diff --git a/qemu/header_gen.py b/qemu/header_gen.py
index 5f5654d5..da7121fa 100644
--- a/qemu/header_gen.py
+++ b/qemu/header_gen.py
@@ -7320,9 +7320,11 @@ riscv_symbols = (
     'riscv_cpu_set_force_hs_excep',
     'riscv_cpu_set_mode',
     'riscv_cpu_set_rdtime_fn',
+    'riscv_cpu_set_two_stage_lookup',
     'riscv_cpu_set_virt_enabled',
     'riscv_cpu_swap_hypervisor_regs',
     'riscv_cpu_tlb_fill',
+    'riscv_cpu_two_stage_lookup',
     'riscv_cpu_unassigned_access',
     'riscv_cpu_update_mip',
     'riscv_cpu_virt_enabled',
diff --git a/qemu/riscv32.h b/qemu/riscv32.h
index ad441703..8e8c91cb 100644
--- a/qemu/riscv32.h
+++ b/qemu/riscv32.h
@@ -4756,9 +4756,11 @@
 #define riscv_cpu_set_force_hs_excep riscv_cpu_set_force_hs_excep_riscv32
 #define riscv_cpu_set_mode riscv_cpu_set_mode_riscv32
 #define riscv_cpu_set_rdtime_fn riscv_cpu_set_rdtime_fn_riscv32
+#define riscv_cpu_set_two_stage_lookup riscv_cpu_set_two_stage_lookup_riscv32
 #define riscv_cpu_set_virt_enabled riscv_cpu_set_virt_enabled_riscv32
 #define riscv_cpu_swap_hypervisor_regs riscv_cpu_swap_hypervisor_regs_riscv32
 #define riscv_cpu_tlb_fill riscv_cpu_tlb_fill_riscv32
+#define riscv_cpu_two_stage_lookup riscv_cpu_two_stage_lookup_riscv32
 #define riscv_cpu_unassigned_access riscv_cpu_unassigned_access_riscv32
 #define riscv_cpu_update_mip riscv_cpu_update_mip_riscv32
 #define riscv_cpu_virt_enabled riscv_cpu_virt_enabled_riscv32
diff --git a/qemu/riscv64.h b/qemu/riscv64.h
index 8265c3cf..96b72074 100644
--- a/qemu/riscv64.h
+++ b/qemu/riscv64.h
@@ -4756,9 +4756,11 @@
 #define riscv_cpu_set_force_hs_excep riscv_cpu_set_force_hs_excep_riscv64
 #define riscv_cpu_set_mode riscv_cpu_set_mode_riscv64
 #define riscv_cpu_set_rdtime_fn riscv_cpu_set_rdtime_fn_riscv64
+#define riscv_cpu_set_two_stage_lookup riscv_cpu_set_two_stage_lookup_riscv64
 #define riscv_cpu_set_virt_enabled riscv_cpu_set_virt_enabled_riscv64
 #define riscv_cpu_swap_hypervisor_regs riscv_cpu_swap_hypervisor_regs_riscv64
 #define riscv_cpu_tlb_fill riscv_cpu_tlb_fill_riscv64
+#define riscv_cpu_two_stage_lookup riscv_cpu_two_stage_lookup_riscv64
 #define riscv_cpu_unassigned_access riscv_cpu_unassigned_access_riscv64
 #define riscv_cpu_update_mip riscv_cpu_update_mip_riscv64
 #define riscv_cpu_virt_enabled riscv_cpu_virt_enabled_riscv64
diff --git a/qemu/target/riscv/cpu.h b/qemu/target/riscv/cpu.h
index 921318fa..e874b444 100644
--- a/qemu/target/riscv/cpu.h
+++ b/qemu/target/riscv/cpu.h
@@ -324,6 +324,8 @@ bool riscv_cpu_virt_enabled(CPURISCVState *env);
 void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable);
 bool riscv_cpu_force_hs_excep_enabled(CPURISCVState *env);
 void riscv_cpu_set_force_hs_excep(CPURISCVState *env, bool enable);
+bool riscv_cpu_two_stage_lookup(CPURISCVState *env);
+void riscv_cpu_set_two_stage_lookup(CPURISCVState *env, bool enable);
 int riscv_cpu_mmu_index(CPURISCVState *env, bool ifetch);
 hwaddr riscv_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 void  riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
diff --git a/qemu/target/riscv/cpu_bits.h b/qemu/target/riscv/cpu_bits.h
index 49a6fe31..46a34f1e 100644
--- a/qemu/target/riscv/cpu_bits.h
+++ b/qemu/target/riscv/cpu_bits.h
@@ -468,7 +468,7 @@
  * page table fault.
  */
 #define FORCE_HS_EXCEP      2
-
+#define HS_TWO_STAGE        4
 
 /* RV32 satp CSR field masks */
 #define SATP32_MODE         0x80000000
diff --git a/qemu/target/riscv/cpu_helper.c b/qemu/target/riscv/cpu_helper.c
index 5044934a..5511ade8 100644
--- a/qemu/target/riscv/cpu_helper.c
+++ b/qemu/target/riscv/cpu_helper.c
@@ -220,6 +220,24 @@ void riscv_cpu_set_force_hs_excep(CPURISCVState *env, bool enable)
     env->virt = set_field(env->virt, FORCE_HS_EXCEP, enable);
 }
 
+bool riscv_cpu_two_stage_lookup(CPURISCVState *env)
+{
+    if (!riscv_has_ext(env, RVH)) {
+        return false;
+    }
+
+    return get_field(env->virt, HS_TWO_STAGE);
+}
+
+void riscv_cpu_set_two_stage_lookup(CPURISCVState *env, bool enable)
+{
+    if (!riscv_has_ext(env, RVH)) {
+        return;
+    }
+
+    env->virt = set_field(env->virt, HS_TWO_STAGE, enable);
+}
+
 int riscv_cpu_claim_interrupts(RISCVCPU *cpu, uint32_t interrupts)
 {
     CPURISCVState *env = &cpu->env;