPUState *cs);
 bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 3356ba61d2..8c8f08bb50 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -17,6 +17,7 @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include "cpu_bits.h"
 #include "qemu/osdep.h"
 #include "qemu/qemu-print.h"
 #include "qemu/ctype.h"
@@ -617,16 +618,20 @@ char *riscv_cpu_get_name(RISCVCPU *cpu)
 static void riscv_dump_csr(CPURISCVState *env, int csrno, FILE *f)
 {
 #ifdef CONFIG_TCG
-    target_ulong val = 0;
+    uint64_t val = 0;
+    bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
+    int width = rv32 ? 8 : 16;
+    uint64_t mask = rv32 ? UINT32_MAX : UINT64_MAX;
     RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
 
+
     /*
      * Rely on the smode, hmode, etc, predicates within csr.c
      * to do the filtering of the registers that are present.
      */
     if (res == RISCV_EXCP_NONE) {
-        qemu_fprintf(f, " %-13s " TARGET_FMT_lx "\n",
-                     csr_ops[csrno].name, val);
+        qemu_fprintf(f, " %-13s " "%0*" PRIx64 "\n",
+                     csr_ops[csrno].name, width, val & mask);
     }
 #endif
 }
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index 9abbf5bcdf..6cb905de78 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -171,7 +171,7 @@ static int riscv_gdb_get_csr(CPUState *cs, GByteArray *buf, int n)
     CPURISCVState *env = &cpu->env;
 
     if (n < CSR_TABLE_SIZE) {
-        target_ulong val = 0;
+        uint64_t val = 0;
         int result;
 
         result = riscv_csrrw_debug(env, n, &val, 0, 0);
diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index 7e61ae2a47..fc61638702 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -21,6 +21,7 @@
 #include "qemu/osdep.h"
 #include "qemu/ctype.h"
 #include "qemu/qemu-print.h"
+#include "exec/target_long.h"
 #include "cpu.h"
 #include "target/riscv/tcg/csr.h"
 #include "cpu_bits.h"
@@ -250,7 +251,7 @@ void hmp_info_mem(MonitorHMP *hmp, const QDict *qdict)
 
 #ifdef CONFIG_TCG
 static bool reg_is_ulong_integer(CPURISCVState *env, const char *name,
-                                 target_ulong *val, bool is_gprh)
+                                 uint64_t *val, bool is_gprh)
 {
     const char * const *reg_names;
     uint64_t *vals;
@@ -321,7 +322,7 @@ int riscv_monitor_get_register_legacy(CPUState *cs, const char *name,
 {
     RISCVCPU *hart = RISCV_CPU(cs);
     CPURISCVState *env = cpu_env(cs);
-    target_ulong val = 0;
+    uint64_t val = 0;
     uint64_t val64 = 0;
     int i;
 
diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
index bd4b6dc114..48b3d28734 100644
--- a/target/riscv/tcg/csr.c
+++ b/target/riscv/tcg/csr.c
@@ -20,21 +20,22 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "qemu/timer.h"
-#include "cpu.h"
+#include "qemu/target-info.h"
+#include "target/riscv/cpu.h"
+#include "target/riscv/internals.h"
+#include "target/riscv/time_helper.h"
 #include "target/riscv/tcg/csr.h"
-#include "tcg/tcg-cpu.h"
-#include "pmu.h"
-#include "time_helper.h"
+#include "target/riscv/tcg/tcg-cpu.h"
+#include "target/riscv/tcg/pmu.h"
+#if !defined(CONFIG_USER_ONLY)
+#include "target/riscv/tcg/debug.h"
+#endif
 #include "exec/cputlb.h"
 #include "exec/icount.h"
 #include "accel/tcg/cpu-loop.h"
 #include "accel/tcg/getpc.h"
 #include "qapi/error.h"
 #include "tcg/insn-start-words.h"
-#include "internals.h"
-#if !defined(CONFIG_USER_ONLY)
-#include "target/riscv/tcg/debug.h"
-#endif
 
 /* CSR function table public API */
 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
@@ -114,7 +115,7 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 #if !defined(CONFIG_USER_ONLY)
     RISCVCPU *cpu = env_archcpu(env);
     int ctr_index;
-    target_ulong ctr_mask;
+    uint64_t ctr_mask;
     int base_csrno = CSR_CYCLE;
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
 
@@ -867,14 +868,14 @@ static RISCVException seed(CPURISCVState *env, int csrno)
 
 /* zicfiss CSR_SSP read and write */
 static RISCVException read_ssp(CPURISCVState *env, int csrno,
-                               target_ulong *val)
+                               uint64_t *val)
 {
     *val = env->ssp;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_ssp(CPURISCVState *env, int csrno,
-                                target_ulong val, uintptr_t ra)
+                                uint64_t val, uintptr_t ra)
 {
     env->ssp = val;
     return RISCV_EXCP_NONE;
@@ -882,14 +883,14 @@ static RISCVException write_ssp(CPURISCVState *env, int csrno,
 
 /* User Floating-Point CSRs */
 static RISCVException read_fflags(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = riscv_cpu_get_fflags(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_fflags(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVF)) {
@@ -901,14 +902,14 @@ static RISCVException write_fflags(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_frm(CPURISCVState *env, int csrno,
-                               target_ulong *val)
+                               uint64_t *val)
 {
     *val = env->frm;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_frm(CPURISCVState *env, int csrno,
-                                target_ulong val, uintptr_t ra)
+                                uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVF)) {
@@ -920,7 +921,7 @@ static RISCVException write_frm(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_fcsr(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     /*
      * This is an 8-bit operation, fflags make up the lower 5 bits and
@@ -932,7 +933,7 @@ static RISCVException read_fcsr(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_fcsr(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVF)) {
@@ -945,7 +946,7 @@ static RISCVException write_fcsr(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vtype(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     uint64_t vill;
     int xl = env->xl;
@@ -967,33 +968,33 @@ static RISCVException read_vtype(CPURISCVState *env, int csrno,
     default:
         g_assert_not_reached();
     }
-    *val = (target_ulong)vill | env->vtype;
+    *val = (uint64_t)vill | env->vtype;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vl(CPURISCVState *env, int csrno,
-                              target_ulong *val)
+                              uint64_t *val)
 {
     *val = env->vl;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vlenb(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = riscv_cpu_cfg(env)->vlenb;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vxrm(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = env->vxrm;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vxrm(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -1003,14 +1004,14 @@ static RISCVException write_vxrm(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vxsat(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->vxsat & BIT(0);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vxsat(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -1020,14 +1021,14 @@ static RISCVException write_vxsat(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vstart(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->vstart;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vstart(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -1041,14 +1042,14 @@ static RISCVException write_vstart(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vcsr(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = (env->vxrm << VCSR_VXRM_SHIFT) | (env->vxsat << VCSR_VXSAT_SHIFT);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vcsr(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -1060,37 +1061,37 @@ static RISCVException write_vcsr(CPURISCVState *env, int csrno,
 
 #if defined(CONFIG_USER_ONLY)
 /* User Timers and Counters */
-static target_ulong get_ticks(bool shift)
+static uint64_t get_ticks(bool shift)
 {
     int64_t val = cpu_get_host_ticks();
-    target_ulong result = shift ? val >> 32 : val;
+    uint64_t result = shift ? val >> 32 : val;
 
     return result;
 }
 
 static RISCVException read_time(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = cpu_get_host_ticks();
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_timeh(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = cpu_get_host_ticks() >> 32;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_hpmcounter(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = get_ticks(false);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     *val = get_ticks(true);
     return RISCV_EXCP_NONE;
@@ -1099,7 +1100,7 @@ static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
 #else /* CONFIG_USER_ONLY */
 
 static RISCVException read_mcyclecfg(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
     *val = extract64(env->mcyclecfg, 0, rv32 ? 32 : 64);
@@ -1107,7 +1108,7 @@ static RISCVException read_mcyclecfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mcyclecfg(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     uint64_t inh_avail_mask;
 
@@ -1129,16 +1130,16 @@ static RISCVException write_mcyclecfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mcyclecfgh(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = extract64(env->mcyclecfg, 32, 32);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mcyclecfgh(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
-    target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
+    uint64_t inh_avail_mask = (uint64_t)(~MHPMEVENTH_FILTER_MASK |
                                                  MCYCLECFGH_BIT_MINH);
 
     /* Set xINH fields if priv mode supported */
@@ -1154,7 +1155,7 @@ static RISCVException write_mcyclecfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_minstretcfg(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
     *val = extract64(env->minstretcfg, 0, rv32 ? 32 : 64);
@@ -1162,7 +1163,7 @@ static RISCVException read_minstretcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_minstretcfg(CPURISCVState *env, int csrno,
-                                        target_ulong val, uintptr_t ra)
+                                        uint64_t val, uintptr_t ra)
 {
     uint64_t inh_avail_mask;
 
@@ -1182,16 +1183,16 @@ static RISCVException write_minstretcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_minstretcfgh(CPURISCVState *env, int csrno,
-                                        target_ulong *val)
+                                        uint64_t *val)
 {
     *val = extract64(env->minstretcfg, 32, 32);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_minstretcfgh(CPURISCVState *env, int csrno,
-                                         target_ulong val, uintptr_t ra)
+                                         uint64_t val, uintptr_t ra)
 {
-    target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
+    uint64_t inh_avail_mask = (uint64_t)(~MHPMEVENTH_FILTER_MASK |
                                                  MINSTRETCFGH_BIT_MINH);
 
     inh_avail_mask |= riscv_has_ext(env, RVU) ? MINSTRETCFGH_BIT_UINH : 0;
@@ -1207,7 +1208,7 @@ static RISCVException write_minstretcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mhpmevent(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     int evt_index = csrno - CSR_MCOUNTINHIBIT;
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
@@ -1218,7 +1219,7 @@ static RISCVException read_mhpmevent(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mhpmevent(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     int evt_index = csrno - CSR_MCOUNTINHIBIT;
     uint64_t mhpmevt_val;
@@ -1244,7 +1245,7 @@ static RISCVException write_mhpmevent(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mhpmeventh(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
 
@@ -1254,10 +1255,10 @@ static RISCVException read_mhpmeventh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mhpmeventh(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
-    target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
+    uint64_t inh_avail_mask = (uint64_t)(~MHPMEVENTH_FILTER_MASK |
                                                   MHPMEVENTH_BIT_MINH);
 
     inh_avail_mask |= riscv_has_ext(env, RVU) ? MHPMEVENTH_BIT_UINH : 0;
@@ -1329,7 +1330,7 @@ static uint64_t riscv_pmu_ctr_get_fixed_counters_val(CPURISCVState *env,
     return curr_val;
 }
 
-static RISCVException riscv_pmu_write_ctr(CPURISCVState *env, target_ulong val,
+static RISCVException riscv_pmu_write_ctr(CPURISCVState *env, uint64_t val,
                                           uint32_t ctr_idx)
 {
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
@@ -1359,7 +1360,7 @@ static RISCVException riscv_pmu_write_ctr(CPURISCVState *env, target_ulong val,
     return RISCV_EXCP_NONE;
 }
 
-static RISCVException riscv_pmu_write_ctrh(CPURISCVState *env, target_ulong val,
+static RISCVException riscv_pmu_write_ctrh(CPURISCVState *env, uint64_t val,
                                           uint32_t ctr_idx)
 {
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
@@ -1385,7 +1386,7 @@ static RISCVException riscv_pmu_write_ctrh(CPURISCVState *env, target_ulong val,
 }
 
 static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
-                                        target_ulong val, uintptr_t ra)
+                                        uint64_t val, uintptr_t ra)
 {
     int ctr_idx = csrno - CSR_MCYCLE;
 
@@ -1393,14 +1394,14 @@ static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mhpmcounterh(CPURISCVState *env, int csrno,
-                                         target_ulong val, uintptr_t ra)
+                                         uint64_t val, uintptr_t ra)
 {
     int ctr_idx = csrno - CSR_MCYCLEH;
 
     return riscv_pmu_write_ctrh(env, val, ctr_idx);
 }
 
-RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
+RISCVException riscv_pmu_read_ctr(CPURISCVState *env, uint64_t *val,
                                   bool upper_half, uint32_t ctr_idx)
 {
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
@@ -1441,7 +1442,7 @@ RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
 }
 
 static RISCVException read_hpmcounter(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     uint16_t ctr_index;
 
@@ -1457,7 +1458,7 @@ static RISCVException read_hpmcounter(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     uint16_t ctr_index;
 
@@ -1473,8 +1474,8 @@ static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
 }
 
 static int rmw_cd_mhpmcounter(CPURISCVState *env, int ctr_idx,
-                              target_ulong *val, target_ulong new_val,
-                              target_ulong wr_mask)
+                              uint64_t *val, uint64_t new_val,
+                              uint64_t wr_mask)
 {
     if (wr_mask != 0 && wr_mask != -1) {
         return -EINVAL;
@@ -1492,8 +1493,8 @@ static int rmw_cd_mhpmcounter(CPURISCVState *env, int ctr_idx,
 }
 
 static int rmw_cd_mhpmcounterh(CPURISCVState *env, int ctr_idx,
-                               target_ulong *val, target_ulong new_val,
-                               target_ulong wr_mask)
+                               uint64_t *val, uint64_t new_val,
+                               uint64_t wr_mask)
 {
     if (wr_mask != 0 && wr_mask != -1) {
         return -EINVAL;
@@ -1511,7 +1512,7 @@ static int rmw_cd_mhpmcounterh(CPURISCVState *env, int ctr_idx,
 }
 
 static int rmw_cd_mhpmevent(CPURISCVState *env, int evt_index,
-                            target_ulong *val, target_ulong new_val,
+                            uint64_t *val, uint64_t new_val,
                             uint64_t wr_mask)
 {
     uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
@@ -1539,8 +1540,8 @@ static int rmw_cd_mhpmevent(CPURISCVState *env, int evt_index,
 }
 
 static int rmw_cd_mhpmeventh(CPURISCVState *env, int evt_index,
-                             target_ulong *val, target_ulong new_val,
-                             target_ulong wr_mask)
+                             uint64_t *val, uint64_t new_val,
+                             uint64_t wr_mask)
 {
     uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
     uint32_t mhpmevth_val = extract64(mhpmevt_val, 32, 32);
@@ -1567,8 +1568,8 @@ static int rmw_cd_mhpmeventh(CPURISCVState *env, int evt_index,
     return 0;
 }
 
-static int rmw_cd_ctr_cfg(CPURISCVState *env, int cfg_index, target_ulong *val,
-                          target_ulong new_val, uint64_t wr_mask)
+static int rmw_cd_ctr_cfg(CPURISCVState *env, int cfg_index, uint64_t *val,
+                          uint64_t new_val, uint64_t wr_mask)
 {
     /*
      * wr_mask is 64-bit so upper 32 bits of mcyclecfg and minstretcfg
@@ -1598,8 +1599,8 @@ static int rmw_cd_ctr_cfg(CPURISCVState *env, int cfg_index, target_ulong *val,
     return 0;
 }
 
-static int rmw_cd_ctr_cfgh(CPURISCVState *env, int cfg_index, target_ulong *val,
-                           target_ulong new_val, target_ulong wr_mask)
+static int rmw_cd_ctr_cfgh(CPURISCVState *env, int cfg_index, uint64_t *val,
+                           uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t cfgh;
 
@@ -1636,7 +1637,7 @@ static int rmw_cd_ctr_cfgh(CPURISCVState *env, int cfg_index, target_ulong *val,
 
 
 static RISCVException read_scountovf(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     int mhpmevt_start = CSR_MHPMEVENT3 - CSR_MCOUNTINHIBIT;
     int i;
@@ -1673,7 +1674,7 @@ static RISCVException read_scountovf(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_time(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
 
@@ -1686,7 +1687,7 @@ static RISCVException read_time(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_timeh(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
 
@@ -1699,7 +1700,7 @@ static RISCVException read_timeh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vstimecmp(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     *val = env->vstimecmp;
 
@@ -1707,7 +1708,7 @@ static RISCVException read_vstimecmp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = env->vstimecmp >> 32;
 
@@ -1715,7 +1716,7 @@ static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     if (riscv_cpu_mxl(env) == MXL_RV32) {
         env->vstimecmp = deposit64(env->vstimecmp, 0, 32, (uint64_t)val);
@@ -1730,7 +1731,7 @@ static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     env->vstimecmp = deposit64(env->vstimecmp, 32, 32, (uint64_t)val);
     riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
@@ -1740,7 +1741,7 @@ static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     if (env->virt_enabled) {
         *val = env->vstimecmp;
@@ -1752,7 +1753,7 @@ static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     if (env->virt_enabled) {
         *val = env->vstimecmp >> 32;
@@ -1764,7 +1765,7 @@ static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     if (env->virt_enabled) {
         if (env->hvictl & HVICTL_VTI) {
@@ -1785,7 +1786,7 @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     if (env->virt_enabled) {
         if (env->hvictl & HVICTL_VTI) {
@@ -1836,7 +1837,7 @@ static const uint64_t all_ints = M_MODE_INTERRUPTS | S_MODE_INTERRUPTS |
                          (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) | \
                          (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) | \
                          (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)))
-static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
+static const uint64_t vs_delegable_excps = DELEGABLE_EXCPS &
     ~((1ULL << (RISCV_EXCP_S_ECALL)) |
       (1ULL << (RISCV_EXCP_VS_ECALL)) |
       (1ULL << (RISCV_EXCP_M_ECALL)) |
@@ -1844,7 +1845,7 @@ static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
       (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) |
       (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) |
       (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)));
-static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
+static const uint64_t sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
 
@@ -1876,41 +1877,41 @@ static const uint64_t vsip_writable_mask = MIP_VSSIP | LOCAL_INTERRUPTS;
 
 /* Machine Information Registers */
 static RISCVException read_zero(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = 0;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_ignore(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     *val = riscv_cpu_cfg(env)->mvendorid;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_marchid(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = riscv_cpu_cfg(env)->marchid;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mimpid(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = riscv_cpu_cfg(env)->mimpid;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mhartid(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->mhartid;
     return RISCV_EXCP_NONE;
@@ -1939,13 +1940,13 @@ static uint64_t add_status_sd(RISCVMXL xl, uint64_t status)
 }
 
 static RISCVException read_mstatus(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus);
     return RISCV_EXCP_NONE;
 }
 
-static bool validate_vm(CPURISCVState *env, target_ulong vm)
+static bool validate_vm(CPURISCVState *env, uint64_t vm)
 {
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
     RISCVCPU *cpu = env_archcpu(env);
@@ -1956,10 +1957,10 @@ static bool validate_vm(CPURISCVState *env, target_ulong vm)
     return vm <= satp_mode_supported_max && valid_vm[vm];
 }
 
-static target_ulong legalize_xatp(CPURISCVState *env, target_ulong old_xatp,
-                                  target_ulong val)
+static uint64_t legalize_xatp(CPURISCVState *env, uint64_t old_xatp,
+                              uint64_t val)
 {
-    target_ulong mask;
+    uint64_t mask;
     bool vm;
     if (riscv_cpu_mxl(env) == MXL_RV32) {
         vm = validate_vm(env, get_field(val, SATP32_MODE));
@@ -1982,11 +1983,11 @@ static target_ulong legalize_xatp(CPURISCVState *env, target_ulong old_xatp,
     return old_xatp;
 }
 
-static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
-                                 target_ulong val)
+static uint64_t legalize_mpp(CPURISCVState *env, uint64_t old_mpp,
+                             uint64_t val)
 {
     bool valid = false;
-    target_ulong new_mpp = get_field(val, MSTATUS_MPP);
+    uint64_t new_mpp = get_field(val, MSTATUS_MPP);
 
     switch (new_mpp) {
     case PRV_M:
@@ -2023,7 +2024,7 @@ static uint64_t riscv_write_uxl(CPURISCVState *env, uint64_t val,
 }
 
 static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     uint64_t mstatus = env->mstatus;
     uint64_t mask = 0;
@@ -2099,14 +2100,14 @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mstatush(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->mstatus >> 32;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mstatush(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     uint64_t valh = (uint64_t)val << 32;
     uint64_t mask = 0;
@@ -2138,19 +2139,17 @@ static RISCVException read_misa_i128(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_misa(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
-    target_ulong misa;
+    uint64_t misa;
 
     switch (env->misa_mxl) {
     case MXL_RV32:
-        misa = (target_ulong)MXL_RV32 << 30;
+        misa = (uint64_t)MXL_RV32 << 30;
         break;
-#ifdef TARGET_RISCV64
     case MXL_RV64:
-        misa = (target_ulong)MXL_RV64 << 62;
+        misa = (uint64_t)MXL_RV64 << 62;
         break;
-#endif
     default:
         g_assert_not_reached();
     }
@@ -2159,7 +2158,7 @@ static RISCVException read_misa(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
-static target_ulong get_next_pc(CPURISCVState *env, uintptr_t ra)
+static uint64_t get_next_pc(CPURISCVState *env, uintptr_t ra)
 {
     uint64_t data[INSN_START_WORDS];
 
@@ -2173,7 +2172,7 @@ static target_ulong get_next_pc(CPURISCVState *env, uintptr_t ra)
 }
 
 static RISCVException write_misa(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
     uint32_t orig_misa_ext = env->misa_ext;
@@ -2229,14 +2228,14 @@ static RISCVException write_misa(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_medeleg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->medeleg;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_medeleg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     env->medeleg = (env->medeleg & ~DELEGABLE_EXCPS) | (val & DELEGABLE_EXCPS);
     return RISCV_EXCP_NONE;
@@ -2262,8 +2261,8 @@ static RISCVException rmw_mideleg64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mideleg(CPURISCVState *env, int csrno,
-                                  target_ulong *ret_val,
-                                  target_ulong new_val, target_ulong wr_mask)
+                                  uint64_t *ret_val,
+                                  uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2277,9 +2276,9 @@ static RISCVException rmw_mideleg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_midelegh(CPURISCVState *env, int csrno,
-                                   target_ulong *ret_val,
-                                   target_ulong new_val,
-                                   target_ulong wr_mask)
+                                   uint64_t *ret_val,
+                                   uint64_t new_val,
+                                   uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2313,8 +2312,8 @@ static RISCVException rmw_mie64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mie(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2328,8 +2327,8 @@ static RISCVException rmw_mie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mieh(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2359,8 +2358,8 @@ static RISCVException rmw_mvien64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mvien(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2374,8 +2373,8 @@ static RISCVException rmw_mvien(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mvienh(CPURISCVState *env, int csrno,
-                                target_ulong *ret_val,
-                                target_ulong new_val, target_ulong wr_mask)
+                                uint64_t *ret_val,
+                                uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2390,7 +2389,7 @@ static RISCVException rmw_mvienh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mtopi(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     int irq;
     uint8_t iprio;
@@ -2452,8 +2451,8 @@ static int csrind_xlate_vs_csrno(CPURISCVState *env, int csrno)
 }
 
 static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
-                                   target_ulong *val, target_ulong new_val,
-                                   target_ulong wr_mask)
+                                   uint64_t *val, uint64_t new_val,
+                                   uint64_t wr_mask)
 {
     uint16_t *iselect;
     int ret;
@@ -2516,13 +2515,13 @@ static bool xiselect_ctr_range(int csrno, uint16_t isel)
            csrno < CSR_MIREG;
 }
 
-static int rmw_iprio(target_ulong xlen,
+static int rmw_iprio(uint64_t xlen,
                      uint16_t iselect, uint8_t *iprio,
-                     target_ulong *val, target_ulong new_val,
-                     target_ulong wr_mask, int ext_irq_no)
+                     uint64_t *val, uint64_t new_val,
+                     uint64_t wr_mask, int ext_irq_no)
 {
     int i, firq, nirqs;
-    target_ulong old_val;
+    uint64_t old_val;
 
     if (iselect < ISELECT_IPRIO0 || ISELECT_IPRIO15 < iselect) {
         return -EINVAL;
@@ -2536,7 +2535,7 @@ static int rmw_iprio(target_ulong xlen,
 
     old_val = 0;
     for (i = 0; i < nirqs; i++) {
-        old_val |= ((target_ulong)iprio[firq + i]) << (IPRIO_IRQ_BITS * i);
+        old_val |= ((uint64_t)iprio[firq + i]) << (IPRIO_IRQ_BITS * i);
     }
 
     if (val) {
@@ -2561,8 +2560,8 @@ static int rmw_iprio(target_ulong xlen,
     return 0;
 }
 
-static int rmw_ctrsource(CPURISCVState *env, uint16_t isel, target_ulong *val,
-                          target_ulong new_val, target_ulong wr_mask)
+static int rmw_ctrsource(CPURISCVState *env, uint16_t isel, uint64_t *val,
+                         uint64_t new_val, uint64_t wr_mask)
 {
     /*
      * CTR arrays are treated as circular buffers and TOS always points to next
@@ -2600,8 +2599,8 @@ static int rmw_ctrsource(CPURISCVState *env, uint16_t isel, target_ulong *val,
     return 0;
 }
 
-static int rmw_ctrtarget(CPURISCVState *env, uint16_t isel, target_ulong *val,
-                          target_ulong new_val, target_ulong wr_mask)
+static int rmw_ctrtarget(CPURISCVState *env, uint16_t isel, uint64_t *val,
+                          uint64_t new_val, uint64_t wr_mask)
 {
     /*
      * CTR arrays are treated as circular buffers and TOS always points to next
@@ -2639,8 +2638,8 @@ static int rmw_ctrtarget(CPURISCVState *env, uint16_t isel, target_ulong *val,
     return 0;
 }
 
-static int rmw_ctrdata(CPURISCVState *env, uint16_t isel, target_ulong *val,
-                        target_ulong new_val, target_ulong wr_mask)
+static int rmw_ctrdata(CPURISCVState *env, uint16_t isel, uint64_t *val,
+                       uint64_t new_val, uint64_t wr_mask)
 {
     /*
      * CTR arrays are treated as circular buffers and TOS always points to next
@@ -2680,8 +2679,8 @@ static int rmw_ctrdata(CPURISCVState *env, uint16_t isel, target_ulong *val,
 }
 
 static RISCVException rmw_xireg_aia(CPURISCVState *env, int csrno,
-                         uint16_t isel, target_ulong *val,
-                         target_ulong new_val, target_ulong wr_mask)
+                                    uint16_t isel, uint64_t *val,
+                                    uint64_t new_val, uint64_t wr_mask)
 {
     bool virt = false, isel_reserved = false;
     int ret = -EINVAL;
@@ -2765,8 +2764,8 @@ done:
 }
 
 static int rmw_xireg_cd(CPURISCVState *env, int csrno,
-                        uint16_t isel, target_ulong *val,
-                        target_ulong new_val, target_ulong wr_mask)
+                        uint16_t isel, uint64_t *val,
+                        uint64_t new_val, uint64_t wr_mask)
 {
     int ret = -EINVAL;
     uint16_t ctr_index = isel - ISELECT_CD_FIRST;
@@ -2837,8 +2836,8 @@ done:
 }
 
 static int rmw_xireg_ctr(CPURISCVState *env, int csrno,
-                        uint16_t isel, target_ulong *val,
-                        target_ulong new_val, target_ulong wr_mask)
+                         uint16_t isel, uint64_t *val,
+                         uint64_t new_val, uint64_t wr_mask)
 {
     if (!riscv_cpu_cfg(env)->ext_smctr && !riscv_cpu_cfg(env)->ext_ssctr) {
         return -EINVAL;
@@ -2865,8 +2864,8 @@ static int rmw_xireg_ctr(CPURISCVState *env, int csrno,
  * extension using csrind should be implemented here.
  */
 static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
-                              uint16_t isel, target_ulong *val,
-                              target_ulong new_val, target_ulong wr_mask)
+                            uint16_t isel, uint64_t *val,
+                            uint64_t new_val, uint64_t wr_mask)
 {
     bool virt = csrno == CSR_VSIREG ? true : false;
     int ret = -EINVAL;
@@ -2891,8 +2890,8 @@ static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
-static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
-                      target_ulong new_val, target_ulong wr_mask)
+static int rmw_xiregi(CPURISCVState *env, int csrno, uint64_t *val,
+                      uint64_t new_val, uint64_t wr_mask)
 {
     int ret = -EINVAL;
     uint16_t isel;
@@ -2922,8 +2921,8 @@ static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
 }
 
 static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
-                                target_ulong *val, target_ulong new_val,
-                                target_ulong wr_mask)
+                                uint64_t *val, uint64_t new_val,
+                                uint64_t wr_mask)
 {
     int ret = -EINVAL;
     uint16_t isel;
@@ -2971,8 +2970,8 @@ done:
 }
 
 static RISCVException rmw_xtopei(CPURISCVState *env, int csrno,
-                                 target_ulong *val, target_ulong new_val,
-                                 target_ulong wr_mask)
+                                 uint64_t *val, uint64_t new_val,
+                                 uint64_t wr_mask)
 {
     bool virt;
     int ret = -EINVAL;
@@ -3034,14 +3033,14 @@ done:
 }
 
 static RISCVException read_mtvec(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->mtvec;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mtvec(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
     if ((val & 3) < 2) {
@@ -3053,20 +3052,20 @@ static RISCVException write_mtvec(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
-                                         target_ulong *val)
+                                         uint64_t *val)
 {
     *val = env->mcountinhibit;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
-                                          target_ulong val, uintptr_t ra)
+                                          uint64_t val, uintptr_t ra)
 {
     int cidx;
     PMUCTRState *counter;
     RISCVCPU *cpu = env_archcpu(env);
     uint32_t present_ctrs = cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR;
-    target_ulong updated_ctrs = (env->mcountinhibit ^ val) & present_ctrs;
+    uint64_t updated_ctrs = (env->mcountinhibit ^ val) & present_ctrs;
     uint64_t mhpmctr_val, prev_count, curr_count;
 
     /* WARL register - disable unavailable counters; TM bit is always 0 */
@@ -3104,7 +3103,7 @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_scountinhibit(CPURISCVState *env, int csrno,
-                                         target_ulong *val)
+                                         uint64_t *val)
 {
     /* S-mode can only access the bits delegated by M-mode */
     *val = env->mcountinhibit & env->mcounteren;
@@ -3112,20 +3111,20 @@ static RISCVException read_scountinhibit(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_scountinhibit(CPURISCVState *env, int csrno,
-                                          target_ulong val, uintptr_t ra)
+                                          uint64_t val, uintptr_t ra)
 {
     return write_mcountinhibit(env, csrno, val & env->mcounteren, ra);
 }
 
 static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = env->mcounteren;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -3152,56 +3151,56 @@ static RISCVException write_mscratch_i128(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mscratch(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->mscratch;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mscratch(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     env->mscratch = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mepc(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = env->mepc & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mepc(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
     env->mepc = val & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mcause(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->mcause;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mcause(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->mcause = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mtval(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->mtval;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mtval(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->mtval = val;
     return RISCV_EXCP_NONE;
@@ -3209,16 +3208,16 @@ static RISCVException write_mtval(CPURISCVState *env, int csrno,
 
 /* Execution environment configuration setup */
 static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->menvcfg;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra);
+                                    uint64_t val, uintptr_t ra);
 static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE |
@@ -3270,16 +3269,16 @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->menvcfg >> 32;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra);
+                                     uint64_t val, uintptr_t ra);
 static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
@@ -3309,7 +3308,7 @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     RISCVException ret;
 
@@ -3323,7 +3322,7 @@ static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
     RISCVException ret;
@@ -3359,7 +3358,7 @@ static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     RISCVException ret;
 
@@ -3380,7 +3379,7 @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
@@ -3443,7 +3442,7 @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     RISCVException ret;
 
@@ -3458,7 +3457,7 @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
@@ -3490,7 +3489,7 @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mstateen(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->mstateen[csrno - CSR_MSTATEEN0];
 
@@ -3498,7 +3497,7 @@ static RISCVException read_mstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen(CPURISCVState *env, int csrno,
-                                     uint64_t wr_mask, target_ulong new_val)
+                                     uint64_t wr_mask, uint64_t new_val)
 {
     uint64_t *reg;
 
@@ -3509,7 +3508,7 @@ static RISCVException write_mstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
-                                      target_ulong new_val, uintptr_t ra)
+                                      uint64_t new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
     if (!riscv_has_ext(env, RVF)) {
@@ -3545,13 +3544,13 @@ static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen_1_3(CPURISCVState *env, int csrno,
-                                         target_ulong new_val, uintptr_t ra)
+                                         uint64_t new_val, uintptr_t ra)
 {
     return write_mstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
 
 static RISCVException read_mstateenh(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     *val = env->mstateen[csrno - CSR_MSTATEEN0H] >> 32;
 
@@ -3559,7 +3558,7 @@ static RISCVException read_mstateenh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
-                                      uint64_t wr_mask, target_ulong new_val)
+                                      uint64_t wr_mask, uint64_t new_val)
 {
     uint64_t *reg, val;
 
@@ -3572,7 +3571,7 @@ static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
-                                       target_ulong new_val, uintptr_t ra)
+                                       uint64_t new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
@@ -3602,13 +3601,13 @@ static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateenh_1_3(CPURISCVState *env, int csrno,
-                                          target_ulong new_val, uintptr_t ra)
+                                          uint64_t new_val, uintptr_t ra)
 {
     return write_mstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
 
 static RISCVException read_hstateen(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     int index = csrno - CSR_HSTATEEN0;
 
@@ -3618,7 +3617,7 @@ static RISCVException read_hstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen(CPURISCVState *env, int csrno,
-                                     uint64_t mask, target_ulong new_val)
+                                     uint64_t mask, uint64_t new_val)
 {
     int index = csrno - CSR_HSTATEEN0;
     uint64_t *reg, wr_mask;
@@ -3631,7 +3630,7 @@ static RISCVException write_hstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
-                                      target_ulong new_val, uintptr_t ra)
+                                      uint64_t new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
@@ -3664,13 +3663,13 @@ static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen_1_3(CPURISCVState *env, int csrno,
-                                         target_ulong new_val, uintptr_t ra)
+                                         uint64_t new_val, uintptr_t ra)
 {
     return write_hstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
 
 static RISCVException read_hstateenh(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     int index = csrno - CSR_HSTATEEN0H;
 
@@ -3680,7 +3679,7 @@ static RISCVException read_hstateenh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
-                                      uint64_t mask, target_ulong new_val)
+                                      uint64_t mask, uint64_t new_val)
 {
     int index = csrno - CSR_HSTATEEN0H;
     uint64_t *reg, wr_mask, val;
@@ -3695,7 +3694,7 @@ static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
-                                       target_ulong new_val, uintptr_t ra)
+                                       uint64_t new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
@@ -3721,13 +3720,13 @@ static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateenh_1_3(CPURISCVState *env, int csrno,
-                                          target_ulong new_val, uintptr_t ra)
+                                          uint64_t new_val, uintptr_t ra)
 {
     return write_hstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
 
 static RISCVException read_sstateen(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     bool virt = env->virt_enabled;
     int index = csrno - CSR_SSTATEEN0;
@@ -3741,7 +3740,7 @@ static RISCVException read_sstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstateen(CPURISCVState *env, int csrno,
-                                     uint64_t mask, target_ulong new_val)
+                                     uint64_t mask, uint64_t new_val)
 {
     bool virt = env->virt_enabled;
     int index = csrno - CSR_SSTATEEN0;
@@ -3760,7 +3759,7 @@ static RISCVException write_sstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
-                                      target_ulong new_val, uintptr_t ra)
+                                      uint64_t new_val, uintptr_t ra)
 {
     uint64_t wr_mask = 0;
 
@@ -3772,7 +3771,7 @@ static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
-                                         target_ulong new_val, uintptr_t ra)
+                                         uint64_t new_val, uintptr_t ra)
 {
     return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
@@ -3830,8 +3829,8 @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mip(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -3845,8 +3844,8 @@ static RISCVException rmw_mip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_miph(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -3872,11 +3871,11 @@ static RISCVException rmw_miph(CPURISCVState *env, int csrno,
  * mvien[i] are zero but mvip needs to be an alias of mip.
  */
 static RISCVException rmw_mvip64(CPURISCVState *env, int csrno,
-                                uint64_t *ret_val,
-                                uint64_t new_val, uint64_t wr_mask)
+                                 uint64_t *ret_val,
+                                 uint64_t new_val, uint64_t wr_mask)
 {
     RISCVCPU *cpu = env_archcpu(env);
-    target_ulong ret_mip = 0;
+    uint64_t ret_mip = 0;
     RISCVException ret;
     uint64_t old_mvip;
 
@@ -3967,8 +3966,8 @@ static RISCVException rmw_mvip64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mvip(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -3982,8 +3981,8 @@ static RISCVException rmw_mvip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mviph(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                                uint64_t *ret_val,
+                                uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4019,9 +4018,9 @@ static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_sstatus(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
-    target_ulong mask = (sstatus_v1_10_mask);
+    uint64_t mask = (sstatus_v1_10_mask);
     if (env->xl != MXL_RV32 || env->debugger) {
         mask |= SSTATUS64_UXL;
     }
@@ -4038,9 +4037,9 @@ static RISCVException read_sstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstatus(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
-    target_ulong mask = (sstatus_v1_10_mask);
+    uint64_t mask = (sstatus_v1_10_mask);
 
     if (env->xl != MXL_RV32 || env->debugger) {
         if ((val & SSTATUS64_UXL) != 0) {
@@ -4054,7 +4053,7 @@ static RISCVException write_sstatus(CPURISCVState *env, int csrno,
     if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
         mask |= SSTATUS_SDT;
     }
-    target_ulong newval = (env->mstatus & ~mask) | (val & mask);
+    uint64_t newval = (env->mstatus & ~mask) | (val & mask);
     return write_mstatus(env, CSR_MSTATUS, newval, ra);
 }
 
@@ -4098,8 +4097,8 @@ static RISCVException rmw_vsie64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_vsie(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4113,8 +4112,8 @@ static RISCVException rmw_vsie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_vsieh(CPURISCVState *env, int csrno,
-                                target_ulong *ret_val,
-                                target_ulong new_val, target_ulong wr_mask)
+                                uint64_t *ret_val,
+                                uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4169,8 +4168,8 @@ static RISCVException rmw_sie64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_sie(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4184,8 +4183,8 @@ static RISCVException rmw_sie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_sieh(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4200,14 +4199,14 @@ static RISCVException rmw_sieh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_stvec(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->stvec;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_stvec(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
     if ((val & 3) < 2) {
@@ -4219,14 +4218,14 @@ static RISCVException write_stvec(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_scounteren(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = env->scounteren;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_scounteren(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -4253,56 +4252,56 @@ static RISCVException write_sscratch_i128(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_sscratch(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->sscratch;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_sscratch(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     env->sscratch = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_sepc(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = env->sepc & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_sepc(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
     env->sepc = val & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_scause(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->scause;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_scause(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->scause = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_stval(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->stval;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_stval(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->stval = val;
     return RISCV_EXCP_NONE;
@@ -4344,8 +4343,8 @@ static RISCVException rmw_vsip64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_vsip(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4359,8 +4358,8 @@ static RISCVException rmw_vsip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_vsiph(CPURISCVState *env, int csrno,
-                                target_ulong *ret_val,
-                                target_ulong new_val, target_ulong wr_mask)
+                                uint64_t *ret_val,
+                                uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4399,8 +4398,8 @@ static RISCVException rmw_sip64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_sip(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4414,8 +4413,8 @@ static RISCVException rmw_sip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_siph(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4431,7 +4430,7 @@ static RISCVException rmw_siph(CPURISCVState *env, int csrno,
 
 /* Supervisor Protection and Translation */
 static RISCVException read_satp(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     if (!riscv_cpu_cfg(env)->mmu) {
         *val = 0;
@@ -4442,7 +4441,7 @@ static RISCVException read_satp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_satp(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
     if (!riscv_cpu_cfg(env)->mmu) {
         return RISCV_EXCP_NONE;
@@ -4453,8 +4452,8 @@ static RISCVException write_satp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_sctrdepth(CPURISCVState *env, int csrno,
-                                    target_ulong *ret_val,
-                                    target_ulong new_val, target_ulong wr_mask)
+                                    uint64_t *ret_val,
+                                    uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t mask = wr_mask & SCTRDEPTH_MASK;
 
@@ -4483,8 +4482,8 @@ static RISCVException rmw_sctrdepth(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_sctrstatus(CPURISCVState *env, int csrno,
-                                     target_ulong *ret_val,
-                                     target_ulong new_val, target_ulong wr_mask)
+                                     uint64_t *ret_val,
+                                     uint64_t new_val, uint64_t wr_mask)
 {
     uint32_t depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
     uint32_t mask = wr_mask & SCTRSTATUS_MASK;
@@ -4502,8 +4501,8 @@ static RISCVException rmw_sctrstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_xctrctl(CPURISCVState *env, int csrno,
-                                    target_ulong *ret_val,
-                                    target_ulong new_val, target_ulong wr_mask)
+                                    uint64_t *ret_val,
+                                    uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t csr_mask, mask = wr_mask;
     uint64_t *ctl_ptr = &env->mctrctl;
@@ -4533,7 +4532,7 @@ static RISCVException rmw_xctrctl(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vstopi(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     int irq, ret;
     uint64_t topei = 0;
@@ -4623,7 +4622,7 @@ static RISCVException read_vstopi(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_stopi(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     int irq;
     uint8_t iprio;
@@ -4651,7 +4650,7 @@ static RISCVException read_stopi(CPURISCVState *env, int csrno,
 
 /* Hypervisor Extensions */
 static RISCVException read_hstatus(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->hstatus;
     if (riscv_cpu_mxl(env) != MXL_RV32) {
@@ -4664,9 +4663,9 @@ static RISCVException read_hstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstatus(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
-    uint64_t mask = (target_ulong)-1;
+    uint64_t mask = ~0ULL;
     if (!env_archcpu(env)->cfg.ext_svukte) {
         mask &= ~HSTATUS_HUKTE;
     }
@@ -4689,21 +4688,21 @@ static RISCVException write_hstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hedeleg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->hedeleg;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_hedeleg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     env->hedeleg = val & vs_delegable_excps;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_hedelegh(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     RISCVException ret;
     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_P1P13);
@@ -4717,7 +4716,7 @@ static RISCVException read_hedelegh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hedelegh(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     RISCVException ret;
     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_P1P13);
@@ -4745,8 +4744,8 @@ static RISCVException rmw_hvien64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hvien(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4760,8 +4759,8 @@ static RISCVException rmw_hvien(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hvienh(CPURISCVState *env, int csrno,
-                                   target_ulong *ret_val,
-                                   target_ulong new_val, target_ulong wr_mask)
+                                 uint64_t *ret_val,
+                                 uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4790,8 +4789,8 @@ static RISCVException rmw_hideleg64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hideleg(CPURISCVState *env, int csrno,
-                                  target_ulong *ret_val,
-                                  target_ulong new_val, target_ulong wr_mask)
+                                  uint64_t *ret_val,
+                                  uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4805,8 +4804,8 @@ static RISCVException rmw_hideleg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hidelegh(CPURISCVState *env, int csrno,
-                                   target_ulong *ret_val,
-                                   target_ulong new_val, target_ulong wr_mask)
+                                   uint64_t *ret_val,
+                                   uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4914,8 +4913,8 @@ static RISCVException rmw_hvip64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hvip(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4929,8 +4928,8 @@ static RISCVException rmw_hvip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hviph(CPURISCVState *env, int csrno,
-                                target_ulong *ret_val,
-                                target_ulong new_val, target_ulong wr_mask)
+                                uint64_t *ret_val,
+                                uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4945,8 +4944,8 @@ static RISCVException rmw_hviph(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hip(CPURISCVState *env, int csrno,
-                              target_ulong *ret_value,
-                              target_ulong new_value, target_ulong write_mask)
+                              uint64_t *ret_value,
+                              uint64_t new_value, uint64_t write_mask)
 {
     int ret = rmw_mip(env, csrno, ret_value, new_value,
                       write_mask & hip_writable_mask);
@@ -4958,8 +4957,8 @@ static RISCVException rmw_hip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hie(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4973,14 +4972,14 @@ static RISCVException rmw_hie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hcounteren(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = env->hcounteren;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_hcounteren(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -4991,7 +4990,7 @@ static RISCVException write_hcounteren(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hgeie(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     if (val) {
         *val = env->hgeie;
@@ -5000,7 +4999,7 @@ static RISCVException read_hgeie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hgeie(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     /* Only GEILEN:1 bits implemented and BIT0 is never implemented */
     val &= ((1ULL << env->geilen) - 1) << 1;
@@ -5012,34 +5011,34 @@ static RISCVException write_hgeie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_htval(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->htval;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_htval(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->htval = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_htinst(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->htinst;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_htinst(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_hgeip(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     if (val) {
         *val = env->hgeip;
@@ -5048,21 +5047,21 @@ static RISCVException read_hgeip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hgatp(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->hgatp;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_hgatp(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->hgatp = legalize_xatp(env, env->hgatp, val);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5073,7 +5072,7 @@ static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5094,7 +5093,7 @@ static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5105,7 +5104,7 @@ static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
-                                        target_ulong val, uintptr_t ra)
+                                        uint64_t val, uintptr_t ra)
 {
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5122,21 +5121,21 @@ static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hvictl(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->hvictl;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_hvictl(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->hvictl = val & HVICTL_VALID_MASK;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_hvipriox(CPURISCVState *env, int first_index,
-                         uint8_t *iprio, target_ulong *val)
+                                    uint8_t *iprio, uint64_t *val)
 {
     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
 
@@ -5155,14 +5154,14 @@ static RISCVException read_hvipriox(CPURISCVState *env, int first_index,
         if (rdzero) {
             continue;
         }
-        *val |= ((target_ulong)iprio[irq]) << (i * 8);
+        *val |= ((uint64_t)iprio[irq]) << (i * 8);
     }
 
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_hvipriox(CPURISCVState *env, int first_index,
-                          uint8_t *iprio, target_ulong val)
+                                     uint8_t *iprio, uint64_t val)
 {
     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
 
@@ -5188,65 +5187,65 @@ static RISCVException write_hvipriox(CPURISCVState *env, int first_index,
 }
 
 static RISCVException read_hviprio1(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     return read_hvipriox(env, 0, env->hviprio, val);
 }
 
 static RISCVException write_hviprio1(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     return write_hvipriox(env, 0, env->hviprio, val);
 }
 
 static RISCVException read_hviprio1h(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     return read_hvipriox(env, 4, env->hviprio, val);
 }
 
 static RISCVException write_hviprio1h(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     return write_hvipriox(env, 4, env->hviprio, val);
 }
 
 static RISCVException read_hviprio2(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     return read_hvipriox(env, 8, env->hviprio, val);
 }
 
 static RISCVException write_hviprio2(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     return write_hvipriox(env, 8, env->hviprio, val);
 }
 
 static RISCVException read_hviprio2h(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     return read_hvipriox(env, 12, env->hviprio, val);
 }
 
 static RISCVException write_hviprio2h(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     return write_hvipriox(env, 12, env->hviprio, val);
 }
 
 /* Virtual CSR Registers */
 static RISCVException read_vsstatus(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->vsstatus;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
-    uint64_t mask = (target_ulong)-1;
+    uint64_t mask = ~0ULL;
     if ((val & VSSTATUS64_UXL) == 0) {
         mask &= ~VSSTATUS64_UXL;
     } else {
@@ -5264,14 +5263,14 @@ static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vstvec(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->vstvec;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vstvec(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
     if ((val & 3) < 2) {
@@ -5283,98 +5282,98 @@ static RISCVException write_vstvec(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vsscratch(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     *val = env->vsscratch;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vsscratch(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     env->vsscratch = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vsepc(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->vsepc;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vsepc(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->vsepc = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vscause(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->vscause;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vscause(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     env->vscause = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vstval(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->vstval;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vstval(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->vstval = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vsatp(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->vsatp;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vsatp(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->vsatp = legalize_xatp(env, env->vsatp, val);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mtval2(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->mtval2;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mtval2(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->mtval2 = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mtinst(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->mtinst;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mtinst(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->mtinst = val;
     return RISCV_EXCP_NONE;
@@ -5382,21 +5381,21 @@ static RISCVException write_mtinst(CPURISCVState *env, int csrno,
 
 /* Physical Memory Protection */
 static RISCVException read_mseccfg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = mseccfg_csr_read(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     mseccfg_csr_write(env, val);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     uint32_t reg_index = csrno - CSR_PMPCFG0;
 
@@ -5405,7 +5404,7 @@ static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     uint32_t reg_index = csrno - CSR_PMPCFG0;
 
@@ -5414,7 +5413,7 @@ static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_pmpaddr(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = pmpaddr_csr_read(env, csrno - CSR_PMPADDR0);
 
@@ -5422,44 +5421,38 @@ static RISCVException read_pmpaddr(CPURISCVState *env, int csrno,
      * For RV64, bits 54-63 of the address registers
      * PMPAADDR(0-63) is a WARL zero field (priv spec,
      * section "Physical Memory Protection CSRs").
-     *
-     * We'll have to add an annoying TARGET_RISCV64 gate
-     * here to avoid complaints about masking bits 0-53
-     * of a potential 32 bit target_ulong '*var'.
      */
-#ifdef TARGET_RISCV64
     if (env->misa_mxl == MXL_RV64
         && csrno >= CSR_PMPADDR0 && csrno <= CSR_PMPADDR63) {
-        target_ulong read_mask = MAKE_64BIT_MASK(0, 54);
+        uint64_t read_mask = MAKE_64BIT_MASK(0, 54);
         *val &= read_mask;
     }
-#endif
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_pmpaddr(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     pmpaddr_csr_write(env, csrno - CSR_PMPADDR0, val);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_tselect(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = tselect_csr_read(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_tselect(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     tselect_csr_write(env, val);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_tdata(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     /* return 0 in tdata1 to end the trigger enumeration */
     if (env->trigger_cur >= env->num_triggers && csrno == CSR_TDATA1) {
@@ -5476,7 +5469,7 @@ static RISCVException read_tdata(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_tdata(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     if (!tdata_available(env, csrno - CSR_TDATA1)) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5487,21 +5480,21 @@ static RISCVException write_tdata(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_tinfo(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = tinfo_csr_read(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mcontext(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->mcontext;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mcontext(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
     int32_t mask;
@@ -5519,58 +5512,58 @@ static RISCVException write_mcontext(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mnscratch(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     *val = env->mnscratch;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mnscratch(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     env->mnscratch = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mnepc(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->mnepc;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mnepc(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->mnepc = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mncause(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->mncause;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mncause(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     env->mncause = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mnstatus(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->mnstatus;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mnstatus(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
-    target_ulong mask = (MNSTATUS_NMIE | MNSTATUS_MNPP);
+    uint64_t mask = (MNSTATUS_NMIE | MNSTATUS_MNPP);
 
     if (riscv_has_ext(env, RVH)) {
         /* Flush tlb on mnstatus fields that affect VM. */
@@ -5590,11 +5583,11 @@ static RISCVException write_mnstatus(CPURISCVState *env, int csrno,
 
 /* Crypto Extension */
 static RISCVException rmw_seed(CPURISCVState *env, int csrno,
-                               target_ulong *ret_value,
-                               target_ulong new_value,
-                               target_ulong write_mask)
+                               uint64_t *ret_value,
+                               uint64_t new_value,
+                               uint64_t write_mask)
 {
-    target_ulong rval;
+    uint64_t rval;
 
     rval = riscv_new_csr_seed(new_value, write_mask);
 
@@ -5678,13 +5671,13 @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
 }
 
 static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
-                                       target_ulong *ret_value,
-                                       target_ulong new_value,
-                                       target_ulong write_mask,
+                                       uint64_t *ret_value,
+                                       uint64_t new_value,
+                                       uint64_t write_mask,
                                        uintptr_t ra)
 {
     RISCVException ret;
-    target_ulong old_value = 0;
+    uint64_t old_value = 0;
 
     /* execute combined read/write operation if it exists */
     if (csr_ops[csrno].op) {
@@ -5727,7 +5720,7 @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
 }
 
 RISCVException riscv_csrr(CPURISCVState *env, int csrno,
-                           target_ulong *ret_value)
+                           uint64_t *ret_value)
 {
     RISCVException ret = riscv_csrrw_check(env, csrno, false);
     if (ret != RISCV_EXCP_NONE) {
@@ -5738,8 +5731,8 @@ RISCVException riscv_csrr(CPURISCVState *env, int csrno,
 }
 
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
-                           target_ulong *ret_value, target_ulong new_value,
-                           target_ulong write_mask, uintptr_t ra)
+                           uint64_t *ret_value, uint64_t new_value,
+                           uint64_t write_mask, uintptr_t ra)
 {
     RISCVException ret = riscv_csrrw_check(env, csrno, true);
     if (ret != RISCV_EXCP_NONE) {
@@ -5751,14 +5744,13 @@ RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
 
 RISCVException riscv_csr_write_i64(CPURISCVState *env, int csrno, uint64_t val)
 {
-    return riscv_csrrw(env, csrno, NULL, val,
-                       MAKE_64BIT_MASK(0, TARGET_LONG_BITS), 0);
+    return riscv_csrrw(env, csrno, NULL, val, ~0ULL, 0);
 }
 
 RISCVException riscv_csr_read_i64(CPURISCVState *env, int csrno, uint64_t *res)
 {
     RISCVException ret;
-    target_ulong val = 0;
+    uint64_t val = 0;
     ret = riscv_csrr(env, csrno, &val);
     *res = val;
     return ret;
@@ -5826,7 +5818,7 @@ RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
      * significant), for those, this fallback is correctly handling the
      * accesses
      */
-    target_ulong old_value;
+    uint64_t old_value;
     ret = riscv_csrrw_do64(env, csrno, &old_value, 0, 0, 0);
     if (ret == RISCV_EXCP_NONE && ret_value) {
         *ret_value = int128_make64(old_value);
@@ -5857,7 +5849,7 @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
      * significant), for those, this fallback is correctly handling the
      * accesses
      */
-    target_ulong old_value;
+    uint64_t old_value;
     ret = riscv_csrrw_do64(env, csrno, &old_value,
                            int128_getlo(new_value),
                            int128_getlo(write_mask), ra);
@@ -5872,9 +5864,9 @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
  * riscv_csrrw call and clear it after the call.
  */
 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
-                                 target_ulong *ret_value,
-                                 target_ulong new_value,
-                                 target_ulong write_mask)
+                                 uint64_t *ret_value,
+                                 uint64_t new_value,
+                                 uint64_t write_mask)
 {
     RISCVException ret;
 #if !defined(CONFIG_USER_ONLY)
@@ -5892,14 +5884,14 @@ RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_jvt(CPURISCVState *env, int csrno,
-                               target_ulong *val)
+                               uint64_t *val)
 {
     *val = env->jvt;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_jvt(CPURISCVState *env, int csrno,
-                                target_ulong val, uintptr_t ra)
+                                uint64_t val, uintptr_t ra)
 {
     env->jvt = val;
     return RISCV_EXCP_NONE;
diff --git a/target/riscv/tcg/debug.c b/target/riscv/tcg/debug.c
index 90172298ce..142d912b5e 100644
--- a/target/riscv/tcg/debug.c
+++ b/target/riscv/tcg/debug.c
@@ -171,12 +171,12 @@ bool tdata_available(CPURISCVState *env, int tdata_index)
     return tdata_mapping[trigger_type][tdata_index];
 }
 
-target_ulong tselect_csr_read(CPURISCVState *env)
+uint64_t tselect_csr_read(CPURISCVState *env)
 {
     return env->trigger_cur;
 }
 
-void tselect_csr_write(CPURISCVState *env, target_ulong val)
+void tselect_csr_write(CPURISCVState *env, uint64_t val)
 {
     if (val < env->num_triggers) {
         env->trigger_cur = val;
@@ -898,7 +898,7 @@ static int itrigger_get_adjust_count(CPURISCVState *env)
     return count;
 }
 
-target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
+uint64_t tdata_csr_read(CPURISCVState *env, int tdata_index)
 {
     int trigger_type;
     switch (tdata_index) {
@@ -919,7 +919,7 @@ target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
     }
 }
 
-void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
+void tdata_csr_write(CPURISCVState *env, int tdata_index, uint64_t val)
 {
     int trigger_type;
 
@@ -956,7 +956,7 @@ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
     }
 }
 
-target_ulong tinfo_csr_read(CPURISCVState *env)
+uint64_t tinfo_csr_read(CPURISCVState *env)
 {
     target_ulong val = BIT(TRIGGER_TYPE_AD_MATCH) |
                        BIT(TRIGGER_TYPE_AD_MATCH6);
diff --git a/target/riscv/tcg/mips_csr.c b/target/riscv/tcg/mips_csr.c
index 884030e91d..c239eceddc 100644
--- a/target/riscv/tcg/mips_csr.c
+++ b/target/riscv/tcg/mips_csr.c
@@ -56,42 +56,42 @@ static RISCVException any(CPURISCVState *env, int csrno)
 }
 
 static RISCVException read_mipstvec(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = mips_csr_state.tvec;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mipstvec(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     mips_csr_state.tvec = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mipsconfig(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = mips_csr_state.config[csrno - CSR_MIPSCONFIG0];
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mipsconfig(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     mips_csr_state.config[csrno - CSR_MIPSCONFIG0] = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mipspmacfg(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = mips_csr_state.pmacfg[csrno - CSR_MIPSPMACFG0];
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mipspmacfg(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     mips_csr_state.pmacfg[csrno - CSR_MIPSPMACFG0] = val;
     return RISCV_EXCP_NONE;
diff --git a/target/riscv/tcg/op_helper.c b/target/riscv/tcg/op_helper.c
index 3e94005d2b..3f6731202a 100644
--- a/target/riscv/tcg/op_helper.c
+++ b/target/riscv/tcg/op_helper.c
@@ -67,7 +67,7 @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
     }
 
-    target_ulong val = 0;
+    uint64_t val = 0;
     RISCVException ret = riscv_csrr(env, csr, &val);
 
     if (ret != RISCV_EXCP_NONE) {
@@ -78,7 +78,7 @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
 
 void helper_csrw(CPURISCVState *env, int csr, target_ulong src)
 {
-    target_ulong mask = env->xl == MXL_RV32 ? UINT32_MAX : (target_ulong)-1;
+    uint64_t mask = env->xl == MXL_RV32 ? UINT32_MAX : (target_ulong)-1;
     RISCVException ret = riscv_csrrw(env, csr, NULL, src, mask, GETPC());
 
     if (ret != RISCV_EXCP_NONE) {
@@ -89,7 +89,7 @@ void helper_csrw(CPURISCVState *env, int csr, target_ulong src)
 target_ulong helper_csrrw(CPURISCVState *env, int csr,
                           target_ulong src, target_ulong write_mask)
 {
-    target_ulong val = 0;
+    uint64_t val = 0;
     RISCVException ret = riscv_csrrw(env, csr, &val, src, write_mask, GETPC());
 
     if (ret != RISCV_EXCP_NONE) {
diff --git a/target/riscv/tcg/pmp.c b/target/riscv/tcg/pmp.c
index 41b55519a8..99345d63dc 100644
--- a/target/riscv/tcg/pmp.c
+++ b/target/riscv/tcg/pmp.c
@@ -535,7 +535,7 @@ bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
  * Handle a write to a pmpcfg CSR
  */
 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
-                      target_ulong val)
+                      uint64_t val)
 {
     int i;
     uint8_t cfg_val;
@@ -560,11 +560,11 @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
 /*
  * Handle a read from a pmpcfg CSR
  */
-target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
+uint64_t pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
 {
     int i;
-    target_ulong cfg_val = 0;
-    target_ulong val = 0;
+    uint64_t cfg_val = 0;
+    uint64_t val = 0;
     int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 
     for (i = 0; i < pmpcfg_nums; i++) {
@@ -581,7 +581,7 @@ target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
  * Handle a write to a pmpaddr CSR
  */
 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
-                       target_ulong val)
+                       uint64_t val)
 {
     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
     bool is_next_cfg_tor = false;
@@ -630,9 +630,9 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
  * Handle a read from a pmpaddr CSR
  * Change A field of pmpcfg affects the read value of pmpaddr
  */
-target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
+uint64_t pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 {
-    target_ulong val = 0;
+    uint64_t val = 0;
     uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
 
     if (addr_index < pmp_regions) {
diff --git a/target/riscv/tcg/pmu.c b/target/riscv/tcg/pmu.c
index c8acb85df4..48beb569b2 100644
--- a/target/riscv/tcg/pmu.c
+++ b/target/riscv/tcg/pmu.c
@@ -384,10 +384,10 @@ static void pmu_timer_trigger_irq(RISCVCPU *cpu,
         return;
     }
 
-    riscv_pmu_read_ctr(env, (target_ulong *)&curr_ctr_val, false, ctr_idx);
+    riscv_pmu_read_ctr(env, &curr_ctr_val, false, ctr_idx);
     ctr_val = counter->mhpmcounter_val;
     if (riscv_cpu_mxl(env) == MXL_RV32) {
-        riscv_pmu_read_ctr(env, (target_ulong *)&curr_ctrh_val, true, ctr_idx);
+        riscv_pmu_read_ctr(env, &curr_ctrh_val, true, ctr_idx);
         curr_ctr_val = curr_ctr_val | (curr_ctrh_val << 32);
     }
 
diff --git a/target/riscv/tcg/th_csr.c b/target/riscv/tcg/th_csr.c
index e6f642991c..e7cd24ac6d 100644
--- a/target/riscv/tcg/th_csr.c
+++ b/target/riscv/tcg/th_csr.c
@@ -122,7 +122,7 @@ static bool test_thead_mvendorid(RISCVCPU *cpu)
 }
 
 static RISCVException read_th_mxstatus(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     /* We don't set MAEE here, because QEMU does not implement MAEE. */
     *val = TH_MXSTATUS_UCME | TH_MXSTATUS_THEADISAEE;
@@ -130,14 +130,14 @@ static RISCVException read_th_mxstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_unimp_th_csr(CPURISCVState *env, int csrno,
-                                        target_ulong *val)
+                                        uint64_t *val)
 {
     *val = 0;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_th_sxstatus(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     /* We don't set MAEE here, because QEMU does not implement MAEE. */
     *val = TH_SXSTATUS_UCME | TH_SXSTATUS_THEADISAEE;
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index 954dfc10e0..8f95c8f400 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -5,7 +5,6 @@ endif
 riscv_ss.add(files(
   'bitmanip_helper.c',
  'cpu_helper.c',
-  'csr.c',
   'crypto_helper.c',
   'fpu_helper.c',
   'm128_helper.c',
@@ -20,8 +19,18 @@ riscv_ss.add(files(
 
 riscv_system_ss.add(files(
   'debug.c',
-  'mips_csr.c',
   'pmp.c',
+))
+
+
+riscv_user_ss.add(files(
+  'csr.c',
+))
+
+
+riscv_common_system_ss.add(files(
+  'csr.c',
+  'mips_csr.c',
   'pmu.c',
   'th_csr.c',
 ))

-- 
2.52.0

[PATCH 05/18] target/riscv: Widen CSR ops to 64-bit and compile once for system-mode

[Anton Johansson via]

Mostly mechanical change of target_ulong to uint64_t, motivated by the
fact that csr.c compiled with a 64-bit target_ulong already can handle
rv32 CPUs just fine.  If there's any discrepancy between rv32 on
qemu-riscv32 and rv32 on qemu-riscv64 I've failed to take into account
please do let me know.

Aside from minor formatting fixes, masks are sometimes replaced with
~0ULL, such as for write_vsstatus()

-    uint64_t mask = (target_ulong)-1;
+    uint64_t mask = ~0ULL;

this assumes that the behaviour for rv32 on qemu-riscv64 is correct.

Functions in other files containing CSR relevant behaviour are
also updated.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/csr.h       |  35 +-
 target/riscv/tcg/debug.h     |  11 +-
 target/riscv/cpu.c           |  11 +-
 target/riscv/gdbstub.c       |   2 +-
 target/riscv/monitor.c       |   5 +-
 target/riscv/tcg/csr.c       | 736 +++++++++++++++++++++----------------------
 target/riscv/tcg/debug.c     |  10 +-
 target/riscv/tcg/mips_csr.c  |  12 +-
 target/riscv/tcg/op_helper.c |   6 +-
 target/riscv/tcg/pmp.c       |  14 +-
 target/riscv/tcg/pmu.c       |   4 +-
 target/riscv/tcg/th_csr.c    |   6 +-
 target/riscv/tcg/meson.build |  13 +-
 13 files changed, 434 insertions(+), 431 deletions(-)

diff --git a/target/riscv/tcg/csr.h b/target/riscv/tcg/csr.h
index 03f96cce04..c6af3ebe50 100644
--- a/target/riscv/tcg/csr.h
+++ b/target/riscv/tcg/csr.h
@@ -9,31 +9,28 @@
 #ifndef RISCV_CSR_H
 #define RISCV_CSR_H
 
-#include "exec/target_long.h"
-#include "cpu_bits.h"
-
 RISCVException riscv_csrr(CPURISCVState *env, int csrno,
-                          target_ulong *ret_value);
+                          uint64_t *ret_value);
 
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
-                           target_ulong *ret_value, target_ulong new_value,
-                           target_ulong write_mask, uintptr_t ra);
+                           uint64_t *ret_value, uint64_t new_value,
+                           uint64_t write_mask, uintptr_t ra);
 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
-                                 target_ulong *ret_value,
-                                 target_ulong new_value,
-                                 target_ulong write_mask);
+                                 uint64_t *ret_value,
+                                 uint64_t new_value,
+                                 uint64_t write_mask);
 
 typedef RISCVException (*riscv_csr_predicate_fn)(CPURISCVState *env,
                                                  int csrno);
 typedef RISCVException (*riscv_csr_read_fn)(CPURISCVState *env, int csrno,
-                                            target_ulong *ret_value);
+                                            uint64_t *ret_value);
 typedef RISCVException (*riscv_csr_write_fn)(CPURISCVState *env, int csrno,
-                                             target_ulong new_value,
+                                             uint64_t new_value,
                                              uintptr_t ra);
 typedef RISCVException (*riscv_csr_op_fn)(CPURISCVState *env, int csrno,
-                                          target_ulong *ret_value,
-                                          target_ulong new_value,
-                                          target_ulong write_mask);
+                                          uint64_t *ret_value,
+                                          uint64_t new_value,
+                                          uint64_t write_mask);
 
 RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
                                Int128 *ret_value);
@@ -89,18 +86,18 @@ extern const RISCVCSR mips_csr_list[];
 
 /* PMP CSRs, defined in pmp.c */
 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
-                      target_ulong val);
-target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index);
+                      uint64_t val);
+uint64_t pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index);
 
 void mseccfg_csr_write(CPURISCVState *env, uint64_t val);
 uint64_t mseccfg_csr_read(CPURISCVState *env);
 
 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
-                       target_ulong val);
-target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
+                       uint64_t val);
+uint64_t pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index);
 
 /* Used in pmu.c */
-RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
+RISCVException riscv_pmu_read_ctr(CPURISCVState *env, uint64_t *val,
                                   bool upper_half, uint32_t ctr_idx);
 
 #endif /* RISCV_CSR_H */
diff --git a/target/riscv/tcg/debug.h b/target/riscv/tcg/debug.h
index fcd92b768c..5383905b01 100644
--- a/target/riscv/tcg/debug.h
+++ b/target/riscv/tcg/debug.h
@@ -23,7 +23,6 @@
 #define RISCV_DEBUG_H
 
 #include "exec/breakpoint.h"
-#include "exec/target_long.h"
 
 /* register index of tdata CSRs */
 enum {
@@ -139,13 +138,13 @@ enum {
 
 bool tdata_available(CPURISCVState *env, int tdata_index);
 
-target_ulong tselect_csr_read(CPURISCVState *env);
-void tselect_csr_write(CPURISCVState *env, target_ulong val);
+uint64_t tselect_csr_read(CPURISCVState *env);
+void tselect_csr_write(CPURISCVState *env, uint64_t val);
 
-target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index);
-void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val);
+uint64_t tdata_csr_read(CPURISCVState *env, int tdata_index);
+void tdata_csr_write(CPURISCVState *env, int tdata_index, uint64_t val);
 
-target_ulong tinfo_csr_read(CPURISCVState *env);
+uint64_t tinfo_csr_read(CPURISCVState *env);
 
 void riscv_cpu_debug_excp_handler(CPUState *cs);
 bool riscv_cpu_debug_check_breakpoint(CPUState *cs);
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 3356ba61d2..8c8f08bb50 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -17,6 +17,7 @@
  * this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include "cpu_bits.h"
 #include "qemu/osdep.h"
 #include "qemu/qemu-print.h"
 #include "qemu/ctype.h"
@@ -617,16 +618,20 @@ char *riscv_cpu_get_name(RISCVCPU *cpu)
 static void riscv_dump_csr(CPURISCVState *env, int csrno, FILE *f)
 {
 #ifdef CONFIG_TCG
-    target_ulong val = 0;
+    uint64_t val = 0;
+    bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
+    int width = rv32 ? 8 : 16;
+    uint64_t mask = rv32 ? UINT32_MAX : UINT64_MAX;
     RISCVException res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
 
+
     /*
      * Rely on the smode, hmode, etc, predicates within csr.c
      * to do the filtering of the registers that are present.
      */
     if (res == RISCV_EXCP_NONE) {
-        qemu_fprintf(f, " %-13s " TARGET_FMT_lx "\n",
-                     csr_ops[csrno].name, val);
+        qemu_fprintf(f, " %-13s " "%0*" PRIx64 "\n",
+                     csr_ops[csrno].name, width, val & mask);
     }
 #endif
 }
diff --git a/target/riscv/gdbstub.c b/target/riscv/gdbstub.c
index 9abbf5bcdf..6cb905de78 100644
--- a/target/riscv/gdbstub.c
+++ b/target/riscv/gdbstub.c
@@ -171,7 +171,7 @@ static int riscv_gdb_get_csr(CPUState *cs, GByteArray *buf, int n)
     CPURISCVState *env = &cpu->env;
 
     if (n < CSR_TABLE_SIZE) {
-        target_ulong val = 0;
+        uint64_t val = 0;
         int result;
 
         result = riscv_csrrw_debug(env, n, &val, 0, 0);
diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index 7e61ae2a47..fc61638702 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -21,6 +21,7 @@
 #include "qemu/osdep.h"
 #include "qemu/ctype.h"
 #include "qemu/qemu-print.h"
+#include "exec/target_long.h"
 #include "cpu.h"
 #include "target/riscv/tcg/csr.h"
 #include "cpu_bits.h"
@@ -250,7 +251,7 @@ void hmp_info_mem(MonitorHMP *hmp, const QDict *qdict)
 
 #ifdef CONFIG_TCG
 static bool reg_is_ulong_integer(CPURISCVState *env, const char *name,
-                                 target_ulong *val, bool is_gprh)
+                                 uint64_t *val, bool is_gprh)
 {
     const char * const *reg_names;
     uint64_t *vals;
@@ -321,7 +322,7 @@ int riscv_monitor_get_register_legacy(CPUState *cs, const char *name,
 {
     RISCVCPU *hart = RISCV_CPU(cs);
     CPURISCVState *env = cpu_env(cs);
-    target_ulong val = 0;
+    uint64_t val = 0;
     uint64_t val64 = 0;
     int i;
 
diff --git a/target/riscv/tcg/csr.c b/target/riscv/tcg/csr.c
index bd4b6dc114..48b3d28734 100644
--- a/target/riscv/tcg/csr.c
+++ b/target/riscv/tcg/csr.c
@@ -20,21 +20,22 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "qemu/timer.h"
-#include "cpu.h"
+#include "qemu/target-info.h"
+#include "target/riscv/cpu.h"
+#include "target/riscv/internals.h"
+#include "target/riscv/time_helper.h"
 #include "target/riscv/tcg/csr.h"
-#include "tcg/tcg-cpu.h"
-#include "pmu.h"
-#include "time_helper.h"
+#include "target/riscv/tcg/tcg-cpu.h"
+#include "target/riscv/tcg/pmu.h"
+#if !defined(CONFIG_USER_ONLY)
+#include "target/riscv/tcg/debug.h"
+#endif
 #include "exec/cputlb.h"
 #include "exec/icount.h"
 #include "accel/tcg/cpu-loop.h"
 #include "accel/tcg/getpc.h"
 #include "qapi/error.h"
 #include "tcg/insn-start-words.h"
-#include "internals.h"
-#if !defined(CONFIG_USER_ONLY)
-#include "target/riscv/tcg/debug.h"
-#endif
 
 /* CSR function table public API */
 void riscv_get_csr_ops(int csrno, riscv_csr_operations *ops)
@@ -114,7 +115,7 @@ static RISCVException ctr(CPURISCVState *env, int csrno)
 #if !defined(CONFIG_USER_ONLY)
     RISCVCPU *cpu = env_archcpu(env);
     int ctr_index;
-    target_ulong ctr_mask;
+    uint64_t ctr_mask;
     int base_csrno = CSR_CYCLE;
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
 
@@ -867,14 +868,14 @@ static RISCVException seed(CPURISCVState *env, int csrno)
 
 /* zicfiss CSR_SSP read and write */
 static RISCVException read_ssp(CPURISCVState *env, int csrno,
-                               target_ulong *val)
+                               uint64_t *val)
 {
     *val = env->ssp;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_ssp(CPURISCVState *env, int csrno,
-                                target_ulong val, uintptr_t ra)
+                                uint64_t val, uintptr_t ra)
 {
     env->ssp = val;
     return RISCV_EXCP_NONE;
@@ -882,14 +883,14 @@ static RISCVException write_ssp(CPURISCVState *env, int csrno,
 
 /* User Floating-Point CSRs */
 static RISCVException read_fflags(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = riscv_cpu_get_fflags(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_fflags(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVF)) {
@@ -901,14 +902,14 @@ static RISCVException write_fflags(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_frm(CPURISCVState *env, int csrno,
-                               target_ulong *val)
+                               uint64_t *val)
 {
     *val = env->frm;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_frm(CPURISCVState *env, int csrno,
-                                target_ulong val, uintptr_t ra)
+                                uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVF)) {
@@ -920,7 +921,7 @@ static RISCVException write_frm(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_fcsr(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     /*
      * This is an 8-bit operation, fflags make up the lower 5 bits and
@@ -932,7 +933,7 @@ static RISCVException read_fcsr(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_fcsr(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     if (riscv_has_ext(env, RVF)) {
@@ -945,7 +946,7 @@ static RISCVException write_fcsr(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vtype(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     uint64_t vill;
     int xl = env->xl;
@@ -967,33 +968,33 @@ static RISCVException read_vtype(CPURISCVState *env, int csrno,
     default:
         g_assert_not_reached();
     }
-    *val = (target_ulong)vill | env->vtype;
+    *val = (uint64_t)vill | env->vtype;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vl(CPURISCVState *env, int csrno,
-                              target_ulong *val)
+                              uint64_t *val)
 {
     *val = env->vl;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vlenb(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = riscv_cpu_cfg(env)->vlenb;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vxrm(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = env->vxrm;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vxrm(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -1003,14 +1004,14 @@ static RISCVException write_vxrm(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vxsat(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->vxsat & BIT(0);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vxsat(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -1020,14 +1021,14 @@ static RISCVException write_vxsat(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vstart(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->vstart;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vstart(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -1041,14 +1042,14 @@ static RISCVException write_vstart(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vcsr(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = (env->vxrm << VCSR_VXRM_SHIFT) | (env->vxsat << VCSR_VXSAT_SHIFT);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vcsr(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->mstatus |= MSTATUS_VS;
@@ -1060,37 +1061,37 @@ static RISCVException write_vcsr(CPURISCVState *env, int csrno,
 
 #if defined(CONFIG_USER_ONLY)
 /* User Timers and Counters */
-static target_ulong get_ticks(bool shift)
+static uint64_t get_ticks(bool shift)
 {
     int64_t val = cpu_get_host_ticks();
-    target_ulong result = shift ? val >> 32 : val;
+    uint64_t result = shift ? val >> 32 : val;
 
     return result;
 }
 
 static RISCVException read_time(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = cpu_get_host_ticks();
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_timeh(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = cpu_get_host_ticks() >> 32;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_hpmcounter(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = get_ticks(false);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     *val = get_ticks(true);
     return RISCV_EXCP_NONE;
@@ -1099,7 +1100,7 @@ static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
 #else /* CONFIG_USER_ONLY */
 
 static RISCVException read_mcyclecfg(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
     *val = extract64(env->mcyclecfg, 0, rv32 ? 32 : 64);
@@ -1107,7 +1108,7 @@ static RISCVException read_mcyclecfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mcyclecfg(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     uint64_t inh_avail_mask;
 
@@ -1129,16 +1130,16 @@ static RISCVException write_mcyclecfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mcyclecfgh(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = extract64(env->mcyclecfg, 32, 32);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mcyclecfgh(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
-    target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
+    uint64_t inh_avail_mask = (uint64_t)(~MHPMEVENTH_FILTER_MASK |
                                                  MCYCLECFGH_BIT_MINH);
 
     /* Set xINH fields if priv mode supported */
@@ -1154,7 +1155,7 @@ static RISCVException write_mcyclecfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_minstretcfg(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
     *val = extract64(env->minstretcfg, 0, rv32 ? 32 : 64);
@@ -1162,7 +1163,7 @@ static RISCVException read_minstretcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_minstretcfg(CPURISCVState *env, int csrno,
-                                        target_ulong val, uintptr_t ra)
+                                        uint64_t val, uintptr_t ra)
 {
     uint64_t inh_avail_mask;
 
@@ -1182,16 +1183,16 @@ static RISCVException write_minstretcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_minstretcfgh(CPURISCVState *env, int csrno,
-                                        target_ulong *val)
+                                        uint64_t *val)
 {
     *val = extract64(env->minstretcfg, 32, 32);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_minstretcfgh(CPURISCVState *env, int csrno,
-                                         target_ulong val, uintptr_t ra)
+                                         uint64_t val, uintptr_t ra)
 {
-    target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
+    uint64_t inh_avail_mask = (uint64_t)(~MHPMEVENTH_FILTER_MASK |
                                                  MINSTRETCFGH_BIT_MINH);
 
     inh_avail_mask |= riscv_has_ext(env, RVU) ? MINSTRETCFGH_BIT_UINH : 0;
@@ -1207,7 +1208,7 @@ static RISCVException write_minstretcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mhpmevent(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     int evt_index = csrno - CSR_MCOUNTINHIBIT;
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
@@ -1218,7 +1219,7 @@ static RISCVException read_mhpmevent(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mhpmevent(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     int evt_index = csrno - CSR_MCOUNTINHIBIT;
     uint64_t mhpmevt_val;
@@ -1244,7 +1245,7 @@ static RISCVException write_mhpmevent(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mhpmeventh(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
 
@@ -1254,10 +1255,10 @@ static RISCVException read_mhpmeventh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mhpmeventh(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     int evt_index = csrno - CSR_MHPMEVENT3H + 3;
-    target_ulong inh_avail_mask = (target_ulong)(~MHPMEVENTH_FILTER_MASK |
+    uint64_t inh_avail_mask = (uint64_t)(~MHPMEVENTH_FILTER_MASK |
                                                   MHPMEVENTH_BIT_MINH);
 
     inh_avail_mask |= riscv_has_ext(env, RVU) ? MHPMEVENTH_BIT_UINH : 0;
@@ -1329,7 +1330,7 @@ static uint64_t riscv_pmu_ctr_get_fixed_counters_val(CPURISCVState *env,
     return curr_val;
 }
 
-static RISCVException riscv_pmu_write_ctr(CPURISCVState *env, target_ulong val,
+static RISCVException riscv_pmu_write_ctr(CPURISCVState *env, uint64_t val,
                                           uint32_t ctr_idx)
 {
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
@@ -1359,7 +1360,7 @@ static RISCVException riscv_pmu_write_ctr(CPURISCVState *env, target_ulong val,
     return RISCV_EXCP_NONE;
 }
 
-static RISCVException riscv_pmu_write_ctrh(CPURISCVState *env, target_ulong val,
+static RISCVException riscv_pmu_write_ctrh(CPURISCVState *env, uint64_t val,
                                           uint32_t ctr_idx)
 {
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
@@ -1385,7 +1386,7 @@ static RISCVException riscv_pmu_write_ctrh(CPURISCVState *env, target_ulong val,
 }
 
 static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
-                                        target_ulong val, uintptr_t ra)
+                                        uint64_t val, uintptr_t ra)
 {
     int ctr_idx = csrno - CSR_MCYCLE;
 
@@ -1393,14 +1394,14 @@ static RISCVException write_mhpmcounter(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mhpmcounterh(CPURISCVState *env, int csrno,
-                                         target_ulong val, uintptr_t ra)
+                                         uint64_t val, uintptr_t ra)
 {
     int ctr_idx = csrno - CSR_MCYCLEH;
 
     return riscv_pmu_write_ctrh(env, val, ctr_idx);
 }
 
-RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
+RISCVException riscv_pmu_read_ctr(CPURISCVState *env, uint64_t *val,
                                   bool upper_half, uint32_t ctr_idx)
 {
     PMUCTRState *counter = &env->pmu_ctrs[ctr_idx];
@@ -1441,7 +1442,7 @@ RISCVException riscv_pmu_read_ctr(CPURISCVState *env, target_ulong *val,
 }
 
 static RISCVException read_hpmcounter(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     uint16_t ctr_index;
 
@@ -1457,7 +1458,7 @@ static RISCVException read_hpmcounter(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     uint16_t ctr_index;
 
@@ -1473,8 +1474,8 @@ static RISCVException read_hpmcounterh(CPURISCVState *env, int csrno,
 }
 
 static int rmw_cd_mhpmcounter(CPURISCVState *env, int ctr_idx,
-                              target_ulong *val, target_ulong new_val,
-                              target_ulong wr_mask)
+                              uint64_t *val, uint64_t new_val,
+                              uint64_t wr_mask)
 {
     if (wr_mask != 0 && wr_mask != -1) {
         return -EINVAL;
@@ -1492,8 +1493,8 @@ static int rmw_cd_mhpmcounter(CPURISCVState *env, int ctr_idx,
 }
 
 static int rmw_cd_mhpmcounterh(CPURISCVState *env, int ctr_idx,
-                               target_ulong *val, target_ulong new_val,
-                               target_ulong wr_mask)
+                               uint64_t *val, uint64_t new_val,
+                               uint64_t wr_mask)
 {
     if (wr_mask != 0 && wr_mask != -1) {
         return -EINVAL;
@@ -1511,7 +1512,7 @@ static int rmw_cd_mhpmcounterh(CPURISCVState *env, int ctr_idx,
 }
 
 static int rmw_cd_mhpmevent(CPURISCVState *env, int evt_index,
-                            target_ulong *val, target_ulong new_val,
+                            uint64_t *val, uint64_t new_val,
                             uint64_t wr_mask)
 {
     uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
@@ -1539,8 +1540,8 @@ static int rmw_cd_mhpmevent(CPURISCVState *env, int evt_index,
 }
 
 static int rmw_cd_mhpmeventh(CPURISCVState *env, int evt_index,
-                             target_ulong *val, target_ulong new_val,
-                             target_ulong wr_mask)
+                             uint64_t *val, uint64_t new_val,
+                             uint64_t wr_mask)
 {
     uint64_t mhpmevt_val = env->mhpmevent_val[evt_index];
     uint32_t mhpmevth_val = extract64(mhpmevt_val, 32, 32);
@@ -1567,8 +1568,8 @@ static int rmw_cd_mhpmeventh(CPURISCVState *env, int evt_index,
     return 0;
 }
 
-static int rmw_cd_ctr_cfg(CPURISCVState *env, int cfg_index, target_ulong *val,
-                          target_ulong new_val, uint64_t wr_mask)
+static int rmw_cd_ctr_cfg(CPURISCVState *env, int cfg_index, uint64_t *val,
+                          uint64_t new_val, uint64_t wr_mask)
 {
     /*
      * wr_mask is 64-bit so upper 32 bits of mcyclecfg and minstretcfg
@@ -1598,8 +1599,8 @@ static int rmw_cd_ctr_cfg(CPURISCVState *env, int cfg_index, target_ulong *val,
     return 0;
 }
 
-static int rmw_cd_ctr_cfgh(CPURISCVState *env, int cfg_index, target_ulong *val,
-                           target_ulong new_val, target_ulong wr_mask)
+static int rmw_cd_ctr_cfgh(CPURISCVState *env, int cfg_index, uint64_t *val,
+                           uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t cfgh;
 
@@ -1636,7 +1637,7 @@ static int rmw_cd_ctr_cfgh(CPURISCVState *env, int cfg_index, target_ulong *val,
 
 
 static RISCVException read_scountovf(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     int mhpmevt_start = CSR_MHPMEVENT3 - CSR_MCOUNTINHIBIT;
     int i;
@@ -1673,7 +1674,7 @@ static RISCVException read_scountovf(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_time(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
 
@@ -1686,7 +1687,7 @@ static RISCVException read_time(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_timeh(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     uint64_t delta = env->virt_enabled ? env->htimedelta : 0;
 
@@ -1699,7 +1700,7 @@ static RISCVException read_timeh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vstimecmp(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     *val = env->vstimecmp;
 
@@ -1707,7 +1708,7 @@ static RISCVException read_vstimecmp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = env->vstimecmp >> 32;
 
@@ -1715,7 +1716,7 @@ static RISCVException read_vstimecmph(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     if (riscv_cpu_mxl(env) == MXL_RV32) {
         env->vstimecmp = deposit64(env->vstimecmp, 0, 32, (uint64_t)val);
@@ -1730,7 +1731,7 @@ static RISCVException write_vstimecmp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     env->vstimecmp = deposit64(env->vstimecmp, 32, 32, (uint64_t)val);
     riscv_timer_write_timecmp(env, env->vstimer, env->vstimecmp,
@@ -1740,7 +1741,7 @@ static RISCVException write_vstimecmph(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     if (env->virt_enabled) {
         *val = env->vstimecmp;
@@ -1752,7 +1753,7 @@ static RISCVException read_stimecmp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     if (env->virt_enabled) {
         *val = env->vstimecmp >> 32;
@@ -1764,7 +1765,7 @@ static RISCVException read_stimecmph(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     if (env->virt_enabled) {
         if (env->hvictl & HVICTL_VTI) {
@@ -1785,7 +1786,7 @@ static RISCVException write_stimecmp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_stimecmph(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     if (env->virt_enabled) {
         if (env->hvictl & HVICTL_VTI) {
@@ -1836,7 +1837,7 @@ static const uint64_t all_ints = M_MODE_INTERRUPTS | S_MODE_INTERRUPTS |
                          (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) | \
                          (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) | \
                          (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)))
-static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
+static const uint64_t vs_delegable_excps = DELEGABLE_EXCPS &
     ~((1ULL << (RISCV_EXCP_S_ECALL)) |
       (1ULL << (RISCV_EXCP_VS_ECALL)) |
       (1ULL << (RISCV_EXCP_M_ECALL)) |
@@ -1844,7 +1845,7 @@ static const target_ulong vs_delegable_excps = DELEGABLE_EXCPS &
       (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) |
       (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) |
       (1ULL << (RISCV_EXCP_STORE_GUEST_AMO_ACCESS_FAULT)));
-static const target_ulong sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
+static const uint64_t sstatus_v1_10_mask = SSTATUS_SIE | SSTATUS_SPIE |
     SSTATUS_UIE | SSTATUS_UPIE | SSTATUS_SPP | SSTATUS_FS | SSTATUS_XS |
     SSTATUS_SUM | SSTATUS_MXR | SSTATUS_VS;
 
@@ -1876,41 +1877,41 @@ static const uint64_t vsip_writable_mask = MIP_VSSIP | LOCAL_INTERRUPTS;
 
 /* Machine Information Registers */
 static RISCVException read_zero(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = 0;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_ignore(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mvendorid(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     *val = riscv_cpu_cfg(env)->mvendorid;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_marchid(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = riscv_cpu_cfg(env)->marchid;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mimpid(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = riscv_cpu_cfg(env)->mimpid;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mhartid(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->mhartid;
     return RISCV_EXCP_NONE;
@@ -1939,13 +1940,13 @@ static uint64_t add_status_sd(RISCVMXL xl, uint64_t status)
 }
 
 static RISCVException read_mstatus(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus);
     return RISCV_EXCP_NONE;
 }
 
-static bool validate_vm(CPURISCVState *env, target_ulong vm)
+static bool validate_vm(CPURISCVState *env, uint64_t vm)
 {
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32;
     RISCVCPU *cpu = env_archcpu(env);
@@ -1956,10 +1957,10 @@ static bool validate_vm(CPURISCVState *env, target_ulong vm)
     return vm <= satp_mode_supported_max && valid_vm[vm];
 }
 
-static target_ulong legalize_xatp(CPURISCVState *env, target_ulong old_xatp,
-                                  target_ulong val)
+static uint64_t legalize_xatp(CPURISCVState *env, uint64_t old_xatp,
+                              uint64_t val)
 {
-    target_ulong mask;
+    uint64_t mask;
     bool vm;
     if (riscv_cpu_mxl(env) == MXL_RV32) {
         vm = validate_vm(env, get_field(val, SATP32_MODE));
@@ -1982,11 +1983,11 @@ static target_ulong legalize_xatp(CPURISCVState *env, target_ulong old_xatp,
     return old_xatp;
 }
 
-static target_ulong legalize_mpp(CPURISCVState *env, target_ulong old_mpp,
-                                 target_ulong val)
+static uint64_t legalize_mpp(CPURISCVState *env, uint64_t old_mpp,
+                             uint64_t val)
 {
     bool valid = false;
-    target_ulong new_mpp = get_field(val, MSTATUS_MPP);
+    uint64_t new_mpp = get_field(val, MSTATUS_MPP);
 
     switch (new_mpp) {
     case PRV_M:
@@ -2023,7 +2024,7 @@ static uint64_t riscv_write_uxl(CPURISCVState *env, uint64_t val,
 }
 
 static RISCVException write_mstatus(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     uint64_t mstatus = env->mstatus;
     uint64_t mask = 0;
@@ -2099,14 +2100,14 @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mstatush(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->mstatus >> 32;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mstatush(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     uint64_t valh = (uint64_t)val << 32;
     uint64_t mask = 0;
@@ -2138,19 +2139,17 @@ static RISCVException read_misa_i128(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_misa(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
-    target_ulong misa;
+    uint64_t misa;
 
     switch (env->misa_mxl) {
     case MXL_RV32:
-        misa = (target_ulong)MXL_RV32 << 30;
+        misa = (uint64_t)MXL_RV32 << 30;
         break;
-#ifdef TARGET_RISCV64
     case MXL_RV64:
-        misa = (target_ulong)MXL_RV64 << 62;
+        misa = (uint64_t)MXL_RV64 << 62;
         break;
-#endif
     default:
         g_assert_not_reached();
     }
@@ -2159,7 +2158,7 @@ static RISCVException read_misa(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
-static target_ulong get_next_pc(CPURISCVState *env, uintptr_t ra)
+static uint64_t get_next_pc(CPURISCVState *env, uintptr_t ra)
 {
     uint64_t data[INSN_START_WORDS];
 
@@ -2173,7 +2172,7 @@ static target_ulong get_next_pc(CPURISCVState *env, uintptr_t ra)
 }
 
 static RISCVException write_misa(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
     uint32_t orig_misa_ext = env->misa_ext;
@@ -2229,14 +2228,14 @@ static RISCVException write_misa(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_medeleg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->medeleg;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_medeleg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     env->medeleg = (env->medeleg & ~DELEGABLE_EXCPS) | (val & DELEGABLE_EXCPS);
     return RISCV_EXCP_NONE;
@@ -2262,8 +2261,8 @@ static RISCVException rmw_mideleg64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mideleg(CPURISCVState *env, int csrno,
-                                  target_ulong *ret_val,
-                                  target_ulong new_val, target_ulong wr_mask)
+                                  uint64_t *ret_val,
+                                  uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2277,9 +2276,9 @@ static RISCVException rmw_mideleg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_midelegh(CPURISCVState *env, int csrno,
-                                   target_ulong *ret_val,
-                                   target_ulong new_val,
-                                   target_ulong wr_mask)
+                                   uint64_t *ret_val,
+                                   uint64_t new_val,
+                                   uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2313,8 +2312,8 @@ static RISCVException rmw_mie64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mie(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2328,8 +2327,8 @@ static RISCVException rmw_mie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mieh(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2359,8 +2358,8 @@ static RISCVException rmw_mvien64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mvien(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2374,8 +2373,8 @@ static RISCVException rmw_mvien(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mvienh(CPURISCVState *env, int csrno,
-                                target_ulong *ret_val,
-                                target_ulong new_val, target_ulong wr_mask)
+                                uint64_t *ret_val,
+                                uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -2390,7 +2389,7 @@ static RISCVException rmw_mvienh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mtopi(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     int irq;
     uint8_t iprio;
@@ -2452,8 +2451,8 @@ static int csrind_xlate_vs_csrno(CPURISCVState *env, int csrno)
 }
 
 static RISCVException rmw_xiselect(CPURISCVState *env, int csrno,
-                                   target_ulong *val, target_ulong new_val,
-                                   target_ulong wr_mask)
+                                   uint64_t *val, uint64_t new_val,
+                                   uint64_t wr_mask)
 {
     uint16_t *iselect;
     int ret;
@@ -2516,13 +2515,13 @@ static bool xiselect_ctr_range(int csrno, uint16_t isel)
            csrno < CSR_MIREG;
 }
 
-static int rmw_iprio(target_ulong xlen,
+static int rmw_iprio(uint64_t xlen,
                      uint16_t iselect, uint8_t *iprio,
-                     target_ulong *val, target_ulong new_val,
-                     target_ulong wr_mask, int ext_irq_no)
+                     uint64_t *val, uint64_t new_val,
+                     uint64_t wr_mask, int ext_irq_no)
 {
     int i, firq, nirqs;
-    target_ulong old_val;
+    uint64_t old_val;
 
     if (iselect < ISELECT_IPRIO0 || ISELECT_IPRIO15 < iselect) {
         return -EINVAL;
@@ -2536,7 +2535,7 @@ static int rmw_iprio(target_ulong xlen,
 
     old_val = 0;
     for (i = 0; i < nirqs; i++) {
-        old_val |= ((target_ulong)iprio[firq + i]) << (IPRIO_IRQ_BITS * i);
+        old_val |= ((uint64_t)iprio[firq + i]) << (IPRIO_IRQ_BITS * i);
     }
 
     if (val) {
@@ -2561,8 +2560,8 @@ static int rmw_iprio(target_ulong xlen,
     return 0;
 }
 
-static int rmw_ctrsource(CPURISCVState *env, uint16_t isel, target_ulong *val,
-                          target_ulong new_val, target_ulong wr_mask)
+static int rmw_ctrsource(CPURISCVState *env, uint16_t isel, uint64_t *val,
+                         uint64_t new_val, uint64_t wr_mask)
 {
     /*
      * CTR arrays are treated as circular buffers and TOS always points to next
@@ -2600,8 +2599,8 @@ static int rmw_ctrsource(CPURISCVState *env, uint16_t isel, target_ulong *val,
     return 0;
 }
 
-static int rmw_ctrtarget(CPURISCVState *env, uint16_t isel, target_ulong *val,
-                          target_ulong new_val, target_ulong wr_mask)
+static int rmw_ctrtarget(CPURISCVState *env, uint16_t isel, uint64_t *val,
+                          uint64_t new_val, uint64_t wr_mask)
 {
     /*
      * CTR arrays are treated as circular buffers and TOS always points to next
@@ -2639,8 +2638,8 @@ static int rmw_ctrtarget(CPURISCVState *env, uint16_t isel, target_ulong *val,
     return 0;
 }
 
-static int rmw_ctrdata(CPURISCVState *env, uint16_t isel, target_ulong *val,
-                        target_ulong new_val, target_ulong wr_mask)
+static int rmw_ctrdata(CPURISCVState *env, uint16_t isel, uint64_t *val,
+                       uint64_t new_val, uint64_t wr_mask)
 {
     /*
      * CTR arrays are treated as circular buffers and TOS always points to next
@@ -2680,8 +2679,8 @@ static int rmw_ctrdata(CPURISCVState *env, uint16_t isel, target_ulong *val,
 }
 
 static RISCVException rmw_xireg_aia(CPURISCVState *env, int csrno,
-                         uint16_t isel, target_ulong *val,
-                         target_ulong new_val, target_ulong wr_mask)
+                                    uint16_t isel, uint64_t *val,
+                                    uint64_t new_val, uint64_t wr_mask)
 {
     bool virt = false, isel_reserved = false;
     int ret = -EINVAL;
@@ -2765,8 +2764,8 @@ done:
 }
 
 static int rmw_xireg_cd(CPURISCVState *env, int csrno,
-                        uint16_t isel, target_ulong *val,
-                        target_ulong new_val, target_ulong wr_mask)
+                        uint16_t isel, uint64_t *val,
+                        uint64_t new_val, uint64_t wr_mask)
 {
     int ret = -EINVAL;
     uint16_t ctr_index = isel - ISELECT_CD_FIRST;
@@ -2837,8 +2836,8 @@ done:
 }
 
 static int rmw_xireg_ctr(CPURISCVState *env, int csrno,
-                        uint16_t isel, target_ulong *val,
-                        target_ulong new_val, target_ulong wr_mask)
+                         uint16_t isel, uint64_t *val,
+                         uint64_t new_val, uint64_t wr_mask)
 {
     if (!riscv_cpu_cfg(env)->ext_smctr && !riscv_cpu_cfg(env)->ext_ssctr) {
         return -EINVAL;
@@ -2865,8 +2864,8 @@ static int rmw_xireg_ctr(CPURISCVState *env, int csrno,
  * extension using csrind should be implemented here.
  */
 static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
-                              uint16_t isel, target_ulong *val,
-                              target_ulong new_val, target_ulong wr_mask)
+                            uint16_t isel, uint64_t *val,
+                            uint64_t new_val, uint64_t wr_mask)
 {
     bool virt = csrno == CSR_VSIREG ? true : false;
     int ret = -EINVAL;
@@ -2891,8 +2890,8 @@ static int rmw_xireg_csrind(CPURISCVState *env, int csrno,
     return RISCV_EXCP_NONE;
 }
 
-static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
-                      target_ulong new_val, target_ulong wr_mask)
+static int rmw_xiregi(CPURISCVState *env, int csrno, uint64_t *val,
+                      uint64_t new_val, uint64_t wr_mask)
 {
     int ret = -EINVAL;
     uint16_t isel;
@@ -2922,8 +2921,8 @@ static int rmw_xiregi(CPURISCVState *env, int csrno, target_ulong *val,
 }
 
 static RISCVException rmw_xireg(CPURISCVState *env, int csrno,
-                                target_ulong *val, target_ulong new_val,
-                                target_ulong wr_mask)
+                                uint64_t *val, uint64_t new_val,
+                                uint64_t wr_mask)
 {
     int ret = -EINVAL;
     uint16_t isel;
@@ -2971,8 +2970,8 @@ done:
 }
 
 static RISCVException rmw_xtopei(CPURISCVState *env, int csrno,
-                                 target_ulong *val, target_ulong new_val,
-                                 target_ulong wr_mask)
+                                 uint64_t *val, uint64_t new_val,
+                                 uint64_t wr_mask)
 {
     bool virt;
     int ret = -EINVAL;
@@ -3034,14 +3033,14 @@ done:
 }
 
 static RISCVException read_mtvec(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->mtvec;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mtvec(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
     if ((val & 3) < 2) {
@@ -3053,20 +3052,20 @@ static RISCVException write_mtvec(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mcountinhibit(CPURISCVState *env, int csrno,
-                                         target_ulong *val)
+                                         uint64_t *val)
 {
     *val = env->mcountinhibit;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
-                                          target_ulong val, uintptr_t ra)
+                                          uint64_t val, uintptr_t ra)
 {
     int cidx;
     PMUCTRState *counter;
     RISCVCPU *cpu = env_archcpu(env);
     uint32_t present_ctrs = cpu->pmu_avail_ctrs | COUNTEREN_CY | COUNTEREN_IR;
-    target_ulong updated_ctrs = (env->mcountinhibit ^ val) & present_ctrs;
+    uint64_t updated_ctrs = (env->mcountinhibit ^ val) & present_ctrs;
     uint64_t mhpmctr_val, prev_count, curr_count;
 
     /* WARL register - disable unavailable counters; TM bit is always 0 */
@@ -3104,7 +3103,7 @@ static RISCVException write_mcountinhibit(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_scountinhibit(CPURISCVState *env, int csrno,
-                                         target_ulong *val)
+                                         uint64_t *val)
 {
     /* S-mode can only access the bits delegated by M-mode */
     *val = env->mcountinhibit & env->mcounteren;
@@ -3112,20 +3111,20 @@ static RISCVException read_scountinhibit(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_scountinhibit(CPURISCVState *env, int csrno,
-                                          target_ulong val, uintptr_t ra)
+                                          uint64_t val, uintptr_t ra)
 {
     return write_mcountinhibit(env, csrno, val & env->mcounteren, ra);
 }
 
 static RISCVException read_mcounteren(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = env->mcounteren;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mcounteren(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -3152,56 +3151,56 @@ static RISCVException write_mscratch_i128(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mscratch(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->mscratch;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mscratch(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     env->mscratch = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mepc(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = env->mepc & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mepc(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
     env->mepc = val & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mcause(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->mcause;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mcause(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->mcause = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mtval(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->mtval;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mtval(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->mtval = val;
     return RISCV_EXCP_NONE;
@@ -3209,16 +3208,16 @@ static RISCVException write_mtval(CPURISCVState *env, int csrno,
 
 /* Execution environment configuration setup */
 static RISCVException read_menvcfg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->menvcfg;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra);
+                                    uint64_t val, uintptr_t ra);
 static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = MENVCFG_FIOM | MENVCFG_CBIE | MENVCFG_CBCFE |
@@ -3270,16 +3269,16 @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_menvcfgh(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->menvcfg >> 32;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra);
+                                     uint64_t val, uintptr_t ra);
 static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) |
@@ -3309,7 +3308,7 @@ static RISCVException write_menvcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     RISCVException ret;
 
@@ -3323,7 +3322,7 @@ static RISCVException read_senvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     uint64_t mask = SENVCFG_FIOM | SENVCFG_CBIE | SENVCFG_CBCFE | SENVCFG_CBZE;
     RISCVException ret;
@@ -3359,7 +3358,7 @@ static RISCVException write_senvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     RISCVException ret;
 
@@ -3380,7 +3379,7 @@ static RISCVException read_henvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = HENVCFG_FIOM | HENVCFG_CBIE | HENVCFG_CBCFE | HENVCFG_CBZE;
@@ -3443,7 +3442,7 @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     RISCVException ret;
 
@@ -3458,7 +3457,7 @@ static RISCVException read_henvcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     const RISCVCPUConfig *cfg = riscv_cpu_cfg(env);
     uint64_t mask = env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE |
@@ -3490,7 +3489,7 @@ static RISCVException write_henvcfgh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mstateen(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->mstateen[csrno - CSR_MSTATEEN0];
 
@@ -3498,7 +3497,7 @@ static RISCVException read_mstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen(CPURISCVState *env, int csrno,
-                                     uint64_t wr_mask, target_ulong new_val)
+                                     uint64_t wr_mask, uint64_t new_val)
 {
     uint64_t *reg;
 
@@ -3509,7 +3508,7 @@ static RISCVException write_mstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
-                                      target_ulong new_val, uintptr_t ra)
+                                      uint64_t new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
     if (!riscv_has_ext(env, RVF)) {
@@ -3545,13 +3544,13 @@ static RISCVException write_mstateen0(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen_1_3(CPURISCVState *env, int csrno,
-                                         target_ulong new_val, uintptr_t ra)
+                                         uint64_t new_val, uintptr_t ra)
 {
     return write_mstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
 
 static RISCVException read_mstateenh(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     *val = env->mstateen[csrno - CSR_MSTATEEN0H] >> 32;
 
@@ -3559,7 +3558,7 @@ static RISCVException read_mstateenh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
-                                      uint64_t wr_mask, target_ulong new_val)
+                                      uint64_t wr_mask, uint64_t new_val)
 {
     uint64_t *reg, val;
 
@@ -3572,7 +3571,7 @@ static RISCVException write_mstateenh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
-                                       target_ulong new_val, uintptr_t ra)
+                                       uint64_t new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
@@ -3602,13 +3601,13 @@ static RISCVException write_mstateen0h(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_mstateenh_1_3(CPURISCVState *env, int csrno,
-                                          target_ulong new_val, uintptr_t ra)
+                                          uint64_t new_val, uintptr_t ra)
 {
     return write_mstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
 
 static RISCVException read_hstateen(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     int index = csrno - CSR_HSTATEEN0;
 
@@ -3618,7 +3617,7 @@ static RISCVException read_hstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen(CPURISCVState *env, int csrno,
-                                     uint64_t mask, target_ulong new_val)
+                                     uint64_t mask, uint64_t new_val)
 {
     int index = csrno - CSR_HSTATEEN0;
     uint64_t *reg, wr_mask;
@@ -3631,7 +3630,7 @@ static RISCVException write_hstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
-                                      target_ulong new_val, uintptr_t ra)
+                                      uint64_t new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
@@ -3664,13 +3663,13 @@ static RISCVException write_hstateen0(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen_1_3(CPURISCVState *env, int csrno,
-                                         target_ulong new_val, uintptr_t ra)
+                                         uint64_t new_val, uintptr_t ra)
 {
     return write_hstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
 
 static RISCVException read_hstateenh(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     int index = csrno - CSR_HSTATEEN0H;
 
@@ -3680,7 +3679,7 @@ static RISCVException read_hstateenh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
-                                      uint64_t mask, target_ulong new_val)
+                                      uint64_t mask, uint64_t new_val)
 {
     int index = csrno - CSR_HSTATEEN0H;
     uint64_t *reg, wr_mask, val;
@@ -3695,7 +3694,7 @@ static RISCVException write_hstateenh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
-                                       target_ulong new_val, uintptr_t ra)
+                                       uint64_t new_val, uintptr_t ra)
 {
     uint64_t wr_mask = SMSTATEEN_STATEEN | SMSTATEEN0_HSENVCFG;
 
@@ -3721,13 +3720,13 @@ static RISCVException write_hstateen0h(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstateenh_1_3(CPURISCVState *env, int csrno,
-                                          target_ulong new_val, uintptr_t ra)
+                                          uint64_t new_val, uintptr_t ra)
 {
     return write_hstateenh(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
 
 static RISCVException read_sstateen(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     bool virt = env->virt_enabled;
     int index = csrno - CSR_SSTATEEN0;
@@ -3741,7 +3740,7 @@ static RISCVException read_sstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstateen(CPURISCVState *env, int csrno,
-                                     uint64_t mask, target_ulong new_val)
+                                     uint64_t mask, uint64_t new_val)
 {
     bool virt = env->virt_enabled;
     int index = csrno - CSR_SSTATEEN0;
@@ -3760,7 +3759,7 @@ static RISCVException write_sstateen(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
-                                      target_ulong new_val, uintptr_t ra)
+                                      uint64_t new_val, uintptr_t ra)
 {
     uint64_t wr_mask = 0;
 
@@ -3772,7 +3771,7 @@ static RISCVException write_sstateen0(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstateen_1_3(CPURISCVState *env, int csrno,
-                                         target_ulong new_val, uintptr_t ra)
+                                         uint64_t new_val, uintptr_t ra)
 {
     return write_sstateen(env, csrno, SMSTATEEN_STATEEN, new_val);
 }
@@ -3830,8 +3829,8 @@ static RISCVException rmw_mip64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mip(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -3845,8 +3844,8 @@ static RISCVException rmw_mip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_miph(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -3872,11 +3871,11 @@ static RISCVException rmw_miph(CPURISCVState *env, int csrno,
  * mvien[i] are zero but mvip needs to be an alias of mip.
  */
 static RISCVException rmw_mvip64(CPURISCVState *env, int csrno,
-                                uint64_t *ret_val,
-                                uint64_t new_val, uint64_t wr_mask)
+                                 uint64_t *ret_val,
+                                 uint64_t new_val, uint64_t wr_mask)
 {
     RISCVCPU *cpu = env_archcpu(env);
-    target_ulong ret_mip = 0;
+    uint64_t ret_mip = 0;
     RISCVException ret;
     uint64_t old_mvip;
 
@@ -3967,8 +3966,8 @@ static RISCVException rmw_mvip64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mvip(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -3982,8 +3981,8 @@ static RISCVException rmw_mvip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_mviph(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                                uint64_t *ret_val,
+                                uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4019,9 +4018,9 @@ static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_sstatus(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
-    target_ulong mask = (sstatus_v1_10_mask);
+    uint64_t mask = (sstatus_v1_10_mask);
     if (env->xl != MXL_RV32 || env->debugger) {
         mask |= SSTATUS64_UXL;
     }
@@ -4038,9 +4037,9 @@ static RISCVException read_sstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_sstatus(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
-    target_ulong mask = (sstatus_v1_10_mask);
+    uint64_t mask = (sstatus_v1_10_mask);
 
     if (env->xl != MXL_RV32 || env->debugger) {
         if ((val & SSTATUS64_UXL) != 0) {
@@ -4054,7 +4053,7 @@ static RISCVException write_sstatus(CPURISCVState *env, int csrno,
     if (riscv_cpu_cfg(env)->ext_ssdbltrp) {
         mask |= SSTATUS_SDT;
     }
-    target_ulong newval = (env->mstatus & ~mask) | (val & mask);
+    uint64_t newval = (env->mstatus & ~mask) | (val & mask);
     return write_mstatus(env, CSR_MSTATUS, newval, ra);
 }
 
@@ -4098,8 +4097,8 @@ static RISCVException rmw_vsie64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_vsie(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4113,8 +4112,8 @@ static RISCVException rmw_vsie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_vsieh(CPURISCVState *env, int csrno,
-                                target_ulong *ret_val,
-                                target_ulong new_val, target_ulong wr_mask)
+                                uint64_t *ret_val,
+                                uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4169,8 +4168,8 @@ static RISCVException rmw_sie64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_sie(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4184,8 +4183,8 @@ static RISCVException rmw_sie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_sieh(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4200,14 +4199,14 @@ static RISCVException rmw_sieh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_stvec(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->stvec;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_stvec(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
     if ((val & 3) < 2) {
@@ -4219,14 +4218,14 @@ static RISCVException write_stvec(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_scounteren(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = env->scounteren;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_scounteren(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -4253,56 +4252,56 @@ static RISCVException write_sscratch_i128(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_sscratch(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->sscratch;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_sscratch(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     env->sscratch = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_sepc(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     *val = env->sepc & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_sepc(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
     env->sepc = val & get_xepc_mask(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_scause(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->scause;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_scause(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->scause = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_stval(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->stval;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_stval(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->stval = val;
     return RISCV_EXCP_NONE;
@@ -4344,8 +4343,8 @@ static RISCVException rmw_vsip64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_vsip(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4359,8 +4358,8 @@ static RISCVException rmw_vsip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_vsiph(CPURISCVState *env, int csrno,
-                                target_ulong *ret_val,
-                                target_ulong new_val, target_ulong wr_mask)
+                                uint64_t *ret_val,
+                                uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4399,8 +4398,8 @@ static RISCVException rmw_sip64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_sip(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4414,8 +4413,8 @@ static RISCVException rmw_sip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_siph(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4431,7 +4430,7 @@ static RISCVException rmw_siph(CPURISCVState *env, int csrno,
 
 /* Supervisor Protection and Translation */
 static RISCVException read_satp(CPURISCVState *env, int csrno,
-                                target_ulong *val)
+                                uint64_t *val)
 {
     if (!riscv_cpu_cfg(env)->mmu) {
         *val = 0;
@@ -4442,7 +4441,7 @@ static RISCVException read_satp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_satp(CPURISCVState *env, int csrno,
-                                 target_ulong val, uintptr_t ra)
+                                 uint64_t val, uintptr_t ra)
 {
     if (!riscv_cpu_cfg(env)->mmu) {
         return RISCV_EXCP_NONE;
@@ -4453,8 +4452,8 @@ static RISCVException write_satp(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_sctrdepth(CPURISCVState *env, int csrno,
-                                    target_ulong *ret_val,
-                                    target_ulong new_val, target_ulong wr_mask)
+                                    uint64_t *ret_val,
+                                    uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t mask = wr_mask & SCTRDEPTH_MASK;
 
@@ -4483,8 +4482,8 @@ static RISCVException rmw_sctrdepth(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_sctrstatus(CPURISCVState *env, int csrno,
-                                     target_ulong *ret_val,
-                                     target_ulong new_val, target_ulong wr_mask)
+                                     uint64_t *ret_val,
+                                     uint64_t new_val, uint64_t wr_mask)
 {
     uint32_t depth = 16 << get_field(env->sctrdepth, SCTRDEPTH_MASK);
     uint32_t mask = wr_mask & SCTRSTATUS_MASK;
@@ -4502,8 +4501,8 @@ static RISCVException rmw_sctrstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_xctrctl(CPURISCVState *env, int csrno,
-                                    target_ulong *ret_val,
-                                    target_ulong new_val, target_ulong wr_mask)
+                                    uint64_t *ret_val,
+                                    uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t csr_mask, mask = wr_mask;
     uint64_t *ctl_ptr = &env->mctrctl;
@@ -4533,7 +4532,7 @@ static RISCVException rmw_xctrctl(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vstopi(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     int irq, ret;
     uint64_t topei = 0;
@@ -4623,7 +4622,7 @@ static RISCVException read_vstopi(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_stopi(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     int irq;
     uint8_t iprio;
@@ -4651,7 +4650,7 @@ static RISCVException read_stopi(CPURISCVState *env, int csrno,
 
 /* Hypervisor Extensions */
 static RISCVException read_hstatus(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->hstatus;
     if (riscv_cpu_mxl(env) != MXL_RV32) {
@@ -4664,9 +4663,9 @@ static RISCVException read_hstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hstatus(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
-    uint64_t mask = (target_ulong)-1;
+    uint64_t mask = ~0ULL;
     if (!env_archcpu(env)->cfg.ext_svukte) {
         mask &= ~HSTATUS_HUKTE;
     }
@@ -4689,21 +4688,21 @@ static RISCVException write_hstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hedeleg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->hedeleg;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_hedeleg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     env->hedeleg = val & vs_delegable_excps;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_hedelegh(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     RISCVException ret;
     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_P1P13);
@@ -4717,7 +4716,7 @@ static RISCVException read_hedelegh(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hedelegh(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     RISCVException ret;
     ret = smstateen_acc_ok(env, 0, SMSTATEEN0_P1P13);
@@ -4745,8 +4744,8 @@ static RISCVException rmw_hvien64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hvien(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4760,8 +4759,8 @@ static RISCVException rmw_hvien(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hvienh(CPURISCVState *env, int csrno,
-                                   target_ulong *ret_val,
-                                   target_ulong new_val, target_ulong wr_mask)
+                                 uint64_t *ret_val,
+                                 uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4790,8 +4789,8 @@ static RISCVException rmw_hideleg64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hideleg(CPURISCVState *env, int csrno,
-                                  target_ulong *ret_val,
-                                  target_ulong new_val, target_ulong wr_mask)
+                                  uint64_t *ret_val,
+                                  uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4805,8 +4804,8 @@ static RISCVException rmw_hideleg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hidelegh(CPURISCVState *env, int csrno,
-                                   target_ulong *ret_val,
-                                   target_ulong new_val, target_ulong wr_mask)
+                                   uint64_t *ret_val,
+                                   uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4914,8 +4913,8 @@ static RISCVException rmw_hvip64(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hvip(CPURISCVState *env, int csrno,
-                               target_ulong *ret_val,
-                               target_ulong new_val, target_ulong wr_mask)
+                               uint64_t *ret_val,
+                               uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4929,8 +4928,8 @@ static RISCVException rmw_hvip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hviph(CPURISCVState *env, int csrno,
-                                target_ulong *ret_val,
-                                target_ulong new_val, target_ulong wr_mask)
+                                uint64_t *ret_val,
+                                uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4945,8 +4944,8 @@ static RISCVException rmw_hviph(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hip(CPURISCVState *env, int csrno,
-                              target_ulong *ret_value,
-                              target_ulong new_value, target_ulong write_mask)
+                              uint64_t *ret_value,
+                              uint64_t new_value, uint64_t write_mask)
 {
     int ret = rmw_mip(env, csrno, ret_value, new_value,
                       write_mask & hip_writable_mask);
@@ -4958,8 +4957,8 @@ static RISCVException rmw_hip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException rmw_hie(CPURISCVState *env, int csrno,
-                              target_ulong *ret_val,
-                              target_ulong new_val, target_ulong wr_mask)
+                              uint64_t *ret_val,
+                              uint64_t new_val, uint64_t wr_mask)
 {
     uint64_t rval;
     RISCVException ret;
@@ -4973,14 +4972,14 @@ static RISCVException rmw_hie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hcounteren(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = env->hcounteren;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_hcounteren(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     RISCVCPU *cpu = env_archcpu(env);
 
@@ -4991,7 +4990,7 @@ static RISCVException write_hcounteren(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hgeie(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     if (val) {
         *val = env->hgeie;
@@ -5000,7 +4999,7 @@ static RISCVException read_hgeie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_hgeie(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     /* Only GEILEN:1 bits implemented and BIT0 is never implemented */
     val &= ((1ULL << env->geilen) - 1) << 1;
@@ -5012,34 +5011,34 @@ static RISCVException write_hgeie(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_htval(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->htval;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_htval(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->htval = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_htinst(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->htinst;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_htinst(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_hgeip(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     if (val) {
         *val = env->hgeip;
@@ -5048,21 +5047,21 @@ static RISCVException read_hgeip(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hgatp(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->hgatp;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_hgatp(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->hgatp = legalize_xatp(env, env->hgatp, val);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5073,7 +5072,7 @@ static RISCVException read_htimedelta(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5094,7 +5093,7 @@ static RISCVException write_htimedelta(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5105,7 +5104,7 @@ static RISCVException read_htimedeltah(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
-                                        target_ulong val, uintptr_t ra)
+                                        uint64_t val, uintptr_t ra)
 {
     if (!env->rdtime_fn) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5122,21 +5121,21 @@ static RISCVException write_htimedeltah(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_hvictl(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->hvictl;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_hvictl(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->hvictl = val & HVICTL_VALID_MASK;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_hvipriox(CPURISCVState *env, int first_index,
-                         uint8_t *iprio, target_ulong *val)
+                                    uint8_t *iprio, uint64_t *val)
 {
     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
 
@@ -5155,14 +5154,14 @@ static RISCVException read_hvipriox(CPURISCVState *env, int first_index,
         if (rdzero) {
             continue;
         }
-        *val |= ((target_ulong)iprio[irq]) << (i * 8);
+        *val |= ((uint64_t)iprio[irq]) << (i * 8);
     }
 
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_hvipriox(CPURISCVState *env, int first_index,
-                          uint8_t *iprio, target_ulong val)
+                                     uint8_t *iprio, uint64_t val)
 {
     int i, irq, rdzero, num_irqs = 4 * (riscv_cpu_mxl_bits(env) / 32);
 
@@ -5188,65 +5187,65 @@ static RISCVException write_hvipriox(CPURISCVState *env, int first_index,
 }
 
 static RISCVException read_hviprio1(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     return read_hvipriox(env, 0, env->hviprio, val);
 }
 
 static RISCVException write_hviprio1(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     return write_hvipriox(env, 0, env->hviprio, val);
 }
 
 static RISCVException read_hviprio1h(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     return read_hvipriox(env, 4, env->hviprio, val);
 }
 
 static RISCVException write_hviprio1h(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     return write_hvipriox(env, 4, env->hviprio, val);
 }
 
 static RISCVException read_hviprio2(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     return read_hvipriox(env, 8, env->hviprio, val);
 }
 
 static RISCVException write_hviprio2(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     return write_hvipriox(env, 8, env->hviprio, val);
 }
 
 static RISCVException read_hviprio2h(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     return read_hvipriox(env, 12, env->hviprio, val);
 }
 
 static RISCVException write_hviprio2h(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     return write_hvipriox(env, 12, env->hviprio, val);
 }
 
 /* Virtual CSR Registers */
 static RISCVException read_vsstatus(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->vsstatus;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
-    uint64_t mask = (target_ulong)-1;
+    uint64_t mask = ~0ULL;
     if ((val & VSSTATUS64_UXL) == 0) {
         mask &= ~VSSTATUS64_UXL;
     } else {
@@ -5264,14 +5263,14 @@ static RISCVException write_vsstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vstvec(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->vstvec;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vstvec(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     /* bits [1:0] encode mode; 0 = direct, 1 = vectored, 2 >= reserved */
     if ((val & 3) < 2) {
@@ -5283,98 +5282,98 @@ static RISCVException write_vstvec(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_vsscratch(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     *val = env->vsscratch;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vsscratch(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     env->vsscratch = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vsepc(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->vsepc;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vsepc(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->vsepc = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vscause(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->vscause;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vscause(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     env->vscause = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vstval(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->vstval;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vstval(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->vstval = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_vsatp(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->vsatp;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_vsatp(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->vsatp = legalize_xatp(env, env->vsatp, val);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mtval2(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->mtval2;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mtval2(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->mtval2 = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mtinst(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     *val = env->mtinst;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mtinst(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     env->mtinst = val;
     return RISCV_EXCP_NONE;
@@ -5382,21 +5381,21 @@ static RISCVException write_mtinst(CPURISCVState *env, int csrno,
 
 /* Physical Memory Protection */
 static RISCVException read_mseccfg(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = mseccfg_csr_read(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mseccfg(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     mseccfg_csr_write(env, val);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
-                                  target_ulong *val)
+                                  uint64_t *val)
 {
     uint32_t reg_index = csrno - CSR_PMPCFG0;
 
@@ -5405,7 +5404,7 @@ static RISCVException read_pmpcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
-                                   target_ulong val, uintptr_t ra)
+                                   uint64_t val, uintptr_t ra)
 {
     uint32_t reg_index = csrno - CSR_PMPCFG0;
 
@@ -5414,7 +5413,7 @@ static RISCVException write_pmpcfg(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_pmpaddr(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = pmpaddr_csr_read(env, csrno - CSR_PMPADDR0);
 
@@ -5422,44 +5421,38 @@ static RISCVException read_pmpaddr(CPURISCVState *env, int csrno,
      * For RV64, bits 54-63 of the address registers
      * PMPAADDR(0-63) is a WARL zero field (priv spec,
      * section "Physical Memory Protection CSRs").
-     *
-     * We'll have to add an annoying TARGET_RISCV64 gate
-     * here to avoid complaints about masking bits 0-53
-     * of a potential 32 bit target_ulong '*var'.
      */
-#ifdef TARGET_RISCV64
     if (env->misa_mxl == MXL_RV64
         && csrno >= CSR_PMPADDR0 && csrno <= CSR_PMPADDR63) {
-        target_ulong read_mask = MAKE_64BIT_MASK(0, 54);
+        uint64_t read_mask = MAKE_64BIT_MASK(0, 54);
         *val &= read_mask;
     }
-#endif
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_pmpaddr(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     pmpaddr_csr_write(env, csrno - CSR_PMPADDR0, val);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_tselect(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = tselect_csr_read(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_tselect(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     tselect_csr_write(env, val);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_tdata(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     /* return 0 in tdata1 to end the trigger enumeration */
     if (env->trigger_cur >= env->num_triggers && csrno == CSR_TDATA1) {
@@ -5476,7 +5469,7 @@ static RISCVException read_tdata(CPURISCVState *env, int csrno,
 }
 
 static RISCVException write_tdata(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     if (!tdata_available(env, csrno - CSR_TDATA1)) {
         return RISCV_EXCP_ILLEGAL_INST;
@@ -5487,21 +5480,21 @@ static RISCVException write_tdata(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_tinfo(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = tinfo_csr_read(env);
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mcontext(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->mcontext;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mcontext(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     bool rv32 = riscv_cpu_mxl(env) == MXL_RV32 ? true : false;
     int32_t mask;
@@ -5519,58 +5512,58 @@ static RISCVException write_mcontext(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_mnscratch(CPURISCVState *env, int csrno,
-                                     target_ulong *val)
+                                     uint64_t *val)
 {
     *val = env->mnscratch;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mnscratch(CPURISCVState *env, int csrno,
-                                      target_ulong val, uintptr_t ra)
+                                      uint64_t val, uintptr_t ra)
 {
     env->mnscratch = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mnepc(CPURISCVState *env, int csrno,
-                                 target_ulong *val)
+                                 uint64_t *val)
 {
     *val = env->mnepc;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mnepc(CPURISCVState *env, int csrno,
-                                  target_ulong val, uintptr_t ra)
+                                  uint64_t val, uintptr_t ra)
 {
     env->mnepc = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mncause(CPURISCVState *env, int csrno,
-                                   target_ulong *val)
+                                   uint64_t *val)
 {
     *val = env->mncause;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mncause(CPURISCVState *env, int csrno,
-                                    target_ulong val, uintptr_t ra)
+                                    uint64_t val, uintptr_t ra)
 {
     env->mncause = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mnstatus(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = env->mnstatus;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mnstatus(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
-    target_ulong mask = (MNSTATUS_NMIE | MNSTATUS_MNPP);
+    uint64_t mask = (MNSTATUS_NMIE | MNSTATUS_MNPP);
 
     if (riscv_has_ext(env, RVH)) {
         /* Flush tlb on mnstatus fields that affect VM. */
@@ -5590,11 +5583,11 @@ static RISCVException write_mnstatus(CPURISCVState *env, int csrno,
 
 /* Crypto Extension */
 static RISCVException rmw_seed(CPURISCVState *env, int csrno,
-                               target_ulong *ret_value,
-                               target_ulong new_value,
-                               target_ulong write_mask)
+                               uint64_t *ret_value,
+                               uint64_t new_value,
+                               uint64_t write_mask)
 {
-    target_ulong rval;
+    uint64_t rval;
 
     rval = riscv_new_csr_seed(new_value, write_mask);
 
@@ -5678,13 +5671,13 @@ static inline RISCVException riscv_csrrw_check(CPURISCVState *env,
 }
 
 static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
-                                       target_ulong *ret_value,
-                                       target_ulong new_value,
-                                       target_ulong write_mask,
+                                       uint64_t *ret_value,
+                                       uint64_t new_value,
+                                       uint64_t write_mask,
                                        uintptr_t ra)
 {
     RISCVException ret;
-    target_ulong old_value = 0;
+    uint64_t old_value = 0;
 
     /* execute combined read/write operation if it exists */
     if (csr_ops[csrno].op) {
@@ -5727,7 +5720,7 @@ static RISCVException riscv_csrrw_do64(CPURISCVState *env, int csrno,
 }
 
 RISCVException riscv_csrr(CPURISCVState *env, int csrno,
-                           target_ulong *ret_value)
+                           uint64_t *ret_value)
 {
     RISCVException ret = riscv_csrrw_check(env, csrno, false);
     if (ret != RISCV_EXCP_NONE) {
@@ -5738,8 +5731,8 @@ RISCVException riscv_csrr(CPURISCVState *env, int csrno,
 }
 
 RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
-                           target_ulong *ret_value, target_ulong new_value,
-                           target_ulong write_mask, uintptr_t ra)
+                           uint64_t *ret_value, uint64_t new_value,
+                           uint64_t write_mask, uintptr_t ra)
 {
     RISCVException ret = riscv_csrrw_check(env, csrno, true);
     if (ret != RISCV_EXCP_NONE) {
@@ -5751,14 +5744,13 @@ RISCVException riscv_csrrw(CPURISCVState *env, int csrno,
 
 RISCVException riscv_csr_write_i64(CPURISCVState *env, int csrno, uint64_t val)
 {
-    return riscv_csrrw(env, csrno, NULL, val,
-                       MAKE_64BIT_MASK(0, TARGET_LONG_BITS), 0);
+    return riscv_csrrw(env, csrno, NULL, val, ~0ULL, 0);
 }
 
 RISCVException riscv_csr_read_i64(CPURISCVState *env, int csrno, uint64_t *res)
 {
     RISCVException ret;
-    target_ulong val = 0;
+    uint64_t val = 0;
     ret = riscv_csrr(env, csrno, &val);
     *res = val;
     return ret;
@@ -5826,7 +5818,7 @@ RISCVException riscv_csrr_i128(CPURISCVState *env, int csrno,
      * significant), for those, this fallback is correctly handling the
      * accesses
      */
-    target_ulong old_value;
+    uint64_t old_value;
     ret = riscv_csrrw_do64(env, csrno, &old_value, 0, 0, 0);
     if (ret == RISCV_EXCP_NONE && ret_value) {
         *ret_value = int128_make64(old_value);
@@ -5857,7 +5849,7 @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
      * significant), for those, this fallback is correctly handling the
      * accesses
      */
-    target_ulong old_value;
+    uint64_t old_value;
     ret = riscv_csrrw_do64(env, csrno, &old_value,
                            int128_getlo(new_value),
                            int128_getlo(write_mask), ra);
@@ -5872,9 +5864,9 @@ RISCVException riscv_csrrw_i128(CPURISCVState *env, int csrno,
  * riscv_csrrw call and clear it after the call.
  */
 RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
-                                 target_ulong *ret_value,
-                                 target_ulong new_value,
-                                 target_ulong write_mask)
+                                 uint64_t *ret_value,
+                                 uint64_t new_value,
+                                 uint64_t write_mask)
 {
     RISCVException ret;
 #if !defined(CONFIG_USER_ONLY)
@@ -5892,14 +5884,14 @@ RISCVException riscv_csrrw_debug(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_jvt(CPURISCVState *env, int csrno,
-                               target_ulong *val)
+                               uint64_t *val)
 {
     *val = env->jvt;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_jvt(CPURISCVState *env, int csrno,
-                                target_ulong val, uintptr_t ra)
+                                uint64_t val, uintptr_t ra)
 {
     env->jvt = val;
     return RISCV_EXCP_NONE;
diff --git a/target/riscv/tcg/debug.c b/target/riscv/tcg/debug.c
index 90172298ce..142d912b5e 100644
--- a/target/riscv/tcg/debug.c
+++ b/target/riscv/tcg/debug.c
@@ -171,12 +171,12 @@ bool tdata_available(CPURISCVState *env, int tdata_index)
     return tdata_mapping[trigger_type][tdata_index];
 }
 
-target_ulong tselect_csr_read(CPURISCVState *env)
+uint64_t tselect_csr_read(CPURISCVState *env)
 {
     return env->trigger_cur;
 }
 
-void tselect_csr_write(CPURISCVState *env, target_ulong val)
+void tselect_csr_write(CPURISCVState *env, uint64_t val)
 {
     if (val < env->num_triggers) {
         env->trigger_cur = val;
@@ -898,7 +898,7 @@ static int itrigger_get_adjust_count(CPURISCVState *env)
     return count;
 }
 
-target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
+uint64_t tdata_csr_read(CPURISCVState *env, int tdata_index)
 {
     int trigger_type;
     switch (tdata_index) {
@@ -919,7 +919,7 @@ target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
     }
 }
 
-void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
+void tdata_csr_write(CPURISCVState *env, int tdata_index, uint64_t val)
 {
     int trigger_type;
 
@@ -956,7 +956,7 @@ void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
     }
 }
 
-target_ulong tinfo_csr_read(CPURISCVState *env)
+uint64_t tinfo_csr_read(CPURISCVState *env)
 {
     target_ulong val = BIT(TRIGGER_TYPE_AD_MATCH) |
                        BIT(TRIGGER_TYPE_AD_MATCH6);
diff --git a/target/riscv/tcg/mips_csr.c b/target/riscv/tcg/mips_csr.c
index 884030e91d..c239eceddc 100644
--- a/target/riscv/tcg/mips_csr.c
+++ b/target/riscv/tcg/mips_csr.c
@@ -56,42 +56,42 @@ static RISCVException any(CPURISCVState *env, int csrno)
 }
 
 static RISCVException read_mipstvec(CPURISCVState *env, int csrno,
-                                    target_ulong *val)
+                                    uint64_t *val)
 {
     *val = mips_csr_state.tvec;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mipstvec(CPURISCVState *env, int csrno,
-                                     target_ulong val, uintptr_t ra)
+                                     uint64_t val, uintptr_t ra)
 {
     mips_csr_state.tvec = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mipsconfig(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = mips_csr_state.config[csrno - CSR_MIPSCONFIG0];
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mipsconfig(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     mips_csr_state.config[csrno - CSR_MIPSCONFIG0] = val;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_mipspmacfg(CPURISCVState *env, int csrno,
-                                      target_ulong *val)
+                                      uint64_t *val)
 {
     *val = mips_csr_state.pmacfg[csrno - CSR_MIPSPMACFG0];
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException write_mipspmacfg(CPURISCVState *env, int csrno,
-                                       target_ulong val, uintptr_t ra)
+                                       uint64_t val, uintptr_t ra)
 {
     mips_csr_state.pmacfg[csrno - CSR_MIPSPMACFG0] = val;
     return RISCV_EXCP_NONE;
diff --git a/target/riscv/tcg/op_helper.c b/target/riscv/tcg/op_helper.c
index 3e94005d2b..3f6731202a 100644
--- a/target/riscv/tcg/op_helper.c
+++ b/target/riscv/tcg/op_helper.c
@@ -67,7 +67,7 @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
         riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
     }
 
-    target_ulong val = 0;
+    uint64_t val = 0;
     RISCVException ret = riscv_csrr(env, csr, &val);
 
     if (ret != RISCV_EXCP_NONE) {
@@ -78,7 +78,7 @@ target_ulong helper_csrr(CPURISCVState *env, int csr)
 
 void helper_csrw(CPURISCVState *env, int csr, target_ulong src)
 {
-    target_ulong mask = env->xl == MXL_RV32 ? UINT32_MAX : (target_ulong)-1;
+    uint64_t mask = env->xl == MXL_RV32 ? UINT32_MAX : (target_ulong)-1;
     RISCVException ret = riscv_csrrw(env, csr, NULL, src, mask, GETPC());
 
     if (ret != RISCV_EXCP_NONE) {
@@ -89,7 +89,7 @@ void helper_csrw(CPURISCVState *env, int csr, target_ulong src)
 target_ulong helper_csrrw(CPURISCVState *env, int csr,
                           target_ulong src, target_ulong write_mask)
 {
-    target_ulong val = 0;
+    uint64_t val = 0;
     RISCVException ret = riscv_csrrw(env, csr, &val, src, write_mask, GETPC());
 
     if (ret != RISCV_EXCP_NONE) {
diff --git a/target/riscv/tcg/pmp.c b/target/riscv/tcg/pmp.c
index 41b55519a8..99345d63dc 100644
--- a/target/riscv/tcg/pmp.c
+++ b/target/riscv/tcg/pmp.c
@@ -535,7 +535,7 @@ bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr,
  * Handle a write to a pmpcfg CSR
  */
 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
-                      target_ulong val)
+                      uint64_t val)
 {
     int i;
     uint8_t cfg_val;
@@ -560,11 +560,11 @@ void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
 /*
  * Handle a read from a pmpcfg CSR
  */
-target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
+uint64_t pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
 {
     int i;
-    target_ulong cfg_val = 0;
-    target_ulong val = 0;
+    uint64_t cfg_val = 0;
+    uint64_t val = 0;
     int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 
     for (i = 0; i < pmpcfg_nums; i++) {
@@ -581,7 +581,7 @@ target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
  * Handle a write to a pmpaddr CSR
  */
 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
-                       target_ulong val)
+                       uint64_t val)
 {
     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
     bool is_next_cfg_tor = false;
@@ -630,9 +630,9 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
  * Handle a read from a pmpaddr CSR
  * Change A field of pmpcfg affects the read value of pmpaddr
  */
-target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
+uint64_t pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 {
-    target_ulong val = 0;
+    uint64_t val = 0;
     uint8_t pmp_regions = riscv_cpu_cfg(env)->pmp_regions;
 
     if (addr_index < pmp_regions) {
diff --git a/target/riscv/tcg/pmu.c b/target/riscv/tcg/pmu.c
index c8acb85df4..48beb569b2 100644
--- a/target/riscv/tcg/pmu.c
+++ b/target/riscv/tcg/pmu.c
@@ -384,10 +384,10 @@ static void pmu_timer_trigger_irq(RISCVCPU *cpu,
         return;
     }
 
-    riscv_pmu_read_ctr(env, (target_ulong *)&curr_ctr_val, false, ctr_idx);
+    riscv_pmu_read_ctr(env, &curr_ctr_val, false, ctr_idx);
     ctr_val = counter->mhpmcounter_val;
     if (riscv_cpu_mxl(env) == MXL_RV32) {
-        riscv_pmu_read_ctr(env, (target_ulong *)&curr_ctrh_val, true, ctr_idx);
+        riscv_pmu_read_ctr(env, &curr_ctrh_val, true, ctr_idx);
         curr_ctr_val = curr_ctr_val | (curr_ctrh_val << 32);
     }
 
diff --git a/target/riscv/tcg/th_csr.c b/target/riscv/tcg/th_csr.c
index e6f642991c..e7cd24ac6d 100644
--- a/target/riscv/tcg/th_csr.c
+++ b/target/riscv/tcg/th_csr.c
@@ -122,7 +122,7 @@ static bool test_thead_mvendorid(RISCVCPU *cpu)
 }
 
 static RISCVException read_th_mxstatus(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     /* We don't set MAEE here, because QEMU does not implement MAEE. */
     *val = TH_MXSTATUS_UCME | TH_MXSTATUS_THEADISAEE;
@@ -130,14 +130,14 @@ static RISCVException read_th_mxstatus(CPURISCVState *env, int csrno,
 }
 
 static RISCVException read_unimp_th_csr(CPURISCVState *env, int csrno,
-                                        target_ulong *val)
+                                        uint64_t *val)
 {
     *val = 0;
     return RISCV_EXCP_NONE;
 }
 
 static RISCVException read_th_sxstatus(CPURISCVState *env, int csrno,
-                                       target_ulong *val)
+                                       uint64_t *val)
 {
     /* We don't set MAEE here, because QEMU does not implement MAEE. */
     *val = TH_SXSTATUS_UCME | TH_SXSTATUS_THEADISAEE;
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index 954dfc10e0..8f95c8f400 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -5,7 +5,6 @@ endif
 riscv_ss.add(files(
   'bitmanip_helper.c',
  'cpu_helper.c',
-  'csr.c',
   'crypto_helper.c',
   'fpu_helper.c',
   'm128_helper.c',
@@ -20,8 +19,18 @@ riscv_ss.add(files(
 
 riscv_system_ss.add(files(
   'debug.c',
-  'mips_csr.c',
   'pmp.c',
+))
+
+
+riscv_user_ss.add(files(
+  'csr.c',
+))
+
+
+riscv_common_system_ss.add(files(
+  'csr.c',
+  'mips_csr.c',
   'pmu.c',
   'th_csr.c',
 ))

-- 
2.52.0

Re: [PATCH 05/18] target/riscv: Widen CSR ops to 64-bit and compile once for system-mode

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson via qemu development wrote:
> Mostly mechanical change of target_ulong to uint64_t, motivated by the
> fact that csr.c compiled with a 64-bit target_ulong already can handle
> rv32 CPUs just fine.  If there's any discrepancy between rv32 on
> qemu-riscv32 and rv32 on qemu-riscv64 I've failed to take into account
> please do let me know.
> 
> Aside from minor formatting fixes, masks are sometimes replaced with
> ~0ULL, such as for write_vsstatus()
> 
> -    uint64_t mask = (target_ulong)-1;
> +    uint64_t mask = ~0ULL;
> 
> this assumes that the behaviour for rv32 on qemu-riscv64 is correct.
> 
> Functions in other files containing CSR relevant behaviour are
> also updated.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/tcg/csr.h       |  35 +-
>  target/riscv/tcg/debug.h     |  11 +-
>  target/riscv/cpu.c           |  11 +-
>  target/riscv/gdbstub.c       |   2 +-
>  target/riscv/monitor.c       |   5 +-
>  target/riscv/tcg/csr.c       | 736 +++++++++++++++++++++----------------------
>  target/riscv/tcg/debug.c     |  10 +-
>  target/riscv/tcg/mips_csr.c  |  12 +-
>  target/riscv/tcg/op_helper.c |   6 +-
>  target/riscv/tcg/pmp.c       |  14 +-
>  target/riscv/tcg/pmu.c       |   4 +-
>  target/riscv/tcg/th_csr.c    |   6 +-
>  target/riscv/tcg/meson.build |  13 +-
>  13 files changed, 434 insertions(+), 431 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 06/18] target/riscv: Runtime CPU registration

[Anton Johansson via qemu development]

Uses TypeInfo::is_available to determine what CPUs to register,
convenience macros are modified slightly to make this conversion
more ergonomic.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/cpu.c | 156 +++++++++++++++++++++++++++++++++--------------------
 1 file changed, 97 insertions(+), 59 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 8c8f08bb50..cfc80aaaf1 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -23,6 +23,7 @@
 #include "qemu/ctype.h"
 #include "qemu/log.h"
 #include "qemu/guest-random.h"
+#include "qemu/target-info.h"
 #include "cpu.h"
 #include "cpu_vendorid.h"
 #include "target/riscv/tcg/csr.h"
@@ -3259,34 +3260,76 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
 }
 #endif
 
-#define DEFINE_ABSTRACT_RISCV_CPU(type_name, parent_type_name, ...) \
-    {                                                       \
-        .name = (type_name),                                \
-        .parent = (parent_type_name),                       \
-        .abstract = true,                                   \
-        .class_data = &(const RISCVCPUDef) {                \
-             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .cfg.max_satp_mode = -1,                       \
-             __VA_ARGS__                                    \
-        },                                                  \
+/*
+ * Returns true for targets supporting 32-bit CPUs
+ * (32-bit user-/system-mode or 64-bit system-mode).
+ */
+static bool riscv_cpu_supports_rv32(void)
+{
+#ifdef CONFIG_USER_ONLY
+    return target_riscv32();
+#else
+    return true;
+#endif
+}
+
+/*
+ * Returns true for targets supporting 64-bit CPUs
+ * (64-bit user and system-mode).
+ */
+static bool riscv_cpu_supports_rv64(void)
+{
+    return target_riscv64();
+}
+
+/*
+ * Returns true for targets supporting 128-bit CPUs
+ * (64-bit system-mode on TCG).
+ */
+#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
+static bool riscv_cpu_supports_rv128(void)
+{
+    return target_riscv64();
+}
+#endif
+
+#define DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, \
+                              abstract_, avail_fn, ...)    \
+    {                                                      \
+        .name = (type_name),                               \
+        .parent = (parent_type_name),                      \
+        .abstract = (abstract_),                           \
+        .class_data = &(const RISCVCPUDef) {               \
+             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,       \
+             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,       \
+             .cfg.max_satp_mode = -1,                      \
+             __VA_ARGS__                                   \
+        },                                                 \
+        .is_available = (avail_fn),                        \
     }
 
+#define DEFINE_ABSTRACT_RISCV_CPU(type_name, parent_type_name, ...) \
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, true, NULL, __VA_ARGS__)
+
+#define DEFINE_RISCV64_PROFILE_CPU(type_name, parent_type_name, profile_) \
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, false,             \
+                          riscv_cpu_supports_rv64,                        \
+                          .profile = &(profile_))
+
 #define DEFINE_RISCV_CPU(type_name, parent_type_name, ...)  \
-    {                                                       \
-        .name = (type_name),                                \
-        .parent = (parent_type_name),                       \
-        .class_data = &(const RISCVCPUDef) {                \
-             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .cfg.max_satp_mode = -1,                       \
-             __VA_ARGS__                                    \
-        },                                                  \
-    }
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, false, NULL, __VA_ARGS__)
 
-#define DEFINE_PROFILE_CPU(type_name, parent_type_name, profile_)    \
-    DEFINE_RISCV_CPU(type_name, parent_type_name,             \
-        .profile = &(profile_))
+#define DEFINE_RISCV32_CPU(type_name, parent_type_name, ...)  \
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, false, \
+                          riscv_cpu_supports_rv32, __VA_ARGS__)
+
+#define DEFINE_RISCV64_CPU(type_name, parent_type_name, ...)  \
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, false, \
+                          riscv_cpu_supports_rv64, __VA_ARGS__)
+
+#define DEFINE_RISCV128_CPU(type_name, parent_type_name, ...)  \
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, false,  \
+                          riscv_cpu_supports_rv128, __VA_ARGS__)
 
 static void riscv_cpu_instance_finalize(Object *obj)
 {
@@ -3380,9 +3423,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.pmp_regions = 8
     ),
 
-#if defined(TARGET_RISCV32) || \
-    (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE32, TYPE_RISCV_DYNAMIC_CPU,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_BASE32, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV32,
         .misa_mxl_max = MXL_RV32,
 
@@ -3408,7 +3449,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.ext_svvptc = true,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_IBEX, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_IBEX, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVI | RVM | RVC | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3425,37 +3466,35 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.ext_xlrbr = true
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E31, TYPE_RISCV_CPU_SIFIVE_E,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_SIFIVE_E31, TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV32
     ),
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E34, TYPE_RISCV_CPU_SIFIVE_E,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_SIFIVE_E34, TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVF,  /* IMAFCU */
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_U34, TYPE_RISCV_CPU_SIFIVE_U,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_SIFIVE_U34, TYPE_RISCV_CPU_SIFIVE_U,
         .misa_mxl_max = MXL_RV32,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV32I, TYPE_RISCV_BARE_CPU,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_RV32I, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVI
     ),
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV32E, TYPE_RISCV_BARE_CPU,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_RV32E, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVE
     ),
-#endif
 
-#if (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX32, TYPE_RISCV_DYNAMIC_CPU,
+#ifndef CONFIG_USER_ONLY
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_MAX32, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV32,
         .misa_mxl_max = MXL_RV32,
     ),
 #endif
 
-#if defined(TARGET_RISCV64)
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE64, TYPE_RISCV_DYNAMIC_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_BASE64, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV57,
         .misa_mxl_max = MXL_RV64,
 
@@ -3481,19 +3520,19 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.ext_svvptc = true,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E51, TYPE_RISCV_CPU_SIFIVE_E,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_SIFIVE_E51, TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV64
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_U54, TYPE_RISCV_CPU_SIFIVE_U,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_SIFIVE_U54, TYPE_RISCV_CPU_SIFIVE_U,
         .misa_mxl_max = MXL_RV64,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SHAKTI_C, TYPE_RISCV_CPU_SIFIVE_U,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_SHAKTI_C, TYPE_RISCV_CPU_SIFIVE_U,
         .misa_mxl_max = MXL_RV64,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_THEAD_C906, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_THEAD_C906, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_11_0,
@@ -3521,7 +3560,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_THEAD_C908, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_THEAD_C908, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3568,12 +3607,12 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_THEAD_C908V, TYPE_RISCV_CPU_THEAD_C908,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_THEAD_C908V, TYPE_RISCV_CPU_THEAD_C908,
         .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU | RVV,
         .vext_spec = VEXT_VERSION_1_00_0,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_TT_ASCALON, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_TT_ASCALON, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVS | RVU | RVH | RVV,
         .priv_spec = PRIV_VERSION_1_13_0,
@@ -3637,7 +3676,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV57,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_VEYRON_V1, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_VEYRON_V1, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVS | RVU | RVH,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3673,7 +3712,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV48,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVB | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3696,7 +3735,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV39,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_XIANGSHAN_KMH, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_XIANGSHAN_KMH, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVB | RVS | RVU | RVH | RVV,
         .priv_spec = PRIV_VERSION_1_13_0,
@@ -3756,7 +3795,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     ),
 
     /* https://mips.com/products/hardware/p8700/ */
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MIPS_P8700, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_MIPS_P8700, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3778,26 +3817,25 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
-#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE128, TYPE_RISCV_DYNAMIC_CPU,
+#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
+    DEFINE_RISCV128_CPU(TYPE_RISCV_CPU_BASE128, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV57,
         .misa_mxl_max = MXL_RV128,
     ),
-#endif /* CONFIG_TCG */
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV64I, TYPE_RISCV_BARE_CPU,
+#endif
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_RV64I, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVI
     ),
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV64E, TYPE_RISCV_BARE_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_RV64E, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVE
     ),
 
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  TYPE_RISCV_CPU_RV64I,  RVA22U64),
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  TYPE_RISCV_CPU_RV64I,  RVA22S64),
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  TYPE_RISCV_CPU_RV64I,  RVA23U64),
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23S64,  TYPE_RISCV_CPU_RV64I,  RVA23S64),
-#endif /* TARGET_RISCV64 */
+    DEFINE_RISCV64_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  TYPE_RISCV_CPU_RV64I,  RVA22U64),
+    DEFINE_RISCV64_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  TYPE_RISCV_CPU_RV64I,  RVA22S64),
+    DEFINE_RISCV64_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  TYPE_RISCV_CPU_RV64I,  RVA23U64),
+    DEFINE_RISCV64_PROFILE_CPU(TYPE_RISCV_CPU_RVA23S64,  TYPE_RISCV_CPU_RV64I,  RVA23S64),
 };
 
 DEFINE_TYPES(riscv_cpu_type_infos)

-- 
2.52.0

[PATCH 06/18] target/riscv: Runtime CPU registration

[Anton Johansson via]

Uses TypeInfo::is_available to determine what CPUs to register,
convenience macros are modified slightly to make this conversion
more ergonomic.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/cpu.c | 156 +++++++++++++++++++++++++++++++++--------------------
 1 file changed, 97 insertions(+), 59 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 8c8f08bb50..cfc80aaaf1 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -23,6 +23,7 @@
 #include "qemu/ctype.h"
 #include "qemu/log.h"
 #include "qemu/guest-random.h"
+#include "qemu/target-info.h"
 #include "cpu.h"
 #include "cpu_vendorid.h"
 #include "target/riscv/tcg/csr.h"
@@ -3259,34 +3260,76 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
 }
 #endif
 
-#define DEFINE_ABSTRACT_RISCV_CPU(type_name, parent_type_name, ...) \
-    {                                                       \
-        .name = (type_name),                                \
-        .parent = (parent_type_name),                       \
-        .abstract = true,                                   \
-        .class_data = &(const RISCVCPUDef) {                \
-             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .cfg.max_satp_mode = -1,                       \
-             __VA_ARGS__                                    \
-        },                                                  \
+/*
+ * Returns true for targets supporting 32-bit CPUs
+ * (32-bit user-/system-mode or 64-bit system-mode).
+ */
+static bool riscv_cpu_supports_rv32(void)
+{
+#ifdef CONFIG_USER_ONLY
+    return target_riscv32();
+#else
+    return true;
+#endif
+}
+
+/*
+ * Returns true for targets supporting 64-bit CPUs
+ * (64-bit user and system-mode).
+ */
+static bool riscv_cpu_supports_rv64(void)
+{
+    return target_riscv64();
+}
+
+/*
+ * Returns true for targets supporting 128-bit CPUs
+ * (64-bit system-mode on TCG).
+ */
+#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
+static bool riscv_cpu_supports_rv128(void)
+{
+    return target_riscv64();
+}
+#endif
+
+#define DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, \
+                              abstract_, avail_fn, ...)    \
+    {                                                      \
+        .name = (type_name),                               \
+        .parent = (parent_type_name),                      \
+        .abstract = (abstract_),                           \
+        .class_data = &(const RISCVCPUDef) {               \
+             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,       \
+             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,       \
+             .cfg.max_satp_mode = -1,                      \
+             __VA_ARGS__                                   \
+        },                                                 \
+        .is_available = (avail_fn),                        \
     }
 
+#define DEFINE_ABSTRACT_RISCV_CPU(type_name, parent_type_name, ...) \
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, true, NULL, __VA_ARGS__)
+
+#define DEFINE_RISCV64_PROFILE_CPU(type_name, parent_type_name, profile_) \
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, false,             \
+                          riscv_cpu_supports_rv64,                        \
+                          .profile = &(profile_))
+
 #define DEFINE_RISCV_CPU(type_name, parent_type_name, ...)  \
-    {                                                       \
-        .name = (type_name),                                \
-        .parent = (parent_type_name),                       \
-        .class_data = &(const RISCVCPUDef) {                \
-             .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
-             .cfg.max_satp_mode = -1,                       \
-             __VA_ARGS__                                    \
-        },                                                  \
-    }
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, false, NULL, __VA_ARGS__)
 
-#define DEFINE_PROFILE_CPU(type_name, parent_type_name, profile_)    \
-    DEFINE_RISCV_CPU(type_name, parent_type_name,             \
-        .profile = &(profile_))
+#define DEFINE_RISCV32_CPU(type_name, parent_type_name, ...)  \
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, false, \
+                          riscv_cpu_supports_rv32, __VA_ARGS__)
+
+#define DEFINE_RISCV64_CPU(type_name, parent_type_name, ...)  \
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, false, \
+                          riscv_cpu_supports_rv64, __VA_ARGS__)
+
+#define DEFINE_RISCV128_CPU(type_name, parent_type_name, ...)  \
+    DEFINE_RISCV_CPU_FULL(type_name, parent_type_name, false,  \
+                          riscv_cpu_supports_rv128, __VA_ARGS__)
 
 static void riscv_cpu_instance_finalize(Object *obj)
 {
@@ -3380,9 +3423,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.pmp_regions = 8
     ),
 
-#if defined(TARGET_RISCV32) || \
-    (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE32, TYPE_RISCV_DYNAMIC_CPU,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_BASE32, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV32,
         .misa_mxl_max = MXL_RV32,
 
@@ -3408,7 +3449,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.ext_svvptc = true,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_IBEX, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_IBEX, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVI | RVM | RVC | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3425,37 +3466,35 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.ext_xlrbr = true
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E31, TYPE_RISCV_CPU_SIFIVE_E,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_SIFIVE_E31, TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV32
     ),
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E34, TYPE_RISCV_CPU_SIFIVE_E,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_SIFIVE_E34, TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVF,  /* IMAFCU */
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_U34, TYPE_RISCV_CPU_SIFIVE_U,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_SIFIVE_U34, TYPE_RISCV_CPU_SIFIVE_U,
         .misa_mxl_max = MXL_RV32,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV32I, TYPE_RISCV_BARE_CPU,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_RV32I, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVI
     ),
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV32E, TYPE_RISCV_BARE_CPU,
+    DEFINE_RISCV32_CPU(TYPE_RISCV_CPU_RV32E, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVE
     ),
-#endif
 
-#if (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX32, TYPE_RISCV_DYNAMIC_CPU,
+#ifndef CONFIG_USER_ONLY
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_MAX32, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV32,
         .misa_mxl_max = MXL_RV32,
     ),
 #endif
 
-#if defined(TARGET_RISCV64)
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE64, TYPE_RISCV_DYNAMIC_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_BASE64, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV57,
         .misa_mxl_max = MXL_RV64,
 
@@ -3481,19 +3520,19 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.ext_svvptc = true,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E51, TYPE_RISCV_CPU_SIFIVE_E,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_SIFIVE_E51, TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV64
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_U54, TYPE_RISCV_CPU_SIFIVE_U,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_SIFIVE_U54, TYPE_RISCV_CPU_SIFIVE_U,
         .misa_mxl_max = MXL_RV64,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SHAKTI_C, TYPE_RISCV_CPU_SIFIVE_U,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_SHAKTI_C, TYPE_RISCV_CPU_SIFIVE_U,
         .misa_mxl_max = MXL_RV64,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_THEAD_C906, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_THEAD_C906, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_11_0,
@@ -3521,7 +3560,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_THEAD_C908, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_THEAD_C908, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3568,12 +3607,12 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_THEAD_C908V, TYPE_RISCV_CPU_THEAD_C908,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_THEAD_C908V, TYPE_RISCV_CPU_THEAD_C908,
         .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU | RVV,
         .vext_spec = VEXT_VERSION_1_00_0,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_TT_ASCALON, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_TT_ASCALON, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVS | RVU | RVH | RVV,
         .priv_spec = PRIV_VERSION_1_13_0,
@@ -3637,7 +3676,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV57,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_VEYRON_V1, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_VEYRON_V1, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVS | RVU | RVH,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3673,7 +3712,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV48,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVB | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3696,7 +3735,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV39,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_XIANGSHAN_KMH, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_XIANGSHAN_KMH, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVB | RVS | RVU | RVH | RVV,
         .priv_spec = PRIV_VERSION_1_13_0,
@@ -3756,7 +3795,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     ),
 
     /* https://mips.com/products/hardware/p8700/ */
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MIPS_P8700, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_MIPS_P8700, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3778,26 +3817,25 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
-#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE128, TYPE_RISCV_DYNAMIC_CPU,
+#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
+    DEFINE_RISCV128_CPU(TYPE_RISCV_CPU_BASE128, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV57,
         .misa_mxl_max = MXL_RV128,
     ),
-#endif /* CONFIG_TCG */
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV64I, TYPE_RISCV_BARE_CPU,
+#endif
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_RV64I, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVI
     ),
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV64E, TYPE_RISCV_BARE_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_RV64E, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVE
     ),
 
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  TYPE_RISCV_CPU_RV64I,  RVA22U64),
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  TYPE_RISCV_CPU_RV64I,  RVA22S64),
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  TYPE_RISCV_CPU_RV64I,  RVA23U64),
-    DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23S64,  TYPE_RISCV_CPU_RV64I,  RVA23S64),
-#endif /* TARGET_RISCV64 */
+    DEFINE_RISCV64_PROFILE_CPU(TYPE_RISCV_CPU_RVA22U64,  TYPE_RISCV_CPU_RV64I,  RVA22U64),
+    DEFINE_RISCV64_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  TYPE_RISCV_CPU_RV64I,  RVA22S64),
+    DEFINE_RISCV64_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  TYPE_RISCV_CPU_RV64I,  RVA23U64),
+    DEFINE_RISCV64_PROFILE_CPU(TYPE_RISCV_CPU_RVA23S64,  TYPE_RISCV_CPU_RV64I,  RVA23S64),
 };
 
 DEFINE_TYPES(riscv_cpu_type_infos)

-- 
2.52.0

Re: [PATCH 06/18] target/riscv: Runtime CPU registration

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> Uses TypeInfo::is_available to determine what CPUs to register,
> convenience macros are modified slightly to make this conversion
> more ergonomic.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/cpu.c | 156 +++++++++++++++++++++++++++++++++--------------------
>  1 file changed, 97 insertions(+), 59 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Anton Johansson via qemu development]

Moves initialization of satp and mxl fields to a class initialization
function that checks target_riscv64().

Note: I'm aware the current iteration of this patch is rather hacky, I
don't like the introduction of runtime_misa_mxl_max, but I'm keeping
this in to get the series out there and collect feedback.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/cpu.h |  1 +
 target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
 2 files changed, 59 insertions(+), 32 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 3fa322a8a9..0b17fd3db1 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -590,6 +590,7 @@ typedef struct RISCVCPUDef {
     bool bare;
 #if !defined(CONFIG_USER_ONLY)
 #if defined(CONFIG_TCG)
+    bool runtime_misa_mxl_max; /* Skip max mxl base class validation */
     const RISCVCSR *custom_csrs;
 #endif
     uint8_t irq_local_guest_max;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index cfc80aaaf1..39501c6c9f 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -3062,6 +3062,27 @@ static void riscv_cpu_common_class_init(ObjectClass *c, const void *data)
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
+static void riscv_cpu_max_class_init(ObjectClass *c, const void *data)
+{
+    RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
+    bool rv64 = target_riscv64();
+    mcc->def->misa_mxl_max = (rv64) ? MXL_RV64 : MXL_RV32;
+    mcc->def->cfg.max_satp_mode = (rv64) ? VM_1_10_SV57 : VM_1_10_SV32;
+    riscv_cpu_validate_misa_mxl(mcc);
+}
+
+static void riscv_cpu_bare_class_init(ObjectClass *c, const void *data)
+{
+    RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
+    bool rv64 = target_riscv64();
+    /*
+     * Support all available satp_mode settings. By default
+     * only MBARE will be available if the user doesn't enable
+     * a mode manually (see riscv_cpu_satp_mode_finalize()).
+     */
+    mcc->def->cfg.max_satp_mode = (rv64) ? VM_1_10_SV57 : VM_1_10_SV32;
+}
+
 static bool profile_extends(RISCVCPUProfile *trial, RISCVCPUProfile *parent)
 {
     RISCVCPUProfile *curr;
@@ -3113,6 +3134,9 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
     if (data) {
         const RISCVCPUDef *def = data;
         mcc->def->bare |= def->bare;
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+        mcc->def->runtime_misa_mxl_max |= def->runtime_misa_mxl_max;
+#endif
         if (def->profile) {
             assert(profile_extends(def->profile, mcc->def->profile));
             assert(mcc->def->bare);
@@ -3157,9 +3181,11 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
 #endif
     }
 
-    if (!object_class_is_abstract(c)) {
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+    if (!object_class_is_abstract(c) && !mcc->def->runtime_misa_mxl_max) {
         riscv_cpu_validate_misa_mxl(mcc);
     }
+#endif
 }
 
 static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
@@ -3365,41 +3391,41 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     ),
 
     DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_VENDOR_CPU, TYPE_RISCV_CPU),
-    DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_BARE_CPU, TYPE_RISCV_CPU,
-        /*
-         * Bare CPUs do not inherit the timer and performance
-         * counters from the parent class (see riscv_cpu_init()
-         * for info on why the parent enables them).
-         *
-         * Users have to explicitly enable these counters for
-         * bare CPUs.
-         */
-        .bare = true,
 
-        /* Set to QEMU's first supported priv version */
-        .priv_spec = PRIV_VERSION_1_10_0,
+    {
+        .name = TYPE_RISCV_BARE_CPU,
+        .parent = TYPE_RISCV_CPU,
+        .abstract = true,
+        .class_data = &(const RISCVCPUDef) {
+            /* Set to QEMU's first supported priv version */
+            .priv_spec = PRIV_VERSION_1_10_0,
+            .vext_spec = RISCV_PROFILE_ATTR_UNUSED,
 
-        /*
-         * Support all available satp_mode settings. By default
-         * only MBARE will be available if the user doesn't enable
-         * a mode manually (see riscv_cpu_satp_mode_finalize()).
-         */
-#ifdef TARGET_RISCV32
-        .cfg.max_satp_mode = VM_1_10_SV32,
-#else
-        .cfg.max_satp_mode = VM_1_10_SV57,
-#endif
-    ),
+            /*
+             * Bare CPUs do not inherit the timer and performance
+             * counters from the parent class (see riscv_cpu_init()
+             * for info on why the parent enables them).
+             *
+             * Users have to explicitly enable these counters for
+             * bare CPUs.
+             */
+            .bare = true,
+        },
+        .class_init = riscv_cpu_bare_class_init,
+    },
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX, TYPE_RISCV_DYNAMIC_CPU,
-#if defined(TARGET_RISCV32)
-        .misa_mxl_max = MXL_RV32,
-        .cfg.max_satp_mode = VM_1_10_SV32,
-#elif defined(TARGET_RISCV64)
-        .misa_mxl_max = MXL_RV64,
-        .cfg.max_satp_mode = VM_1_10_SV57,
+    {
+        .name = TYPE_RISCV_CPU_MAX,
+        .parent = TYPE_RISCV_DYNAMIC_CPU,
+        .class_data = &(const RISCVCPUDef) {
+            .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
+            .vext_spec = RISCV_PROFILE_ATTR_UNUSED,
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+            .runtime_misa_mxl_max = true,
 #endif
-    ),
+        },
+        .class_init = riscv_cpu_max_class_init,
+    },
 
     DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E, TYPE_RISCV_VENDOR_CPU,
         .misa_ext = RVI | RVM | RVA | RVC | RVU,

-- 
2.52.0

[PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Anton Johansson via]

Moves initialization of satp and mxl fields to a class initialization
function that checks target_riscv64().

Note: I'm aware the current iteration of this patch is rather hacky, I
don't like the introduction of runtime_misa_mxl_max, but I'm keeping
this in to get the series out there and collect feedback.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/cpu.h |  1 +
 target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
 2 files changed, 59 insertions(+), 32 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 3fa322a8a9..0b17fd3db1 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -590,6 +590,7 @@ typedef struct RISCVCPUDef {
     bool bare;
 #if !defined(CONFIG_USER_ONLY)
 #if defined(CONFIG_TCG)
+    bool runtime_misa_mxl_max; /* Skip max mxl base class validation */
     const RISCVCSR *custom_csrs;
 #endif
     uint8_t irq_local_guest_max;
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index cfc80aaaf1..39501c6c9f 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -3062,6 +3062,27 @@ static void riscv_cpu_common_class_init(ObjectClass *c, const void *data)
     device_class_set_props(dc, riscv_cpu_properties);
 }
 
+static void riscv_cpu_max_class_init(ObjectClass *c, const void *data)
+{
+    RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
+    bool rv64 = target_riscv64();
+    mcc->def->misa_mxl_max = (rv64) ? MXL_RV64 : MXL_RV32;
+    mcc->def->cfg.max_satp_mode = (rv64) ? VM_1_10_SV57 : VM_1_10_SV32;
+    riscv_cpu_validate_misa_mxl(mcc);
+}
+
+static void riscv_cpu_bare_class_init(ObjectClass *c, const void *data)
+{
+    RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
+    bool rv64 = target_riscv64();
+    /*
+     * Support all available satp_mode settings. By default
+     * only MBARE will be available if the user doesn't enable
+     * a mode manually (see riscv_cpu_satp_mode_finalize()).
+     */
+    mcc->def->cfg.max_satp_mode = (rv64) ? VM_1_10_SV57 : VM_1_10_SV32;
+}
+
 static bool profile_extends(RISCVCPUProfile *trial, RISCVCPUProfile *parent)
 {
     RISCVCPUProfile *curr;
@@ -3113,6 +3134,9 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
     if (data) {
         const RISCVCPUDef *def = data;
         mcc->def->bare |= def->bare;
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+        mcc->def->runtime_misa_mxl_max |= def->runtime_misa_mxl_max;
+#endif
         if (def->profile) {
             assert(profile_extends(def->profile, mcc->def->profile));
             assert(mcc->def->bare);
@@ -3157,9 +3181,11 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
 #endif
     }
 
-    if (!object_class_is_abstract(c)) {
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+    if (!object_class_is_abstract(c) && !mcc->def->runtime_misa_mxl_max) {
         riscv_cpu_validate_misa_mxl(mcc);
     }
+#endif
 }
 
 static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
@@ -3365,41 +3391,41 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     ),
 
     DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_VENDOR_CPU, TYPE_RISCV_CPU),
-    DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_BARE_CPU, TYPE_RISCV_CPU,
-        /*
-         * Bare CPUs do not inherit the timer and performance
-         * counters from the parent class (see riscv_cpu_init()
-         * for info on why the parent enables them).
-         *
-         * Users have to explicitly enable these counters for
-         * bare CPUs.
-         */
-        .bare = true,
 
-        /* Set to QEMU's first supported priv version */
-        .priv_spec = PRIV_VERSION_1_10_0,
+    {
+        .name = TYPE_RISCV_BARE_CPU,
+        .parent = TYPE_RISCV_CPU,
+        .abstract = true,
+        .class_data = &(const RISCVCPUDef) {
+            /* Set to QEMU's first supported priv version */
+            .priv_spec = PRIV_VERSION_1_10_0,
+            .vext_spec = RISCV_PROFILE_ATTR_UNUSED,
 
-        /*
-         * Support all available satp_mode settings. By default
-         * only MBARE will be available if the user doesn't enable
-         * a mode manually (see riscv_cpu_satp_mode_finalize()).
-         */
-#ifdef TARGET_RISCV32
-        .cfg.max_satp_mode = VM_1_10_SV32,
-#else
-        .cfg.max_satp_mode = VM_1_10_SV57,
-#endif
-    ),
+            /*
+             * Bare CPUs do not inherit the timer and performance
+             * counters from the parent class (see riscv_cpu_init()
+             * for info on why the parent enables them).
+             *
+             * Users have to explicitly enable these counters for
+             * bare CPUs.
+             */
+            .bare = true,
+        },
+        .class_init = riscv_cpu_bare_class_init,
+    },
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX, TYPE_RISCV_DYNAMIC_CPU,
-#if defined(TARGET_RISCV32)
-        .misa_mxl_max = MXL_RV32,
-        .cfg.max_satp_mode = VM_1_10_SV32,
-#elif defined(TARGET_RISCV64)
-        .misa_mxl_max = MXL_RV64,
-        .cfg.max_satp_mode = VM_1_10_SV57,
+    {
+        .name = TYPE_RISCV_CPU_MAX,
+        .parent = TYPE_RISCV_DYNAMIC_CPU,
+        .class_data = &(const RISCVCPUDef) {
+            .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
+            .vext_spec = RISCV_PROFILE_ATTR_UNUSED,
+#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
+            .runtime_misa_mxl_max = true,
 #endif
-    ),
+        },
+        .class_init = riscv_cpu_max_class_init,
+    },
 
     DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E, TYPE_RISCV_VENDOR_CPU,
         .misa_ext = RVI | RVM | RVA | RVC | RVU,

-- 
2.52.0

Re: [PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Yonggang Luo]

[-- Attachment #1: Type: text/plain, Size: 6295 bytes --]

On Thu, Oct 1, 2026 at 11:55 PM Anton Johansson via qemu development
<qemu-devel@nongnu.org> wrote:
>
> Moves initialization of satp and mxl fields to a class initialization
> function that checks target_riscv64().
>
> Note: I'm aware the current iteration of this patch is rather hacky, I
> don't like the introduction of runtime_misa_mxl_max, but I'm keeping
> this in to get the series out there and collect feedback.
>
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/cpu.h |  1 +
>  target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
>  2 files changed, 59 insertions(+), 32 deletions(-)
>
> diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
> index 3fa322a8a9..0b17fd3db1 100644
> --- a/target/riscv/cpu.h
> +++ b/target/riscv/cpu.h
> @@ -590,6 +590,7 @@ typedef struct RISCVCPUDef {
>      bool bare;
>  #if !defined(CONFIG_USER_ONLY)
>  #if defined(CONFIG_TCG)
> +    bool runtime_misa_mxl_max; /* Skip max mxl base class validation */
>      const RISCVCSR *custom_csrs;
>  #endif
>      uint8_t irq_local_guest_max;
> diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
> index cfc80aaaf1..39501c6c9f 100644
> --- a/target/riscv/cpu.c
> +++ b/target/riscv/cpu.c
> @@ -3062,6 +3062,27 @@ static void riscv_cpu_common_class_init(ObjectClass *c, const void *data)
>      device_class_set_props(dc, riscv_cpu_properties);
>  }
>
> +static void riscv_cpu_max_class_init(ObjectClass *c, const void *data)
> +{
> +    RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
> +    bool rv64 = target_riscv64();
> +    mcc->def->misa_mxl_max = (rv64) ? MXL_RV64 : MXL_RV32;
> +    mcc->def->cfg.max_satp_mode = (rv64) ? VM_1_10_SV57 : VM_1_10_SV32;
> +    riscv_cpu_validate_misa_mxl(mcc);
> +}
> +
> +static void riscv_cpu_bare_class_init(ObjectClass *c, const void *data)
> +{
> +    RISCVCPUClass *mcc = RISCV_CPU_CLASS(c);
> +    bool rv64 = target_riscv64();
> +    /*
> +     * Support all available satp_mode settings. By default
> +     * only MBARE will be available if the user doesn't enable
> +     * a mode manually (see riscv_cpu_satp_mode_finalize()).
> +     */
> +    mcc->def->cfg.max_satp_mode = (rv64) ? VM_1_10_SV57 : VM_1_10_SV32;
> +}
> +
>  static bool profile_extends(RISCVCPUProfile *trial, RISCVCPUProfile *parent)
>  {
>      RISCVCPUProfile *curr;
> @@ -3113,6 +3134,9 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
>      if (data) {
>          const RISCVCPUDef *def = data;
>          mcc->def->bare |= def->bare;
> +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
> +        mcc->def->runtime_misa_mxl_max |= def->runtime_misa_mxl_max;
> +#endif
>          if (def->profile) {
>              assert(profile_extends(def->profile, mcc->def->profile));
>              assert(mcc->def->bare);
> @@ -3157,9 +3181,11 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
>  #endif
>      }
>
> -    if (!object_class_is_abstract(c)) {
> +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
> +    if (!object_class_is_abstract(c) && !mcc->def->runtime_misa_mxl_max) {
>          riscv_cpu_validate_misa_mxl(mcc);
>      }
> +#endif
>  }
>
>  static void riscv_isa_string_ext(RISCVCPU *cpu, char **isa_str,
> @@ -3365,41 +3391,41 @@ static const TypeInfo riscv_cpu_type_infos[] = {
>      ),
>
>      DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_VENDOR_CPU, TYPE_RISCV_CPU),
> -    DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_BARE_CPU, TYPE_RISCV_CPU,
> -        /*
> -         * Bare CPUs do not inherit the timer and performance
> -         * counters from the parent class (see riscv_cpu_init()
> -         * for info on why the parent enables them).
> -         *
> -         * Users have to explicitly enable these counters for
> -         * bare CPUs.
> -         */
> -        .bare = true,
>
> -        /* Set to QEMU's first supported priv version */
> -        .priv_spec = PRIV_VERSION_1_10_0,
> +    {
> +        .name = TYPE_RISCV_BARE_CPU,
> +        .parent = TYPE_RISCV_CPU,
> +        .abstract = true,
> +        .class_data = &(const RISCVCPUDef) {
> +            /* Set to QEMU's first supported priv version */
> +            .priv_spec = PRIV_VERSION_1_10_0,
> +            .vext_spec = RISCV_PROFILE_ATTR_UNUSED,
>
> -        /*
> -         * Support all available satp_mode settings. By default
> -         * only MBARE will be available if the user doesn't enable
> -         * a mode manually (see riscv_cpu_satp_mode_finalize()).
> -         */
> -#ifdef TARGET_RISCV32
> -        .cfg.max_satp_mode = VM_1_10_SV32,
> -#else
> -        .cfg.max_satp_mode = VM_1_10_SV57,
> -#endif
> -    ),
> +            /*
> +             * Bare CPUs do not inherit the timer and performance
> +             * counters from the parent class (see riscv_cpu_init()
> +             * for info on why the parent enables them).
> +             *
> +             * Users have to explicitly enable these counters for
> +             * bare CPUs.
> +             */
> +            .bare = true,
> +        },
> +        .class_init = riscv_cpu_bare_class_init,
> +    },
>
> -    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX, TYPE_RISCV_DYNAMIC_CPU,
> -#if defined(TARGET_RISCV32)
> -        .misa_mxl_max = MXL_RV32,
> -        .cfg.max_satp_mode = VM_1_10_SV32,
> -#elif defined(TARGET_RISCV64)
> -        .misa_mxl_max = MXL_RV64,
> -        .cfg.max_satp_mode = VM_1_10_SV57,
> +    {
> +        .name = TYPE_RISCV_CPU_MAX,
> +        .parent = TYPE_RISCV_DYNAMIC_CPU,
> +        .class_data = &(const RISCVCPUDef) {
> +            .priv_spec = RISCV_PROFILE_ATTR_UNUSED,
> +            .vext_spec = RISCV_PROFILE_ATTR_UNUSED,
> +#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
> +            .runtime_misa_mxl_max = true,
>  #endif
> -    ),
> +        },
> +        .class_init = riscv_cpu_max_class_init,
> +    },
>
>      DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E, TYPE_RISCV_VENDOR_CPU,
>          .misa_ext = RVI | RVM | RVA | RVC | RVU,
>
> --
> 2.52.0
>
>

This patch is how I handle these, just for reference, not a review.
-- 
         此致
礼
罗勇刚
Yours
    sincerely,
Yonggang Luo

[-- Attachment #2: 0002-target-riscv-gate-CPU-types-with-TargetInfo.patch --]
[-- Type: text/plain, Size: 14729 bytes --]

From 9764965c0591910d03a7c5c56e666598b600cc73 Mon Sep 17 00:00:00 2001
From: Yonggang Luo <luoyonggang@gmail.com>
Date: Fri, 11 Sep 2026 17:55:19 +0800
Subject: [PATCH 2/2] target/riscv: gate CPU types with TargetInfo

Gate CPU types with TypeInfo.is_available instead of
TARGET_RISCV32/64: DEFINE_RISCV_CPU_AVAIL, DEFINE_RISCV64_CPU, and
DEFINE_RISCV_CPU_32_64SYS.

Add RISCVCPUDef.target_init. max and bare keep RV64/SV57 in the
TypeInfo; on riscv32 the callbacks set RV32/SV32 after merge. Do
not inherit the parent pointer. Validate RV64/128 misa_mxl_max only
when not target_riscv32().

Signed-off-by: Yonggang Luo <luoyonggang@gmail.com>
---
 target/riscv/cpu.c | 131 ++++++++++++++++++++++++++++++---------------
 target/riscv/cpu.h |   7 +++
 2 files changed, 96 insertions(+), 42 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index c6f1739075..ad161d58dc 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1586,18 +1586,37 @@ static const MISAExtInfo misa_ext_info_arr[] = {
     MISA_EXT_INFO(RVB, "b", "Bit manipulation (Zba_Zbb_Zbs)")
 };
 
+static void riscv_max_target_init(RISCVCPUClass *mcc)
+{
+    if (!target_riscv32()) {
+        return;
+    }
+    mcc->def->misa_mxl_max = MXL_RV32;
+    mcc->def->cfg.max_satp_mode = VM_1_10_SV32;
+}
+
+static void riscv_bare_target_init(RISCVCPUClass *mcc)
+{
+    if (!target_riscv32()) {
+        return;
+    }
+    /* BARE has no misa_mxl_max, so the class_base_init satp clamp skips it. */
+    mcc->def->cfg.max_satp_mode = VM_1_10_SV32;
+}
+
 static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
 {
     CPUClass *cc = CPU_CLASS(mcc);
 
     /* Validate that MISA_MXL is set properly. */
     switch (mcc->def->misa_mxl_max) {
-#ifdef TARGET_RISCV64
     case MXL_RV64:
     case MXL_RV128:
+        if (target_riscv32()) {
+            g_assert_not_reached();
+        }
         cc->gdb_core_xml_file = "riscv-64bit-cpu.xml";
         break;
-#endif
     case MXL_RV32:
         cc->gdb_core_xml_file = "riscv-32bit-cpu.xml";
         break;
@@ -3092,6 +3111,8 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
 
     if (pcc->def) {
         mcc->def = g_memdup2(pcc->def, sizeof(*pcc->def));
+        /* TypeInfo supplies target_init; do not inherit the parent pointer. */
+        mcc->def->target_init = NULL;
     } else {
         mcc->def = g_new0(RISCVCPUDef, 1);
     }
@@ -3152,6 +3173,9 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
             mcc->def->custom_csrs = def->custom_csrs;
         }
 #endif
+        if (def->target_init) {
+            def->target_init(mcc);
+        }
     }
 
     if (!object_class_is_abstract(c)) {
@@ -3262,6 +3286,7 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         .name = (type_name),                                \
         .parent = (parent_type_name),                       \
         .abstract = true,                                   \
+        .is_available = target_is_base_riscv,               \
         .class_data = &(const RISCVCPUDef) {                \
              .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
              .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
@@ -3270,10 +3295,11 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         },                                                  \
     }
 
-#define DEFINE_RISCV_CPU(type_name, parent_type_name, ...)  \
+#define DEFINE_RISCV_CPU_AVAIL(type_name, parent_type_name, avail, ...) \
     {                                                       \
         .name = (type_name),                                \
         .parent = (parent_type_name),                       \
+        .is_available = (avail),                            \
         .class_data = &(const RISCVCPUDef) {                \
              .priv_spec = RISCV_PROFILE_ATTR_UNUSED,        \
              .vext_spec = RISCV_PROFILE_ATTR_UNUSED,        \
@@ -3282,8 +3308,37 @@ void riscv_isa_write_fdt(RISCVCPU *cpu, void *fdt, char *nodename)
         },                                                  \
     }
 
+#define DEFINE_RISCV_CPU(type_name, parent_type_name, ...)  \
+    DEFINE_RISCV_CPU_AVAIL(type_name, parent_type_name,     \
+                           target_is_base_riscv, __VA_ARGS__)
+
+#define DEFINE_RISCV64_CPU(type_name, parent_type_name, ...) \
+    DEFINE_RISCV_CPU_AVAIL(type_name, parent_type_name,     \
+                           target_is_riscv64, __VA_ARGS__)
+
+/*
+ * Original:
+ *   #if defined(TARGET_RISCV32) || \
+ *       (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
+ *
+ * RV32 models on every riscv32 binary, and on system riscv64
+ * (-cpu rv32 / e31 / ibex). Not linux-user riscv64.
+ */
+static bool riscv32_64sys_available(const TargetInfo *ti)
+{
+#ifdef CONFIG_USER_ONLY
+    return target_is_riscv32(ti);
+#else
+    return target_is_base_riscv(ti);
+#endif
+}
+
+#define DEFINE_RISCV_CPU_32_64SYS(type_name, parent_type_name, ...) \
+    DEFINE_RISCV_CPU_AVAIL(type_name, parent_type_name,     \
+                           riscv32_64sys_available, __VA_ARGS__)
+
 #define DEFINE_PROFILE_CPU(type_name, parent_type_name, profile_)    \
-    DEFINE_RISCV_CPU(type_name, parent_type_name,             \
+    DEFINE_RISCV64_CPU(type_name, parent_type_name,             \
         .profile = &(profile_))
 
 static void riscv_cpu_instance_finalize(Object *obj)
@@ -3311,6 +3366,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .class_size = sizeof(RISCVCPUClass),
         .class_init = riscv_cpu_common_class_init,
         .class_base_init = riscv_cpu_class_base_init,
+        .is_available = target_is_base_riscv,
     },
 
     DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_DYNAMIC_CPU, TYPE_RISCV_CPU,
@@ -3339,21 +3395,14 @@ static const TypeInfo riscv_cpu_type_infos[] = {
          * only MBARE will be available if the user doesn't enable
          * a mode manually (see riscv_cpu_satp_mode_finalize()).
          */
-#ifdef TARGET_RISCV32
-        .cfg.max_satp_mode = VM_1_10_SV32,
-#else
         .cfg.max_satp_mode = VM_1_10_SV57,
-#endif
+        .target_init = riscv_bare_target_init,
     ),
 
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX, TYPE_RISCV_DYNAMIC_CPU,
-#if defined(TARGET_RISCV32)
-        .misa_mxl_max = MXL_RV32,
-        .cfg.max_satp_mode = VM_1_10_SV32,
-#elif defined(TARGET_RISCV64)
         .misa_mxl_max = MXL_RV64,
         .cfg.max_satp_mode = VM_1_10_SV57,
-#endif
+        .target_init = riscv_max_target_init,
     ),
 
     DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E, TYPE_RISCV_VENDOR_CPU,
@@ -3378,9 +3427,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.pmp_regions = 8
     ),
 
-#if defined(TARGET_RISCV32) || \
-    (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE32, TYPE_RISCV_DYNAMIC_CPU,
+    DEFINE_RISCV_CPU_32_64SYS(TYPE_RISCV_CPU_BASE32, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV32,
         .misa_mxl_max = MXL_RV32,
 
@@ -3406,7 +3453,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.ext_svvptc = true,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_IBEX, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV_CPU_32_64SYS(TYPE_RISCV_CPU_IBEX, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVI | RVM | RVC | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3423,37 +3470,38 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.ext_xlrbr = true
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E31, TYPE_RISCV_CPU_SIFIVE_E,
+    DEFINE_RISCV_CPU_32_64SYS(TYPE_RISCV_CPU_SIFIVE_E31,
+                              TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV32
     ),
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E34, TYPE_RISCV_CPU_SIFIVE_E,
+    DEFINE_RISCV_CPU_32_64SYS(TYPE_RISCV_CPU_SIFIVE_E34,
+                              TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVF,  /* IMAFCU */
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_U34, TYPE_RISCV_CPU_SIFIVE_U,
+    DEFINE_RISCV_CPU_32_64SYS(TYPE_RISCV_CPU_SIFIVE_U34,
+                              TYPE_RISCV_CPU_SIFIVE_U,
         .misa_mxl_max = MXL_RV32,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV32I, TYPE_RISCV_BARE_CPU,
+    DEFINE_RISCV_CPU_32_64SYS(TYPE_RISCV_CPU_RV32I, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVI
     ),
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV32E, TYPE_RISCV_BARE_CPU,
+    DEFINE_RISCV_CPU_32_64SYS(TYPE_RISCV_CPU_RV32E, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV32,
         .misa_ext = RVE
     ),
-#endif
 
-#if (defined(TARGET_RISCV64) && !defined(CONFIG_USER_ONLY))
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX32, TYPE_RISCV_DYNAMIC_CPU,
+#ifndef CONFIG_USER_ONLY
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_MAX32, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV32,
         .misa_mxl_max = MXL_RV32,
     ),
 #endif
 
-#if defined(TARGET_RISCV64)
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE64, TYPE_RISCV_DYNAMIC_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_BASE64, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV57,
         .misa_mxl_max = MXL_RV64,
 
@@ -3479,19 +3527,19 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.ext_svvptc = true,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E51, TYPE_RISCV_CPU_SIFIVE_E,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_SIFIVE_E51, TYPE_RISCV_CPU_SIFIVE_E,
         .misa_mxl_max = MXL_RV64
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_U54, TYPE_RISCV_CPU_SIFIVE_U,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_SIFIVE_U54, TYPE_RISCV_CPU_SIFIVE_U,
         .misa_mxl_max = MXL_RV64,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_SHAKTI_C, TYPE_RISCV_CPU_SIFIVE_U,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_SHAKTI_C, TYPE_RISCV_CPU_SIFIVE_U,
         .misa_mxl_max = MXL_RV64,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_THEAD_C906, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_THEAD_C906, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_11_0,
@@ -3519,7 +3567,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_THEAD_C908, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_THEAD_C908, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3566,12 +3614,12 @@ static const TypeInfo riscv_cpu_type_infos[] = {
 #endif
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_THEAD_C908V, TYPE_RISCV_CPU_THEAD_C908,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_THEAD_C908V, TYPE_RISCV_CPU_THEAD_C908,
         .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU | RVV,
         .vext_spec = VEXT_VERSION_1_00_0,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_TT_ASCALON, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_TT_ASCALON, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVS | RVU | RVH | RVV,
         .priv_spec = PRIV_VERSION_1_13_0,
@@ -3635,7 +3683,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV57,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_VEYRON_V1, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_VEYRON_V1, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVS | RVU | RVH,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3671,7 +3719,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV48,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_XIANGSHAN_NANHU, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVB | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3694,7 +3742,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
         .cfg.max_satp_mode = VM_1_10_SV39,
     ),
 
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_XIANGSHAN_KMH, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_XIANGSHAN_KMH, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVG | RVC | RVB | RVS | RVU | RVH | RVV,
         .priv_spec = PRIV_VERSION_1_13_0,
@@ -3754,7 +3802,7 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     ),
 
     /* https://mips.com/products/hardware/p8700/ */
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MIPS_P8700, TYPE_RISCV_VENDOR_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_MIPS_P8700, TYPE_RISCV_VENDOR_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVI | RVM | RVA | RVF | RVD | RVC | RVS | RVU,
         .priv_spec = PRIV_VERSION_1_12_0,
@@ -3777,16 +3825,16 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     ),
 
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_BASE128, TYPE_RISCV_DYNAMIC_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_BASE128, TYPE_RISCV_DYNAMIC_CPU,
         .cfg.max_satp_mode = VM_1_10_SV57,
         .misa_mxl_max = MXL_RV128,
     ),
 #endif /* CONFIG_TCG */
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV64I, TYPE_RISCV_BARE_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_RV64I, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVI
     ),
-    DEFINE_RISCV_CPU(TYPE_RISCV_CPU_RV64E, TYPE_RISCV_BARE_CPU,
+    DEFINE_RISCV64_CPU(TYPE_RISCV_CPU_RV64E, TYPE_RISCV_BARE_CPU,
         .misa_mxl_max = MXL_RV64,
         .misa_ext = RVE
     ),
@@ -3795,7 +3843,6 @@ static const TypeInfo riscv_cpu_type_infos[] = {
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA22S64,  TYPE_RISCV_CPU_RV64I,  RVA22S64),
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23U64,  TYPE_RISCV_CPU_RV64I,  RVA23U64),
     DEFINE_PROFILE_CPU(TYPE_RISCV_CPU_RVA23S64,  TYPE_RISCV_CPU_RV64I,  RVA23S64),
-#endif /* TARGET_RISCV64 */
 };
 
 DEFINE_TYPES(riscv_cpu_type_infos)
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 034d7e96c4..265c632206 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -597,6 +597,13 @@ typedef struct RISCVCPUDef {
 #endif
     /* This is just a setter for env->num_triggers.  */
     uint32_t num_triggers;
+
+    /*
+     * Optional per-CPU callback run from riscv_cpu_class_base_init
+     * after the static def is merged. Use it to adjust fields that
+     * depend on the build target (e.g. clamp misa_mxl_max for RV32).
+     */
+    void (*target_init)(struct RISCVCPUClass *mcc);
 } RISCVCPUDef;
 
 /**
-- 
2.55.0.windows.3

Re: [PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Pierrick Bouvier]

On 10/1/2026 9:28 AM, Yonggang Luo wrote:
> On Thu, Oct 1, 2026 at 11:55 PM Anton Johansson via qemu development
> <qemu-devel@nongnu.org> wrote:
>>
>> Moves initialization of satp and mxl fields to a class initialization
>> function that checks target_riscv64().
>>
>> Note: I'm aware the current iteration of this patch is rather hacky, I
>> don't like the introduction of runtime_misa_mxl_max, but I'm keeping
>> this in to get the series out there and collect feedback.
>>
>> Signed-off-by: Anton Johansson <anjo@rev.ng>
>> ---
>>  target/riscv/cpu.h |  1 +
>>  target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
>>  2 files changed, 59 insertions(+), 32 deletions(-)
>>
> 
> This patch is how I handle these, just for reference, not a review.

Yonggang approach looks cleaner, I would favor this one.

Regards,
Pierrick

Re: [PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Anton Johansson via qemu development]

On 02/10/26, Pierrick Bouvier wrote:
> On 10/1/2026 9:28 AM, Yonggang Luo wrote:
> > On Thu, Oct 1, 2026 at 11:55 PM Anton Johansson via qemu development
> > <qemu-devel@nongnu.org> wrote:
> >>
> >> Moves initialization of satp and mxl fields to a class initialization
> >> function that checks target_riscv64().
> >>
> >> Note: I'm aware the current iteration of this patch is rather hacky, I
> >> don't like the introduction of runtime_misa_mxl_max, but I'm keeping
> >> this in to get the series out there and collect feedback.
> >>
> >> Signed-off-by: Anton Johansson <anjo@rev.ng>
> >> ---
> >>  target/riscv/cpu.h |  1 +
> >>  target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
> >>  2 files changed, 59 insertions(+), 32 deletions(-)
> >>
> > 
> > This patch is how I handle these, just for reference, not a review.
> 
> Yonggang approach looks cleaner, I would favor this one.

I'm personally not a huge fan, it still feels rather hacky. Why add a
completely new RISCVCPUDef::target_init just to make sure fields are
initialized before riscv_cpu_validate_misa_mxl()? Wouldn't moving the
check to a later point, maybe .instance_init, be better? Then for
riscv_cpu_init() we get

  riscv_cpu_validate_misa_mxl(mcc);
  env->misa_mxl = mcc->def->misa_mxl_max;

misa_mxl_max would be verified only during instance rather than
class initialization, which seems like a decent tradeoff for a simpler
solution.

-- 
Anton Johansson
rev.ng Labs Srl.

Re: [PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Anton Johansson via]

On 02/10/26, Pierrick Bouvier wrote:
> On 10/1/2026 9:28 AM, Yonggang Luo wrote:
> > On Thu, Oct 1, 2026 at 11:55 PM Anton Johansson via qemu development
> > <qemu-devel@nongnu.org> wrote:
> >>
> >> Moves initialization of satp and mxl fields to a class initialization
> >> function that checks target_riscv64().
> >>
> >> Note: I'm aware the current iteration of this patch is rather hacky, I
> >> don't like the introduction of runtime_misa_mxl_max, but I'm keeping
> >> this in to get the series out there and collect feedback.
> >>
> >> Signed-off-by: Anton Johansson <anjo@rev.ng>
> >> ---
> >>  target/riscv/cpu.h |  1 +
> >>  target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
> >>  2 files changed, 59 insertions(+), 32 deletions(-)
> >>
> > 
> > This patch is how I handle these, just for reference, not a review.
> 
> Yonggang approach looks cleaner, I would favor this one.

I'm personally not a huge fan, it still feels rather hacky. Why add a
completely new RISCVCPUDef::target_init just to make sure fields are
initialized before riscv_cpu_validate_misa_mxl()? Wouldn't moving the
check to a later point, maybe .instance_init, be better? Then for
riscv_cpu_init() we get

  riscv_cpu_validate_misa_mxl(mcc);
  env->misa_mxl = mcc->def->misa_mxl_max;

misa_mxl_max would be verified only during instance rather than
class initialization, which seems like a decent tradeoff for a simpler
solution.

-- 
Anton Johansson
rev.ng Labs Srl.

Re: [PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Yonggang Luo]

On Fri, Oct 2, 2026 at 11:36 PM Anton Johansson <anjo@rev.ng> wrote:
>
> On 02/10/26, Pierrick Bouvier wrote:
> > On 10/1/2026 9:28 AM, Yonggang Luo wrote:
> > > On Thu, Oct 1, 2026 at 11:55 PM Anton Johansson via qemu development
> > > <qemu-devel@nongnu.org> wrote:
> > >>
> > >> Moves initialization of satp and mxl fields to a class initialization
> > >> function that checks target_riscv64().
> > >>
> > >> Note: I'm aware the current iteration of this patch is rather hacky, I
> > >> don't like the introduction of runtime_misa_mxl_max, but I'm keeping
> > >> this in to get the series out there and collect feedback.
> > >>
> > >> Signed-off-by: Anton Johansson <anjo@rev.ng>
> > >> ---
> > >>  target/riscv/cpu.h |  1 +
> > >>  target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
> > >>  2 files changed, 59 insertions(+), 32 deletions(-)
> > >>
> > >
> > > This patch is how I handle these, just for reference, not a review.
> >
> > Yonggang approach looks cleaner, I would favor this one.
>
> I'm personally not a huge fan, it still feels rather hacky. Why add a
> completely new RISCVCPUDef::target_init just to make sure fields are
> initialized before riscv_cpu_validate_misa_mxl()? Wouldn't moving the
> check to a later point, maybe .instance_init, be better? Then for
> riscv_cpu_init() we get
>
>   riscv_cpu_validate_misa_mxl(mcc);
>   env->misa_mxl = mcc->def->misa_mxl_max;
>

Yeap I also tried instance_init but it's too generic, that needs if else in
riscv_cpu_init guard which CPU name from(that's not explicitly related).

    if (target_riscv32()) {
        if (mcc->def->misa_mxl_max > MXL_RV32) {
            mcc->def->misa_mxl_max = MXL_RV32;
            mcc->def->cfg.max_satp_mode = VM_1_10_SV32;
        }
        if (mcc->def->bare) {
            mcc->def->cfg.max_satp_mode = VM_1_10_SV32;
        }
#ifndef CONFIG_USER_ONLY
        if (mcc->def->misa_mxl_max == MXL_RV32 &&
            !valid_vm_1_10_32[mcc->def->cfg.max_satp_mode]) {
            mcc->def->cfg.max_satp_mode = VM_1_10_SV32;
        }
#endif
    }
That would be something like this.
Maybe another option is get max_satp_mode to be a function instead?
Indeed "max_satp_mode" depends on the chosen target.

> misa_mxl_max would be verified only during instance rather than
> class initialization, which seems like a decent tradeoff for a simpler
> solution.
>
> --
> Anton Johansson
> rev.ng Labs Srl.



-- 
         此致
礼
罗勇刚
Yours
    sincerely,
Yonggang Luo

Re: [PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Yonggang Luo]

On Fri, Oct 2, 2026 at 11:36 PM Anton Johansson <anjo@rev.ng> wrote:
>
> On 02/10/26, Pierrick Bouvier wrote:
> > On 10/1/2026 9:28 AM, Yonggang Luo wrote:
> > > On Thu, Oct 1, 2026 at 11:55 PM Anton Johansson via qemu development
> > > <qemu-devel@nongnu.org> wrote:
> > >>
> > >> Moves initialization of satp and mxl fields to a class initialization
> > >> function that checks target_riscv64().
> > >>
> > >> Note: I'm aware the current iteration of this patch is rather hacky, I
> > >> don't like the introduction of runtime_misa_mxl_max, but I'm keeping
> > >> this in to get the series out there and collect feedback.
> > >>
> > >> Signed-off-by: Anton Johansson <anjo@rev.ng>
> > >> ---
> > >>  target/riscv/cpu.h |  1 +
> > >>  target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
> > >>  2 files changed, 59 insertions(+), 32 deletions(-)
> > >>
> > >
> > > This patch is how I handle these, just for reference, not a review.
> >
> > Yonggang approach looks cleaner, I would favor this one.
>
> I'm personally not a huge fan, it still feels rather hacky. Why add a
> completely new RISCVCPUDef::target_init just to make sure fields are
> initialized before riscv_cpu_validate_misa_mxl()? Wouldn't moving the
> check to a later point, maybe .instance_init, be better? Then for
> riscv_cpu_init() we get
>
>   riscv_cpu_validate_misa_mxl(mcc);
>   env->misa_mxl = mcc->def->misa_mxl_max;
>
> misa_mxl_max would be verified only during instance rather than
> class initialization, which seems like a decent tradeoff for a simpler
> solution.
>

For example, we can add a max_satp_mode_choose callback, when provided
then misa_mxl_max is computed from max_satp_mode_choose
inside riscv_cpu_init(that is instance_init).
> --
> Anton Johansson
> rev.ng Labs Srl.



-- 
         此致
礼
罗勇刚
Yours
    sincerely,
Yonggang Luo

Re: [PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Yonggang Luo]

[-- Attachment #1: Type: text/plain, Size: 2273 bytes --]

target/riscv: resolve target-dependent CPU definition fields

The class-base initializer later reads def->misa_mxl_max and passes
def->cfg to riscv_cpu_cfg_merge(), which merges max_satp_mode. Resolve
both chooser results in a mutable copy so those steps use the selected
values without modifying the const TypeInfo class data.


defer riscv_cpu_validate_misa_mxl is not enough, mainly
def->misa_mxl_max is accessed in
riscv_cpu_class_base_init, for exactly match previous behavior, add
two callback for each value

On Fri, Oct 2, 2026 at 11:36 PM Anton Johansson <anjo@rev.ng> wrote:
>
> On 02/10/26, Pierrick Bouvier wrote:
> > On 10/1/2026 9:28 AM, Yonggang Luo wrote:
> > > On Thu, Oct 1, 2026 at 11:55 PM Anton Johansson via qemu development
> > > <qemu-devel@nongnu.org> wrote:
> > >>
> > >> Moves initialization of satp and mxl fields to a class initialization
> > >> function that checks target_riscv64().
> > >>
> > >> Note: I'm aware the current iteration of this patch is rather hacky, I
> > >> don't like the introduction of runtime_misa_mxl_max, but I'm keeping
> > >> this in to get the series out there and collect feedback.
> > >>
> > >> Signed-off-by: Anton Johansson <anjo@rev.ng>
> > >> ---
> > >>  target/riscv/cpu.h |  1 +
> > >>  target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
> > >>  2 files changed, 59 insertions(+), 32 deletions(-)
> > >>
> > >
> > > This patch is how I handle these, just for reference, not a review.
> >
> > Yonggang approach looks cleaner, I would favor this one.
>
> I'm personally not a huge fan, it still feels rather hacky. Why add a
> completely new RISCVCPUDef::target_init just to make sure fields are
> initialized before riscv_cpu_validate_misa_mxl()? Wouldn't moving the
> check to a later point, maybe .instance_init, be better? Then for
> riscv_cpu_init() we get
>
>   riscv_cpu_validate_misa_mxl(mcc);
>   env->misa_mxl = mcc->def->misa_mxl_max;
>
> misa_mxl_max would be verified only during instance rather than
> class initialization, which seems like a decent tradeoff for a simpler
> solution.
>
> --
> Anton Johansson
> rev.ng Labs Srl.



-- 
         此致
礼
罗勇刚
Yours
    sincerely,
Yonggang Luo

[-- Attachment #2: 0001-target-riscv-resolve-target-dependent-CPU-definition.patch --]
[-- Type: text/plain, Size: 3754 bytes --]

From 31138892fe5cf878da9818cf93535ce10b125cb0 Mon Sep 17 00:00:00 2001
From: Yonggang Luo <luoyonggang@gmail.com>
Date: Sat, 3 Oct 2026 01:54:52 +0800
Subject: [PATCH] target/riscv: resolve target-dependent CPU definition fields

The class-base initializer later reads def->misa_mxl_max and passes
def->cfg to riscv_cpu_cfg_merge(), which merges max_satp_mode. Resolve
both chooser results in a mutable copy so those steps use the selected
values without modifying the const TypeInfo class data.

Signed-off-by: Yonggang Luo <luoyonggang@gmail.com>
---
 target/riscv/cpu.c | 40 +++++++++++++++++++++++++++-------------
 target/riscv/cpu.h |  2 ++
 2 files changed, 29 insertions(+), 13 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index c6f1739075..754f158250 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -3092,6 +3092,8 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
 
     if (pcc->def) {
         mcc->def = g_memdup2(pcc->def, sizeof(*pcc->def));
+        mcc->def->max_satp_mode_choose = NULL;
+        mcc->def->misa_mxl_max_choose = NULL;
     } else {
         mcc->def = g_new0(RISCVCPUDef, 1);
     }
@@ -3108,7 +3110,16 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
 #endif
 
     if (data) {
-        const RISCVCPUDef *def = data;
+        RISCVCPUDef def_data = *(const RISCVCPUDef *)data;
+        RISCVCPUDef *def = &def_data;
+
+        if (def->max_satp_mode_choose) {
+            def->cfg.max_satp_mode = def->max_satp_mode_choose(def);
+        }
+        if (def->misa_mxl_max_choose) {
+            def->misa_mxl_max = def->misa_mxl_max_choose(def);
+        }
+
         mcc->def->bare |= def->bare;
         if (def->profile) {
             assert(profile_extends(def->profile, mcc->def->profile));
@@ -3299,6 +3310,18 @@ static void riscv_cpu_instance_finalize(Object *obj)
     g_clear_pointer(&cpu->multi_ext_user_opts, g_hash_table_destroy);
 }
 
+static int8_t riscv_cpu_max_satp_mode_choose(const RISCVCPUDef *def)
+{
+    (void)def;
+    return target_riscv32() ? VM_1_10_SV32 : VM_1_10_SV57;
+}
+
+static RISCVMXL riscv_cpu_misa_mxl_max_choose(const RISCVCPUDef *def)
+{
+    (void)def;
+    return target_riscv32() ? MXL_RV32 : MXL_RV64;
+}
+
 static const TypeInfo riscv_cpu_type_infos[] = {
     {
         .name = TYPE_RISCV_CPU,
@@ -3339,21 +3362,12 @@ static const TypeInfo riscv_cpu_type_infos[] = {
          * only MBARE will be available if the user doesn't enable
          * a mode manually (see riscv_cpu_satp_mode_finalize()).
          */
-#ifdef TARGET_RISCV32
-        .cfg.max_satp_mode = VM_1_10_SV32,
-#else
-        .cfg.max_satp_mode = VM_1_10_SV57,
-#endif
+        .max_satp_mode_choose = riscv_cpu_max_satp_mode_choose,
     ),
 
     DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX, TYPE_RISCV_DYNAMIC_CPU,
-#if defined(TARGET_RISCV32)
-        .misa_mxl_max = MXL_RV32,
-        .cfg.max_satp_mode = VM_1_10_SV32,
-#elif defined(TARGET_RISCV64)
-        .misa_mxl_max = MXL_RV64,
-        .cfg.max_satp_mode = VM_1_10_SV57,
-#endif
+        .max_satp_mode_choose = riscv_cpu_max_satp_mode_choose,
+        .misa_mxl_max_choose = riscv_cpu_misa_mxl_max_choose,
     ),
 
     DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E, TYPE_RISCV_VENDOR_CPU,
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 034d7e96c4..b6b5f679c9 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -597,6 +597,8 @@ typedef struct RISCVCPUDef {
 #endif
     /* This is just a setter for env->num_triggers.  */
     uint32_t num_triggers;
+    int8_t (*max_satp_mode_choose)(const struct RISCVCPUDef *def);
+    RISCVMXL (*misa_mxl_max_choose)(const struct RISCVCPUDef *def);
 } RISCVCPUDef;
 
 /**
-- 
2.55.0.windows.3

Re: [PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Anton Johansson via qemu development]

On 02/10/26, Yonggang Luo wrote:
> target/riscv: resolve target-dependent CPU definition fields
> 
> The class-base initializer later reads def->misa_mxl_max and passes
> def->cfg to riscv_cpu_cfg_merge(), which merges max_satp_mode. Resolve
> both chooser results in a mutable copy so those steps use the selected
> values without modifying the const TypeInfo class data.
> 
> 
> defer riscv_cpu_validate_misa_mxl is not enough, mainly
> def->misa_mxl_max is accessed in
> riscv_cpu_class_base_init, for exactly match previous behavior, add
> two callback for each value

Right, we would have to move more stuff to instance init which isn't the
best idea.  Personally I'm still not keen on adding more callbacks to
initialize two fields for two cpus, surely this is solvable with the
current machinery.  I'll submit a v2 and try defining two tables for
MAX/BARE instead, similar to ARM.

> 
> On Fri, Oct 2, 2026 at 11:36 PM Anton Johansson <anjo@rev.ng> wrote:
> >
> > On 02/10/26, Pierrick Bouvier wrote:
> > > On 10/1/2026 9:28 AM, Yonggang Luo wrote:
> > > > On Thu, Oct 1, 2026 at 11:55 PM Anton Johansson via qemu development
> > > > <qemu-devel@nongnu.org> wrote:
> > > >>
> > > >> Moves initialization of satp and mxl fields to a class initialization
> > > >> function that checks target_riscv64().
> > > >>
> > > >> Note: I'm aware the current iteration of this patch is rather hacky, I
> > > >> don't like the introduction of runtime_misa_mxl_max, but I'm keeping
> > > >> this in to get the series out there and collect feedback.
> > > >>
> > > >> Signed-off-by: Anton Johansson <anjo@rev.ng>
> > > >> ---
> > > >>  target/riscv/cpu.h |  1 +
> > > >>  target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
> > > >>  2 files changed, 59 insertions(+), 32 deletions(-)
> > > >>
> > > >
> > > > This patch is how I handle these, just for reference, not a review.
> > >
> > > Yonggang approach looks cleaner, I would favor this one.
> >
> > I'm personally not a huge fan, it still feels rather hacky. Why add a
> > completely new RISCVCPUDef::target_init just to make sure fields are
> > initialized before riscv_cpu_validate_misa_mxl()? Wouldn't moving the
> > check to a later point, maybe .instance_init, be better? Then for
> > riscv_cpu_init() we get
> >
> >   riscv_cpu_validate_misa_mxl(mcc);
> >   env->misa_mxl = mcc->def->misa_mxl_max;
> >
> > misa_mxl_max would be verified only during instance rather than
> > class initialization, which seems like a decent tradeoff for a simpler
> > solution.
> >
> > --
> > Anton Johansson
> > rev.ng Labs Srl.
> 
> 
> 
> -- 
>          此致
> 礼
> 罗勇刚
> Yours
>     sincerely,
> Yonggang Luo

> From 31138892fe5cf878da9818cf93535ce10b125cb0 Mon Sep 17 00:00:00 2001
> From: Yonggang Luo <luoyonggang@gmail.com>
> Date: Sat, 3 Oct 2026 01:54:52 +0800
> Subject: [PATCH] target/riscv: resolve target-dependent CPU definition fields
> 
> The class-base initializer later reads def->misa_mxl_max and passes
> def->cfg to riscv_cpu_cfg_merge(), which merges max_satp_mode. Resolve
> both chooser results in a mutable copy so those steps use the selected
> values without modifying the const TypeInfo class data.
> 
> Signed-off-by: Yonggang Luo <luoyonggang@gmail.com>
> ---
>  target/riscv/cpu.c | 40 +++++++++++++++++++++++++++-------------
>  target/riscv/cpu.h |  2 ++
>  2 files changed, 29 insertions(+), 13 deletions(-)
> 
> diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
> index c6f1739075..754f158250 100644
> --- a/target/riscv/cpu.c
> +++ b/target/riscv/cpu.c
> @@ -3092,6 +3092,8 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
>  
>      if (pcc->def) {
>          mcc->def = g_memdup2(pcc->def, sizeof(*pcc->def));
> +        mcc->def->max_satp_mode_choose = NULL;
> +        mcc->def->misa_mxl_max_choose = NULL;
>      } else {
>          mcc->def = g_new0(RISCVCPUDef, 1);
>      }
> @@ -3108,7 +3110,16 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
>  #endif
>  
>      if (data) {
> -        const RISCVCPUDef *def = data;
> +        RISCVCPUDef def_data = *(const RISCVCPUDef *)data;
> +        RISCVCPUDef *def = &def_data;
> +
> +        if (def->max_satp_mode_choose) {
> +            def->cfg.max_satp_mode = def->max_satp_mode_choose(def);
> +        }
> +        if (def->misa_mxl_max_choose) {
> +            def->misa_mxl_max = def->misa_mxl_max_choose(def);
> +        }
> +
>          mcc->def->bare |= def->bare;
>          if (def->profile) {
>              assert(profile_extends(def->profile, mcc->def->profile));
> @@ -3299,6 +3310,18 @@ static void riscv_cpu_instance_finalize(Object *obj)
>      g_clear_pointer(&cpu->multi_ext_user_opts, g_hash_table_destroy);
>  }
>  
> +static int8_t riscv_cpu_max_satp_mode_choose(const RISCVCPUDef *def)
> +{
> +    (void)def;
> +    return target_riscv32() ? VM_1_10_SV32 : VM_1_10_SV57;
> +}
> +
> +static RISCVMXL riscv_cpu_misa_mxl_max_choose(const RISCVCPUDef *def)
> +{
> +    (void)def;
> +    return target_riscv32() ? MXL_RV32 : MXL_RV64;
> +}
> +
>  static const TypeInfo riscv_cpu_type_infos[] = {
>      {
>          .name = TYPE_RISCV_CPU,
> @@ -3339,21 +3362,12 @@ static const TypeInfo riscv_cpu_type_infos[] = {
>           * only MBARE will be available if the user doesn't enable
>           * a mode manually (see riscv_cpu_satp_mode_finalize()).
>           */
> -#ifdef TARGET_RISCV32
> -        .cfg.max_satp_mode = VM_1_10_SV32,
> -#else
> -        .cfg.max_satp_mode = VM_1_10_SV57,
> -#endif
> +        .max_satp_mode_choose = riscv_cpu_max_satp_mode_choose,
>      ),
>  
>      DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX, TYPE_RISCV_DYNAMIC_CPU,
> -#if defined(TARGET_RISCV32)
> -        .misa_mxl_max = MXL_RV32,
> -        .cfg.max_satp_mode = VM_1_10_SV32,
> -#elif defined(TARGET_RISCV64)
> -        .misa_mxl_max = MXL_RV64,
> -        .cfg.max_satp_mode = VM_1_10_SV57,
> -#endif
> +        .max_satp_mode_choose = riscv_cpu_max_satp_mode_choose,
> +        .misa_mxl_max_choose = riscv_cpu_misa_mxl_max_choose,
>      ),
>  
>      DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E, TYPE_RISCV_VENDOR_CPU,
> diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
> index 034d7e96c4..b6b5f679c9 100644
> --- a/target/riscv/cpu.h
> +++ b/target/riscv/cpu.h
> @@ -597,6 +597,8 @@ typedef struct RISCVCPUDef {
>  #endif
>      /* This is just a setter for env->num_triggers.  */
>      uint32_t num_triggers;
> +    int8_t (*max_satp_mode_choose)(const struct RISCVCPUDef *def);
> +    RISCVMXL (*misa_mxl_max_choose)(const struct RISCVCPUDef *def);
>  } RISCVCPUDef;
>  
>  /**
> -- 
> 2.55.0.windows.3
> 

Re: [PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Anton Johansson via]

On 02/10/26, Yonggang Luo wrote:
> target/riscv: resolve target-dependent CPU definition fields
> 
> The class-base initializer later reads def->misa_mxl_max and passes
> def->cfg to riscv_cpu_cfg_merge(), which merges max_satp_mode. Resolve
> both chooser results in a mutable copy so those steps use the selected
> values without modifying the const TypeInfo class data.
> 
> 
> defer riscv_cpu_validate_misa_mxl is not enough, mainly
> def->misa_mxl_max is accessed in
> riscv_cpu_class_base_init, for exactly match previous behavior, add
> two callback for each value

Right, we would have to move more stuff to instance init which isn't the
best idea.  Personally I'm still not keen on adding more callbacks to
initialize two fields for two cpus, surely this is solvable with the
current machinery.  I'll submit a v2 and try defining two tables for
MAX/BARE instead, similar to ARM.

> 
> On Fri, Oct 2, 2026 at 11:36 PM Anton Johansson <anjo@rev.ng> wrote:
> >
> > On 02/10/26, Pierrick Bouvier wrote:
> > > On 10/1/2026 9:28 AM, Yonggang Luo wrote:
> > > > On Thu, Oct 1, 2026 at 11:55 PM Anton Johansson via qemu development
> > > > <qemu-devel@nongnu.org> wrote:
> > > >>
> > > >> Moves initialization of satp and mxl fields to a class initialization
> > > >> function that checks target_riscv64().
> > > >>
> > > >> Note: I'm aware the current iteration of this patch is rather hacky, I
> > > >> don't like the introduction of runtime_misa_mxl_max, but I'm keeping
> > > >> this in to get the series out there and collect feedback.
> > > >>
> > > >> Signed-off-by: Anton Johansson <anjo@rev.ng>
> > > >> ---
> > > >>  target/riscv/cpu.h |  1 +
> > > >>  target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
> > > >>  2 files changed, 59 insertions(+), 32 deletions(-)
> > > >>
> > > >
> > > > This patch is how I handle these, just for reference, not a review.
> > >
> > > Yonggang approach looks cleaner, I would favor this one.
> >
> > I'm personally not a huge fan, it still feels rather hacky. Why add a
> > completely new RISCVCPUDef::target_init just to make sure fields are
> > initialized before riscv_cpu_validate_misa_mxl()? Wouldn't moving the
> > check to a later point, maybe .instance_init, be better? Then for
> > riscv_cpu_init() we get
> >
> >   riscv_cpu_validate_misa_mxl(mcc);
> >   env->misa_mxl = mcc->def->misa_mxl_max;
> >
> > misa_mxl_max would be verified only during instance rather than
> > class initialization, which seems like a decent tradeoff for a simpler
> > solution.
> >
> > --
> > Anton Johansson
> > rev.ng Labs Srl.
> 
> 
> 
> -- 
>          此致
> 礼
> 罗勇刚
> Yours
>     sincerely,
> Yonggang Luo

> From 31138892fe5cf878da9818cf93535ce10b125cb0 Mon Sep 17 00:00:00 2001
> From: Yonggang Luo <luoyonggang@gmail.com>
> Date: Sat, 3 Oct 2026 01:54:52 +0800
> Subject: [PATCH] target/riscv: resolve target-dependent CPU definition fields
> 
> The class-base initializer later reads def->misa_mxl_max and passes
> def->cfg to riscv_cpu_cfg_merge(), which merges max_satp_mode. Resolve
> both chooser results in a mutable copy so those steps use the selected
> values without modifying the const TypeInfo class data.
> 
> Signed-off-by: Yonggang Luo <luoyonggang@gmail.com>
> ---
>  target/riscv/cpu.c | 40 +++++++++++++++++++++++++++-------------
>  target/riscv/cpu.h |  2 ++
>  2 files changed, 29 insertions(+), 13 deletions(-)
> 
> diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
> index c6f1739075..754f158250 100644
> --- a/target/riscv/cpu.c
> +++ b/target/riscv/cpu.c
> @@ -3092,6 +3092,8 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
>  
>      if (pcc->def) {
>          mcc->def = g_memdup2(pcc->def, sizeof(*pcc->def));
> +        mcc->def->max_satp_mode_choose = NULL;
> +        mcc->def->misa_mxl_max_choose = NULL;
>      } else {
>          mcc->def = g_new0(RISCVCPUDef, 1);
>      }
> @@ -3108,7 +3110,16 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
>  #endif
>  
>      if (data) {
> -        const RISCVCPUDef *def = data;
> +        RISCVCPUDef def_data = *(const RISCVCPUDef *)data;
> +        RISCVCPUDef *def = &def_data;
> +
> +        if (def->max_satp_mode_choose) {
> +            def->cfg.max_satp_mode = def->max_satp_mode_choose(def);
> +        }
> +        if (def->misa_mxl_max_choose) {
> +            def->misa_mxl_max = def->misa_mxl_max_choose(def);
> +        }
> +
>          mcc->def->bare |= def->bare;
>          if (def->profile) {
>              assert(profile_extends(def->profile, mcc->def->profile));
> @@ -3299,6 +3310,18 @@ static void riscv_cpu_instance_finalize(Object *obj)
>      g_clear_pointer(&cpu->multi_ext_user_opts, g_hash_table_destroy);
>  }
>  
> +static int8_t riscv_cpu_max_satp_mode_choose(const RISCVCPUDef *def)
> +{
> +    (void)def;
> +    return target_riscv32() ? VM_1_10_SV32 : VM_1_10_SV57;
> +}
> +
> +static RISCVMXL riscv_cpu_misa_mxl_max_choose(const RISCVCPUDef *def)
> +{
> +    (void)def;
> +    return target_riscv32() ? MXL_RV32 : MXL_RV64;
> +}
> +
>  static const TypeInfo riscv_cpu_type_infos[] = {
>      {
>          .name = TYPE_RISCV_CPU,
> @@ -3339,21 +3362,12 @@ static const TypeInfo riscv_cpu_type_infos[] = {
>           * only MBARE will be available if the user doesn't enable
>           * a mode manually (see riscv_cpu_satp_mode_finalize()).
>           */
> -#ifdef TARGET_RISCV32
> -        .cfg.max_satp_mode = VM_1_10_SV32,
> -#else
> -        .cfg.max_satp_mode = VM_1_10_SV57,
> -#endif
> +        .max_satp_mode_choose = riscv_cpu_max_satp_mode_choose,
>      ),
>  
>      DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX, TYPE_RISCV_DYNAMIC_CPU,
> -#if defined(TARGET_RISCV32)
> -        .misa_mxl_max = MXL_RV32,
> -        .cfg.max_satp_mode = VM_1_10_SV32,
> -#elif defined(TARGET_RISCV64)
> -        .misa_mxl_max = MXL_RV64,
> -        .cfg.max_satp_mode = VM_1_10_SV57,
> -#endif
> +        .max_satp_mode_choose = riscv_cpu_max_satp_mode_choose,
> +        .misa_mxl_max_choose = riscv_cpu_misa_mxl_max_choose,
>      ),
>  
>      DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E, TYPE_RISCV_VENDOR_CPU,
> diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
> index 034d7e96c4..b6b5f679c9 100644
> --- a/target/riscv/cpu.h
> +++ b/target/riscv/cpu.h
> @@ -597,6 +597,8 @@ typedef struct RISCVCPUDef {
>  #endif
>      /* This is just a setter for env->num_triggers.  */
>      uint32_t num_triggers;
> +    int8_t (*max_satp_mode_choose)(const struct RISCVCPUDef *def);
> +    RISCVMXL (*misa_mxl_max_choose)(const struct RISCVCPUDef *def);
>  } RISCVCPUDef;
>  
>  /**
> -- 
> 2.55.0.windows.3
> 

Re: [PATCH 07/18] target/riscv: Runtime register MAX and BARE CPUs

[Yonggang Luo]

On Wed, Oct 7, 2026 at 7:09 AM Anton Johansson <anjo@rev.ng> wrote:
>
> On 02/10/26, Yonggang Luo wrote:
> > target/riscv: resolve target-dependent CPU definition fields
> >
> > The class-base initializer later reads def->misa_mxl_max and passes
> > def->cfg to riscv_cpu_cfg_merge(), which merges max_satp_mode. Resolve
> > both chooser results in a mutable copy so those steps use the selected
> > values without modifying the const TypeInfo class data.
> >
> >
> > defer riscv_cpu_validate_misa_mxl is not enough, mainly
> > def->misa_mxl_max is accessed in
> > riscv_cpu_class_base_init, for exactly match previous behavior, add
> > two callback for each value
>
> Right, we would have to move more stuff to instance init which isn't the
> best idea.  Personally I'm still not keen on adding more callbacks to
> initialize two fields for two cpus, surely this is solvable with the
> current machinery.  I'll submit a v2 and try defining two tables for
> MAX/BARE instead, similar to ARM.


Make sense, thanks

>
> >
> > On Fri, Oct 2, 2026 at 11:36 PM Anton Johansson <anjo@rev.ng> wrote:
> > >
> > > On 02/10/26, Pierrick Bouvier wrote:
> > > > On 10/1/2026 9:28 AM, Yonggang Luo wrote:
> > > > > On Thu, Oct 1, 2026 at 11:55 PM Anton Johansson via qemu development
> > > > > <qemu-devel@nongnu.org> wrote:
> > > > >>
> > > > >> Moves initialization of satp and mxl fields to a class initialization
> > > > >> function that checks target_riscv64().
> > > > >>
> > > > >> Note: I'm aware the current iteration of this patch is rather hacky, I
> > > > >> don't like the introduction of runtime_misa_mxl_max, but I'm keeping
> > > > >> this in to get the series out there and collect feedback.
> > > > >>
> > > > >> Signed-off-by: Anton Johansson <anjo@rev.ng>
> > > > >> ---
> > > > >>  target/riscv/cpu.h |  1 +
> > > > >>  target/riscv/cpu.c | 90 +++++++++++++++++++++++++++++++++++-------------------
> > > > >>  2 files changed, 59 insertions(+), 32 deletions(-)
> > > > >>
> > > > >
> > > > > This patch is how I handle these, just for reference, not a review.
> > > >
> > > > Yonggang approach looks cleaner, I would favor this one.
> > >
> > > I'm personally not a huge fan, it still feels rather hacky. Why add a
> > > completely new RISCVCPUDef::target_init just to make sure fields are
> > > initialized before riscv_cpu_validate_misa_mxl()? Wouldn't moving the
> > > check to a later point, maybe .instance_init, be better? Then for
> > > riscv_cpu_init() we get
> > >
> > >   riscv_cpu_validate_misa_mxl(mcc);
> > >   env->misa_mxl = mcc->def->misa_mxl_max;
> > >
> > > misa_mxl_max would be verified only during instance rather than
> > > class initialization, which seems like a decent tradeoff for a simpler
> > > solution.
> > >
> > > --
> > > Anton Johansson
> > > rev.ng Labs Srl.
> >
> >
> >
> > --
> >          此致
> > 礼
> > 罗勇刚
> > Yours
> >     sincerely,
> > Yonggang Luo
>
> > From 31138892fe5cf878da9818cf93535ce10b125cb0 Mon Sep 17 00:00:00 2001
> > From: Yonggang Luo <luoyonggang@gmail.com>
> > Date: Sat, 3 Oct 2026 01:54:52 +0800
> > Subject: [PATCH] target/riscv: resolve target-dependent CPU definition fields
> >
> > The class-base initializer later reads def->misa_mxl_max and passes
> > def->cfg to riscv_cpu_cfg_merge(), which merges max_satp_mode. Resolve
> > both chooser results in a mutable copy so those steps use the selected
> > values without modifying the const TypeInfo class data.
> >
> > Signed-off-by: Yonggang Luo <luoyonggang@gmail.com>
> > ---
> >  target/riscv/cpu.c | 40 +++++++++++++++++++++++++++-------------
> >  target/riscv/cpu.h |  2 ++
> >  2 files changed, 29 insertions(+), 13 deletions(-)
> >
> > diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
> > index c6f1739075..754f158250 100644
> > --- a/target/riscv/cpu.c
> > +++ b/target/riscv/cpu.c
> > @@ -3092,6 +3092,8 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
> >
> >      if (pcc->def) {
> >          mcc->def = g_memdup2(pcc->def, sizeof(*pcc->def));
> > +        mcc->def->max_satp_mode_choose = NULL;
> > +        mcc->def->misa_mxl_max_choose = NULL;
> >      } else {
> >          mcc->def = g_new0(RISCVCPUDef, 1);
> >      }
> > @@ -3108,7 +3110,16 @@ static void riscv_cpu_class_base_init(ObjectClass *c, const void *data)
> >  #endif
> >
> >      if (data) {
> > -        const RISCVCPUDef *def = data;
> > +        RISCVCPUDef def_data = *(const RISCVCPUDef *)data;
> > +        RISCVCPUDef *def = &def_data;
> > +
> > +        if (def->max_satp_mode_choose) {
> > +            def->cfg.max_satp_mode = def->max_satp_mode_choose(def);
> > +        }
> > +        if (def->misa_mxl_max_choose) {
> > +            def->misa_mxl_max = def->misa_mxl_max_choose(def);
> > +        }
> > +
> >          mcc->def->bare |= def->bare;
> >          if (def->profile) {
> >              assert(profile_extends(def->profile, mcc->def->profile));
> > @@ -3299,6 +3310,18 @@ static void riscv_cpu_instance_finalize(Object *obj)
> >      g_clear_pointer(&cpu->multi_ext_user_opts, g_hash_table_destroy);
> >  }
> >
> > +static int8_t riscv_cpu_max_satp_mode_choose(const RISCVCPUDef *def)
> > +{
> > +    (void)def;
> > +    return target_riscv32() ? VM_1_10_SV32 : VM_1_10_SV57;
> > +}
> > +
> > +static RISCVMXL riscv_cpu_misa_mxl_max_choose(const RISCVCPUDef *def)
> > +{
> > +    (void)def;
> > +    return target_riscv32() ? MXL_RV32 : MXL_RV64;
> > +}
> > +
> >  static const TypeInfo riscv_cpu_type_infos[] = {
> >      {
> >          .name = TYPE_RISCV_CPU,
> > @@ -3339,21 +3362,12 @@ static const TypeInfo riscv_cpu_type_infos[] = {
> >           * only MBARE will be available if the user doesn't enable
> >           * a mode manually (see riscv_cpu_satp_mode_finalize()).
> >           */
> > -#ifdef TARGET_RISCV32
> > -        .cfg.max_satp_mode = VM_1_10_SV32,
> > -#else
> > -        .cfg.max_satp_mode = VM_1_10_SV57,
> > -#endif
> > +        .max_satp_mode_choose = riscv_cpu_max_satp_mode_choose,
> >      ),
> >
> >      DEFINE_RISCV_CPU(TYPE_RISCV_CPU_MAX, TYPE_RISCV_DYNAMIC_CPU,
> > -#if defined(TARGET_RISCV32)
> > -        .misa_mxl_max = MXL_RV32,
> > -        .cfg.max_satp_mode = VM_1_10_SV32,
> > -#elif defined(TARGET_RISCV64)
> > -        .misa_mxl_max = MXL_RV64,
> > -        .cfg.max_satp_mode = VM_1_10_SV57,
> > -#endif
> > +        .max_satp_mode_choose = riscv_cpu_max_satp_mode_choose,
> > +        .misa_mxl_max_choose = riscv_cpu_misa_mxl_max_choose,
> >      ),
> >
> >      DEFINE_ABSTRACT_RISCV_CPU(TYPE_RISCV_CPU_SIFIVE_E, TYPE_RISCV_VENDOR_CPU,
> > diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
> > index 034d7e96c4..b6b5f679c9 100644
> > --- a/target/riscv/cpu.h
> > +++ b/target/riscv/cpu.h
> > @@ -597,6 +597,8 @@ typedef struct RISCVCPUDef {
> >  #endif
> >      /* This is just a setter for env->num_triggers.  */
> >      uint32_t num_triggers;
> > +    int8_t (*max_satp_mode_choose)(const struct RISCVCPUDef *def);
> > +    RISCVMXL (*misa_mxl_max_choose)(const struct RISCVCPUDef *def);
> >  } RISCVCPUDef;
> >
> >  /**
> > --
> > 2.55.0.windows.3
> >



-- 
         此致
礼
罗勇刚
Yours
    sincerely,
Yonggang Luo

[PATCH 08/18] target/riscv: cpu.c unconditionally check larger MXL

[Anton Johansson via qemu development]

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/cpu.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 39501c6c9f..23ca8f2431 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1595,12 +1595,10 @@ static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
 
     /* Validate that MISA_MXL is set properly. */
     switch (mcc->def->misa_mxl_max) {
-#ifdef TARGET_RISCV64
     case MXL_RV64:
     case MXL_RV128:
         cc->gdb_core_xml_file = "riscv-64bit-cpu.xml";
         break;
-#endif
     case MXL_RV32:
         cc->gdb_core_xml_file = "riscv-32bit-cpu.xml";
         break;

-- 
2.52.0

[PATCH 08/18] target/riscv: cpu.c unconditionally check larger MXL

[Anton Johansson via]

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/cpu.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index 39501c6c9f..23ca8f2431 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1595,12 +1595,10 @@ static void riscv_cpu_validate_misa_mxl(RISCVCPUClass *mcc)
 
     /* Validate that MISA_MXL is set properly. */
     switch (mcc->def->misa_mxl_max) {
-#ifdef TARGET_RISCV64
     case MXL_RV64:
     case MXL_RV128:
         cc->gdb_core_xml_file = "riscv-64bit-cpu.xml";
         break;
-#endif
     case MXL_RV32:
         cc->gdb_core_xml_file = "riscv-32bit-cpu.xml";
         break;

-- 
2.52.0

Re: [PATCH 08/18] target/riscv: cpu.c unconditionally check larger MXL

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/cpu.c | 2 --
>  1 file changed, 2 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 09/18] target/riscv: Stub KVM functions for machines.c/cpu.c

[Anton Johansson via qemu development]

In order to compile cpu.c and machine.c once for system mode and keep
the linker happy in a single binary setting, we need to stub out some
required functions otherwise only available under CONFIG_KVM.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/kvm/kvm-stub.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/riscv/kvm/kvm-stub.c b/target/riscv/kvm/kvm-stub.c
index 64e39c96d8..5dc91b9265 100644
--- a/target/riscv/kvm/kvm-stub.c
+++ b/target/riscv/kvm/kvm-stub.c
@@ -21,3 +21,24 @@ uint64_t kvm_riscv_get_timebase_frequency(RISCVCPU *cpu)
 {
     g_assert_not_reached();
 }
+
+void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level)
+{
+    g_assert_not_reached();
+}
+
+void riscv_kvm_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
+{
+    g_assert_not_reached();
+}
+
+bool kvm_riscv_has_mp_state(void)
+{
+    g_assert_not_reached();
+}
+

-- 
2.52.0

[PATCH 09/18] target/riscv: Stub KVM functions for machines.c/cpu.c

[Anton Johansson via]

In order to compile cpu.c and machine.c once for system mode and keep
the linker happy in a single binary setting, we need to stub out some
required functions otherwise only available under CONFIG_KVM.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/kvm/kvm-stub.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/riscv/kvm/kvm-stub.c b/target/riscv/kvm/kvm-stub.c
index 64e39c96d8..5dc91b9265 100644
--- a/target/riscv/kvm/kvm-stub.c
+++ b/target/riscv/kvm/kvm-stub.c
@@ -21,3 +21,24 @@ uint64_t kvm_riscv_get_timebase_frequency(RISCVCPU *cpu)
 {
     g_assert_not_reached();
 }
+
+void kvm_riscv_reset_vcpu(RISCVCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+void kvm_riscv_set_irq(RISCVCPU *cpu, int irq, int level)
+{
+    g_assert_not_reached();
+}
+
+void riscv_kvm_cpu_finalize_features(RISCVCPU *cpu, Error **errp)
+{
+    g_assert_not_reached();
+}
+
+bool kvm_riscv_has_mp_state(void)
+{
+    g_assert_not_reached();
+}
+

-- 
2.52.0

Re: [PATCH 09/18] target/riscv: Stub KVM functions for machines.c/cpu.c

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson via qemu development wrote:
> In order to compile cpu.c and machine.c once for system mode and keep
> the linker happy in a single binary setting, we need to stub out some
> required functions otherwise only available under CONFIG_KVM.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/kvm/kvm-stub.c | 21 +++++++++++++++++++++
>  1 file changed, 21 insertions(+)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 10/18] target/riscv: Compile cpu.c once for system-mode

[Anton Johansson via qemu development]

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/meson.build | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index 3cdff11f75..ba38e421c5 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -15,7 +15,6 @@ riscv_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
 		     if_true: files('common-semi-target.c'))
 
 riscv_ss.add(files(
-  'cpu.c',
   'gdbstub.c',
 ))
 
@@ -33,6 +32,14 @@ riscv_system_ss.add(files(
 riscv_user_ss = ss.source_set()
 riscv_common_system_ss = ss.source_set()
 
+riscv_user_ss.add(files(
+  'cpu.c',
+))
+
+riscv_common_system_ss.add(files(
+  'cpu.c',
+))
+
 subdir('tcg')
 subdir('kvm')
 

-- 
2.52.0

[PATCH 10/18] target/riscv: Compile cpu.c once for system-mode

[Anton Johansson via]

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/meson.build | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index 3cdff11f75..ba38e421c5 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -15,7 +15,6 @@ riscv_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
 		     if_true: files('common-semi-target.c'))
 
 riscv_ss.add(files(
-  'cpu.c',
   'gdbstub.c',
 ))
 
@@ -33,6 +32,14 @@ riscv_system_ss.add(files(
 riscv_user_ss = ss.source_set()
 riscv_common_system_ss = ss.source_set()
 
+riscv_user_ss.add(files(
+  'cpu.c',
+))
+
+riscv_common_system_ss.add(files(
+  'cpu.c',
+))
+
 subdir('tcg')
 subdir('kvm')
 

-- 
2.52.0

Re: [PATCH 10/18] target/riscv: Compile cpu.c once for system-mode

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/meson.build | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 11/18] target/riscv: Compile cpu_helper.c once for system-mode

[Anton Johansson via qemu development]

Makes cpu_helper.c agnostic to compile-time target specifics, allowing
it to be compiled twice (once for user- and once for system mode).
target_[u]long is widened to [u]int64_t and runtime target_long_bits()
is used in place of the equivalent macro.  Most changes are straight
forward and no behavioural change is intended.

Note: the following change might be a bit unclear at first glance

  #define PTE_PPN_MASK 0x3FFFFFFFFFFC00ULL

  - target_ulong pte;
  + uint64_t pte;

  - ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
  + ppn = (pte & PTE_PPN_MASK) >> PTE_PPN_SHIFT;

but retains expected behaviour as pte is written a uint32_t for
MXL_RV32, meaning the top bits of PTE_PPN_MASK or chopped of in the &,
rather than truncated.

Note: This commit will print all addresses as 64-bit values, even for a
32-bit target. If breaking this interface is not an option we can
instead opt for more runtime branching, as done by Joel Stanley
in commit 409c7d8682a.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/cpu_helper.c | 79 ++++++++++++++++++++++---------------------
 target/riscv/tcg/meson.build  |  3 +-
 2 files changed, 43 insertions(+), 39 deletions(-)

diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index 07d9222652..ee433a88fe 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
+#include "qemu/target-info.h"
 #include "cpu.h"
 #include "internals.h"
 #include "pmu.h"
@@ -28,7 +29,6 @@
 #include "exec/target_page.h"
 #include "system/memory.h"
 #include "instmap.h"
-#include "tcg/tcg-op.h"
 #include "accel/tcg/cpu-loop.h"
 #include "accel/tcg/cpu-ops.h"
 #include "trace.h"
@@ -1017,7 +1017,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     bool use_background = false;
     hwaddr ppn;
     int napot_bits = 0;
-    target_ulong napot_mask;
+    uint64_t napot_mask;
     bool is_sstack_idx = ((mmu_idx & MMU_IDX_SS_WRITE) == MMU_IDX_SS_WRITE);
     bool sstack_page = false;
 
@@ -1101,7 +1101,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     int sxlen_bytes = sxlen / 8;
 
     if (first_stage == true) {
-        target_ulong mask, masked_msbs;
+        uint64_t mask, masked_msbs;
 
         if (sxlen > (va_bits - 1)) {
             mask = (1L << (sxlen - (va_bits - 1))) - 1;
@@ -1131,7 +1131,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     int ptshift;
-    target_ulong pte;
+    uint64_t pte;
     hwaddr pte_addr;
     const hwaddr base_root = base;
     const bool be = mo_endian_env(env) == MO_BE;
@@ -1141,7 +1141,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     ptshift = (levels - 1) * ptidxbits;
     base = base_root;
     for (i = 0; i < levels; i++, ptshift -= ptidxbits) {
-        target_ulong idx;
+        uint64_t idx;
         if (i == 0) {
             idx = (addr >> (PGSHIFT + ptshift)) &
                            ((1 << (ptidxbits + widened)) - 1);
@@ -1214,7 +1214,8 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         } else {
             if (pte & PTE_RESERVED(svrsw60t59b)) {
                 qemu_log_mask(LOG_GUEST_ERROR, "%s: reserved bits set in PTE: "
-                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                              "addr: 0x%" HWADDR_PRIx
+                              " pte: 0x%016" PRIx64 "\n",
                               __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
@@ -1223,7 +1224,8 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
                 /* Reserved without Svpbmt. */
                 qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits set in PTE, "
                               "and Svpbmt extension is disabled: "
-                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                              "addr: 0x%" HWADDR_PRIx
+                              " pte: 0x%016" PRIx64 "\n",
                               __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
@@ -1242,7 +1244,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
             if ((pte & PTE_PBMT) == PTE_PBMT) {
                 qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits 62 and 61 are "
                         "reserved but are set in PTE: "
-                        "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                        "addr: 0x%" HWADDR_PRIx " pte: 0x%016" PRIx64 "\n",
                         __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
@@ -1251,12 +1253,13 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
                 /* Reserved without Svnapot extension */
                 qemu_log_mask(LOG_GUEST_ERROR, "%s: N bit set in PTE, "
                               "and Svnapot extension is disabled: "
-                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                              "addr: 0x%" HWADDR_PRIx
+                              " pte: 0x%016" PRIx64 "\n",
                               __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
 
-            ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
+            ppn = (pte & PTE_PPN_MASK) >> PTE_PPN_SHIFT;
         }
 
         if (!(pte & PTE_V)) {
@@ -1271,7 +1274,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         if (pte & (PTE_D | PTE_A | PTE_U | PTE_ATTR)) {
             /* D, A, and U bits are reserved in non-leaf/inner PTEs */
             qemu_log_mask(LOG_GUEST_ERROR, "%s: D, A, or U bits set in non-leaf PTE: "
-                          "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                          "addr: 0x%" HWADDR_PRIx " pte: 0x%016" PRIx64 "\n",
                           __func__, pte_addr, pte);
             return TRANSLATE_FAIL;
         }
@@ -1286,7 +1289,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     if (ppn & ((1ULL << ptshift) - 1)) {
         /* Misaligned PPN */
         qemu_log_mask(LOG_GUEST_ERROR, "%s: PPN bits in PTE is misaligned: "
-                      "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                      "addr: 0x%" HWADDR_PRIx " pte: 0x%016" PRIx64 "\n",
                       __func__, pte_addr, pte);
         return TRANSLATE_FAIL;
     }
@@ -1294,7 +1297,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         /* Reserved without Svpbmt. */
         qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits set in PTE, "
                       "and Svpbmt extension is disabled: "
-                      "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                      "addr: 0x%" HWADDR_PRIx " pte: 0x%016" PRIx64 "\n",
                       __func__, pte_addr, pte);
         return TRANSLATE_FAIL;
     }
@@ -1311,12 +1314,12 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     if ((pte & PTE_PBMT) == PTE_PBMT) {
         qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits 62 and 61 are "
                       "reserved but are set in leaf PTE: "
-                      "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                      "addr: 0x%" HWADDR_PRIx " pte: 0x%016" PRIx64 "\n",
                       __func__, pte_addr, pte);
         return TRANSLATE_FAIL;
     }
 
-    target_ulong rwx = pte & (PTE_R | PTE_W | PTE_X);
+    uint64_t rwx = pte & (PTE_R | PTE_W | PTE_X);
     /* Check for reserved combinations of RWX flags. */
     switch (rwx) {
     case PTE_W | PTE_X:
@@ -1403,7 +1406,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         return sstack_page ? TRANSLATE_PMP_FAIL : TRANSLATE_FAIL;
     }
 
-    target_ulong updated_pte = pte;
+    uint64_t updated_pte = pte;
 
     /*
      * If ADUE is enabled, set accessed and dirty bits.
@@ -1471,7 +1474,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     /* For superpage mappings, make a fake leaf PTE for the TLB's benefit. */
-    target_ulong vpn = addr >> PGSHIFT;
+    uint64_t vpn = addr >> PGSHIFT;
 
     if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
         napot_bits = ctzl(ppn) + 1;
@@ -1482,7 +1485,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
 
     napot_mask = (1 << napot_bits) - 1;
     *physical = (((ppn & ~napot_mask) | (vpn & napot_mask) |
-                  (vpn & (((target_ulong)1 << ptshift) - 1))
+                  (vpn & ((1ULL << ptshift) - 1))
                  ) << PGSHIFT) | (addr & ~TARGET_PAGE_MASK);
 
     /*
@@ -1498,7 +1501,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     return TRANSLATE_SUCCESS;
 }
 
-static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
+static void raise_mmu_exception(CPURISCVState *env, vaddr address,
                                 MMUAccessType access_type,
                                 bool pmp_pma_violation,
                                 bool first_stage, bool two_stage,
@@ -1795,12 +1798,12 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     return true;
 }
 
-static target_ulong riscv_transformed_insn(CPURISCVState *env,
-                                           target_ulong insn,
-                                           target_ulong taddr)
+static uint64_t riscv_transformed_insn(CPURISCVState *env,
+                                           uint64_t insn,
+                                           uint64_t taddr)
 {
-    target_ulong xinsn = 0;
-    target_ulong access_rs1 = 0, access_imm = 0, access_size = 0;
+    uint64_t xinsn = 0;
+    uint64_t access_rs1 = 0, access_imm = 0, access_size = 0;
 
     /*
      * Only Quadrant 0 and Quadrant 2 of RVC instruction space need to
@@ -1956,7 +1959,7 @@ static target_ulong riscv_transformed_insn(CPURISCVState *env,
          * Clear Bit1 of transformed instruction to indicate that
          * original insruction was a 16bit instruction
          */
-        xinsn &= ~((target_ulong)0x2);
+        xinsn &= ~((uint64_t)0x2);
     } else {
         /* Transform 32bit (or wider) instructions */
         switch (MASK_OP_MAJOR(insn)) {
@@ -2000,7 +2003,7 @@ static target_ulong riscv_transformed_insn(CPURISCVState *env,
     return xinsn;
 }
 
-static target_ulong promote_load_fault(target_ulong orig_cause)
+static uint64_t promote_load_fault(uint64_t orig_cause)
 {
     switch (orig_cause) {
     case RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT:
@@ -2020,7 +2023,7 @@ static target_ulong promote_load_fault(target_ulong orig_cause)
     return orig_cause;
 }
 
-static void riscv_do_nmi(CPURISCVState *env, target_ulong cause, bool virt)
+static void riscv_do_nmi(CPURISCVState *env, uint64_t cause, bool virt)
 {
     env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, false);
     env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPV, virt);
@@ -2059,7 +2062,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
      * so we mask off the MSB and separate into trap type and cause.
      */
     bool async = !!(cs->exception_index & RISCV_EXCP_INT_FLAG);
-    target_ulong cause = cs->exception_index & RISCV_EXCP_INT_MASK;
+    uint64_t cause = cs->exception_index & RISCV_EXCP_INT_MASK;
     uint64_t deleg = async ? env->mideleg : env->medeleg;
     bool s_injected = env->mvip & (1ULL << cause) & env->mvien &&
         !(env->mip & (1ULL << cause));
@@ -2070,17 +2073,17 @@ void riscv_cpu_do_interrupt(CPUState *cs)
     const bool prev_virt = env->virt_enabled;
     const privilege_mode_t prev_priv = env->priv;
     uint64_t last_pc = env->pc;
-    target_ulong tval = 0;
-    target_ulong tinst = 0;
-    target_ulong htval = 0;
-    target_ulong mtval2 = 0;
-    target_ulong src;
+    uint64_t tval = 0;
+    uint64_t tinst = 0;
+    uint64_t htval = 0;
+    uint64_t mtval2 = 0;
+    uint64_t src;
     int sxlen = 0;
     int mxlen = 16 << riscv_cpu_mxl(env);
     bool nnmi_excep = false;
 
     if (cpu->cfg.ext_smrnmi && env->rnmip && async) {
-        riscv_do_nmi(env, cause | ((target_ulong)1U << (mxlen - 1)),
+        riscv_do_nmi(env, cause | (1ULL << (mxlen - 1)),
                      env->virt_enabled);
         return;
     }
@@ -2173,8 +2176,8 @@ void riscv_cpu_do_interrupt(CPUState *cs)
                      riscv_cpu_get_trap_name(cause, async));
 
     qemu_log_mask(CPU_LOG_INT,
-                  "%s: hart:%"PRIu64", async:%d, cause:"TARGET_FMT_lx", "
-                  "epc:0x%"PRIx64", tval:0x"TARGET_FMT_lx", desc=%s\n",
+                  "%s: hart:%"PRIu64", async:%d, cause:%016"PRIx64", "
+                  "epc:0x%016"PRIx64", tval:0x%016"PRIx64", desc=%s\n",
                   __func__, env->mhartid, async, cause, env->pc,
                   tval, riscv_cpu_get_trap_name(cause, async));
 
@@ -2253,7 +2256,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
         }
         env->mstatus = s;
         sxlen = 16 << riscv_cpu_sxl(env);
-        env->scause = cause | ((target_ulong)async << (sxlen - 1));
+        env->scause = cause | ((uint64_t)async << (sxlen - 1));
         env->sepc = env->pc;
         env->stval = tval;
         env->htval = htval;
@@ -2325,7 +2328,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
             s = set_field(s, MSTATUS_MDT, 1);
         }
         env->mstatus = s;
-        env->mcause = cause | ((target_ulong)async << (mxlen - 1));
+        env->mcause = cause | ((uint64_t)async << (mxlen - 1));
         if (smode_double_trap) {
             env->mtval2 = env->mcause;
             env->mcause = RISCV_EXCP_DOUBLE_TRAP;
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index 8f95c8f400..cc50f3764c 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -4,7 +4,6 @@ endif
 
 riscv_ss.add(files(
   'bitmanip_helper.c',
- 'cpu_helper.c',
   'crypto_helper.c',
   'fpu_helper.c',
   'm128_helper.c',
@@ -24,11 +23,13 @@ riscv_system_ss.add(files(
 
 
 riscv_user_ss.add(files(
+  'cpu_helper.c',
   'csr.c',
 ))
 
 
 riscv_common_system_ss.add(files(
+  'cpu_helper.c',
   'csr.c',
   'mips_csr.c',
   'pmu.c',

-- 
2.52.0

[PATCH 11/18] target/riscv: Compile cpu_helper.c once for system-mode

[Anton Johansson via]

Makes cpu_helper.c agnostic to compile-time target specifics, allowing
it to be compiled twice (once for user- and once for system mode).
target_[u]long is widened to [u]int64_t and runtime target_long_bits()
is used in place of the equivalent macro.  Most changes are straight
forward and no behavioural change is intended.

Note: the following change might be a bit unclear at first glance

  #define PTE_PPN_MASK 0x3FFFFFFFFFFC00ULL

  - target_ulong pte;
  + uint64_t pte;

  - ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
  + ppn = (pte & PTE_PPN_MASK) >> PTE_PPN_SHIFT;

but retains expected behaviour as pte is written a uint32_t for
MXL_RV32, meaning the top bits of PTE_PPN_MASK or chopped of in the &,
rather than truncated.

Note: This commit will print all addresses as 64-bit values, even for a
32-bit target. If breaking this interface is not an option we can
instead opt for more runtime branching, as done by Joel Stanley
in commit 409c7d8682a.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/cpu_helper.c | 79 ++++++++++++++++++++++---------------------
 target/riscv/tcg/meson.build  |  3 +-
 2 files changed, 43 insertions(+), 39 deletions(-)

diff --git a/target/riscv/tcg/cpu_helper.c b/target/riscv/tcg/cpu_helper.c
index 07d9222652..ee433a88fe 100644
--- a/target/riscv/tcg/cpu_helper.c
+++ b/target/riscv/tcg/cpu_helper.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "qemu/main-loop.h"
+#include "qemu/target-info.h"
 #include "cpu.h"
 #include "internals.h"
 #include "pmu.h"
@@ -28,7 +29,6 @@
 #include "exec/target_page.h"
 #include "system/memory.h"
 #include "instmap.h"
-#include "tcg/tcg-op.h"
 #include "accel/tcg/cpu-loop.h"
 #include "accel/tcg/cpu-ops.h"
 #include "trace.h"
@@ -1017,7 +1017,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     bool use_background = false;
     hwaddr ppn;
     int napot_bits = 0;
-    target_ulong napot_mask;
+    uint64_t napot_mask;
     bool is_sstack_idx = ((mmu_idx & MMU_IDX_SS_WRITE) == MMU_IDX_SS_WRITE);
     bool sstack_page = false;
 
@@ -1101,7 +1101,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     int sxlen_bytes = sxlen / 8;
 
     if (first_stage == true) {
-        target_ulong mask, masked_msbs;
+        uint64_t mask, masked_msbs;
 
         if (sxlen > (va_bits - 1)) {
             mask = (1L << (sxlen - (va_bits - 1))) - 1;
@@ -1131,7 +1131,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     int ptshift;
-    target_ulong pte;
+    uint64_t pte;
     hwaddr pte_addr;
     const hwaddr base_root = base;
     const bool be = mo_endian_env(env) == MO_BE;
@@ -1141,7 +1141,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     ptshift = (levels - 1) * ptidxbits;
     base = base_root;
     for (i = 0; i < levels; i++, ptshift -= ptidxbits) {
-        target_ulong idx;
+        uint64_t idx;
         if (i == 0) {
             idx = (addr >> (PGSHIFT + ptshift)) &
                            ((1 << (ptidxbits + widened)) - 1);
@@ -1214,7 +1214,8 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         } else {
             if (pte & PTE_RESERVED(svrsw60t59b)) {
                 qemu_log_mask(LOG_GUEST_ERROR, "%s: reserved bits set in PTE: "
-                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                              "addr: 0x%" HWADDR_PRIx
+                              " pte: 0x%016" PRIx64 "\n",
                               __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
@@ -1223,7 +1224,8 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
                 /* Reserved without Svpbmt. */
                 qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits set in PTE, "
                               "and Svpbmt extension is disabled: "
-                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                              "addr: 0x%" HWADDR_PRIx
+                              " pte: 0x%016" PRIx64 "\n",
                               __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
@@ -1242,7 +1244,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
             if ((pte & PTE_PBMT) == PTE_PBMT) {
                 qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits 62 and 61 are "
                         "reserved but are set in PTE: "
-                        "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                        "addr: 0x%" HWADDR_PRIx " pte: 0x%016" PRIx64 "\n",
                         __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
@@ -1251,12 +1253,13 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
                 /* Reserved without Svnapot extension */
                 qemu_log_mask(LOG_GUEST_ERROR, "%s: N bit set in PTE, "
                               "and Svnapot extension is disabled: "
-                              "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                              "addr: 0x%" HWADDR_PRIx
+                              " pte: 0x%016" PRIx64 "\n",
                               __func__, pte_addr, pte);
                 return TRANSLATE_FAIL;
             }
 
-            ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
+            ppn = (pte & PTE_PPN_MASK) >> PTE_PPN_SHIFT;
         }
 
         if (!(pte & PTE_V)) {
@@ -1271,7 +1274,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         if (pte & (PTE_D | PTE_A | PTE_U | PTE_ATTR)) {
             /* D, A, and U bits are reserved in non-leaf/inner PTEs */
             qemu_log_mask(LOG_GUEST_ERROR, "%s: D, A, or U bits set in non-leaf PTE: "
-                          "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                          "addr: 0x%" HWADDR_PRIx " pte: 0x%016" PRIx64 "\n",
                           __func__, pte_addr, pte);
             return TRANSLATE_FAIL;
         }
@@ -1286,7 +1289,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     if (ppn & ((1ULL << ptshift) - 1)) {
         /* Misaligned PPN */
         qemu_log_mask(LOG_GUEST_ERROR, "%s: PPN bits in PTE is misaligned: "
-                      "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                      "addr: 0x%" HWADDR_PRIx " pte: 0x%016" PRIx64 "\n",
                       __func__, pte_addr, pte);
         return TRANSLATE_FAIL;
     }
@@ -1294,7 +1297,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         /* Reserved without Svpbmt. */
         qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits set in PTE, "
                       "and Svpbmt extension is disabled: "
-                      "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                      "addr: 0x%" HWADDR_PRIx " pte: 0x%016" PRIx64 "\n",
                       __func__, pte_addr, pte);
         return TRANSLATE_FAIL;
     }
@@ -1311,12 +1314,12 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     if ((pte & PTE_PBMT) == PTE_PBMT) {
         qemu_log_mask(LOG_GUEST_ERROR, "%s: PBMT bits 62 and 61 are "
                       "reserved but are set in leaf PTE: "
-                      "addr: 0x%" HWADDR_PRIx " pte: 0x" TARGET_FMT_lx "\n",
+                      "addr: 0x%" HWADDR_PRIx " pte: 0x%016" PRIx64 "\n",
                       __func__, pte_addr, pte);
         return TRANSLATE_FAIL;
     }
 
-    target_ulong rwx = pte & (PTE_R | PTE_W | PTE_X);
+    uint64_t rwx = pte & (PTE_R | PTE_W | PTE_X);
     /* Check for reserved combinations of RWX flags. */
     switch (rwx) {
     case PTE_W | PTE_X:
@@ -1403,7 +1406,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
         return sstack_page ? TRANSLATE_PMP_FAIL : TRANSLATE_FAIL;
     }
 
-    target_ulong updated_pte = pte;
+    uint64_t updated_pte = pte;
 
     /*
      * If ADUE is enabled, set accessed and dirty bits.
@@ -1471,7 +1474,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     }
 
     /* For superpage mappings, make a fake leaf PTE for the TLB's benefit. */
-    target_ulong vpn = addr >> PGSHIFT;
+    uint64_t vpn = addr >> PGSHIFT;
 
     if (riscv_cpu_cfg(env)->ext_svnapot && (pte & PTE_N)) {
         napot_bits = ctzl(ppn) + 1;
@@ -1482,7 +1485,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
 
     napot_mask = (1 << napot_bits) - 1;
     *physical = (((ppn & ~napot_mask) | (vpn & napot_mask) |
-                  (vpn & (((target_ulong)1 << ptshift) - 1))
+                  (vpn & ((1ULL << ptshift) - 1))
                  ) << PGSHIFT) | (addr & ~TARGET_PAGE_MASK);
 
     /*
@@ -1498,7 +1501,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
     return TRANSLATE_SUCCESS;
 }
 
-static void raise_mmu_exception(CPURISCVState *env, target_ulong address,
+static void raise_mmu_exception(CPURISCVState *env, vaddr address,
                                 MMUAccessType access_type,
                                 bool pmp_pma_violation,
                                 bool first_stage, bool two_stage,
@@ -1795,12 +1798,12 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     return true;
 }
 
-static target_ulong riscv_transformed_insn(CPURISCVState *env,
-                                           target_ulong insn,
-                                           target_ulong taddr)
+static uint64_t riscv_transformed_insn(CPURISCVState *env,
+                                           uint64_t insn,
+                                           uint64_t taddr)
 {
-    target_ulong xinsn = 0;
-    target_ulong access_rs1 = 0, access_imm = 0, access_size = 0;
+    uint64_t xinsn = 0;
+    uint64_t access_rs1 = 0, access_imm = 0, access_size = 0;
 
     /*
      * Only Quadrant 0 and Quadrant 2 of RVC instruction space need to
@@ -1956,7 +1959,7 @@ static target_ulong riscv_transformed_insn(CPURISCVState *env,
          * Clear Bit1 of transformed instruction to indicate that
          * original insruction was a 16bit instruction
          */
-        xinsn &= ~((target_ulong)0x2);
+        xinsn &= ~((uint64_t)0x2);
     } else {
         /* Transform 32bit (or wider) instructions */
         switch (MASK_OP_MAJOR(insn)) {
@@ -2000,7 +2003,7 @@ static target_ulong riscv_transformed_insn(CPURISCVState *env,
     return xinsn;
 }
 
-static target_ulong promote_load_fault(target_ulong orig_cause)
+static uint64_t promote_load_fault(uint64_t orig_cause)
 {
     switch (orig_cause) {
     case RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT:
@@ -2020,7 +2023,7 @@ static target_ulong promote_load_fault(target_ulong orig_cause)
     return orig_cause;
 }
 
-static void riscv_do_nmi(CPURISCVState *env, target_ulong cause, bool virt)
+static void riscv_do_nmi(CPURISCVState *env, uint64_t cause, bool virt)
 {
     env->mnstatus = set_field(env->mnstatus, MNSTATUS_NMIE, false);
     env->mnstatus = set_field(env->mnstatus, MNSTATUS_MNPV, virt);
@@ -2059,7 +2062,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
      * so we mask off the MSB and separate into trap type and cause.
      */
     bool async = !!(cs->exception_index & RISCV_EXCP_INT_FLAG);
-    target_ulong cause = cs->exception_index & RISCV_EXCP_INT_MASK;
+    uint64_t cause = cs->exception_index & RISCV_EXCP_INT_MASK;
     uint64_t deleg = async ? env->mideleg : env->medeleg;
     bool s_injected = env->mvip & (1ULL << cause) & env->mvien &&
         !(env->mip & (1ULL << cause));
@@ -2070,17 +2073,17 @@ void riscv_cpu_do_interrupt(CPUState *cs)
     const bool prev_virt = env->virt_enabled;
     const privilege_mode_t prev_priv = env->priv;
     uint64_t last_pc = env->pc;
-    target_ulong tval = 0;
-    target_ulong tinst = 0;
-    target_ulong htval = 0;
-    target_ulong mtval2 = 0;
-    target_ulong src;
+    uint64_t tval = 0;
+    uint64_t tinst = 0;
+    uint64_t htval = 0;
+    uint64_t mtval2 = 0;
+    uint64_t src;
     int sxlen = 0;
     int mxlen = 16 << riscv_cpu_mxl(env);
     bool nnmi_excep = false;
 
     if (cpu->cfg.ext_smrnmi && env->rnmip && async) {
-        riscv_do_nmi(env, cause | ((target_ulong)1U << (mxlen - 1)),
+        riscv_do_nmi(env, cause | (1ULL << (mxlen - 1)),
                      env->virt_enabled);
         return;
     }
@@ -2173,8 +2176,8 @@ void riscv_cpu_do_interrupt(CPUState *cs)
                      riscv_cpu_get_trap_name(cause, async));
 
     qemu_log_mask(CPU_LOG_INT,
-                  "%s: hart:%"PRIu64", async:%d, cause:"TARGET_FMT_lx", "
-                  "epc:0x%"PRIx64", tval:0x"TARGET_FMT_lx", desc=%s\n",
+                  "%s: hart:%"PRIu64", async:%d, cause:%016"PRIx64", "
+                  "epc:0x%016"PRIx64", tval:0x%016"PRIx64", desc=%s\n",
                   __func__, env->mhartid, async, cause, env->pc,
                   tval, riscv_cpu_get_trap_name(cause, async));
 
@@ -2253,7 +2256,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
         }
         env->mstatus = s;
         sxlen = 16 << riscv_cpu_sxl(env);
-        env->scause = cause | ((target_ulong)async << (sxlen - 1));
+        env->scause = cause | ((uint64_t)async << (sxlen - 1));
         env->sepc = env->pc;
         env->stval = tval;
         env->htval = htval;
@@ -2325,7 +2328,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
             s = set_field(s, MSTATUS_MDT, 1);
         }
         env->mstatus = s;
-        env->mcause = cause | ((target_ulong)async << (mxlen - 1));
+        env->mcause = cause | ((uint64_t)async << (mxlen - 1));
         if (smode_double_trap) {
             env->mtval2 = env->mcause;
             env->mcause = RISCV_EXCP_DOUBLE_TRAP;
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index 8f95c8f400..cc50f3764c 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -4,7 +4,6 @@ endif
 
 riscv_ss.add(files(
   'bitmanip_helper.c',
- 'cpu_helper.c',
   'crypto_helper.c',
   'fpu_helper.c',
   'm128_helper.c',
@@ -24,11 +23,13 @@ riscv_system_ss.add(files(
 
 
 riscv_user_ss.add(files(
+  'cpu_helper.c',
   'csr.c',
 ))
 
 
 riscv_common_system_ss.add(files(
+  'cpu_helper.c',
   'csr.c',
   'mips_csr.c',
   'pmu.c',

-- 
2.52.0

Re: [PATCH 11/18] target/riscv: Compile cpu_helper.c once for system-mode

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> Makes cpu_helper.c agnostic to compile-time target specifics, allowing
> it to be compiled twice (once for user- and once for system mode).
> target_[u]long is widened to [u]int64_t and runtime target_long_bits()
> is used in place of the equivalent macro.  Most changes are straight
> forward and no behavioural change is intended.
> 
> Note: the following change might be a bit unclear at first glance
> 
>   #define PTE_PPN_MASK 0x3FFFFFFFFFFC00ULL
> 
>   - target_ulong pte;
>   + uint64_t pte;
> 
>   - ppn = (pte & (target_ulong)PTE_PPN_MASK) >> PTE_PPN_SHIFT;
>   + ppn = (pte & PTE_PPN_MASK) >> PTE_PPN_SHIFT;
> 
> but retains expected behaviour as pte is written a uint32_t for
> MXL_RV32, meaning the top bits of PTE_PPN_MASK or chopped of in the &,
> rather than truncated.
> 
> Note: This commit will print all addresses as 64-bit values, even for a
> 32-bit target. If breaking this interface is not an option we can
> instead opt for more runtime branching, as done by Joel Stanley
> in commit 409c7d8682a.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/tcg/cpu_helper.c | 79 ++++++++++++++++++++++---------------------
>  target/riscv/tcg/meson.build  |  3 +-
>  2 files changed, 43 insertions(+), 39 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 12/18] target/riscv: Compile tcg-cpu.c once for system-mode

[Anton Johansson via qemu development]

Remaining target_ulongs are replaced by their corresponding type in
CPUArchState.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/tcg-cpu.c   | 8 ++++----
 target/riscv/tcg/meson.build | 3 ++-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index b68160af83..91b2e128ea 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -229,7 +229,7 @@ static void riscv_restore_state_to_opc(CPUState *cs,
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
     RISCVMXL xl = FIELD_EX32(tb->flags, TB_FLAGS, XL);
-    target_ulong pc;
+    uint64_t pc;
 
     if (tb_cflags(tb) & CF_PCREL) {
         pc = (env->pc & TARGET_PAGE_MASK) | data[0];
@@ -1336,7 +1336,7 @@ static bool riscv_tcg_cpu_realize(CPUState *cs, Error **errp)
 }
 
 typedef struct RISCVCPUMisaExtConfig {
-    target_ulong misa_bit;
+    uint32_t misa_bit;
     bool enabled;
 } RISCVCPUMisaExtConfig;
 
@@ -1344,7 +1344,7 @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
                                  void *opaque, Error **errp)
 {
     const RISCVCPUMisaExtConfig *misa_ext_cfg = opaque;
-    target_ulong misa_bit = misa_ext_cfg->misa_bit;
+    uint32_t misa_bit = misa_ext_cfg->misa_bit;
     RISCVCPU *cpu = RISCV_CPU(obj);
     CPURISCVState *env = &cpu->env;
     bool vendor_cpu = riscv_cpu_is_vendor(obj);
@@ -1386,7 +1386,7 @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
                                  void *opaque, Error **errp)
 {
     const RISCVCPUMisaExtConfig *misa_ext_cfg = opaque;
-    target_ulong misa_bit = misa_ext_cfg->misa_bit;
+    uint32_t misa_bit = misa_ext_cfg->misa_bit;
     RISCVCPU *cpu = RISCV_CPU(obj);
     CPURISCVState *env = &cpu->env;
     bool value;
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index cc50f3764c..69dadfd662 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -9,7 +9,6 @@ riscv_ss.add(files(
   'm128_helper.c',
   'op_helper.c',
   'translate.c',
-  'tcg-cpu.c',
   'vcrypto_helper.c',
   'vector_helper.c',
   'vector_internals.c',
@@ -25,6 +24,7 @@ riscv_system_ss.add(files(
 riscv_user_ss.add(files(
   'cpu_helper.c',
   'csr.c',
+  'tcg-cpu.c',
 ))
 
 
@@ -33,5 +33,6 @@ riscv_common_system_ss.add(files(
   'csr.c',
   'mips_csr.c',
   'pmu.c',
+  'tcg-cpu.c',
   'th_csr.c',
 ))

-- 
2.52.0

[PATCH 12/18] target/riscv: Compile tcg-cpu.c once for system-mode

[Anton Johansson via]

Remaining target_ulongs are replaced by their corresponding type in
CPUArchState.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/tcg-cpu.c   | 8 ++++----
 target/riscv/tcg/meson.build | 3 ++-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index b68160af83..91b2e128ea 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -229,7 +229,7 @@ static void riscv_restore_state_to_opc(CPUState *cs,
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
     RISCVMXL xl = FIELD_EX32(tb->flags, TB_FLAGS, XL);
-    target_ulong pc;
+    uint64_t pc;
 
     if (tb_cflags(tb) & CF_PCREL) {
         pc = (env->pc & TARGET_PAGE_MASK) | data[0];
@@ -1336,7 +1336,7 @@ static bool riscv_tcg_cpu_realize(CPUState *cs, Error **errp)
 }
 
 typedef struct RISCVCPUMisaExtConfig {
-    target_ulong misa_bit;
+    uint32_t misa_bit;
     bool enabled;
 } RISCVCPUMisaExtConfig;
 
@@ -1344,7 +1344,7 @@ static void cpu_set_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
                                  void *opaque, Error **errp)
 {
     const RISCVCPUMisaExtConfig *misa_ext_cfg = opaque;
-    target_ulong misa_bit = misa_ext_cfg->misa_bit;
+    uint32_t misa_bit = misa_ext_cfg->misa_bit;
     RISCVCPU *cpu = RISCV_CPU(obj);
     CPURISCVState *env = &cpu->env;
     bool vendor_cpu = riscv_cpu_is_vendor(obj);
@@ -1386,7 +1386,7 @@ static void cpu_get_misa_ext_cfg(Object *obj, Visitor *v, const char *name,
                                  void *opaque, Error **errp)
 {
     const RISCVCPUMisaExtConfig *misa_ext_cfg = opaque;
-    target_ulong misa_bit = misa_ext_cfg->misa_bit;
+    uint32_t misa_bit = misa_ext_cfg->misa_bit;
     RISCVCPU *cpu = RISCV_CPU(obj);
     CPURISCVState *env = &cpu->env;
     bool value;
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index cc50f3764c..69dadfd662 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -9,7 +9,6 @@ riscv_ss.add(files(
   'm128_helper.c',
   'op_helper.c',
   'translate.c',
-  'tcg-cpu.c',
   'vcrypto_helper.c',
   'vector_helper.c',
   'vector_internals.c',
@@ -25,6 +24,7 @@ riscv_system_ss.add(files(
 riscv_user_ss.add(files(
   'cpu_helper.c',
   'csr.c',
+  'tcg-cpu.c',
 ))
 
 
@@ -33,5 +33,6 @@ riscv_common_system_ss.add(files(
   'csr.c',
   'mips_csr.c',
   'pmu.c',
+  'tcg-cpu.c',
   'th_csr.c',
 ))

-- 
2.52.0

Re: [PATCH 12/18] target/riscv: Compile tcg-cpu.c once for system-mode

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> Remaining target_ulongs are replaced by their corresponding type in
> CPUArchState.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/tcg/tcg-cpu.c   | 8 ++++----
>  target/riscv/tcg/meson.build | 3 ++-
>  2 files changed, 6 insertions(+), 5 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 13/18] target/riscv: Compile riscv-qmp-cmds.c once

[Anton Johansson via qemu development]

File is already agnostic to target specifics at this point.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index ba38e421c5..8d0b3ed4ce 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -26,7 +26,6 @@ riscv_system_ss.add(files(
   'monitor.c',
   'machine.c',
   'time_helper.c',
-  'riscv-qmp-cmds.c',
 ))
 
 riscv_user_ss = ss.source_set()
@@ -38,6 +37,7 @@ riscv_user_ss.add(files(
 
 riscv_common_system_ss.add(files(
   'cpu.c',
+  'riscv-qmp-cmds.c',
 ))
 
 subdir('tcg')

-- 
2.52.0

[PATCH 13/18] target/riscv: Compile riscv-qmp-cmds.c once

[Anton Johansson via]

File is already agnostic to target specifics at this point.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index ba38e421c5..8d0b3ed4ce 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -26,7 +26,6 @@ riscv_system_ss.add(files(
   'monitor.c',
   'machine.c',
   'time_helper.c',
-  'riscv-qmp-cmds.c',
 ))
 
 riscv_user_ss = ss.source_set()
@@ -38,6 +37,7 @@ riscv_user_ss.add(files(
 
 riscv_common_system_ss.add(files(
   'cpu.c',
+  'riscv-qmp-cmds.c',
 ))
 
 subdir('tcg')

-- 
2.52.0

Re: [PATCH 13/18] target/riscv: Compile riscv-qmp-cmds.c once

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> File is already agnostic to target specifics at this point.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/meson.build | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 14/18] target/riscv: Compile pmp.c once

[Anton Johansson via qemu development]

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/pmp.c       | 5 +++--
 target/riscv/tcg/meson.build | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/riscv/tcg/pmp.c b/target/riscv/tcg/pmp.c
index 99345d63dc..2d7194de10 100644
--- a/target/riscv/tcg/pmp.c
+++ b/target/riscv/tcg/pmp.c
@@ -638,19 +638,20 @@ uint64_t pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
     if (addr_index < pmp_regions) {
         val = env->pmp_state.pmp[addr_index].addr_reg;
         int g = pmp_get_granularity_g(env);
+        const unsigned long_bits = target_long_bits();
         switch (pmp_get_a_field(env->pmp_state.pmp[addr_index].cfg_reg)) {
         case PMP_AMATCH_OFF:
             /* fallthrough */
         case PMP_AMATCH_TOR:
             /* Bit [g-1:0] read all zero */
-            if (g >= 1 && g < TARGET_LONG_BITS) {
+            if (g >= 1 && g < long_bits) {
                 uint64_t granule = 1ULL << g;
                 val = ROUND_DOWN(val, granule);
             }
             break;
         case PMP_AMATCH_NAPOT:
             /* Bit [g-2:0] read all one */
-            if (g >= 2 && g < TARGET_LONG_BITS) {
+            if (g >= 2 && g < long_bits) {
                 val = deposit64(val, 0, g - 1, -1ULL);
             }
             break;
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index 69dadfd662..0aaba9cf34 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -17,7 +17,6 @@ riscv_ss.add(files(
 
 riscv_system_ss.add(files(
   'debug.c',
-  'pmp.c',
 ))
 
 
@@ -35,4 +34,5 @@ riscv_common_system_ss.add(files(
   'pmu.c',
   'tcg-cpu.c',
   'th_csr.c',
+  'pmp.c',
 ))

-- 
2.52.0

[PATCH 14/18] target/riscv: Compile pmp.c once

[Anton Johansson via]

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/tcg/pmp.c       | 5 +++--
 target/riscv/tcg/meson.build | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/riscv/tcg/pmp.c b/target/riscv/tcg/pmp.c
index 99345d63dc..2d7194de10 100644
--- a/target/riscv/tcg/pmp.c
+++ b/target/riscv/tcg/pmp.c
@@ -638,19 +638,20 @@ uint64_t pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
     if (addr_index < pmp_regions) {
         val = env->pmp_state.pmp[addr_index].addr_reg;
         int g = pmp_get_granularity_g(env);
+        const unsigned long_bits = target_long_bits();
         switch (pmp_get_a_field(env->pmp_state.pmp[addr_index].cfg_reg)) {
         case PMP_AMATCH_OFF:
             /* fallthrough */
         case PMP_AMATCH_TOR:
             /* Bit [g-1:0] read all zero */
-            if (g >= 1 && g < TARGET_LONG_BITS) {
+            if (g >= 1 && g < long_bits) {
                 uint64_t granule = 1ULL << g;
                 val = ROUND_DOWN(val, granule);
             }
             break;
         case PMP_AMATCH_NAPOT:
             /* Bit [g-2:0] read all one */
-            if (g >= 2 && g < TARGET_LONG_BITS) {
+            if (g >= 2 && g < long_bits) {
                 val = deposit64(val, 0, g - 1, -1ULL);
             }
             break;
diff --git a/target/riscv/tcg/meson.build b/target/riscv/tcg/meson.build
index 69dadfd662..0aaba9cf34 100644
--- a/target/riscv/tcg/meson.build
+++ b/target/riscv/tcg/meson.build
@@ -17,7 +17,6 @@ riscv_ss.add(files(
 
 riscv_system_ss.add(files(
   'debug.c',
-  'pmp.c',
 ))
 
 
@@ -35,4 +34,5 @@ riscv_common_system_ss.add(files(
   'pmu.c',
   'tcg-cpu.c',
   'th_csr.c',
+  'pmp.c',
 ))

-- 
2.52.0

Re: [PATCH 14/18] target/riscv: Compile pmp.c once

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/tcg/pmp.c       | 5 +++--
>  target/riscv/tcg/meson.build | 2 +-
>  2 files changed, 4 insertions(+), 3 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 15/18] target/riscv: Compile arch_dump.c once

[Anton Johansson via qemu development]

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/arch_dump.c | 13 +++++++------
 target/riscv/meson.build |  2 +-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/riscv/arch_dump.c b/target/riscv/arch_dump.c
index 12b6879907..3276c00128 100644
--- a/target/riscv/arch_dump.c
+++ b/target/riscv/arch_dump.c
@@ -17,7 +17,8 @@
  */
 
 #include "qemu/osdep.h"
-#include "cpu.h"
+#include "qemu/target-info.h"
+#include "target/riscv/cpu.h"
 #include "elf.h"
 #include "system/dump.h"
 
@@ -175,11 +176,11 @@ int cpu_get_dump_info(ArchDumpInfo *info,
 
     info->d_machine = EM_RISCV;
 
-#if defined(TARGET_RISCV64)
-    info->d_class = ELFCLASS64;
-#else
-    info->d_class = ELFCLASS32;
-#endif
+    if (target_riscv64()) {
+        info->d_class = ELFCLASS64;
+    } else {
+        info->d_class = ELFCLASS32;
+    }
 
     info->d_endian = (env->mstatus & MSTATUS_UBE) != 0 ?
                      ELFDATA2MSB : ELFDATA2LSB;
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index 8d0b3ed4ce..28a6ff8553 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -22,7 +22,6 @@ riscv_stubs_ss = ss.source_set()
 
 riscv_system_ss = ss.source_set()
 riscv_system_ss.add(files(
-  'arch_dump.c',
   'monitor.c',
   'machine.c',
   'time_helper.c',
@@ -36,6 +35,7 @@ riscv_user_ss.add(files(
 ))
 
 riscv_common_system_ss.add(files(
+  'arch_dump.c',
   'cpu.c',
   'riscv-qmp-cmds.c',
 ))

-- 
2.52.0

[PATCH 15/18] target/riscv: Compile arch_dump.c once

[Anton Johansson via]

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/arch_dump.c | 13 +++++++------
 target/riscv/meson.build |  2 +-
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/riscv/arch_dump.c b/target/riscv/arch_dump.c
index 12b6879907..3276c00128 100644
--- a/target/riscv/arch_dump.c
+++ b/target/riscv/arch_dump.c
@@ -17,7 +17,8 @@
  */
 
 #include "qemu/osdep.h"
-#include "cpu.h"
+#include "qemu/target-info.h"
+#include "target/riscv/cpu.h"
 #include "elf.h"
 #include "system/dump.h"
 
@@ -175,11 +176,11 @@ int cpu_get_dump_info(ArchDumpInfo *info,
 
     info->d_machine = EM_RISCV;
 
-#if defined(TARGET_RISCV64)
-    info->d_class = ELFCLASS64;
-#else
-    info->d_class = ELFCLASS32;
-#endif
+    if (target_riscv64()) {
+        info->d_class = ELFCLASS64;
+    } else {
+        info->d_class = ELFCLASS32;
+    }
 
     info->d_endian = (env->mstatus & MSTATUS_UBE) != 0 ?
                      ELFDATA2MSB : ELFDATA2LSB;
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index 8d0b3ed4ce..28a6ff8553 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -22,7 +22,6 @@ riscv_stubs_ss = ss.source_set()
 
 riscv_system_ss = ss.source_set()
 riscv_system_ss.add(files(
-  'arch_dump.c',
   'monitor.c',
   'machine.c',
   'time_helper.c',
@@ -36,6 +35,7 @@ riscv_user_ss.add(files(
 ))
 
 riscv_common_system_ss.add(files(
+  'arch_dump.c',
   'cpu.c',
   'riscv-qmp-cmds.c',
 ))

-- 
2.52.0

Re: [PATCH 15/18] target/riscv: Compile arch_dump.c once

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/arch_dump.c | 13 +++++++------
>  target/riscv/meson.build |  2 +-
>  2 files changed, 8 insertions(+), 7 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 16/18] target/riscv: Compile machine.c once

[Anton Johansson via qemu development]

There's now also no change in migration stream between KVM/non-KVM
configurations, KVM fields are filtered out via .is_needed().

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/machine.c   | 10 +---------
 target/riscv/meson.build |  2 +-
 2 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index bf203bffce..ddcab8a667 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -21,12 +21,10 @@
 #include "qemu/error-report.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
-#include "migration/cpu.h"
+#include "migration/vmstate.h"
 #include "exec/icount.h"
 #include "target/riscv/tcg/debug.h"
-#ifdef CONFIG_KVM
 #include "kvm/kvm_riscv.h"
-#endif
 
 static bool pmp_needed(void *opaque)
 {
@@ -196,7 +194,6 @@ static const VMStateDescription vmstate_rv128 = {
     }
 };
 
-#ifdef CONFIG_KVM
 static bool kvmtimer_needed(void *opaque)
 {
     return kvm_enabled();
@@ -262,7 +259,6 @@ static const VMStateDescription vmstate_kvm_mp_state = {
         VMSTATE_END_OF_LIST()
     }
 };
-#endif
 
 static bool debug_needed(void *opaque)
 {
@@ -499,9 +495,7 @@ const VMStateDescription vmstate_riscv_cpu = {
     .name = "cpu",
     .version_id = 12,
     .minimum_version_id = 12,
-#ifdef CONFIG_KVM
     .pre_load = riscv_cpu_kvm_pre_load,
-#endif
     .post_load = riscv_cpu_post_load,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT64_ARRAY(env.gpr, RISCVCPU, 32),
@@ -563,10 +557,8 @@ const VMStateDescription vmstate_riscv_cpu = {
         &vmstate_vector,
         &vmstate_pointermasking,
         &vmstate_rv128,
-#ifdef CONFIG_KVM
         &vmstate_kvmtimer,
         &vmstate_kvm_mp_state,
-#endif
         &vmstate_envcfg,
         &vmstate_debug,
         &vmstate_smstateen,
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index 28a6ff8553..b5ec6cdcd8 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -23,7 +23,6 @@ riscv_stubs_ss = ss.source_set()
 riscv_system_ss = ss.source_set()
 riscv_system_ss.add(files(
   'monitor.c',
-  'machine.c',
   'time_helper.c',
 ))
 
@@ -37,6 +36,7 @@ riscv_user_ss.add(files(
 riscv_common_system_ss.add(files(
   'arch_dump.c',
   'cpu.c',
+  'machine.c',
   'riscv-qmp-cmds.c',
 ))
 

-- 
2.52.0

[PATCH 16/18] target/riscv: Compile machine.c once

[Anton Johansson via]

There's now also no change in migration stream between KVM/non-KVM
configurations, KVM fields are filtered out via .is_needed().

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/machine.c   | 10 +---------
 target/riscv/meson.build |  2 +-
 2 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index bf203bffce..ddcab8a667 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -21,12 +21,10 @@
 #include "qemu/error-report.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
-#include "migration/cpu.h"
+#include "migration/vmstate.h"
 #include "exec/icount.h"
 #include "target/riscv/tcg/debug.h"
-#ifdef CONFIG_KVM
 #include "kvm/kvm_riscv.h"
-#endif
 
 static bool pmp_needed(void *opaque)
 {
@@ -196,7 +194,6 @@ static const VMStateDescription vmstate_rv128 = {
     }
 };
 
-#ifdef CONFIG_KVM
 static bool kvmtimer_needed(void *opaque)
 {
     return kvm_enabled();
@@ -262,7 +259,6 @@ static const VMStateDescription vmstate_kvm_mp_state = {
         VMSTATE_END_OF_LIST()
     }
 };
-#endif
 
 static bool debug_needed(void *opaque)
 {
@@ -499,9 +495,7 @@ const VMStateDescription vmstate_riscv_cpu = {
     .name = "cpu",
     .version_id = 12,
     .minimum_version_id = 12,
-#ifdef CONFIG_KVM
     .pre_load = riscv_cpu_kvm_pre_load,
-#endif
     .post_load = riscv_cpu_post_load,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT64_ARRAY(env.gpr, RISCVCPU, 32),
@@ -563,10 +557,8 @@ const VMStateDescription vmstate_riscv_cpu = {
         &vmstate_vector,
         &vmstate_pointermasking,
         &vmstate_rv128,
-#ifdef CONFIG_KVM
         &vmstate_kvmtimer,
         &vmstate_kvm_mp_state,
-#endif
         &vmstate_envcfg,
         &vmstate_debug,
         &vmstate_smstateen,
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index 28a6ff8553..b5ec6cdcd8 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -23,7 +23,6 @@ riscv_stubs_ss = ss.source_set()
 riscv_system_ss = ss.source_set()
 riscv_system_ss.add(files(
   'monitor.c',
-  'machine.c',
   'time_helper.c',
 ))
 
@@ -37,6 +36,7 @@ riscv_user_ss.add(files(
 riscv_common_system_ss.add(files(
   'arch_dump.c',
   'cpu.c',
+  'machine.c',
   'riscv-qmp-cmds.c',
 ))
 

-- 
2.52.0

Re: [PATCH 16/18] target/riscv: Compile machine.c once

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> There's now also no change in migration stream between KVM/non-KVM
> configurations, KVM fields are filtered out via .is_needed().
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/machine.c   | 10 +---------
>  target/riscv/meson.build |  2 +-
>  2 files changed, 2 insertions(+), 10 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 17/18] target/riscv: Compile time_helper.c once

[Anton Johansson via qemu development]

File is already agnostic to target specifics at this point.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index b5ec6cdcd8..d20eaa2269 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -23,7 +23,6 @@ riscv_stubs_ss = ss.source_set()
 riscv_system_ss = ss.source_set()
 riscv_system_ss.add(files(
   'monitor.c',
-  'time_helper.c',
 ))
 
 riscv_user_ss = ss.source_set()
@@ -38,6 +37,7 @@ riscv_common_system_ss.add(files(
   'cpu.c',
   'machine.c',
   'riscv-qmp-cmds.c',
+  'time_helper.c',
 ))
 
 subdir('tcg')

-- 
2.52.0

[PATCH 17/18] target/riscv: Compile time_helper.c once

[Anton Johansson via]

File is already agnostic to target specifics at this point.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index b5ec6cdcd8..d20eaa2269 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -23,7 +23,6 @@ riscv_stubs_ss = ss.source_set()
 riscv_system_ss = ss.source_set()
 riscv_system_ss.add(files(
   'monitor.c',
-  'time_helper.c',
 ))
 
 riscv_user_ss = ss.source_set()
@@ -38,6 +37,7 @@ riscv_common_system_ss.add(files(
   'cpu.c',
   'machine.c',
   'riscv-qmp-cmds.c',
+  'time_helper.c',
 ))
 
 subdir('tcg')

-- 
2.52.0

Re: [PATCH 17/18] target/riscv: Compile time_helper.c once

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson via qemu development wrote:
> File is already agnostic to target specifics at this point.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/meson.build | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

[PATCH 18/18] target/riscv: Compile monitor.c once

[Anton Johansson via qemu development]

Replaces uses of target_ulong with vaddr/hwaddr/uint64_t where
appropriate.

Note: This commit will print all addresses as 64-bit values, even for a
32-bit target. If breaking this interface is not an option we can
instead opt for more runtime branching, as done by Joel Stanley
in commit 409c7d8682a.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/monitor.c   | 42 ++++++++++++++++++------------------------
 target/riscv/meson.build |  2 +-
 2 files changed, 19 insertions(+), 25 deletions(-)

diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index fc61638702..24c5244c36 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -21,35 +21,29 @@
 #include "qemu/osdep.h"
 #include "qemu/ctype.h"
 #include "qemu/qemu-print.h"
-#include "exec/target_long.h"
-#include "cpu.h"
+#include "target/riscv/cpu.h"
+#include "target/riscv/cpu_bits.h"
 #include "target/riscv/tcg/csr.h"
-#include "cpu_bits.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp.h"
 #include "system/memory.h"
 #include "internals.h"
 
-#ifdef TARGET_RISCV64
 #define PTE_HEADER_FIELDS       "vaddr            paddr            "\
                                 "size             attr\n"
 #define PTE_HEADER_DELIMITER    "---------------- ---------------- "\
                                 "---------------- -------\n"
-#else
-#define PTE_HEADER_FIELDS       "vaddr    paddr            size     attr\n"
-#define PTE_HEADER_DELIMITER    "-------- ---------------- -------- -------\n"
-#endif
 
 #ifdef CONFIG_HMP
 
 /* Perform linear address sign extension */
-static target_ulong addr_canonical(int va_bits, target_ulong addr)
+static vaddr addr_canonical(int va_bits, vaddr addr)
 {
-#ifdef TARGET_RISCV64
-    if (addr & (1UL << (va_bits - 1))) {
-        addr |= (hwaddr)-(1L << va_bits);
+    if (target_riscv64()) {
+        if (addr & (1UL << (va_bits - 1))) {
+            addr |= (hwaddr)-(1L << va_bits);
+        }
     }
-#endif
 
     return addr;
 }
@@ -60,8 +54,8 @@ static void print_pte_header(MonitorHMP *hmp)
     monitor_hmp_printf(hmp, PTE_HEADER_DELIMITER);
 }
 
-static void print_pte(MonitorHMP *hmp, int va_bits, target_ulong vaddr,
-                      hwaddr paddr, target_ulong size, int attr)
+static void print_pte(MonitorHMP *hmp, int va_bits, vaddr vaddr,
+                      hwaddr paddr, uint64_t size, int attr)
 {
     /* sanity check on vaddr */
     if (vaddr >= (1UL << va_bits)) {
@@ -72,7 +66,7 @@ static void print_pte(MonitorHMP *hmp, int va_bits, target_ulong vaddr,
         return;
     }
 
-    monitor_hmp_printf(hmp, TARGET_FMT_lx " " HWADDR_FMT_plx " " TARGET_FMT_lx
+    monitor_hmp_printf(hmp, "%016" VADDR_PRIx " " HWADDR_FMT_plx " %016" PRIx64
                        " %c%c%c%c%c%c%c\n",
                        addr_canonical(va_bits, vaddr),
                        paddr, size,
@@ -86,17 +80,17 @@ static void print_pte(MonitorHMP *hmp, int va_bits, target_ulong vaddr,
 }
 
 static void walk_pte(MonitorHMP *hmp, AddressSpace *as,
-                     hwaddr base, target_ulong start,
+                     hwaddr base, uint64_t start,
                      int level, int ptidxbits, int ptesize, int va_bits,
-                     target_ulong *vbase, hwaddr *pbase, hwaddr *last_paddr,
-                     target_ulong *last_size, int *last_attr)
+                     vaddr *vbase, hwaddr *pbase, hwaddr *last_paddr,
+                     uint64_t *last_size, int *last_attr)
 {
     const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     hwaddr pte_addr;
     hwaddr paddr;
-    target_ulong last_start = -1;
-    target_ulong pgsize;
-    target_ulong pte;
+    uint64_t last_start = -1;
+    uint64_t pgsize;
+    uint64_t pte;
     int ptshift;
     int attr;
     int idx;
@@ -158,10 +152,10 @@ static void mem_info_svxx(MonitorHMP *hmp, CPUArchState *env)
     AddressSpace *as = env_cpu(env)->as;
     int levels, ptidxbits, ptesize, vm, va_bits;
     hwaddr base;
-    target_ulong vbase;
+    vaddr vbase;
     hwaddr pbase;
     hwaddr last_paddr;
-    target_ulong last_size;
+    uint64_t last_size;
     int last_attr;
 
     if (riscv_cpu_mxl(env) == MXL_RV32) {
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index d20eaa2269..a28466515e 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -22,7 +22,6 @@ riscv_stubs_ss = ss.source_set()
 
 riscv_system_ss = ss.source_set()
 riscv_system_ss.add(files(
-  'monitor.c',
 ))
 
 riscv_user_ss = ss.source_set()
@@ -36,6 +35,7 @@ riscv_common_system_ss.add(files(
   'arch_dump.c',
   'cpu.c',
   'machine.c',
+  'monitor.c',
   'riscv-qmp-cmds.c',
   'time_helper.c',
 ))

-- 
2.52.0

[PATCH 18/18] target/riscv: Compile monitor.c once

[Anton Johansson via]

Replaces uses of target_ulong with vaddr/hwaddr/uint64_t where
appropriate.

Note: This commit will print all addresses as 64-bit values, even for a
32-bit target. If breaking this interface is not an option we can
instead opt for more runtime branching, as done by Joel Stanley
in commit 409c7d8682a.

Signed-off-by: Anton Johansson <anjo@rev.ng>
---
 target/riscv/monitor.c   | 42 ++++++++++++++++++------------------------
 target/riscv/meson.build |  2 +-
 2 files changed, 19 insertions(+), 25 deletions(-)

diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index fc61638702..24c5244c36 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -21,35 +21,29 @@
 #include "qemu/osdep.h"
 #include "qemu/ctype.h"
 #include "qemu/qemu-print.h"
-#include "exec/target_long.h"
-#include "cpu.h"
+#include "target/riscv/cpu.h"
+#include "target/riscv/cpu_bits.h"
 #include "target/riscv/tcg/csr.h"
-#include "cpu_bits.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp.h"
 #include "system/memory.h"
 #include "internals.h"
 
-#ifdef TARGET_RISCV64
 #define PTE_HEADER_FIELDS       "vaddr            paddr            "\
                                 "size             attr\n"
 #define PTE_HEADER_DELIMITER    "---------------- ---------------- "\
                                 "---------------- -------\n"
-#else
-#define PTE_HEADER_FIELDS       "vaddr    paddr            size     attr\n"
-#define PTE_HEADER_DELIMITER    "-------- ---------------- -------- -------\n"
-#endif
 
 #ifdef CONFIG_HMP
 
 /* Perform linear address sign extension */
-static target_ulong addr_canonical(int va_bits, target_ulong addr)
+static vaddr addr_canonical(int va_bits, vaddr addr)
 {
-#ifdef TARGET_RISCV64
-    if (addr & (1UL << (va_bits - 1))) {
-        addr |= (hwaddr)-(1L << va_bits);
+    if (target_riscv64()) {
+        if (addr & (1UL << (va_bits - 1))) {
+            addr |= (hwaddr)-(1L << va_bits);
+        }
     }
-#endif
 
     return addr;
 }
@@ -60,8 +54,8 @@ static void print_pte_header(MonitorHMP *hmp)
     monitor_hmp_printf(hmp, PTE_HEADER_DELIMITER);
 }
 
-static void print_pte(MonitorHMP *hmp, int va_bits, target_ulong vaddr,
-                      hwaddr paddr, target_ulong size, int attr)
+static void print_pte(MonitorHMP *hmp, int va_bits, vaddr vaddr,
+                      hwaddr paddr, uint64_t size, int attr)
 {
     /* sanity check on vaddr */
     if (vaddr >= (1UL << va_bits)) {
@@ -72,7 +66,7 @@ static void print_pte(MonitorHMP *hmp, int va_bits, target_ulong vaddr,
         return;
     }
 
-    monitor_hmp_printf(hmp, TARGET_FMT_lx " " HWADDR_FMT_plx " " TARGET_FMT_lx
+    monitor_hmp_printf(hmp, "%016" VADDR_PRIx " " HWADDR_FMT_plx " %016" PRIx64
                        " %c%c%c%c%c%c%c\n",
                        addr_canonical(va_bits, vaddr),
                        paddr, size,
@@ -86,17 +80,17 @@ static void print_pte(MonitorHMP *hmp, int va_bits, target_ulong vaddr,
 }
 
 static void walk_pte(MonitorHMP *hmp, AddressSpace *as,
-                     hwaddr base, target_ulong start,
+                     hwaddr base, uint64_t start,
                      int level, int ptidxbits, int ptesize, int va_bits,
-                     target_ulong *vbase, hwaddr *pbase, hwaddr *last_paddr,
-                     target_ulong *last_size, int *last_attr)
+                     vaddr *vbase, hwaddr *pbase, hwaddr *last_paddr,
+                     uint64_t *last_size, int *last_attr)
 {
     const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     hwaddr pte_addr;
     hwaddr paddr;
-    target_ulong last_start = -1;
-    target_ulong pgsize;
-    target_ulong pte;
+    uint64_t last_start = -1;
+    uint64_t pgsize;
+    uint64_t pte;
     int ptshift;
     int attr;
     int idx;
@@ -158,10 +152,10 @@ static void mem_info_svxx(MonitorHMP *hmp, CPUArchState *env)
     AddressSpace *as = env_cpu(env)->as;
     int levels, ptidxbits, ptesize, vm, va_bits;
     hwaddr base;
-    target_ulong vbase;
+    vaddr vbase;
     hwaddr pbase;
     hwaddr last_paddr;
-    target_ulong last_size;
+    uint64_t last_size;
     int last_attr;
 
     if (riscv_cpu_mxl(env) == MXL_RV32) {
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index d20eaa2269..a28466515e 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -22,7 +22,6 @@ riscv_stubs_ss = ss.source_set()
 
 riscv_system_ss = ss.source_set()
 riscv_system_ss.add(files(
-  'monitor.c',
 ))
 
 riscv_user_ss = ss.source_set()
@@ -36,6 +35,7 @@ riscv_common_system_ss.add(files(
   'arch_dump.c',
   'cpu.c',
   'machine.c',
+  'monitor.c',
   'riscv-qmp-cmds.c',
   'time_helper.c',
 ))

-- 
2.52.0

Re: [PATCH 18/18] target/riscv: Compile monitor.c once

[Pierrick Bouvier]

On 10/1/2026 8:59 AM, Anton Johansson via qemu development wrote:
> Replaces uses of target_ulong with vaddr/hwaddr/uint64_t where
> appropriate.
> 
> Note: This commit will print all addresses as 64-bit values, even for a
> 32-bit target. If breaking this interface is not an option we can
> instead opt for more runtime branching, as done by Joel Stanley
> in commit 409c7d8682a.
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>  target/riscv/monitor.c   | 42 ++++++++++++++++++------------------------
>  target/riscv/meson.build |  2 +-
>  2 files changed, 19 insertions(+), 25 deletions(-)
> 

I can survive to the change for hmp, let's see if someone has a problem
with it.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Re: [PATCH 18/18] target/riscv: Compile monitor.c once

[Philippe Mathieu-Daudé]

On 1/10/26 17:59, Anton Johansson wrote:
> Replaces uses of target_ulong with vaddr/hwaddr/uint64_t where
> appropriate.
> 
> Note: This commit will print all addresses as 64-bit values, even for a
> 32-bit target. If breaking this interface is not an option we can
> instead opt for more runtime branching, as done by Joel Stanley
> in commit 409c7d8682a.

This is just about passing @width... mem_info_svxx() already gets MXL.

> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
>   target/riscv/monitor.c   | 42 ++++++++++++++++++------------------------
>   target/riscv/meson.build |  2 +-
>   2 files changed, 19 insertions(+), 25 deletions(-)


> -#ifdef TARGET_RISCV64
>   #define PTE_HEADER_FIELDS       "vaddr            paddr            "\
>                                   "size             attr\n"
>   #define PTE_HEADER_DELIMITER    "---------------- ---------------- "\
>                                   "---------------- -------\n"
> -#else
> -#define PTE_HEADER_FIELDS       "vaddr    paddr            size     attr\n"
> -#define PTE_HEADER_DELIMITER    "-------- ---------------- -------- -------\n"

Otherwise unifying this header LGTM.

> -#endif


> @@ -158,10 +152,10 @@ static void mem_info_svxx(MonitorHMP *hmp, CPUArchState *env)
>       AddressSpace *as = env_cpu(env)->as;
>       int levels, ptidxbits, ptesize, vm, va_bits;
>       hwaddr base;
> -    target_ulong vbase;
> +    vaddr vbase;
>       hwaddr pbase;
>       hwaddr last_paddr;
> -    target_ulong last_size;
> +    uint64_t last_size;
>       int last_attr;
>   
>       if (riscv_cpu_mxl(env) == MXL_RV32) {
             ^^^

Re: [PATCH 00/18] single-binary: target/riscv, compile subset of compilation units once

[Pierrick Bouvier]

Hi Anton,

I wanted to check test results, but unfortunately, based-on series does
not apply anymore. Would that be possible to respin this with all
patches (including the based-on), so it's self contained?

Well, if based-on is on the verge of being pulled by Alistair, this can
probably wait for this.

Regards,
Pierrick

On 10/1/2026 8:59 AM, Anton Johansson wrote:
> All compilation units which do not pull in helper definitions are
> compiled once for system mode by widening target_ulong to
> uint64_t.
> 
> This series is motivated by the fact that riscv64 already handles
> XLEN == 32 as a subset of the 64-bit ISA.  As such we can reduce
> duplicate compilation units by moving towards riscv64 as default.
> 
> If anyone more familiar with riscv is aware of differences between XLEN
> == 32 on riscv64 vs riscv32, please do let me know. No behaviour change
> is intended compared to riscv32.
> 
> Based on: 20260916-hw-riscv-cpu-int-v4-0-babc367b60f5@rev.ng
> 
> Signed-off-by: Anton Johansson <anjo@rev.ng>
> ---
> Anton Johansson (18):
>       target/riscv: Make internals.h target agnostic
>       target/riscv: meson, add user and common system source sets
>       target/riscv: Move pmu CSR read to csr.h
>       target/riscv: Make debug.c target agnostic
>       target/riscv: Widen CSR ops to 64-bit and compile once for system-mode
>       target/riscv: Runtime CPU registration
>       target/riscv: Runtime register MAX and BARE CPUs
>       target/riscv: cpu.c unconditionally check larger MXL
>       target/riscv: Stub KVM functions for machines.c/cpu.c
>       target/riscv: Compile cpu.c once for system-mode
>       target/riscv: Compile cpu_helper.c once for system-mode
>       target/riscv: Compile tcg-cpu.c once for system-mode
>       target/riscv: Compile riscv-qmp-cmds.c once
>       target/riscv: Compile pmp.c once
>       target/riscv: Compile arch_dump.c once
>       target/riscv: Compile machine.c once
>       target/riscv: Compile time_helper.c once
>       target/riscv: Compile monitor.c once
> 
>  target/riscv/cpu.h                  |   1 +
>  target/riscv/internals.h            |  31 +-
>  target/riscv/tcg/csr.h              |  37 +-
>  target/riscv/tcg/debug.h            |  11 +-
>  target/riscv/tcg/pmu.h              |   3 -
>  target/riscv/tcg/vector_internals.h |   5 +-
>  target/riscv/arch_dump.c            |  13 +-
>  target/riscv/cpu.c                  | 259 ++++++++-----
>  target/riscv/gdbstub.c              |   2 +-
>  target/riscv/kvm/kvm-stub.c         |  21 +
>  target/riscv/machine.c              |  10 +-
>  target/riscv/monitor.c              |  45 +--
>  target/riscv/tcg/cpu_helper.c       |  79 ++--
>  target/riscv/tcg/csr.c              | 736 ++++++++++++++++++------------------
>  target/riscv/tcg/debug.c            | 150 ++++----
>  target/riscv/tcg/mips_csr.c         |  12 +-
>  target/riscv/tcg/op_helper.c        |   6 +-
>  target/riscv/tcg/pmp.c              |  19 +-
>  target/riscv/tcg/pmu.c              |   9 +-
>  target/riscv/tcg/tcg-cpu.c          |   8 +-
>  target/riscv/tcg/th_csr.c           |   6 +-
>  target/riscv/tcg/vector_helper.c    |  64 ++--
>  target/riscv/meson.build            |  18 +-
>  target/riscv/tcg/meson.build        |  21 +-
>  24 files changed, 826 insertions(+), 740 deletions(-)
>