Upgrade to privileged architecture 1.7

13 files changed, 282 insertions, 200 deletions

diff --git a/pk/encoding.h b/pk/encoding.h
index 8891ab3..3854d82 100644
--- a/pk/encoding.h
+++ b/pk/encoding.h
@@ -3,42 +3,41 @@
 #ifndef RISCV_CSR_ENCODING_H
 #define RISCV_CSR_ENCODING_H
 
-#define MSTATUS_SSIP        0x00000002
-#define MSTATUS_HSIP        0x00000004
-#define MSTATUS_MSIP        0x00000008
-#define MSTATUS_IE          0x00000010
-#define MSTATUS_PRV         0x00000060
-#define MSTATUS_IE1         0x00000080
-#define MSTATUS_PRV1        0x00000300
-#define MSTATUS_IE2         0x00000400
-#define MSTATUS_PRV2        0x00001800
-#define MSTATUS_IE3         0x00002000
-#define MSTATUS_PRV3        0x0000C000
-#define MSTATUS_MPRV        0x00030000
-#define MSTATUS_VM          0x00780000
-#define MSTATUS_STIE        0x01000000
-#define MSTATUS_HTIE        0x02000000
-#define MSTATUS_MTIE        0x04000000
-#define MSTATUS_FS          0x18000000
-#define MSTATUS_XS          0x60000000
+#define MSTATUS_IE          0x00000001
+#define MSTATUS_PRV         0x00000006
+#define MSTATUS_IE1         0x00000008
+#define MSTATUS_PRV1        0x00000030
+#define MSTATUS_IE2         0x00000040
+#define MSTATUS_PRV2        0x00000180
+#define MSTATUS_IE3         0x00000200
+#define MSTATUS_PRV3        0x00000C00
+#define MSTATUS_FS          0x00003000
+#define MSTATUS_XS          0x0000C000
+#define MSTATUS_MPRV        0x00010000
+#define MSTATUS_VM          0x003E0000
 #define MSTATUS32_SD        0x80000000
-#define MSTATUS64_UA        0x0000000F00000000
-#define MSTATUS64_SA        0x000000F000000000
-#define MSTATUS64_HA        0x00000F0000000000
 #define MSTATUS64_SD        0x8000000000000000
 
-#define SSTATUS_SIP         0x00000002
-#define SSTATUS_IE          0x00000010
-#define SSTATUS_PIE         0x00000080
-#define SSTATUS_PS          0x00000100
-#define SSTATUS_UA          0x000F0000
+#define SSTATUS_IE          0x00000001
+#define SSTATUS_PIE         0x00000008
+#define SSTATUS_PS          0x00000010
+#define SSTATUS_FS          0x00003000
+#define SSTATUS_XS          0x0000C000
+#define SSTATUS_MPRV        0x00010000
 #define SSTATUS_TIE         0x01000000
-#define SSTATUS_TIP         0x04000000
-#define SSTATUS_FS          0x18000000
-#define SSTATUS_XS          0x60000000
 #define SSTATUS32_SD        0x80000000
 #define SSTATUS64_SD        0x8000000000000000
 
+#define MIP_SSIP            0x00000002
+#define MIP_HSIP            0x00000004
+#define MIP_MSIP            0x00000008
+#define MIP_STIP            0x00000200
+#define MIP_HTIP            0x00000400
+#define MIP_MTIP            0x00000800
+
+#define SIP_SSIP MIP_SSIP
+#define SIP_STIP MIP_STIP
+
 #define PRV_U 0
 #define PRV_S 1
 #define PRV_H 2
@@ -55,65 +54,64 @@
 #define UA_RV64  4
 #define UA_RV128 8
 
-#define IRQ_TIMER  0
-#define IRQ_IPI    1
+#define IRQ_SOFT   0
+#define IRQ_TIMER  1
 #define IRQ_HOST   2
 #define IRQ_COP    3
 
-#define IMPL_SPIKE  1
-#define IMPL_ROCKET 2
+#define IMPL_ROCKET 1
+
+#define DEFAULT_MTVEC 0x100
 
 // page table entry (PTE) fields
-#define PTE_TYPE   0x007
-#define PTE_PERM   0x018
-#define PTE_G      0x020 // Global
-#define PTE_R      0x040 // Referenced
-#define PTE_D      0x080 // Dirty
-#define PTE_SOFT   0x300 // Reserved for Software
-#define RV64_PTE_PPN_SHIFT 26
-#define RV32_PTE_PPN_SHIFT 10
-#define PTE_TYPE_INVALID 0
-#define PTE_TYPE_TABLE   1
-#define PTE_TYPE_U       2
-#define PTE_TYPE_S       3
-#define PTE_TYPE_US      4
-#define PTE_TYPE_US_SR   4
-#define PTE_TYPE_US_SRW  5
-#define PTE_TYPE_US_SRX  6
-#define PTE_TYPE_US_SRWX 7
+#define PTE_V     0x001 // Valid
+#define PTE_TYPE  0x01E // Type
+#define PTE_R     0x020 // Referenced
+#define PTE_D     0x040 // Dirty
+#define PTE_SOFT  0x380 // Reserved for Software
+
+#define PTE_TYPE_TABLE        0x00
+#define PTE_TYPE_TABLE_GLOBAL 0x02
+#define PTE_TYPE_URX_SR       0x04
+#define PTE_TYPE_URWX_SRW     0x06
+#define PTE_TYPE_UR_SR        0x08
+#define PTE_TYPE_URW_SRW      0x0A
+#define PTE_TYPE_URX_SRX      0x0C
+#define PTE_TYPE_URWX_SRWX    0x0E
+#define PTE_TYPE_SR           0x10
+#define PTE_TYPE_SRW          0x12
+#define PTE_TYPE_SRX          0x14
+#define PTE_TYPE_SRWX         0x16
+#define PTE_TYPE_SR_GLOBAL    0x18
+#define PTE_TYPE_SRW_GLOBAL   0x1A
+#define PTE_TYPE_SRX_GLOBAL   0x1C
+#define PTE_TYPE_SRWX_GLOBAL  0x1E
+
+#define PTE_PPN_SHIFT 10
 
-#define PROT_TO_PERM(PROT) ((((PROT) & PROT_EXEC) ? 2 : 0) | (((PROT) & PROT_WRITE) ? 1 : 0))
-#define PTE_CREATE(PPN, PERM_U, PERM_S) \
-  (((PPN) << PTE_PPN_SHIFT) | (PROT_TO_PERM(PERM_U) << 3) | \
-   ((PERM_U) && (PERM_S) ? (PTE_TYPE_US | PROT_TO_PERM(PERM_S)) : \
-   (PERM_S) ? (PTE_TYPE_S | (PROT_TO_PERM(PERM_S) << 3)) : \
-   (PERM_U) ? PTE_TYPE_U : 0))
+#define PTE_TABLE(PTE) ((0x0000000AU >> ((PTE) & 0x1F)) & 1)
+#define PTE_UR(PTE)    ((0x0000AAA0U >> ((PTE) & 0x1F)) & 1)
+#define PTE_UW(PTE)    ((0x00008880U >> ((PTE) & 0x1F)) & 1)
+#define PTE_UX(PTE)    ((0x0000A0A0U >> ((PTE) & 0x1F)) & 1)
+#define PTE_SR(PTE)    ((0xAAAAAAA0U >> ((PTE) & 0x1F)) & 1)
+#define PTE_SW(PTE)    ((0x88888880U >> ((PTE) & 0x1F)) & 1)
+#define PTE_SX(PTE)    ((0xA0A0A000U >> ((PTE) & 0x1F)) & 1)
 
-#define PTE_UR(PTE) ((0xF4F4F4F4U >> ((PTE) & 0x1f)) & 1)
-#define PTE_UW(PTE) ((0xF400F400U >> ((PTE) & 0x1f)) & 1)
-#define PTE_UX(PTE) ((0xF4F40000U >> ((PTE) & 0x1f)) & 1)
-#define PTE_SR(PTE) ((0xF8F8F8F8U >> ((PTE) & 0x1f)) & 1)
-#define PTE_SW(PTE) ((0xA8A0A8A0U >> ((PTE) & 0x1f)) & 1)
-#define PTE_SX(PTE) ((0xC8C8C0C0U >> ((PTE) & 0x1f)) & 1)
-#define PTE_CHECK_PERM(PTE, SUPERVISOR, WRITE, EXEC) \
-  ((SUPERVISOR) ? ((WRITE) ? PTE_SW(PTE) : (EXEC) ? PTE_SX(PTE) : PTE_SR(PTE)) \
-                : ((WRITE) ? PTE_UW(PTE) : (EXEC) ? PTE_UX(PTE) : PTE_UR(PTE)))
+#define PTE_CHECK_PERM(PTE, SUPERVISOR, STORE, FETCH) \
+  ((STORE) ? ((SUPERVISOR) ? PTE_SW(PTE) : PTE_UW(PTE)) : \
+   (FETCH) ? ((SUPERVISOR) ? PTE_SX(PTE) : PTE_UX(PTE)) : \
+             ((SUPERVISOR) ? PTE_SR(PTE) : PTE_UR(PTE)))
 
 #ifdef __riscv
 
 #ifdef __riscv64
-# define MSTATUS_UA MSTATUS64_UA
-# define MSTATUS_SA MSTATUS64_SA
-# define MSTATUS_HA MSTATUS64_HA
 # define MSTATUS_SD MSTATUS64_SD
 # define SSTATUS_SD SSTATUS64_SD
 # define RISCV_PGLEVEL_BITS 9
-# define PTE_PPN_SHIFT RV64_PTE_PPN_SHIFT
 #else
 # define MSTATUS_SD MSTATUS32_SD
 # define SSTATUS_SD SSTATUS32_SD
 # define RISCV_PGLEVEL_BITS 10
-# define PTE_PPN_SHIFT RV32_PTE_PPN_SHIFT
 #endif
 #define RISCV_PGSHIFT 12
 #define RISCV_PGSIZE (1 << RISCV_PGSHIFT)
@@ -413,6 +411,8 @@
 #define MASK_FSUB_S  0xfe00007f
 #define MATCH_FSW 0x2027
 #define MASK_FSW  0x707f
+#define MATCH_HRTS 0x20500073
+#define MASK_HRTS  0xffffffff
 #define MATCH_JAL 0x6f
 #define MASK_JAL  0x7f
 #define MATCH_JALR 0x67
@@ -437,6 +437,8 @@
 #define MASK_LW  0x707f
 #define MATCH_LWU 0x6003
 #define MASK_LWU  0x707f
+#define MATCH_MRTH 0x30600073
+#define MASK_MRTH  0xffffffff
 #define MATCH_MRTS 0x30500073
 #define MASK_MRTS  0xffffffff
 #define MATCH_MUL 0x2000033
@@ -517,6 +519,8 @@
 #define MASK_SUBW  0xfe00707f
 #define MATCH_SW 0x2023
 #define MASK_SW  0x707f
+#define MATCH_WFI 0x10200073
+#define MASK_WFI  0xffffffff
 #define MATCH_XOR 0x4033
 #define MASK_XOR  0xfe00707f
 #define MATCH_XORI 0x4013
@@ -546,41 +550,59 @@
 #define CSR_UARCH15 0xccf
 #define CSR_SSTATUS 0x100
 #define CSR_STVEC 0x101
+#define CSR_SIE 0x104
 #define CSR_STIMECMP 0x121
 #define CSR_SSCRATCH 0x140
 #define CSR_SEPC 0x141
-#define CSR_SPTBR 0x188
-#define CSR_SASID 0x189
-#define CSR_SCYCLE 0x900
-#define CSR_STIME 0x901
-#define CSR_SINSTRET 0x902
-#define CSR_SCAUSE 0xd40
-#define CSR_SBADADDR 0xd41
+#define CSR_SIP 0x144
+#define CSR_SPTBR 0x180
+#define CSR_SASID 0x181
+#define CSR_CYCLEW 0x900
+#define CSR_TIMEW 0x901
+#define CSR_INSTRETW 0x902
+#define CSR_STIME 0xd01
+#define CSR_SCAUSE 0xd42
+#define CSR_SBADADDR 0xd43
+#define CSR_STIMEW 0xa01
 #define CSR_MSTATUS 0x300
+#define CSR_MTVEC 0x301
+#define CSR_MTDELEG 0x302
+#define CSR_MIE 0x304
+#define CSR_MTIMECMP 0x321
 #define CSR_MSCRATCH 0x340
 #define CSR_MEPC 0x341
 #define CSR_MCAUSE 0x342
 #define CSR_MBADADDR 0x343
-#define CSR_RESET 0x780
-#define CSR_TOHOST 0x781
-#define CSR_FROMHOST 0x782
+#define CSR_MIP 0x344
+#define CSR_MTIME 0x701
+#define CSR_MCPUID 0xf00
+#define CSR_MIMPID 0xf01
+#define CSR_MHARTID 0xf10
+#define CSR_MTOHOST 0x780
+#define CSR_MFROMHOST 0x781
+#define CSR_MRESET 0x782
 #define CSR_SEND_IPI 0x783
-#define CSR_HARTID 0xfc0
 #define CSR_CYCLEH 0xc80
 #define CSR_TIMEH 0xc81
 #define CSR_INSTRETH 0xc82
-#define CSR_SCYCLEH 0x980
-#define CSR_STIMEH 0x981
-#define CSR_SINSTRETH 0x982
+#define CSR_CYCLEHW 0x980
+#define CSR_TIMEHW 0x981
+#define CSR_INSTRETHW 0x982
+#define CSR_STIMEH 0xd81
+#define CSR_STIMEHW 0xa81
+#define CSR_MTIMEH 0x741
 #define CAUSE_MISALIGNED_FETCH 0x0
 #define CAUSE_FAULT_FETCH 0x1
 #define CAUSE_ILLEGAL_INSTRUCTION 0x2
+#define CAUSE_BREAKPOINT 0x3
 #define CAUSE_MISALIGNED_LOAD 0x4
 #define CAUSE_FAULT_LOAD 0x5
 #define CAUSE_MISALIGNED_STORE 0x6
 #define CAUSE_FAULT_STORE 0x7
-#define CAUSE_ECALL 0x8
-#define CAUSE_BREAKPOINT 0x9
+#define CAUSE_USER_ECALL 0x8
+#define CAUSE_SUPERVISOR_ECALL 0x9
+#define CAUSE_HYPERVISOR_ECALL 0xa
+#define CAUSE_MACHINE_ECALL 0xb
 #endif
 #ifdef DECLARE_INSN
 DECLARE_INSN(add, MATCH_ADD, MASK_ADD)
@@ -709,6 +731,7 @@ DECLARE_INSN(fsqrt_s, MATCH_FSQRT_S, MASK_FSQRT_S)
 DECLARE_INSN(fsub_d, MATCH_FSUB_D, MASK_FSUB_D)
 DECLARE_INSN(fsub_s, MATCH_FSUB_S, MASK_FSUB_S)
 DECLARE_INSN(fsw, MATCH_FSW, MASK_FSW)
+DECLARE_INSN(hrts, MATCH_HRTS, MASK_HRTS)
 DECLARE_INSN(jal, MATCH_JAL, MASK_JAL)
 DECLARE_INSN(jalr, MATCH_JALR, MASK_JALR)
 DECLARE_INSN(lb, MATCH_LB, MASK_LB)
@@ -721,6 +744,7 @@ DECLARE_INSN(lr_w, MATCH_LR_W, MASK_LR_W)
 DECLARE_INSN(lui, MATCH_LUI, MASK_LUI)
 DECLARE_INSN(lw, MATCH_LW, MASK_LW)
 DECLARE_INSN(lwu, MATCH_LWU, MASK_LWU)
+DECLARE_INSN(mrth, MATCH_MRTH, MASK_MRTH)
 DECLARE_INSN(mrts, MATCH_MRTS, MASK_MRTS)
 DECLARE_INSN(mul, MATCH_MUL, MASK_MUL)
 DECLARE_INSN(mulh, MATCH_MULH, MASK_MULH)
@@ -761,6 +785,7 @@ DECLARE_INSN(srlw, MATCH_SRLW, MASK_SRLW)
 DECLARE_INSN(sub, MATCH_SUB, MASK_SUB)
 DECLARE_INSN(subw, MATCH_SUBW, MASK_SUBW)
 DECLARE_INSN(sw, MATCH_SW, MASK_SW)
+DECLARE_INSN(wfi, MATCH_WFI, MASK_WFI)
 DECLARE_INSN(xor, MATCH_XOR, MASK_XOR)
 DECLARE_INSN(xori, MATCH_XORI, MASK_XORI)
 #endif
@@ -790,32 +815,47 @@ DECLARE_CSR(uarch14, CSR_UARCH14)
 DECLARE_CSR(uarch15, CSR_UARCH15)
 DECLARE_CSR(sstatus, CSR_SSTATUS)
 DECLARE_CSR(stvec, CSR_STVEC)
+DECLARE_CSR(sie, CSR_SIE)
 DECLARE_CSR(stimecmp, CSR_STIMECMP)
 DECLARE_CSR(sscratch, CSR_SSCRATCH)
 DECLARE_CSR(sepc, CSR_SEPC)
+DECLARE_CSR(sip, CSR_SIP)
 DECLARE_CSR(sptbr, CSR_SPTBR)
 DECLARE_CSR(sasid, CSR_SASID)
-DECLARE_CSR(scycle, CSR_SCYCLE)
+DECLARE_CSR(cyclew, CSR_CYCLEW)
+DECLARE_CSR(timew, CSR_TIMEW)
+DECLARE_CSR(instretw, CSR_INSTRETW)
 DECLARE_CSR(stime, CSR_STIME)
-DECLARE_CSR(sinstret, CSR_SINSTRET)
 DECLARE_CSR(scause, CSR_SCAUSE)
 DECLARE_CSR(sbadaddr, CSR_SBADADDR)
+DECLARE_CSR(stimew, CSR_STIMEW)
 DECLARE_CSR(mstatus, CSR_MSTATUS)
+DECLARE_CSR(mtvec, CSR_MTVEC)
+DECLARE_CSR(mtdeleg, CSR_MTDELEG)
+DECLARE_CSR(mie, CSR_MIE)
+DECLARE_CSR(mtimecmp, CSR_MTIMECMP)
 DECLARE_CSR(mscratch, CSR_MSCRATCH)
 DECLARE_CSR(mepc, CSR_MEPC)
 DECLARE_CSR(mcause, CSR_MCAUSE)
 DECLARE_CSR(mbadaddr, CSR_MBADADDR)
-DECLARE_CSR(reset, CSR_RESET)
-DECLARE_CSR(tohost, CSR_TOHOST)
-DECLARE_CSR(fromhost, CSR_FROMHOST)
+DECLARE_CSR(mip, CSR_MIP)
+DECLARE_CSR(mtime, CSR_MTIME)
+DECLARE_CSR(mcpuid, CSR_MCPUID)
+DECLARE_CSR(mimpid, CSR_MIMPID)
+DECLARE_CSR(mhartid, CSR_MHARTID)
+DECLARE_CSR(mtohost, CSR_MTOHOST)
+DECLARE_CSR(mfromhost, CSR_MFROMHOST)
+DECLARE_CSR(mreset, CSR_MRESET)
 DECLARE_CSR(send_ipi, CSR_SEND_IPI)
-DECLARE_CSR(hartid, CSR_HARTID)
 DECLARE_CSR(cycleh, CSR_CYCLEH)
 DECLARE_CSR(timeh, CSR_TIMEH)
 DECLARE_CSR(instreth, CSR_INSTRETH)
-DECLARE_CSR(scycleh, CSR_SCYCLEH)
+DECLARE_CSR(cyclehw, CSR_CYCLEHW)
+DECLARE_CSR(timehw, CSR_TIMEHW)
+DECLARE_CSR(instrethw, CSR_INSTRETHW)
 DECLARE_CSR(stimeh, CSR_STIMEH)
-DECLARE_CSR(sinstreth, CSR_SINSTRETH)
+DECLARE_CSR(stimehw, CSR_STIMEHW)
+DECLARE_CSR(mtimeh, CSR_MTIMEH)
 #endif
 #ifdef DECLARE_CAUSE
 DECLARE_CAUSE("fflags", CAUSE_FFLAGS)
@@ -843,30 +883,45 @@ DECLARE_CAUSE("uarch14", CAUSE_UARCH14)
 DECLARE_CAUSE("uarch15", CAUSE_UARCH15)
 DECLARE_CAUSE("sstatus", CAUSE_SSTATUS)
 DECLARE_CAUSE("stvec", CAUSE_STVEC)
+DECLARE_CAUSE("sie", CAUSE_SIE)
 DECLARE_CAUSE("stimecmp", CAUSE_STIMECMP)
 DECLARE_CAUSE("sscratch", CAUSE_SSCRATCH)
 DECLARE_CAUSE("sepc", CAUSE_SEPC)
+DECLARE_CAUSE("sip", CAUSE_SIP)
 DECLARE_CAUSE("sptbr", CAUSE_SPTBR)
 DECLARE_CAUSE("sasid", CAUSE_SASID)
-DECLARE_CAUSE("scycle", CAUSE_SCYCLE)
+DECLARE_CAUSE("cyclew", CAUSE_CYCLEW)
+DECLARE_CAUSE("timew", CAUSE_TIMEW)
+DECLARE_CAUSE("instretw", CAUSE_INSTRETW)
 DECLARE_CAUSE("stime", CAUSE_STIME)
-DECLARE_CAUSE("sinstret", CAUSE_SINSTRET)
 DECLARE_CAUSE("scause", CAUSE_SCAUSE)
 DECLARE_CAUSE("sbadaddr", CAUSE_SBADADDR)
+DECLARE_CAUSE("stimew", CAUSE_STIMEW)
 DECLARE_CAUSE("mstatus", CAUSE_MSTATUS)
+DECLARE_CAUSE("mtvec", CAUSE_MTVEC)
+DECLARE_CAUSE("mtdeleg", CAUSE_MTDELEG)
+DECLARE_CAUSE("mie", CAUSE_MIE)
+DECLARE_CAUSE("mtimecmp", CAUSE_MTIMECMP)
 DECLARE_CAUSE("mscratch", CAUSE_MSCRATCH)
 DECLARE_CAUSE("mepc", CAUSE_MEPC)
 DECLARE_CAUSE("mcause", CAUSE_MCAUSE)
 DECLARE_CAUSE("mbadaddr", CAUSE_MBADADDR)
-DECLARE_CAUSE("reset", CAUSE_RESET)
-DECLARE_CAUSE("tohost", CAUSE_TOHOST)
-DECLARE_CAUSE("fromhost", CAUSE_FROMHOST)
+DECLARE_CAUSE("mip", CAUSE_MIP)
+DECLARE_CAUSE("mtime", CAUSE_MTIME)
+DECLARE_CAUSE("mcpuid", CAUSE_MCPUID)
+DECLARE_CAUSE("mimpid", CAUSE_MIMPID)
+DECLARE_CAUSE("mhartid", CAUSE_MHARTID)
+DECLARE_CAUSE("mtohost", CAUSE_MTOHOST)
+DECLARE_CAUSE("mfromhost", CAUSE_MFROMHOST)
+DECLARE_CAUSE("mreset", CAUSE_MRESET)
 DECLARE_CAUSE("send_ipi", CAUSE_SEND_IPI)
-DECLARE_CAUSE("hartid", CAUSE_HARTID)
 DECLARE_CAUSE("cycleh", CAUSE_CYCLEH)
 DECLARE_CAUSE("timeh", CAUSE_TIMEH)
 DECLARE_CAUSE("instreth", CAUSE_INSTRETH)
-DECLARE_CAUSE("scycleh", CAUSE_SCYCLEH)
+DECLARE_CAUSE("cyclehw", CAUSE_CYCLEHW)
+DECLARE_CAUSE("timehw", CAUSE_TIMEHW)
+DECLARE_CAUSE("instrethw", CAUSE_INSTRETHW)
 DECLARE_CAUSE("stimeh", CAUSE_STIMEH)
-DECLARE_CAUSE("sinstreth", CAUSE_SINSTRETH)
+DECLARE_CAUSE("stimehw", CAUSE_STIMEHW)
+DECLARE_CAUSE("mtimeh", CAUSE_MTIMEH)
 #endif
diff --git a/pk/handlers.c b/pk/handlers.c
index 3ceac1e..c1f7c2b 100644
--- a/pk/handlers.c
+++ b/pk/handlers.c
@@ -80,7 +80,7 @@ static void handle_syscall(trapframe_t* tf)
 
 static void handle_interrupt(trapframe_t* tf)
 {
-  clear_csr(sstatus, SSTATUS_SIP);
+  clear_csr(sip, SIP_SSIP);
 }
 
 void handle_trap(trapframe_t* tf)
@@ -94,7 +94,7 @@ void handle_trap(trapframe_t* tf)
     [CAUSE_MISALIGNED_FETCH] = handle_misaligned_fetch,
     [CAUSE_FAULT_FETCH] = handle_fault_fetch,
     [CAUSE_ILLEGAL_INSTRUCTION] = handle_illegal_instruction,
-    [CAUSE_ECALL] = handle_syscall,
+    [CAUSE_USER_ECALL] = handle_syscall,
     [CAUSE_BREAKPOINT] = handle_breakpoint,
     [CAUSE_MISALIGNED_LOAD] = handle_misaligned_load,
     [CAUSE_MISALIGNED_STORE] = handle_misaligned_store,
diff --git a/pk/init.c b/pk/init.c
index a3f22d9..683c366 100644
--- a/pk/init.c
+++ b/pk/init.c
@@ -19,10 +19,13 @@ char* uarch_counter_names[NUM_COUNTERS];
 void init_tf(trapframe_t* tf, long pc, long sp, int user64)
 {
   memset(tf, 0, sizeof(*tf));
-  if (user64) {
-    kassert(sizeof(void*) == 8);
-    set_csr(sstatus, UA_RV64 * (SSTATUS_UA & ~(SSTATUS_UA << 1)));
-  }
+#ifdef __riscv64
+  if (!user64)
+    panic("can't run 32-bit ELF on 64-bit pk");
+#else
+  if (user64)
+    panic("can't run 64-bit ELF on 32-bit pk");
+#endif
   tf->status = read_csr(sstatus);
   tf->gpr[2] = sp;
   tf->epc = pc;
diff --git a/pk/mcall.h b/pk/mcall.h
index 9992891..5d4b042 100644
--- a/pk/mcall.h
+++ b/pk/mcall.h
@@ -5,6 +5,7 @@
 #define MCALL_CONSOLE_PUTCHAR 1
 #define MCALL_SEND_DEVICE_REQUEST 2
 #define MCALL_RECEIVE_DEVICE_RESPONSE 3
+#define MCALL_SEND_IPI 4
 
 #ifndef __ASSEMBLER__
 
diff --git a/pk/mentry.S b/pk/mentry.S
index 1ddd856..98dc424 100644
--- a/pk/mentry.S
+++ b/pk/mentry.S
@@ -13,46 +13,46 @@ trap_table:
   .word bad_trap
   .word misaligned_store_trap
   .word bad_trap
+  .word bad_trap
   .word mcall_trap
   .word bad_trap
-#define HTIF_INTERRUPT_VECTOR 10
+  .word bad_trap
+#define HTIF_INTERRUPT_VECTOR 12
   .word htif_interrupt
-#define TRAP_FROM_MACHINE_MODE_VECTOR 11
+#define TRAP_FROM_MACHINE_MODE_VECTOR 13
   .word trap_from_machine_mode
   .word bad_trap
   .word bad_trap
-  .word bad_trap
-  .word bad_trap
 
 #define HANDLE_USER_TRAP_IN_MACHINE_MODE 0       \
   | (0 << (31- 0)) /* IF misaligned */           \
   | (0 << (31- 1)) /* IF fault */                \
   | (1 << (31- 2)) /* illegal instruction */     \
-  | (1 << (31- 3)) /* reserved */                \
+  | (0 << (31- 3)) /* breakpoint */              \
   | (1 << (31- 4)) /* load misaligned */         \
   | (0 << (31- 5)) /* load fault */              \
   | (1 << (31- 6)) /* store misaligned */        \
   | (0 << (31- 7)) /* store fault */             \
-  | (0 << (31- 8)) /* environment call */        \
-  | (0 << (31- 9)) /* breakpoint */              \
+  | (0 << (31- 8)) /* user environment call */   \
+  | (0 << (31- 9)) /* super environment call */  \
 
 #define HANDLE_SUPERVISOR_TRAP_IN_MACHINE_MODE 0 \
   | (0 << (31- 0)) /* IF misaligned */           \
   | (0 << (31- 1)) /* IF fault */                \
   | (1 << (31- 2)) /* illegal instruction */     \
-  | (1 << (31- 3)) /* reserved */                \
+  | (0 << (31- 3)) /* breakpoint */              \
   | (1 << (31- 4)) /* load misaligned */         \
   | (0 << (31- 5)) /* load fault */              \
   | (1 << (31- 6)) /* store misaligned */        \
   | (0 << (31- 7)) /* store fault */             \
-  | (1 << (31- 8)) /* environment call */        \
-  | (0 << (31- 9)) /* breakpoint */              \
+  | (0 << (31- 8)) /* user environment call */   \
+  | (1 << (31- 9)) /* super environment call */  \
 
   .section .text.init,"ax",@progbits
   .globl mentry
 mentry:
-  # Entry point from user mode.
   .align 6
+  # Entry point from user mode (mtvec + 0x000)
   csrrw sp, mscratch, sp
   STORE a0, 10*REGBYTES(sp)
   STORE a1, 11*REGBYTES(sp)
@@ -72,7 +72,7 @@ mentry:
   mrts
 
   .align 6
-  # Entry point from supervisor mode.
+  # Entry point from supervisor mode (mtvec + 0x040)
   csrrw sp, mscratch, sp
   STORE a0, 10*REGBYTES(sp)
   STORE a1, 11*REGBYTES(sp)
@@ -98,11 +98,13 @@ mentry:
   mrts
 
   .align 6
-  # Entry point from hypervisor mode.  Not implemented.
+  # Entry point from hypervisor mode (mtvec + 0x080)
+  # Not implemented.
   j bad_trap
 
   .align 6
-  # Entry point from machine mode.  These are rare, so punt to C code.
+  # Entry point from machine mode (mtvec + 0x0C0)
+  # These are rare, so punt to C code.
   csrw mscratch, sp
   addi sp, sp, -INTEGER_CONTEXT_SIZE
   STORE a0,10*REGBYTES(sp)
@@ -117,8 +119,18 @@ mentry:
   csrc mstatus, a0
   j .Lreturn_from_supervisor_double_fault
 
-  .align 6
-  # Entry point for power-on reset.
+  nop
+  nop
+  nop
+  nop
+  nop
+  nop
+
+  # Entry point for NMIs (mtvec + 0x0FC)
+  # Not implemented.
+  j bad_trap
+
+  # Entry point for power-on reset (mtvec + 0x100)
   # TODO per-hart stacks
   la sp, _end + 2*RISCV_PGSIZE - 1
   li t0, -RISCV_PGSIZE
@@ -127,23 +139,21 @@ mentry:
   csrw mscratch, sp
   j machine_init
 
-  # XXX depend on sbi_base to force its linkage
-  la x0, sbi_base
-
 .Linterrupt:
   sll a0, a0, 1    # discard MSB
 
-#if IRQ_TIMER != 0
-#error
-#endif
+  li a1, IRQ_TIMER * 2
   # Send timer interrupts to the OS.
-  beqz a0, .Lmrts
+  beq a0, a1, .Lmrts
 
   # See if this is an IPI; register a supervisor SW interrupt if so.
-  li a1, IRQ_IPI * 2
-  bne a0, a1, 1f
-  csrrc a0, mstatus, MSTATUS_MSIP
-  csrs mstatus, MSTATUS_SSIP
+#if IRQ_SOFT != 0
+#error
+#endif
+  bnez a0, 1f
+  csrr a0, mstatus
+  csrc mip, MIP_MSIP
+  csrs mip, MIP_SSIP
 
   # There are three cases: PRV1=U; PRV1=S and IE1=1; and PRV1=S and IE1=0.
   # For cases 1-2, do an MRTS; for case 3, we can't, so ERET.
@@ -256,11 +266,8 @@ mentry:
   LOAD sp, 2*REGBYTES(sp)
   mrts
 
-  .globl test_fpu_presence
-test_fpu_presence:
-  # return nonzero FPU present; else, trap handler will cause 0 to be returned.
-  fclass.d a0, f0
-  ret
-
 .Lbad_trap:
   j bad_trap
+
+  # XXX depend on sbi_base to force its linkage
+  la x0, sbi_base
diff --git a/pk/minit.c b/pk/minit.c
index 79d1f9a..47c19b0 100644
--- a/pk/minit.c
+++ b/pk/minit.c
@@ -6,31 +6,20 @@ uint32_t num_harts;
 
 static void mstatus_init()
 {
+  if (!supports_extension('S'))
+    panic("supervisor support is required");
+
   uintptr_t ms = 0;
-#ifdef __riscv64
-  ms = INSERT_FIELD(ms, MSTATUS_SA, UA_RV64);
-#endif
   ms = INSERT_FIELD(ms, MSTATUS_PRV, PRV_M);
-  ms = INSERT_FIELD(ms, MSTATUS_IE, 0);
   ms = INSERT_FIELD(ms, MSTATUS_PRV1, PRV_S);
-  ms = INSERT_FIELD(ms, MSTATUS_IE1, 0);
   ms = INSERT_FIELD(ms, MSTATUS_PRV2, PRV_U);
   ms = INSERT_FIELD(ms, MSTATUS_IE2, 1);
-  ms = INSERT_FIELD(ms, MSTATUS_MPRV, PRV_M);
   ms = INSERT_FIELD(ms, MSTATUS_VM, VM_CHOICE);
   ms = INSERT_FIELD(ms, MSTATUS_FS, 3);
   ms = INSERT_FIELD(ms, MSTATUS_XS, 3);
   write_csr(mstatus, ms);
   ms = read_csr(mstatus);
 
-  if (EXTRACT_FIELD(ms, MSTATUS_PRV1) != PRV_S) {
-    ms = INSERT_FIELD(ms, MSTATUS_PRV1, PRV_U);
-    ms = INSERT_FIELD(ms, MSTATUS_IE1, 1);
-    write_csr(mstatus, ms);
-
-    panic("supervisor support is required");
-  }
-
   if (EXTRACT_FIELD(ms, MSTATUS_VM) != VM_CHOICE)
     have_vm = 0;
 }
@@ -53,15 +42,14 @@ static void hart_init()
 static void fp_init()
 {
   kassert(read_csr(mstatus) & MSTATUS_FS);
-  extern int test_fpu_presence();
 
 #ifdef __riscv_hard_float
-  if (!test_fpu_presence())
+  if (!supports_extension('D'))
     panic("FPU not found; recompile pk with -msoft-float");
   for (int i = 0; i < 32; i++)
     init_fp_reg(i);
 #else
-  if (test_fpu_presence())
+  if (supports_extension('D'))
     panic("FPU unexpectedly found; recompile pk without -msoft-float");
 #endif
 }
diff --git a/pk/mtrap.c b/pk/mtrap.c
index 1cb432f..3406c44 100644
--- a/pk/mtrap.c
+++ b/pk/mtrap.c
@@ -63,7 +63,7 @@ void __attribute__((noreturn)) bad_trap()
 
 uintptr_t htif_interrupt(uintptr_t mcause, uintptr_t* regs)
 {
-  uintptr_t fromhost = swap_csr(fromhost, 0);
+  uintptr_t fromhost = swap_csr(mfromhost, 0);
   if (!fromhost)
     return 0;
 
@@ -98,7 +98,7 @@ uintptr_t htif_interrupt(uintptr_t mcause, uintptr_t* regs)
       MAILBOX()->device_response_queue_tail = m;
 
       // signal software interrupt
-      set_csr(mstatus, MSTATUS_SSIP);
+      set_csr(mip, MIP_SSIP);
       return 0;
     }
 
@@ -111,15 +111,15 @@ uintptr_t htif_interrupt(uintptr_t mcause, uintptr_t* regs)
 
 static uintptr_t mcall_console_putchar(uint8_t ch)
 {
-  while (swap_csr(tohost, TOHOST_CMD(1, 1, ch)) != 0);
+  while (swap_csr(mtohost, TOHOST_CMD(1, 1, ch)) != 0);
   while (1) {
-    uintptr_t fromhost = read_csr(fromhost);
+    uintptr_t fromhost = read_csr(mfromhost);
     if (FROMHOST_DEV(fromhost) != 1 || FROMHOST_CMD(fromhost) != 1) {
       if (fromhost)
         htif_interrupt(0, 0);
       continue;
     }
-    write_csr(fromhost, 0);
+    write_csr(mfromhost, 0);
     break;
   }
   return 0;
@@ -132,9 +132,6 @@ static uintptr_t mcall_console_putchar(uint8_t ch)
 static uintptr_t mcall_dev_req(sbi_device_message *m)
 {
   //printm("req %d %p\n", MAILBOX()->device_request_queue_size, m);
-#ifndef __riscv64
-  return -ENOSYS; // TODO: RV32 HTIF?
-#else
   if (!supervisor_paddr_valid(m, sizeof(*m))
       && EXTRACT_FIELD(read_csr(mstatus), MSTATUS_PRV1) != PRV_M)
     return -EFAULT;
@@ -142,7 +139,7 @@ static uintptr_t mcall_dev_req(sbi_device_message *m)
   if ((m->dev > 0xFFU) | (m->cmd > 0xFFU) | (m->data > 0x0000FFFFFFFFFFFFU))
     return -EINVAL;
 
-  while (swap_csr(tohost, TOHOST_CMD(m->dev, m->cmd, m->data)) != 0)
+  while (swap_csr(mtohost, TOHOST_CMD(m->dev, m->cmd, m->data)) != 0)
     ;
 
   m->sbi_private_data = (uintptr_t)MAILBOX()->device_request_queue_head;
@@ -150,7 +147,6 @@ static uintptr_t mcall_dev_req(sbi_device_message *m)
   MAILBOX()->device_request_queue_size++;
 
   return 0;
-#endif
 }
 
 static uintptr_t mcall_dev_resp()
@@ -168,11 +164,16 @@ static uintptr_t mcall_dev_resp()
   return (uintptr_t)m;
 }
 
-uintptr_t mcall_trap(uintptr_t mcause, uintptr_t* regs)
+static uintptr_t mcall_send_ipi(uintptr_t recipient)
 {
-  if (EXTRACT_FIELD(read_csr(mstatus), MSTATUS_PRV1) < PRV_S)
+  if (recipient >= num_harts)
     return -1;
+  write_csr(send_ipi, recipient);
+  return 0;
+}
 
+uintptr_t mcall_trap(uintptr_t mcause, uintptr_t* regs)
+{
   uintptr_t n = regs[10], arg0 = regs[11], retval;
   switch (n)
   {
@@ -188,6 +189,9 @@ uintptr_t mcall_trap(uintptr_t mcause, uintptr_t* regs)
     case MCALL_RECEIVE_DEVICE_RESPONSE:
       retval = mcall_dev_resp();
       break;
+    case MCALL_SEND_IPI:
+      retval = mcall_send_ipi(arg0);
+      break;
     default:
       retval = -ENOSYS;
       break;
@@ -222,12 +226,6 @@ static uintptr_t machine_page_fault(uintptr_t mcause, uintptr_t* regs, uintptr_t
 
 static uintptr_t machine_illegal_instruction(uintptr_t mcause, uintptr_t* regs, uintptr_t mepc)
 {
-  extern void test_fpu_presence();
-  if (mepc == (uintptr_t)&test_fpu_presence) {
-    regs[10] = 0;
-    write_csr(mepc, mepc + 4);
-    return 0;
-  }
   bad_trap();
 }
 
@@ -245,7 +243,7 @@ uintptr_t trap_from_machine_mode(uintptr_t dummy, uintptr_t* regs)
       return machine_page_fault(mcause, regs, mepc);
     case CAUSE_ILLEGAL_INSTRUCTION:
       return machine_illegal_instruction(mcause, regs, mepc);
-    case CAUSE_ECALL:
+    case CAUSE_MACHINE_ECALL:
       return mcall_trap(mcause, regs);
     default:
       bad_trap();
diff --git a/pk/mtrap.h b/pk/mtrap.h
index 844935b..891b879 100644
--- a/pk/mtrap.h
+++ b/pk/mtrap.h
@@ -19,11 +19,10 @@
 #define unpriv_mem_access_base(mstatus, mepc, code, o0, o1, i0, i1, i2) ({ \
   register uintptr_t result asm("t0"); \
   uintptr_t unused1, unused2 __attribute__((unused)); \
-  uintptr_t scratch = ~(mstatus) & MSTATUS_PRV1; \
-  scratch <<= CONST_CTZ32(MSTATUS_MPRV) - CONST_CTZ32(MSTATUS_PRV1); \
-  asm volatile ("csrrc %[result], mstatus, %[scratch]\n" \
+  uintptr_t scratch = MSTATUS_MPRV; \
+  asm volatile ("csrrs %[result], mstatus, %[scratch]\n" \
                 "98: " code "\n" \
-                "99: csrs mstatus, %[scratch]\n" \
+                "99: csrc mstatus, %[scratch]\n" \
                 ".pushsection .unpriv,\"a\",@progbits\n" \
                 ".word 98b; .word 99b\n" \
                 ".popsection" \
@@ -204,6 +203,23 @@ static insn_fetch_t __attribute__((always_inline))
   return fetch;
 }
 
+static inline long __attribute__((pure)) cpuid()
+{
+  long res;
+  asm ("csrr %0, mcpuid" : "=r"(res)); // not volatile, so don't use read_csr()
+  return res;
+}
+
+static inline int supports_extension(char ext)
+{
+  return cpuid() & (1 << (ext - 'A'));
+}
+
+static inline int xlen()
+{
+  return cpuid() < 0 ? 64 : 32;
+}
+
 typedef struct {
   sbi_device_message* device_request_queue_head;
   size_t device_request_queue_size;
diff --git a/pk/pk.ld b/pk/pk.ld
index 396716e..46f1999 100644
--- a/pk/pk.ld
+++ b/pk/pk.ld
@@ -10,7 +10,7 @@ SECTIONS
   /*--------------------------------------------------------------------*/
 
   /* Begining of code and text segment */
-  . = 0x0;
+  . = 0x100;
   _ftext = .;
   PROVIDE( eprol = . );
 
diff --git a/pk/sbi.S b/pk/sbi.S
index a8d5066..e7638ec 100644
--- a/pk/sbi.S
+++ b/pk/sbi.S
@@ -5,3 +5,4 @@
 .globl sbi_send_device_request; sbi_send_device_request = -1984
 .globl sbi_receive_device_response; sbi_receive_device_response = -1968
 .globl sbi_send_ipi; sbi_send_ipi = -1952
+.globl sbi_timebase; sbi_timebase = -1936
diff --git a/pk/sbi.h b/pk/sbi.h
index b9e60b4..cd7594f 100644
--- a/pk/sbi.h
+++ b/pk/sbi.h
@@ -11,6 +11,7 @@ unsigned long sbi_query_memory(unsigned long id, memory_block_info *p);
 
 unsigned long sbi_hart_id(void);
 unsigned long sbi_num_harts(void);
+unsigned long sbi_timebase(void);
 void sbi_send_ipi(uintptr_t hart_id);
 void sbi_console_putchar(unsigned char ch);
 
diff --git a/pk/sbi_entry.S b/pk/sbi_entry.S
index 9e3628b..918ea70 100644
--- a/pk/sbi_entry.S
+++ b/pk/sbi_entry.S
@@ -48,7 +48,14 @@ sbi_base:
 
   # send ipi
   .align 4
-  csrw send_ipi, a0
+  mv a1, a0
+  li a0, MCALL_SEND_IPI
+  ecall
+  ret
+
+  # timebase
+  .align 4
+  li a0, 1000000000 # or, you know, we could provide the correct answer
   ret
 
   # end of SBI trampolines
diff --git a/pk/vm.c b/pk/vm.c
index f66f8f1..50d3c16 100644
--- a/pk/vm.c
+++ b/pk/vm.c
@@ -16,7 +16,7 @@ typedef struct {
 
 #define MAX_VMR 32
 spinlock_t vm_lock = SPINLOCK_INIT;
-static vmr_t vmrs[MAX_VMR] __attribute__((aligned(PTE_TYPE+1)));
+static vmr_t vmrs[MAX_VMR];
 
 typedef uintptr_t pte_t;
 static pte_t* root_page_table;
@@ -69,12 +69,19 @@ static size_t pte_ppn(pte_t pte)
 
 static pte_t ptd_create(uintptr_t ppn)
 {
-  return (ppn << PTE_PPN_SHIFT) | PTE_TYPE_TABLE;
+  return (ppn << PTE_PPN_SHIFT) | PTE_V | PTE_TYPE_TABLE;
 }
 
-static inline pte_t pte_create(uintptr_t ppn, int kprot, int uprot)
+static inline pte_t pte_create(uintptr_t ppn, int prot, int user)
 {
-  return PTE_CREATE(ppn, uprot, kprot);
+  pte_t pte = (ppn << PTE_PPN_SHIFT) | PTE_V;
+  if (prot & PROT_WRITE)
+    pte |= PTE_TYPE_URW_SRW;
+  if (prot & PROT_EXEC)
+    pte |= PTE_TYPE_URX_SRX;
+  if (!user)
+    pte |= PTE_TYPE_SR;
+  return pte;
 }
 
 static uintptr_t ppn(uintptr_t addr)
@@ -107,7 +114,7 @@ static pte_t* __walk_internal(uintptr_t addr, int create)
   for (unsigned i = levels-1; i > 0; i--)
   {
     size_t idx = pt_idx(addr, i);
-    if ((t[idx] & PTE_TYPE) == PTE_TYPE_INVALID)
+    if (!(t[idx] & PTE_V))
     {
       if (!create)
         return 0;
@@ -115,7 +122,7 @@ static pte_t* __walk_internal(uintptr_t addr, int create)
       t[idx] = ptd_create(ppn(page));
     }
     else
-      kassert((t[idx] & PTE_TYPE) == PTE_TYPE_TABLE);
+      kassert(PTE_TABLE(t[idx]));
     t = (pte_t*)(pte_ppn(t[idx]) << RISCV_PGSHIFT);
   }
   return &t[pt_idx(addr, 0)];
@@ -173,11 +180,10 @@ static int __handle_page_fault(uintptr_t vaddr, int prot)
 
   pte_t* pte = __walk(vaddr);
 
-  if (pte == 0 || *pte == 0)
+  if (pte == 0 || *pte == 0 || !__valid_user_range(vaddr, 1))
     return -1;
-  else if ((*pte & PTE_TYPE) == PTE_TYPE_INVALID)
+  else if (!(*pte & PTE_V))
   {
-    kassert(__valid_user_range(vaddr, 1));
     uintptr_t ppn = vpn;
 
     vmr_t* v = (vmr_t*)*pte;
@@ -194,10 +200,10 @@ static int __handle_page_fault(uintptr_t vaddr, int prot)
     else
       memset((void*)vaddr, 0, RISCV_PGSIZE);
     __vmr_decref(v, 1);
-    *pte = pte_create(ppn, v->prot, v->prot);
+    *pte = pte_create(ppn, v->prot, 1);
   }
 
-  pte_t perms = pte_create(0, prot, prot);
+  pte_t perms = pte_create(0, prot, 1);
   if ((*pte & perms) != perms)
     return -1;
 
@@ -221,7 +227,7 @@ static void __do_munmap(uintptr_t addr, size_t len)
     if (pte == 0 || *pte == 0)
       continue;
 
-    if ((*pte & PTE_TYPE) == PTE_TYPE_INVALID)
+    if (!(*pte & PTE_V))
       __vmr_decref((vmr_t*)*pte, 1);
 
     *pte = 0;
@@ -372,7 +378,7 @@ uintptr_t do_mprotect(uintptr_t addr, size_t length, int prot)
         break;
       }
   
-      if ((*pte & PTE_TYPE) == PTE_TYPE_INVALID) {
+      if (!(*pte & PTE_V)) {
         vmr_t* v = (vmr_t*)*pte;
         if((v->prot ^ prot) & ~v->prot){
           //TODO:look at file to find perms
@@ -381,14 +387,13 @@ uintptr_t do_mprotect(uintptr_t addr, size_t length, int prot)
         }
         v->prot = prot;
       } else {
-        if (((prot & PROT_READ) && !PTE_UR(*pte))
-            || ((prot & PROT_WRITE) && !PTE_UW(*pte))
+        if (((prot & PROT_WRITE) && !PTE_UW(*pte))
             || ((prot & PROT_EXEC) && !PTE_UX(*pte))) {
           //TODO:look at file to find perms
           res = -EACCES;
           break;
         }
-        *pte = pte_create(pte_ppn(*pte), prot, prot);
+        *pte = pte_create(pte_ppn(*pte), prot, 1);
       }
     }
   spinlock_unlock(&vm_lock);
@@ -487,7 +492,7 @@ uintptr_t pk_vm_init()
 {
   // keep RV32 addresses positive
   if (!current.elf64)
-    current.mmap_max = MIN(current.mmap_max, 0x80000000);
+    current.mmap_max = MIN(current.mmap_max, 0x80000000U);
 
   __map_kernel_range(0, 0, current.first_free_paddr, PROT_READ|PROT_WRITE|PROT_EXEC);
   __map_kernel_range(first_free_page, first_free_page, free_pages * RISCV_PGSIZE, PROT_READ|PROT_WRITE);