This patch set introduces support for the RISC-V Smsdid and Smmpt
(Supervisor Domain Identifier and Memory Protection Table) extensions
v0.4.9(https://github.com/riscv/riscv-smmtt/releases/tag/v0.4.9).
Smmpt provides a hardware mechanism for fine-grained memory protection,
checked after address translation, which is particularly useful for
supervisor-level sandboxing and security monitoring.

The rfc patch set:
https://mail.gnu.org/archive/html/qemu-riscv/2025-09/msg00216.html

Rahul Pathak is working on SMMPT OpenSBI support -
https://lists.infradead.org/pipermail/opensbi/2026-July/010235.html

based on his QEMU SMMPT branch -
https://github.com/pathakraul/qemu/tree/rpathak_smmpt_v1

As we all agree -
https://patchew.org/QEMU/20260715145016.17369-1-zhiwei._5Fliu@linux.alibaba.com/
, we will collaborate on this work and not duplicate efforts. Rahul will
focus on OpenSBI upstream and I will update the QEMU patch set to v8.

Xiangyi will review the OpenSBI SMMPT patch set and may collaborate to
upstream the other parts, such as SMSDIA and IOMPT.

v7->v8:
    1. Update the mfence.pa and minval.pa instruction encodings to match the
       upstream riscv-opcodes definition
       (https://github.com/riscv/riscv-opcodes/pull/389/): mfence.pa now uses
       funct7=0b0011001 and minval.pa uses funct7=0b0011011. The decoder,
       disassembler and the system test are updated accordingly.

v6->v7:
    The implementation is updated from the v0.3.4 specification to
    v0.4.9. The main changes are:
    1. Update the mmpt CSR number to 0x382 and msdcfg to 0x74E.
    2. Update the mmpt register layout: the SDID and PPN field positions
       changed and the RV64 PPN is now 44 bits.
    3. Rework the MPTE format: the N (NAPOT) bit now lives at bit 2, the
       non-leaf NAPOT form is removed, NAPOT leaf entries encode a single
       XWR tuple plus a G granularity field, and non-NAPOT leaf entries
       hold per-page XWR tuples.
    4. Treat XWR=000 as "no access" and a non-leaf entry with N=1 as a
       fault.
    5. Enforce the Smmpt64 root-table PPN alignment (low 3 bits zero).
    6. Rename the fence instructions mfence.spa/minval.spa to
       mfence.pa/minval.pa.
    7. Drop stale Reviewed-by tags on the substantially reworked patches.
    8. Introduce the configurable "smmpt-sdidlen" CPU property.
    9. Add disassembly support for the Smmpt.
    10. Add bare-metal M-mode system tests.
    11. Rebase to master.

v5->v6:
    1. Use explicitly bit fields extract instead of mpte_union_t.
    2. Use the same exception behavior for MPT valiation as PMP
       valiation.
    3. Use PAGE_* instead of MPT_ACCESS_* as they have same value.
    4. Use address_space_*_le instead of address_space_* for SMMPT.
    5. Only print SMMPT address check log when SMMPT is enabled.
    6. Add implied rule for SMMPT as it depends on SMSDID.
    7. Rebase to master.

v4->v5:
    1. Rebase to master.
v3->v4:
    1. Add missing review tags.
v2->v3:
    1. Fix build error in patch 2.
    2. Rebase to master.

rfc->v2:
    1. When ext_smmpt is false or BARE mode, make other fields in mmpt
       CSR zero.
    2. Add patch 5 to fix smrnmi ISA string order.
    3. Fix patch 6 smmpt and smsdid ISA string order.
    4. Make smmpt and smsdid experiment extensions.
    5. Add review tags.

LIU Zhiwei (11):
  target/riscv: Add basic definitions and CSRs for SMMPT
  target/riscv: Add smmpt-sdidlen property for the mmpt SDID field
  target/riscv: Implement core SMMPT lookup logic
  target/riscv: Integrate SMMPT checks into MMU and TLB fill
  target/riscv: Implement SMMPT fence instructions
  target/riscv: Fix smrnmi isa alphabetical order
  target/riscv: Add disassembly for Smmpt instructions and CSRs
  target/riscv: Enable SMMPT extension
  target/riscv: Add system test for SMMPT extension
  target/riscv: Add system tests for Smmpt52 and Smmpt64
  target/riscv: Add system test for Smmpt34

 disas/riscv.c                                 |   9 +-
 target/riscv/cpu.c                            |  60 +++-
 target/riscv/cpu.h                            |   8 +
 target/riscv/cpu_bits.h                       |  27 ++
 target/riscv/cpu_cfg_fields.h.inc             |   3 +
 target/riscv/insn32.decode                    |   2 +
 target/riscv/meson.build                      |   1 +
 target/riscv/riscv_smmpt.c                    | 339 ++++++++++++++++++
 target/riscv/riscv_smmpt.h                    |  26 ++
 target/riscv/tcg/cpu_helper.c                 | 119 +++++-
 target/riscv/tcg/csr.c                        | 106 ++++++
 .../tcg/insn_trans/trans_privileged.c.inc     |  30 ++
 target/riscv/tcg/pmp.h                        |   3 +
 tests/tcg/riscv64/Makefile.softmmu-target     |  12 +
 tests/tcg/riscv64/smmpt-common.S              | 257 +++++++++++++
 tests/tcg/riscv64/test-smmpt.S                |  85 +++++
 tests/tcg/riscv64/test-smmpt34.S              |  97 +++++
 tests/tcg/riscv64/test-smmpt52.S              |  91 +++++
 tests/tcg/riscv64/test-smmpt64.S              |  98 +++++
 19 files changed, 1354 insertions(+), 19 deletions(-)
 create mode 100644 target/riscv/riscv_smmpt.c
 create mode 100644 target/riscv/riscv_smmpt.h
 create mode 100644 tests/tcg/riscv64/smmpt-common.S
 create mode 100644 tests/tcg/riscv64/test-smmpt.S
 create mode 100644 tests/tcg/riscv64/test-smmpt34.S
 create mode 100644 tests/tcg/riscv64/test-smmpt52.S
 create mode 100644 tests/tcg/riscv64/test-smmpt64.S


base-commit: 499039798cdad7d86b787fec0eaf1da4151c0f05
-- 
2.43.0