udb 0.1.9 → 0.1.14

data/.data/spec/custom/isa/qc_iu/ext/Xqccmi.yaml

@@ -0,0 +1,290 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../schemas/ext_schema.json
+
+$schema: ext_schema.json#
+kind: extension
+name: Xqccmi
+long_name: Qualcomm Custom Compressed Instruction Lookup Table
+description: |
+  == Xqccmi: Qualcomm Custom Compressed Instruction Lookup Table
+
+  The Xqccmi extension adds the `qc.cm.ilut` instruction, a 16-bit compressed
+  instruction that fetches and executes one or two packed instructions from an
+  Instruction Lookup Table (ILUT) stored in memory. The extension also defines
+  two new user-level CSRs: `qc.itba` (ILUT Base Address) and `qc.itdec` (ILUT
+  Double Entry Count).
+
+  NOTE: Xqccmi uses the same encoding space as the `c.fld` instruction defined
+  by the Zcd extension (bits[1:0]=00, bits[15:13]=001). Therefore, Xqccmi and
+  Zcd are mutually exclusive and cannot be implemented together.
+
+  === Instruction Lookup Table (ILUT)
+
+  `qc.cm.ilut` is a 16-bit instruction that takes an 11-bit immediate index
+  (range 0..2047) into the ILUT. The ILUT base address is held in the `qc.itba`
+  CSR (address 0x800). The instruction architecturally behaves as the
+  sub-instruction(s) stored at the addressed ILUT entry, executed in order.
+
+  ILUT memory is treated as instruction memory. It requires execute (X)
+  permission and does NOT require read (R) permission. A `fence.i` instruction
+  must be executed after any write to ILUT memory to guarantee that subsequent
+  `qc.cm.ilut` executions observe the updated contents.
+
+  === qc.itba CSR (Address 0x800)
+
+  The `qc.itba` CSR holds the base address of the ILUT.
+
+  [cols="^1,^1,^3,^3",options="header"]
+  |===
+  | Bits   | Name     | Access      | Description
+  | 31:6   | base     | WARL (RW)   | 64-byte aligned base address of the ILUT. Bits[5:0] of the physical base address are implicitly zero.
+  | 5:0    | mode     | Read-only 0 | Reserved for future use. Always reads as zero; writes are ignored.
+  |===
+
+  `qc.itba` is a user-level read/write CSR. Software must save and restore
+  `qc.itba` on context switches.
+
+  === qc.itdec CSR (Address 0x801) — Double Entry Count
+
+  The `qc.itdec` CSR specifies how many of the leading ILUT entries are 64-bit
+  double entries. All remaining entries are 32-bit.
+
+  [cols="^1,^1,^3,^3",options="header"]
+  |===
+  | Bits   | Name | Access      | Description
+  | 13:3   | dec  | WARL (RW)   | 11-bit double entry count. Legal range: 0..2047. Reset value: 0.
+  | 31:14  | —    | Read-only 0 | Reserved. Always reads as zero; writes are ignored.
+  | 2:0    | —    | Read-only 0 | Reserved. Always reads as zero; writes are ignored.
+  |===
+
+  `qc.itdec` is a user-level read/write CSR. The default reset value of 0
+  selects backward-compatible mode in which all entries are 32-bit.
+
+  === Table Layout
+
+  The first DEC logical entries (indices 0 through DEC−1) are 64-bit double
+  entries. The remaining entries (indices DEC through 2047) are 32-bit entries.
+
+  The byte offset from the ILUT base address for logical index _i_ is:
+
+  * If _i_ < DEC: offset = _i_ × 8
+  * If _i_ ≥ DEC: offset = DEC × 8 + (_i_ − DEC) × 4
+
+  The maximum table size is DEC×8 + (2048−DEC)×4 bytes. This ranges from
+  approximately 8 KB (DEC=0, all 32-bit entries) up to approximately 16 KB
+  (DEC=2047, nearly all 64-bit entries). No alignment constraint beyond the
+  64-byte base alignment imposed by `qc.itba` is required for individual entries.
+
+  === Dual-Instruction Packing
+
+  Each ILUT entry may contain one or two instructions packed together.
+  Instruction sizes are determined by the standard RISC-V instruction-length
+  encoding (bits[1:0] of each sub-instruction).
+
+  ==== 32-bit Entry Valid Combinations
+
+  [cols="^1,^3",options="header"]
+  |===
+  | Combination             | Description
+  | One 32-bit instruction  | bits[1:0] == 2'b11; the entire 32-bit entry is a single RVI instruction.
+  | Two 16-bit instructions | bits[1:0] != 2'b11; the first 16-bit RVC instruction occupies bits[15:0] and the second occupies bits[31:16].
+  |===
+
+  ==== 64-bit Entry Valid Combinations
+
+  [cols="^1,^3",options="header"]
+  |===
+  | Combination               | Description
+  | 16 + 32 bits              | First instruction is 16-bit (bits[1:0] != 2'b11); second instruction is 32-bit.
+  | 16 + 48 bits              | First instruction is 16-bit; second instruction is 48-bit.
+  | 32 + 16 bits              | First instruction is 32-bit (bits[1:0] == 2'b11); second instruction is 16-bit occupying bits[47:32].
+  | 32 + 32 bits              | Both instructions are 32-bit.
+  | Single 48-bit instruction | A single 48-bit instruction occupying bits[47:0]; bits[63:48] must be padded with `c.nop` (16'h0001).
+  |===
+
+  A single 32-bit instruction placed in a 64-bit entry is valid as the 32+16
+  case with `c.nop` (16'h0001) padding in bits[63:48].
+
+  Unused bits in any entry MUST be padded with `c.nop` (16'h0001). Instruction
+  combinations that do not fit within the entry size cause an illegal instruction
+  exception. Instruction sizes are determined by the standard RISC-V
+  instruction-length encoding (bits[1:0] of each sub-instruction).
+
+  === Instruction Restrictions
+
+  Any instruction that references PC as an input or output is NOT permitted
+  in the ILUT. If any such instruction is present in the entry, an
+  IllegalInstruction exception is raised before any sub-instruction in the
+  entry takes architectural effect.
+
+  Forbidden instructions fall into three categories:
+
+  * *PC-relative instructions* (read PC as input):
+  ** `auipc`
+  ** All branch instructions (`beq`, `bne`, `blt`, `bge`, `bltu`, `bgeu`,
+     `c.beqz`, `c.bnez`, etc.)
+  ** PC-relative jump instructions (`jal`, `c.j`, `c.jal`)
+
+  * *Register-indirect jumps* (write PC as output):
+  ** `jalr`
+  ** `c.jr`
+  ** `c.jalr`
+
+  * *Return instructions* (write PC as output):
+  ** `cm.popret`
+  ** `cm.popretz`
+  ** `qc.cm.popret`
+  ** `qc.cm.popretz`
+
+  The following push/pop instructions are explicitly *allowed* in ILUT entries
+  because they do not reference PC:
+  `cm.push`, `cm.pop`, `qc.cm.push`, `qc.cm.pushfp`, `qc.cm.pop`.
+
+  16-bit compressed instructions (bits[1:0] != 2'b11) are otherwise valid
+  in ILUT entries.
+
+  === Execution Model
+
+  The PC points to the `qc.cm.ilut` instruction throughout the execution of all
+  sub-instructions contained within the fetched ILUT entry. Sub-instructions
+  execute sequentially and independently:
+
+  * The architectural state changes produced by the first sub-instruction are
+    visible to the second sub-instruction and to any subsequent trap handler.
+  * Each sub-instruction can trap independently; traps are taken precisely at the
+    sub-instruction that caused them, not deferred.
+  * After the final sub-instruction completes, the PC advances past `qc.cm.ilut`
+    normally.
+
+  === Exception Handling
+
+  On any trap (exception, interrupt, NMI, or double-trap) occurring during the
+  execution of a sub-instruction fetched from the ILUT:
+
+  * mepc (or mnepc for a double-trap) is set to the PC of `qc.cm.ilut`.
+  * Bit 0 of mepc/mnepc encodes which sub-instruction was executing when the trap
+    occurred:
+  ** Bit 0 = 0: the trap occurred during the first (or only) sub-instruction.
+  ** Bit 0 = 1: the trap occurred during the second sub-instruction (the
+     architectural effects of the first sub-instruction are already visible).
+
+  On trap return (`mret`, `qc.c.mret`, `qc.c.mnret`, `qc.c.mileaveret`), $pc is
+  restored directly from mepc/mnepc including bit 0:
+
+  * If bit 0 = 0: `qc.cm.ilut` re-executes from the beginning, running both
+    sub-instructions.
+  * If bit 0 = 1: `qc.cm.ilut` skips the first sub-instruction and executes only
+    the second.
+
+  Bit 0 of mepc/mnepc is readable and writable in this architecture.
+  Software may explicitly set bit 0 to 1 to force resumption from the second
+  sub-instruction.
+
+  NOTE: This is an architectural exception to the standard RISC-V requirement
+  that *epc bit 0 is always zero. The non-zero bit 0 encodes which sub-instruction
+  within the ILUT entry was interrupted, enabling precise trap restart.
+
+  === Encoding
+
+  `qc.cm.ilut` uses the same encoding as `c.fld` (bits[1:0]=00,
+  bits[15:13]=001). Xqccmi is therefore mutually exclusive with the Zcd
+  extension.
+
+  [cols="^2,^5,^2",options="header"]
+  |===
+  | Bits[15:13] | Bits[12:2]       | Bits[1:0]
+  | 001         | ilut_index[10:0] | 00
+  |===
+
+  The 11-bit `ilut_index` field (bits[12:2]) encodes the logical index into the
+  ILUT, selecting one of up to 2048 entries.
+
+  === Instruction Summary
+
+  [%header,cols="^1,^1,4,8"]
+  |===
+  |RV32
+  |RV64
+  |Mnemonic
+  |Instruction
+
+  |yes
+  |no
+  |qc.cm.ilut _index_
+  |<<#insns-qc_cm_ilut>>
+
+  |===
+type: unprivileged
+versions:
+- version: "0.1.0"
+  state: development
+  contributors:
+  - name: Albert Yosher
+    company: Qualcomm Technologies, Inc.
+    email: ayosher@qti.qualcomm.com
+  - name: Derek Hower
+    company: Qualcomm Technologies, Inc.
+    email: dhower@qti.qualcomm.com
+  - name: Gil Zukerman
+    company: Qualcomm Technologies, Inc.
+    email: gzukerma@qti.qualcomm.com
+  changes:
+    - Initial version. Custom instruction lookup table extension with dual-instruction
+      packing and 64-bit double entries. Supports 16-bit, 32-bit, and 48-bit instructions
+      in the ILUT. Introduces qc.itba and qc.itdec CSRs.
+  requirements:
+    allOf:
+      - extension:
+          name: Zca
+          version: ">= 1.0.0"
+      - extension:
+          name: Zicsr
+          version: ">= 2.0.0"
+      - not:
+          extension:
+            name: Zcd
+- version: "0.2.0"
+  state: development
+  contributors:
+  - name: Albert Yosher
+    company: Qualcomm Technologies, Inc.
+    email: ayosher@qti.qualcomm.com
+  - name: Derek Hower
+    company: Qualcomm Technologies, Inc.
+    email: dhower@qti.qualcomm.com
+  - name: Gil Zukerman
+    company: Qualcomm Technologies, Inc.
+    email: gzukerma@qti.qualcomm.com
+  changes:
+    - >-
+      Precise trap semantics: each sub-instruction in an ILUT entry can now trap
+      independently. Traps are taken immediately at the faulting sub-instruction
+      rather than being deferred.
+    - >-
+      Resume mechanism: bit 0 of mepc/mnepc encodes which sub-instruction caused
+      the trap. On trap return, qc.cm.ilut re-enters with PC bit 0 reflecting this
+      value; if set, the first sub-instruction is skipped and only the second is
+      re-executed.
+    - >-
+      mepc/mnepc bit 0 is readable and writable in this architecture.
+      Software may set bit 0 to 1 to force resumption from the second sub-instruction.
+    - >-
+      Expanded ILUT instruction restrictions to all PC-referencing instructions:
+      added register-indirect jumps (jalr, c.jr, c.jalr) and return instructions
+      (cm.popret, cm.popretz, qc.cm.popret, qc.cm.popretz) to the forbidden list.
+    - >-
+      Spec language audit: removed all implementation-implying language; descriptions
+      now define architectural behavior only.
+  requirements:
+    allOf:
+      - extension:
+          name: Zca
+          version: ">= 1.0.0"
+      - extension:
+          name: Zicsr
+          version: ">= 2.0.0"
+      - not:
+          extension:
+            name: Zcd

data/.data/spec/custom/isa/qc_iu/ext/Xqccmt.yaml

@@ -0,0 +1,127 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../schemas/ext_schema.json
+
+$schema: ext_schema.json#
+kind: extension
+name: Xqccmt
+long_name: Qualcomm Custom Compressed Jump Table with Alternate Link Register
+description: |
+  Xqccmt is a Qualcomm custom extension that provides compressed (16-bit) jump table
+  instructions for code-size reduction. It introduces two instructions, `qc.cm.jt` and
+  `qc.cm.jalt`, which perform indirect jumps through a jump vector table (JVT) whose
+  base address is held in the `jvt` CSR.
+
+  === Jump Vector Table
+
+  The jump vector table is an array of XLEN-wide entries stored in memory. Its base
+  address is configured by writing to the `jvt` CSR. The base address must be aligned
+  to a 64-byte boundary (the lower 6 bits of the base are always zero). The memory
+  region pointed to by `jvt.BASE` is treated as instruction memory for the purpose of
+  execute-permission checks.
+
+  Each instruction encodes an 8-bit `index` field. The index selects which entry in the
+  table to use:
+
+  * Indices 0–31 (bits [7:5] of index == 0b000): used by `qc.cm.jt` (jump only, no link)
+  * Indices 32–255 (bits [7:5] of index != 0b000): used by `qc.cm.jalt` (jump with link)
+
+  The entry address is computed as: `entry_addr = {jvt.BASE, 6'b000000} + index × (XLEN/8)`
+
+  === Alternate Link Register
+
+  In standard table-jump behavior, a call instruction always saves the return address in
+  `ra` (x1). Xqccmt extends this by repurposing bit 0 of each call table entry (index ≥ 32)
+  as metadata to select the return address register:
+
+  * Entry bit 0 = 0: save return address in `ra` (x1)
+  * Entry bit 0 = 1: save return address in `t0` (x5), the alternate link register
+
+  Because XLEN-wide addresses are naturally aligned, bit 0 of a valid target address is
+  always zero. Xqccmt repurposes this always-zero bit as a one-bit selector without
+  affecting the jump target. The actual jump target is always computed with bit 0 forced
+  to zero: `target = {entry[XLEN-1:1], 1'b0}`.
+
+  For `qc.cm.jt` (index < 32), bit 0 of the table entry is not used as metadata; the
+  jump target is computed identically: `target = {entry[XLEN-1:1], 1'b0}`, and no link
+  register is written.
+
+  === Encoding
+
+  Both instructions use the 16-bit compressed encoding space (quadrant 2, funct3=0b101),
+  the same space used by `cm.jt` and `cm.jalt` in the standard Zcmt extension. Because
+  of this encoding overlap, Xqccmt and Zcmt are mutually exclusive and cannot both be
+  present in the same configuration.
+
+  The 16-bit encoding is:
+
+  [%header,cols="^1,^1,^1,^1,^1"]
+  |===
+  |[15:13]
+  |[12:10]
+  |[9:5]
+  |[4:2]
+  |[1:0]
+
+  |101
+  |index[7:5]
+  |index[4:0]
+  |000
+  |10
+  |===
+
+  When index[7:5] == 0b000, the instruction is `qc.cm.jt` (indices 0–31).
+  When index[7:5] != 0b000, the instruction is `qc.cm.jalt` (indices 32–255).
+
+  === JVT CSR Access Control
+
+  The `jvt` CSR is accessible at address 0x017. If the Smstateen extension is
+  implemented, access to `jvt` from non-M modes is gated by the JVT bit in the
+  `mstateen0` / `sstateen0` / `hstateen0` CSRs. Attempting to execute `qc.cm.jt` or
+  `qc.cm.jalt` when `jvt` is inaccessible raises an Illegal Instruction exception.
+
+  === Instruction Summary
+
+  [%header,cols="^1,^1,4,8"]
+  |===
+  |RV32
+  |RV64
+  |Mnemonic
+  |Instruction
+
+  |yes
+  |yes
+  |qc.cm.jt _index_
+  |<<#insns-qc_cm_jt>>
+
+  |yes
+  |yes
+  |qc.cm.jalt _index_
+  |<<#insns-qc_cm_jalt>>
+
+  |===
+type: unprivileged
+versions:
+- version: "0.1.0"
+  state: development
+  ratification_date: unknown
+  contributors:
+  - name: Albert Yosher
+    company: Qualcomm Technologies, Inc.
+    email: ayosher@qti.qualcomm.com
+  - name: Derek Hower
+    company: Qualcomm Technologies, Inc.
+    email: dhower@qti.qualcomm.com
+  changes:
+    - Initial version. Custom variant of Zcmt with alternate link register support.
+      Uses bit 0 of call table entries as metadata to select ra (x1) or t0 (x5)
+      as the return address register for qc.cm.jalt.
+  requirements:
+    allOf:
+      - extension:
+          name: Zca
+          version: ">= 1.0.0"
+      - extension:
+          name: Zicsr
+          version: ">= 2.0.0"

data/.data/spec/custom/isa/qc_iu/inst/Xqccmi/qc.cm.ilut.yaml

@@ -0,0 +1,136 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../../schemas/inst_schema.json
+
+$schema: "inst_schema.json#"
+kind: instruction
+name: qc.cm.ilut
+long_name: Instruction Lookup Table Execute
+description: |
+  Fetch and execute the instruction(s) packed in the ILUT entry at index `ilut_index`.
+
+  The ILUT base address is held in `qc.itba.base` (shifted left by 6 to form a
+  64-byte-aligned byte address). The first `qc.itdec.dec` entries are 64-bit
+  double entries; all remaining entries are 32-bit single entries.
+
+  Entry address calculation:
+  - If `ilut_index` < `qc.itdec.dec`: `entry_addr = (qc.itba.BASE << 6) + ilut_index * 8`
+  - Otherwise: `entry_addr = (qc.itba.BASE << 6) + qc.itdec.DEC * 8 + (ilut_index - qc.itdec.DEC) * 4`
+
+  Each entry may contain one or two packed RISC-V instructions. The first
+  instruction begins at bit 0 of the entry. Its size is determined by the
+  standard RISC-V instruction-length encoding (16-bit, 32-bit, or 48-bit).
+  If bits remain after the first instruction and the next 16 bits are not
+  `c.nop` (16'h0001), a second instruction is present and is also executed.
+
+  Any instruction that references PC as an input or output is not permitted
+  inside ILUT entries. This includes: PC-relative instructions (`auipc`,
+  branches, `jal`, `c.j`, `c.jal`, `c.beqz`, `c.bnez`); register-indirect
+  jumps that write PC (`jalr`, `c.jr`, `c.jalr`); and return instructions
+  that write PC (`cm.popret`, `cm.popretz`, `qc.cm.popret`, `qc.cm.popretz`).
+  If any such instruction is present in the entry, an IllegalInstruction
+  exception is raised before any sub-instruction in the entry takes
+  architectural effect.
+
+  When a trap (exception, interrupt, NMI, or double-trap) occurs during
+  execution of a `qc.cm.ilut` entry, `mepc`/`mnepc` is set to the PC of
+  `qc.cm.ilut` with bit 0 encoding which sub-instruction caused the trap:
+  bit 0 = 0 means the trap came from the first (or only) instruction;
+  bit 0 = 1 means the trap came from the second instruction (the architectural
+  effects of the first sub-instruction are already visible). When `qc.cm.ilut` is re-entered with PC bit 0 = 1,
+  it skips the first instruction and executes only the second. This applies
+  uniformly to all trap types including exceptions, interrupts, NMIs, and
+  double-traps.
+
+  See the Xqccmi extension description for full details on entry layout,
+  dual-instruction packing, exception handling, and restrictions.
+definedBy:
+  extension:
+    name: Xqccmi
+assembly: ilut_index
+encoding:
+  match: 001-----------00
+  variables:
+    - name: ilut_index
+      location: 12-2
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+operation(): |
+  XReg real_pc = $pc & ~32'b1;
+  Boolean resuming_second = ($pc[0:0] == 1'b1);
+
+  XReg N = {21'b0, CSR[qc.itdec].dec};
+  XReg base_addr = CSR[qc.itba].base << 6;
+  XReg entry_addr;
+  Boolean is_double;
+
+  if (ilut_index < N) {
+    entry_addr = base_addr + (ilut_index * 8);
+    is_double = true;
+  } else {
+    entry_addr = base_addr + (N * 8) + ((ilut_index - N) * 4);
+    is_double = false;
+  }
+
+  TranslationResult result;
+  if (CSR[misa].S == 1) {
+    result = translate(entry_addr, MemoryOperation::Fetch, mode(), $encoding);
+  } else {
+    result.paddr = entry_addr;
+  }
+  access_check(result.paddr, is_double ? 8 : 4, $pc, MemoryOperation::Fetch, ExceptionCode::InstructionAccessFault, mode());
+
+  XReg entry_lo = read_physical_memory(32, result.paddr);
+  XReg entry_hi = is_double ? read_physical_memory(32, result.paddr + 4) : 32'b0;
+
+  Boolean has_second_inst = false; # true if entry contains a second packed instruction
+  if (entry_lo[1:0] != 2'b11) {
+    if (entry_lo[31:16] != 16'h0001) { has_second_inst = true; }
+  } else if (entry_lo[4:2] != 3'b111) {
+    if (is_double && entry_hi[15:0] != 16'h0001) { has_second_inst = true; }
+  } else {
+    if (!is_double) { raise_ilut(ExceptionCode::IllegalInstruction, $encoding); }
+  }
+
+  if (is_pc_referencing_inst?(entry_lo)) {
+    executing_second_inst = false;
+    raise_ilut(ExceptionCode::IllegalInstruction, $encoding);
+  }
+  if (has_second_inst) {
+    Bits<32> second_inst = (entry_lo[1:0] != 2'b11) ? {16'b0, entry_lo[31:16]} : {16'b0, entry_hi[15:0]};
+    if (is_pc_referencing_inst?(second_inst)) {
+      executing_second_inst = true;
+      raise_ilut(ExceptionCode::IllegalInstruction, $encoding);
+    }
+  }
+
+  # Execute first instruction (skip if resuming after second-slot trap)
+  if (!resuming_second) {
+    if (implemented?(ExtensionName::Smrnmi) && CSR[mnstatus].NMIE == 1'b0) {
+      CSR[mnepc].PC = real_pc;
+    } else {
+      CSR[mepc].PC = real_pc;
+    }
+    execute_instruction(entry_lo);
+  }
+
+  # Execute second instruction if present
+  if (has_second_inst) {
+    Bits<32> second_inst = (entry_lo[1:0] != 2'b11) ? {16'b0, entry_lo[31:16]} : {16'b0, entry_hi[15:0]};
+    if (implemented?(ExtensionName::Smrnmi) && CSR[mnstatus].NMIE == 1'b0) {
+      CSR[mnepc].PC = real_pc | 32'b1;
+    } else {
+      CSR[mepc].PC = real_pc | 32'b1;
+    }
+    execute_instruction(second_inst);
+    # Restore mepc/mnepc bit 0 to 0 after successful completion
+    if (implemented?(ExtensionName::Smrnmi) && CSR[mnstatus].NMIE == 1'b0) {
+      CSR[mnepc].PC = real_pc;
+    } else {
+      CSR[mepc].PC = real_pc;
+    }
+  }

data/.data/spec/custom/isa/qc_iu/inst/Xqccmt/qc.cm.jalt.yaml

@@ -0,0 +1,84 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../../schemas/inst_schema.json
+
+$schema: "inst_schema.json#"
+kind: instruction
+name: qc.cm.jalt
+long_name: Jump Via Table with Link to ra or t0
+description: |
+  Read an address from the Jump Vector Table and jump to it, linking to either
+  `ra` (x1) or `t0` (x5) depending on bit 0 of the table entry.
+
+  Bit 0 of the jump table entry is used as metadata:
+
+  * Bit 0 = 0: save return address in `ra` (x1)
+  * Bit 0 = 1: save return address in `t0` (x5)
+
+  The actual jump target always has bit 0 cleared:
+  `target = {entry[XLEN-1:1], 1'b0}`
+
+  Instruction encoded in the same encoding space as cm.jalt (Zcmt).
+  Xqccmt and Zcmt are mutually exclusive extensions.
+definedBy:
+  extension:
+    name: Xqccmt
+assembly: index_7_5, index_4_0
+encoding:
+  match: 101000--------10
+  variables:
+    - name: index_7_5
+      location: 9-7
+      not: 0
+    - name: index_4_0
+      location: 6-2
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+operation(): |
+  # Ensure JVT readable
+  check_zcmt_enabled($encoding);
+
+  if (CSR[jvt].MODE != 0) {
+    raise(ExceptionCode::IllegalInstruction, mode(), $encoding);
+  }
+
+  # Skip over _this_ 16-bit instruction
+  XReg return_addr = $pc + 2;
+
+  XReg jump_table_base = { CSR[jvt].BASE, 6'b000000 };
+  XReg index = { index_7_5, index_4_0 };
+  XReg virtual_address = jump_table_base + index `* (xlen() / 8);
+  XReg entry;
+  TranslationResult result;
+
+  # TODO: Correct this check when we figure out what MISA can do
+  if (CSR[misa].S == 1) {
+    result = translate(virtual_address, MemoryOperation::Fetch, mode(), $encoding);
+  } else {
+    result.paddr = virtual_address;
+  }
+
+  # may raise an exception
+  access_check(result.paddr, xlen(), $pc, MemoryOperation::Fetch, ExceptionCode::InstructionAccessFault, mode());
+
+  if (xlen() == 32) {
+    entry = read_physical_memory(32, result.paddr);
+  } else {
+    entry = read_physical_memory(64, result.paddr);
+  }
+
+  # Bit 0 of entry is metadata: 0 = link to ra (x1), 1 = link to t0 (x5)
+  if (entry[0] == 1'b1) {
+    X[5] = return_addr;  # t0
+  } else {
+    X[1] = return_addr;  # ra
+  }
+
+  # Jump target always has bit 0 cleared
+  XReg addr = entry & $signed(2'b10);
+
+  jump(addr);

data/.data/spec/custom/isa/qc_iu/inst/Xqccmt/qc.cm.jt.yaml

@@ -0,0 +1,60 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# yaml-language-server: $schema=../../../../../schemas/inst_schema.json
+
+$schema: "inst_schema.json#"
+kind: instruction
+name: qc.cm.jt
+long_name: Jump Via Table
+description: |
+  Read an address from the Jump Vector Table and jump to it.
+  Instruction encoded in the same encoding space as cm.jt (Zcmt).
+  Xqccmt and Zcmt are mutually exclusive extensions.
+definedBy:
+  extension:
+    name: Xqccmt
+assembly: index
+encoding:
+  match: 101000000-----10
+  variables:
+    - name: index
+      location: 6-2
+access:
+  s: always
+  u: always
+  vs: always
+  vu: always
+operation(): |
+  # Ensure JVT readable
+  check_zcmt_enabled($encoding);
+
+  if (CSR[jvt].MODE != 0) {
+    raise(ExceptionCode::IllegalInstruction, mode(), $encoding);
+  }
+
+  XReg jump_table_base = { CSR[jvt].BASE, 6'b000000 };
+  XReg virtual_address = jump_table_base + index `* (xlen() / 8);
+  XReg addr;
+  TranslationResult result;
+
+  # TODO: Correct this check when we figure out what MISA can do
+  if (CSR[misa].S == 1) {
+    result = translate(virtual_address, MemoryOperation::Fetch, mode(), $encoding);
+  } else {
+    result.paddr = virtual_address;
+  }
+
+  # may raise an exception
+  access_check(result.paddr, xlen(), $pc, MemoryOperation::Fetch, ExceptionCode::InstructionAccessFault, mode());
+
+  if (xlen() == 32) {
+    addr = read_physical_memory(32, result.paddr);
+  } else {
+    addr = read_physical_memory(64, result.paddr);
+  }
+
+  # Ensure low-order bit is clear
+  addr = addr & $signed(2'b10);
+
+  jump(addr);