udb 0.1.13 → 0.1.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3c1ac46d7a7612704172bcdd8ec9a5d2fe55936b5c2aa8341a684cc5aa61909
-  data.tar.gz: 76b89f28a9e70ac5376bf815c7fc21e28bc56bf3e685be958e58d0bb18b45328
+  metadata.gz: '033857ac50551c786b5857f54a78a91f6a2c3d8c46554eb0dae62cbc489b9ab4'
+  data.tar.gz: dce0e09b88581e3cc6dc13de86d7e5a72c8c2377e66aca53994d6a0c239ec3a2
 SHA512:
-  metadata.gz: a56d1927a8649d58a0af62af8a473c1a998db9180425855c99c0bc6565125109750ba593891e5ec691708da2e3598148953b8094a13d82abae0391c82cb018bb
-  data.tar.gz: d4fc5b635b10dcaece666c73052f154fc5b5eb24ef8e29e0ae5d1b25bf69e7698e3ae992b5b71a42540d6c4876355257c5d0eb63641daf9680e96d0c5cd528db
+  metadata.gz: 5b0efc566225e863a99ba9c1818a47ef57590bdd7d8e5f37a3937b6c7fb7b94bfe409d96a9e0c886fcb74e2eac312bc3023ebe72e55128043f578acf6a576dca
+  data.tar.gz: fe01c90f6363a506d6191b2a6ac5f39acb91ca241a00a83951b83e2af680895cb56b140d826f0010bb00f21e723794b03415f543afe41c54fe701d942ed2e444

data/.data/cfgs/example_rv64_with_overlay.yaml

@@ -358,23 +358,21 @@ params:
   # this address is reported in the mconfigptr CSR
   CONFIG_PTR_ADDRESS: 0x1000
 
-  # number of implemented PMP entries. Can be any value between 0-64, inclusive.
-  #
-  # the number of implemented PMP registers must be 0, 16, or 64.
-  #
-  # Therefore, whether or not a pmpaddrN or pmpcfgN register exists depends on
-  # NUM_PMP_ENTRIES as follows:
-  # |===
-  # | NUM_PMP_ENTRIES | pmpaddr<0-15> / pmpcfg<0-3> | pmpaddr<16-63> / pmpcfg<4-15>
-  # | 0               | N                           | N
-  # | 1-16            | Y                           | N
-  # | 17-64           | Y                           | Y
-  # |===
-  # ** pmpcfgN for an odd N never exist when XLEN == 64
-  #
-  # when NUM_PMP_ENTRIES is not exactly 0, 16, or 64, some extant pmp registers,
-  # and associated pmpNcfg, will be read-only zero (but will not cause an exception).
-  NUM_PMP_ENTRIES: 14
+  # number of implemented PMP entries, some may be read-only zero.
+  # Must be 0, 16, or 64.
+  NUM_PMP_ENTRIES: 16
+
+  # number of implemented PMP entries that are actually usable (writable).
+  # Must be between 0 and NUM_PMP_ENTRIES, inclusive. Entries at and above this
+  # index are implemented as read-only zero (they exist but cannot be
+  # configured). Here, 16 entries are implemented but only 14 are usable.
+  NUM_USABLE_PMP_ENTRIES: 14
+
+  # Which PMP address matching modes are supported.
+  # NA4 must be false unless PMP_GRANULARITY == 2 (4-byte granularity).
+  PMP_TOR_SUPPORTED: true
+  PMP_NA4_SUPPORTED: false
+  PMP_NAPOT_SUPPORTED: true
 
   # log2 of the smallest supported PMP region
   # generally, for systems with an MMU, should not be smaller than 12,
@@ -596,7 +594,6 @@ params:
   MTVEC_BASE_ALIGNMENT_DIRECT: 4
   MTVEC_BASE_ALIGNMENT_VECTORED: 4
   MSTATUS_FS_LEGAL_VALUES: [0, 1, 2, 3]
-  MSTATUS_TVM_IMPLEMENTED: true
   HW_MSTATUS_FS_DIRTY_UPDATE: precise
   MSTATUS_VS_LEGAL_VALUES: [0, 1, 2, 3]
   HW_MSTATUS_VS_DIRTY_UPDATE: precise

data/.data/cfgs/qc_iu.yaml

@@ -23,7 +23,7 @@ implemented_extensions:
   - { name: Zihpm, version: "= 2.0" }
   - { name: Xqccmp, version: "= 0.3" }
   - { name: Xqccmt, version: "= 0.1.0" }
-  - { name: Xqccmi, version: "= 0.1.0" }
+  - { name: Xqccmi, version: "= 0.2.0" }
   - { name: Xqci, version: "= 0.13" }
   - { name: Xqcia, version: "= 0.7.0" }
   - { name: Xqciac, version: "= 0.3.0" }
@@ -176,6 +176,10 @@ params:
   MTVAL_WIDTH: 32
   PMP_GRANULARITY: 12
   NUM_PMP_ENTRIES: 16
+  NUM_USABLE_PMP_ENTRIES: 16
+  PMP_TOR_SUPPORTED: true
+  PMP_NA4_SUPPORTED: false
+  PMP_NAPOT_SUPPORTED: true
   PMA_GRANULARITY: 12
   M_MODE_ENDIANNESS: little
   MISA_CSR_IMPLEMENTED: true

data/.data/cfgs/rv32-riscv-tests.yaml

@@ -194,8 +194,11 @@ params:
   TRAP_ON_ECALL_FROM_S: true
   MSTATUS_VS_LEGAL_VALUES: [0]
   MSTATUS_FS_LEGAL_VALUES: [3, 2, 1, 0]
-  MSTATUS_TVM_IMPLEMENTED: false
   NUM_PMP_ENTRIES: 16
+  NUM_USABLE_PMP_ENTRIES: 16
+  PMP_TOR_SUPPORTED: true
+  PMP_NA4_SUPPORTED: false
+  PMP_NAPOT_SUPPORTED: true
   PMP_GRANULARITY: 12
   MUTABLE_MISA_U: false
   U_MODE_ENDIANNESS: little

data/.data/cfgs/rv32-vector.yaml

@@ -208,8 +208,11 @@ params:
   MSTATUS_VS_LEGAL_VALUES: [0, 1, 2, 3]
   HW_MSTATUS_FS_DIRTY_UPDATE: precise
   MSTATUS_FS_LEGAL_VALUES: [0, 3]
-  MSTATUS_TVM_IMPLEMENTED: false
   NUM_PMP_ENTRIES: 16
+  NUM_USABLE_PMP_ENTRIES: 16
+  PMP_TOR_SUPPORTED: true
+  PMP_NA4_SUPPORTED: false
+  PMP_NAPOT_SUPPORTED: true
   PMP_GRANULARITY: 12
   MUTABLE_MISA_U: false
   U_MODE_ENDIANNESS: little

data/.data/cfgs/rv64-riscv-tests.yaml

@@ -193,8 +193,11 @@ params:
   TRAP_ON_ECALL_FROM_U: true
   MSTATUS_VS_LEGAL_VALUES: [0]
   MSTATUS_FS_LEGAL_VALUES: [3, 2, 1, 0]
-  MSTATUS_TVM_IMPLEMENTED: false
   NUM_PMP_ENTRIES: 16
+  NUM_USABLE_PMP_ENTRIES: 16
+  PMP_TOR_SUPPORTED: true
+  PMP_NA4_SUPPORTED: false
+  PMP_NAPOT_SUPPORTED: true
   PMP_GRANULARITY: 12
   MUTABLE_MISA_U: false
   U_MODE_ENDIANNESS: little

data/.data/cfgs/rv64-vector.yaml

@@ -205,8 +205,11 @@ params:
   TRAP_ON_ECALL_FROM_U: true
   MSTATUS_VS_LEGAL_VALUES: [0, 1, 2, 3]
   MSTATUS_FS_LEGAL_VALUES: [0, 1, 2, 3]
-  MSTATUS_TVM_IMPLEMENTED: false
   NUM_PMP_ENTRIES: 16
+  NUM_USABLE_PMP_ENTRIES: 16
+  PMP_TOR_SUPPORTED: true
+  PMP_NA4_SUPPORTED: false
+  PMP_NAPOT_SUPPORTED: true
   PMP_GRANULARITY: 12
   MUTABLE_MISA_U: false
   U_MODE_ENDIANNESS: little

data/.data/spec/custom/isa/qc_iu/ext/Xqccmi.yaml

@@ -24,9 +24,8 @@ description: |
 
   `qc.cm.ilut` is a 16-bit instruction that takes an 11-bit immediate index
   (range 0..2047) into the ILUT. The ILUT base address is held in the `qc.itba`
-  CSR (address 0x800). The hardware computes the byte offset of the addressed
-  entry from the base address, fetches the entry, parses the packed instructions
-  within it, and executes them in order.
+  CSR (address 0x800). The instruction architecturally behaves as the
+  sub-instruction(s) stored at the addressed ILUT entry, executed in order.
 
   ILUT memory is treated as instruction memory. It requires execute (X)
   permission and does NOT require read (R) permission. A `fence.i` instruction
@@ -80,9 +79,9 @@ description: |
 
   === Dual-Instruction Packing
 
-  Each ILUT entry may contain one or two instructions packed together. The
-  hardware determines instruction sizes by parsing bits[1:0] of each
-  sub-instruction after fetching the full entry.
+  Each ILUT entry may contain one or two instructions packed together.
+  Instruction sizes are determined by the standard RISC-V instruction-length
+  encoding (bits[1:0] of each sub-instruction).
 
   ==== 32-bit Entry Valid Combinations
 
@@ -110,53 +109,82 @@ description: |
 
   Unused bits in any entry MUST be padded with `c.nop` (16'h0001). Instruction
   combinations that do not fit within the entry size cause an illegal instruction
-  exception. Hardware determines instruction sizes by parsing bits[1:0] of each
-  sub-instruction after fetching the full entry.
+  exception. Instruction sizes are determined by the standard RISC-V
+  instruction-length encoding (bits[1:0] of each sub-instruction).
 
   === Instruction Restrictions
 
-  PC-relative instructions are NOT permitted in the ILUT. This includes:
+  Any instruction that references PC as an input or output is NOT permitted
+  in the ILUT. If any such instruction is present in the entry, an
+  IllegalInstruction exception is raised before any sub-instruction in the
+  entry takes architectural effect.
 
-  * `auipc`
-  * All branch instructions (beq, bne, blt, bge, bltu, bgeu, c.beqz, c.bnez, etc.)
-  * All jump instructions (jal, jalr, c.j, c.jal, c.jr, c.jalr, etc.)
+  Forbidden instructions fall into three categories:
 
-  If a PC-relative instruction is fetched from the ILUT, an illegal instruction
-  exception is raised. 16-bit compressed instructions (bits[1:0] != 2'b11) are
-  otherwise valid in ILUT entries.
+  * *PC-relative instructions* (read PC as input):
+  ** `auipc`
+  ** All branch instructions (`beq`, `bne`, `blt`, `bge`, `bltu`, `bgeu`,
+     `c.beqz`, `c.bnez`, etc.)
+  ** PC-relative jump instructions (`jal`, `c.j`, `c.jal`)
+
+  * *Register-indirect jumps* (write PC as output):
+  ** `jalr`
+  ** `c.jr`
+  ** `c.jalr`
+
+  * *Return instructions* (write PC as output):
+  ** `cm.popret`
+  ** `cm.popretz`
+  ** `qc.cm.popret`
+  ** `qc.cm.popretz`
+
+  The following push/pop instructions are explicitly *allowed* in ILUT entries
+  because they do not reference PC:
+  `cm.push`, `cm.pop`, `qc.cm.push`, `qc.cm.pushfp`, `qc.cm.pop`.
+
+  16-bit compressed instructions (bits[1:0] != 2'b11) are otherwise valid
+  in ILUT entries.
 
   === Execution Model
 
-  Logically, the PC points to the `qc.cm.ilut` instruction throughout the
-  execution of all instructions contained within the fetched entry. The
-  instructions within an entry execute as if they were a single atomic unit from
-  the perspective of interrupt handling:
+  The PC points to the `qc.cm.ilut` instruction throughout the execution of all
+  sub-instructions contained within the fetched ILUT entry. Sub-instructions
+  execute sequentially and independently:
 
-  * Interrupts cannot be taken between two instructions of the same entry once
-    the first instruction has committed.
-  * If the first instruction has not yet committed when an interrupt arrives, the
-    interrupt is taken with mepc set to the PC of `qc.cm.ilut`.
-  * If the first instruction has already committed when an interrupt arrives, the
-    interrupt is serviced after the second instruction commits, with mepc pointing
-    to the next instruction after `qc.cm.ilut`.
+  * The architectural state changes produced by the first sub-instruction are
+    visible to the second sub-instruction and to any subsequent trap handler.
+  * Each sub-instruction can trap independently; traps are taken precisely at the
+    sub-instruction that caused them, not deferred.
+  * After the final sub-instruction completes, the PC advances past `qc.cm.ilut`
+    normally.
 
   === Exception Handling
 
-  On any exception caused by an instruction fetched from the ILUT:
+  On any trap (exception, interrupt, NMI, or double-trap) occurring during the
+  execution of a sub-instruction fetched from the ILUT:
 
   * mepc (or mnepc for a double-trap) is set to the PC of `qc.cm.ilut`.
-  * Bit 0 of mepc/mnepc is set to 0 if the first instruction in the entry caused
-    the exception.
-  * Bit 0 of mepc/mnepc is set to 1 if the second instruction in the entry caused
-    the exception.
+  * Bit 0 of mepc/mnepc encodes which sub-instruction was executing when the trap
+    occurred:
+  ** Bit 0 = 0: the trap occurred during the first (or only) sub-instruction.
+  ** Bit 0 = 1: the trap occurred during the second sub-instruction (the
+     architectural effects of the first sub-instruction are already visible).
 
-  Bit 0 of mepc/mnepc is writable to 0 only; software cannot set it to 1.
-  Return-from-trap instructions (`mret`, `mnret`, `qc.c.mret`, `qc.c.mnret`,
-  `qc.c.mileaveret`) leave bit 0 of mepc/mnepc unchanged when returning.
+  On trap return (`mret`, `qc.c.mret`, `qc.c.mnret`, `qc.c.mileaveret`), $pc is
+  restored directly from mepc/mnepc including bit 0:
+
+  * If bit 0 = 0: `qc.cm.ilut` re-executes from the beginning, running both
+    sub-instructions.
+  * If bit 0 = 1: `qc.cm.ilut` skips the first sub-instruction and executes only
+    the second.
+
+  Bit 0 of mepc/mnepc is readable and writable in this architecture.
+  Software may explicitly set bit 0 to 1 to force resumption from the second
+  sub-instruction.
 
   NOTE: This is an architectural exception to the standard RISC-V requirement
-  that *epc bit 0 is always zero. The non-zero bit 0 encodes which instruction
-  within the ILUT entry caused the exception, enabling precise exception restart.
+  that *epc bit 0 is always zero. The non-zero bit 0 encodes which sub-instruction
+  within the ILUT entry was interrupted, enabling precise trap restart.
 
   === Encoding
 
@@ -217,3 +245,46 @@ versions:
       - not:
           extension:
             name: Zcd
+- version: "0.2.0"
+  state: development
+  contributors:
+  - name: Albert Yosher
+    company: Qualcomm Technologies, Inc.
+    email: ayosher@qti.qualcomm.com
+  - name: Derek Hower
+    company: Qualcomm Technologies, Inc.
+    email: dhower@qti.qualcomm.com
+  - name: Gil Zukerman
+    company: Qualcomm Technologies, Inc.
+    email: gzukerma@qti.qualcomm.com
+  changes:
+    - >-
+      Precise trap semantics: each sub-instruction in an ILUT entry can now trap
+      independently. Traps are taken immediately at the faulting sub-instruction
+      rather than being deferred.
+    - >-
+      Resume mechanism: bit 0 of mepc/mnepc encodes which sub-instruction caused
+      the trap. On trap return, qc.cm.ilut re-enters with PC bit 0 reflecting this
+      value; if set, the first sub-instruction is skipped and only the second is
+      re-executed.
+    - >-
+      mepc/mnepc bit 0 is readable and writable in this architecture.
+      Software may set bit 0 to 1 to force resumption from the second sub-instruction.
+    - >-
+      Expanded ILUT instruction restrictions to all PC-referencing instructions:
+      added register-indirect jumps (jalr, c.jr, c.jalr) and return instructions
+      (cm.popret, cm.popretz, qc.cm.popret, qc.cm.popretz) to the forbidden list.
+    - >-
+      Spec language audit: removed all implementation-implying language; descriptions
+      now define architectural behavior only.
+  requirements:
+    allOf:
+      - extension:
+          name: Zca
+          version: ">= 1.0.0"
+      - extension:
+          name: Zicsr
+          version: ">= 2.0.0"
+      - not:
+          extension:
+            name: Zcd

data/.data/spec/custom/isa/qc_iu/inst/Xqccmi/qc.cm.ilut.yaml

@@ -24,13 +24,24 @@ description: |
   If bits remain after the first instruction and the next 16 bits are not
   `c.nop` (16'h0001), a second instruction is present and is also executed.
 
-  PC-relative instructions (`auipc`, branches, and jumps) are not permitted
-  inside ILUT entries. Hardware detects such instructions during decode and
-  raises an IllegalInstruction exception.
-
-  On an exception caused by the second instruction, hardware sets bit 0 of
-  `mepc` to indicate that the fault originated from the second instruction
-  within the entry.
+  Any instruction that references PC as an input or output is not permitted
+  inside ILUT entries. This includes: PC-relative instructions (`auipc`,
+  branches, `jal`, `c.j`, `c.jal`, `c.beqz`, `c.bnez`); register-indirect
+  jumps that write PC (`jalr`, `c.jr`, `c.jalr`); and return instructions
+  that write PC (`cm.popret`, `cm.popretz`, `qc.cm.popret`, `qc.cm.popretz`).
+  If any such instruction is present in the entry, an IllegalInstruction
+  exception is raised before any sub-instruction in the entry takes
+  architectural effect.
+
+  When a trap (exception, interrupt, NMI, or double-trap) occurs during
+  execution of a `qc.cm.ilut` entry, `mepc`/`mnepc` is set to the PC of
+  `qc.cm.ilut` with bit 0 encoding which sub-instruction caused the trap:
+  bit 0 = 0 means the trap came from the first (or only) instruction;
+  bit 0 = 1 means the trap came from the second instruction (the architectural
+  effects of the first sub-instruction are already visible). When `qc.cm.ilut` is re-entered with PC bit 0 = 1,
+  it skips the first instruction and executes only the second. This applies
+  uniformly to all trap types including exceptions, interrupts, NMIs, and
+  double-traps.
 
   See the Xqccmi extension description for full details on entry layout,
   dual-instruction packing, exception handling, and restrictions.
@@ -49,10 +60,10 @@ access:
   vs: always
   vu: always
 operation(): |
-  # Read the double-entry count (N = number of 64-bit double entries)
-  XReg N = {21'b0, CSR[qc.itdec].dec};
+  XReg real_pc = $pc & ~32'b1;
+  Boolean resuming_second = ($pc[0:0] == 1'b1);
 
-  # Compute the byte address of the ILUT entry
+  XReg N = {21'b0, CSR[qc.itdec].dec};
   XReg base_addr = CSR[qc.itba].base << 6;
   XReg entry_addr;
   Boolean is_double;
@@ -65,89 +76,61 @@ operation(): |
     is_double = false;
   }
 
-  # Translate the entry address (instruction fetch)
   TranslationResult result;
   if (CSR[misa].S == 1) {
     result = translate(entry_addr, MemoryOperation::Fetch, mode(), $encoding);
   } else {
     result.paddr = entry_addr;
   }
-
-  # Access check for instruction fetch
   access_check(result.paddr, is_double ? 8 : 4, $pc, MemoryOperation::Fetch, ExceptionCode::InstructionAccessFault, mode());
 
-  # Read the entry from physical memory.
-  # For a 32-bit entry, read 32 bits. For a 64-bit double entry, read two
-  # consecutive 32-bit words (entry_lo = bits[31:0], entry_hi = bits[63:32]).
   XReg entry_lo = read_physical_memory(32, result.paddr);
-  XReg entry_hi = 32'b0;
-  if (is_double) {
-    entry_hi = read_physical_memory(32, result.paddr + 4);
-  }
-
-  # Determine the size of the first instruction using RISC-V length encoding:
-  #   bits[1:0] != 2'b11 -> 16-bit instruction
-  #   bits[1:0] == 2'b11 and bits[4:2] != 3'b111 -> 32-bit instruction
-  #   bits[1:0] == 2'b11 and bits[4:2] == 3'b111 -> 48-bit instruction
-  Boolean has_second_inst = false; # true if this entry contains a second packed instruction
+  XReg entry_hi = is_double ? read_physical_memory(32, result.paddr + 4) : 32'b0;
 
+  Boolean has_second_inst = false; # true if entry contains a second packed instruction
   if (entry_lo[1:0] != 2'b11) {
-    # 16-bit first instruction; second instruction is in entry_lo[31:16]
-    Bits<16> second_lo = entry_lo[31:16];
-    if (second_lo != 16'h0001) {
-      has_second_inst = true;
-    }
+    if (entry_lo[31:16] != 16'h0001) { has_second_inst = true; }
   } else if (entry_lo[4:2] != 3'b111) {
-    # 32-bit first instruction
-    if (is_double) {
-      # Second instruction starts at entry_hi[15:0]
-      Bits<16> second_lo = entry_hi[15:0];
-      if (second_lo != 16'h0001) {
-        has_second_inst = true;
-      }
-    }
-    # No room for a second instruction in a 32-bit entry after a 32-bit first
+    if (is_double && entry_hi[15:0] != 16'h0001) { has_second_inst = true; }
   } else {
-    # 48-bit first instruction
-    if (!is_double) {
-      # 48-bit instruction does not fit in a 32-bit entry
-      executing_second_inst = false;
-      raise_ilut(ExceptionCode::IllegalInstruction, $encoding);
-    }
-    # No room for a second instruction after a 48-bit first in a 64-bit entry
+    if (!is_double) { raise_ilut(ExceptionCode::IllegalInstruction, $encoding); }
   }
 
-  # PC-relative instruction check:
-  # Hardware detects auipc, branches, and jump instructions during decode
-  # and raises an IllegalInstruction exception before any instruction executes.
-  # mepc bit 0 reflects which slot contained the forbidden instruction.
-  if (is_pc_relative_inst?(entry_lo)) {
+  if (is_pc_referencing_inst?(entry_lo)) {
     executing_second_inst = false;
     raise_ilut(ExceptionCode::IllegalInstruction, $encoding);
   }
   if (has_second_inst) {
-    Bits<32> second_inst;
-    if (entry_lo[1:0] != 2'b11) {
-      second_inst = {16'b0, entry_lo[31:16]};
-    } else {
-      second_inst = {16'b0, entry_hi[15:0]};
-    }
-    if (is_pc_relative_inst?(second_inst)) {
+    Bits<32> second_inst = (entry_lo[1:0] != 2'b11) ? {16'b0, entry_lo[31:16]} : {16'b0, entry_hi[15:0]};
+    if (is_pc_referencing_inst?(second_inst)) {
       executing_second_inst = true;
       raise_ilut(ExceptionCode::IllegalInstruction, $encoding);
     }
   }
 
-  # Execute the first instruction from the ILUT entry.
-  # IDL cannot express dynamic instruction dispatch; actual execution is implementation-defined.
-  # Any exception raised must call raise_ilut() with executing_second_inst = false (mepc bit 0 = 0).
-  executing_second_inst = false;
-  unpredictable("TO-DO: execute first ILUT instruction");
+  # Execute first instruction (skip if resuming after second-slot trap)
+  if (!resuming_second) {
+    if (implemented?(ExtensionName::Smrnmi) && CSR[mnstatus].NMIE == 1'b0) {
+      CSR[mnepc].PC = real_pc;
+    } else {
+      CSR[mepc].PC = real_pc;
+    }
+    execute_instruction(entry_lo);
+  }
 
-  # Execute the second instruction from the ILUT entry, if present.
-  # Any exception raised must call raise_ilut() with executing_second_inst = true (mepc bit 0 = 1).
+  # Execute second instruction if present
   if (has_second_inst) {
-    executing_second_inst = true;
-    unpredictable("TO-DO: execute second ILUT instruction");
-    executing_second_inst = false;
+    Bits<32> second_inst = (entry_lo[1:0] != 2'b11) ? {16'b0, entry_lo[31:16]} : {16'b0, entry_hi[15:0]};
+    if (implemented?(ExtensionName::Smrnmi) && CSR[mnstatus].NMIE == 1'b0) {
+      CSR[mnepc].PC = real_pc | 32'b1;
+    } else {
+      CSR[mepc].PC = real_pc | 32'b1;
+    }
+    execute_instruction(second_inst);
+    # Restore mepc/mnepc bit 0 to 0 after successful completion
+    if (implemented?(ExtensionName::Smrnmi) && CSR[mnstatus].NMIE == 1'b0) {
+      CSR[mnepc].PC = real_pc;
+    } else {
+      CSR[mepc].PC = real_pc;
+    }
   }

data/.data/spec/custom/isa/qc_iu/isa/globals.isa

@@ -103,14 +103,15 @@ function raise_ilut {
   }
 }
 
-function is_pc_relative_inst? {
+function is_pc_referencing_inst? {
   returns Boolean
   arguments Bits<32> inst
   description {
-    Returns true if +inst+ is a PC-relative instruction (auipc, branch, jump, or
-    compressed PC-relative jump (jal/c.j/c.jal), or compressed branch) that is
-    forbidden inside an ILUT entry. Register-indirect jumps (jalr, c.jr, c.jalr)
-    are NOT PC-relative and are permitted inside ILUT entries.
+    Returns true if +inst+ references PC as an input or output, making it
+    forbidden inside an ILUT entry. This covers three categories:
+    (1) PC-relative instructions: auipc, branches, jal, c.j, c.jal, c.beqz, c.bnez;
+    (2) register-indirect jumps that write PC: jalr, c.jr, c.jalr;
+    (3) return instructions that write PC: cm.popret, cm.popretz, qc.cm.popret, qc.cm.popretz.
     For 16-bit compressed instructions, only the lower 16 bits of +inst+ are examined.
     For 48-bit Xqci instructions, only the lower 32 bits are passed here (the upper
     16 bits are in a separate word and are not needed for this check).
@@ -135,6 +136,22 @@ function is_pc_relative_inst? {
       if (cinst[15:13] == 3'b111 && cinst[1:0] == 2'b01) {
         return true;
       }
+      # c.jr:   bits[15:12]=1000, bits[6:2]!=00000, bits[1:0]=10 (register jump, writes PC)
+      if (cinst[15:12] == 4'b1000 && cinst[6:2] != 5'b00000 && cinst[1:0] == 2'b10) {
+        return true;
+      }
+      # c.jalr: bits[15:12]=1001, bits[6:2]!=00000, bits[1:0]=10 (register jump-and-link, writes PC)
+      if (cinst[15:12] == 4'b1001 && cinst[6:2] != 5'b00000 && cinst[1:0] == 2'b10) {
+        return true;
+      }
+      # cm.popret / qc.cm.popret: bits[15:8]=10111110, bits[1:0]=10 (pops stack and returns, writes PC)
+      if (cinst[15:8] == 8'b10111110 && cinst[1:0] == 2'b10) {
+        return true;
+      }
+      # cm.popretz / qc.cm.popretz: bits[15:8]=10111100, bits[1:0]=10 (pops stack, zeroes a0, returns, writes PC)
+      if (cinst[15:8] == 8'b10111100 && cinst[1:0] == 2'b10) {
+        return true;
+      }
       return false;
     } else {
       # 32-bit (or 48-bit) instruction: check opcode field bits[6:0]
@@ -147,6 +164,11 @@ function is_pc_relative_inst? {
       if (opcode == 7'b1101111) {
         return true;
       }
+      # jalr: register-indirect jump, writes PC
+      # (grouped with PC-referencing instructions, not PC-relative)
+      if (opcode == 7'b1100111) {
+        return true;
+      }
       # branches
       if (opcode == 7'b1100011) {
         return true;

data/.data/spec/schemas/config_schema.json

@@ -75,7 +75,7 @@
                 "description": "Extension name"
               },
               "version": {
-                "$ref": "schema_defs.json#/$defs/extension_version"
+                "$ref": "schema_defs.json#/$defs/implemented_extension_version"
               }
             }
           },

data/.data/spec/schemas/mmr_schema.json

@@ -35,11 +35,11 @@
       "description": "One line description for the MMR"
     },
     "description": {
-      "$ref": "schema_defs.json#/definitions/spec_text",
+      "$ref": "schema_defs.json#/$defs/spec_text",
       "description": "Function of the register"
     },
     "definedBy": {
-      "$ref": "schema_defs.json#/definitions/condition",
+      "$ref": "schema_defs.json#/$defs/condition",
       "description": "Extension(s) that define the MMR"
     },
     "physical_address": {
@@ -59,7 +59,7 @@
       "type": "object",
       "patternProperties": {
         "^[a-zA-Z].*$": {
-          "$ref": "csr_schema.json#/definitions/csr_field"
+          "$ref": "csr_schema.json#/$defs/csr_field"
         }
       },
       "description": "fields of this MMR",

data/.data/spec/schemas/schema_defs.json

@@ -231,6 +231,11 @@
       "$ref": "#/$defs/rvi_version",
       "description": "Exact version in `MAJOR[.MINOR[.PATCH]]` format (e.g., `2.1.0`, `2.1`, `2`)"
     },
+    "implemented_extension_version": {
+      "type": "string",
+      "description": "Exact implemented extension version, either bare or prefixed with `=` (e.g., `2.1.0`, `2.1`, `= 2.1`)",
+      "pattern": "^(=\\s*)?[0-9]+(\\.[0-9]+(\\.[0-9]+(-pre)?)?)?$"
+    },
     "requirement_string": {
       "type": "string",
       "description": "Version requirement string (e.g., `>= 2.0`, `~> 1.5`, `= 2.1`). The `~>` operator is a pessimistic version constraint: `~> X.Y` means `>= X.Y` and `< (X+1).0`; `~> X.Y.Z` means `>= X.Y.Z` and `< X.(Y+1).0`.",

data/.data/spec/std/isa/csr/H/henvcfg.yaml

@@ -289,6 +289,27 @@ fields:
         return 0;
       }
       return csr_value.SSE;
+  LPE:
+    location: 2
+    description: |
+      *Landing Pad Enable*
+
+      When the LPE field is set to 1, the Zicfilp extension is enabled in
+      VS-mode. When the LPE field is 0, the Zicfilp extension is not enabled
+      in VS-mode and the following rules apply to VS-mode:
+
+        * The hart does not update the `ELP` state; it remains as `NO_LP_EXPECTED`.
+        * The `LPAD` instruction operates as a no-op.
+    definedBy:
+      extension:
+        name: Zicfilp
+    type: RW
+    reset_value: UNDEFINED_LEGAL
+    sw_write(csr_value): |
+      if (CSR[menvcfg].LPE == 0){
+        return 0;
+      }
+      return csr_value.LPE;
   FIOM:
     location: 0
     description: |
@@ -336,4 +357,8 @@ sw_read(): |
     # henvcfg.SSE must read-as-zero
     value = value & ~(1 `<< 3);
   }
+  if (implemented?(ExtensionName::Zicfilp) && CSR[menvcfg].LPE == 0) {
+    # henvcfg.LPE must read-as-zero
+    value = value & ~(1 `<< 2);
+  }
   return value;